@starci/eslint-canon-be 3.2.18 → 3.3.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 3.3.0 - 2026-10-14
+- Added: the app file role `<app>.env.ts` (150-line budget, `app-file-budget`): `config-owner` lets `main.ts` and the app's env file parse the environment; `app-options-composition-free` also refuses a module list or `register`/`forRoot` call in it, and it imports no feature.
+- Changed: `background-unowned` decides by context (processor, scheduler, saga, event handler and what they call; a resolver or controller is never background) instead of by method name.
+- Changed: `webhook-verify-first` and `webhook-shape` accept a first call to a declared domain verifier (`...Verifier` service or a verifier the webhook module declares) beside `WebhookSignatureService.verify`; `feature-thin` treats that proof as a gate call.
+- Changed: the bundled architecture machine carries `HFS_DUPLICATE_CODE` canon-shape exclusions, staged dead-export consumers and the `<app>.env.ts` role.
+
+
+- Added: law `app-composition` (R245 and R246, owner ruling 2026-10-14). `app-options-composition-free` (`BE_APP_OPTIONS_COMPOSITION`) keeps `apps/<app>/src/<app>.options.ts` to env-derived options and port bindings (provider maps such as `{ approvalGate: X }`): an array that lists a `*Module` class, a `X.register(...)`/`forRoot(...)`/`registerQueue(...)` call, a `*SchedulerOf(...)`/`*Queue(...)` entry or a spread of such a list, and an `imports`, `modules`, `schedulers` or `processors` array are refused, pointing to `compose/<area>.ts`. `app-file-budget` (`BE_APP_COMPOSITION_BUDGET`) holds `main.ts` (80), `<app>.options.ts` (200), `compose/<area>.ts` (120) and `app.module.ts` (250) to the `budget` of their app slot; the budget is absolute. The role of an app file is the slot entry it matches (`lib/app-roles.mjs`), never a path list.
+- Changed: `is-global-only-in-app` accepts `isGlobal: true` in the composition groups `apps/<app>/src/compose/<area>.ts` (they are part of the app root), and the bundled architecture machine reads an app's root and its groups as one composition (register-once, module-per-transport, the connection and context maps).
+- Changed: carry the runtime mirror of HFS manifest 3.1.0 (rule catalog 3.1.0) and the canon pins of eslint-canon-fe 8.2.17, HFS 4.3.0 and CLI 1.2.16.
+
+## 3.2.19 - 2026-10-14
+
+- Changed: carry the canon pins of eslint-canon-fe 8.2.18, HFS 4.2.17 and CLI 1.2.17 in the runtime mirror. ESLint rule implementations are unchanged.
+
 ## 3.2.18 - 2026-10-14
 
 - Changed: carry the runtime mirror with the dead-exports fix (an import by a sibling declared entry is a use) and the canon pins of eslint-canon-fe 8.2.17, HFS 4.2.16 and CLI 1.2.16. ESLint rule implementations are unchanged.

package/README.md

@@ -39,8 +39,9 @@ A sample, not the list:
 |---|---|
 | **Errors** | A `catch` rethrows, calls a method on a `Logger` receiver (typed, from `platform/logging`) or returns an outcome carrying its cause; a `DomainError` subclass lives only in `errors/<capability>.error.ts` of its owner, and that file is one code enum, one `Record<Code, ErrorKind>` table and one empty class; a `throw` throws a `DomainError`, never a bare `Error`, a framework exception or a platform error out of a domain (`catch-must-account`, `error-home`, `throw-domain-error`, `error-family-shape`) |
 | **Schema authority** | Migrations only: every DataSource or TypeORM options object states the literal `synchronize: false` (found by the contextual type), no `migrationsRun`, no DDL string outside a migration, no entity glob; no `@Entity` type reachable from a transport signature, a handler `execute`, a contract or a message, and no GraphQL or validator import in an entity file (`no-runtime-schema`, `no-entity-in-contract`) |
-| **Config and secrets** | `process.env` (any form), `@nestjs/config`, `dotenv` only in the file of `platform/config` that declares `EnvSource` (and the test world, slot `be.tests.world`, for `process.env`); a function exported by a `<capability>.config.ts` is called only from `apps/<app>/src/main.ts` and `<app>.options.ts`, its own config file or spec, the test world and a provider contract spec (`config-parsed-in-main`); no default of any kind for a value typed `Secret` or `Url`; secrets compare with `timingSafeEqual` (`no-direct-env-read`, `config-parsed-in-main`, `no-secret-default`, `secret-compare-timing-safe`) |
+| **Config and secrets** | `process.env` (any form) is allowed in the `platform/config` file declaring `EnvSource`, the test world (slot `be.tests.world`) and the app bootstrap roles `apps/<app>/src/main.ts` and its matching `<app>.env.ts`; only those two app roles may read `EnvSource` or capability parse helpers. Compose groups and `<app>.options.ts` never read `process.env` or `EnvSource`. `@nestjs/config` and `dotenv` are forbidden config paths. A function exported by a `<capability>.config.ts` keeps its existing name and is called only from these bootstrap roles, its own config file or spec, the test world and a provider contract spec (`config-parsed-in-main`). Secrets use `EnvSource.secret()`: `<NAME>_FILE` takes priority for `.starcistacks` custody, and plain `<NAME>` is read only when the file key is absent; a declared file supplies exact contents and an empty or unreadable path fails startup without fallback. No default of any kind for a value typed `Secret` or `Url`; secrets compare with `timingSafeEqual` (`no-direct-env-read`, `config-parsed-in-main`, `no-secret-default`, `secret-compare-timing-safe`) |
 | **Ambient ids** (R142) | `randomUUID` of Node's crypto (named, namespace or global), the `v1`, `v4`, `v6` and `v7` generators of `uuid`, `nanoid` and `ulid` are used only inside `platform/ids`, specs included: code asks the injected `Ids` port and a spec provides `fakeIds()`; the generators are found by the module they are imported from, never by a local name (`no-ambient-id`) |
+| **App composition** (R245, R246) | `apps/<app>/src/<app>.env.ts` exports an explicit typed `<App>Env` interface and `read<App>Env(env: EnvSource): <App>Env` (for example `ApiEnv` and `readApiEnv`). The interface declares its own readonly parsed members, such as `readonly server: ReturnType<typeof parseServerConfig>`, structurally compatible with the app's options. The role name stays `<app>.env.ts`, never `env.ts`; capability `<capability>.config.ts` files stay unchanged. `main.ts` creates `EnvSource` once, imports and calls the reader, builds options and boots. The env file holds fail-fast parsing only, with no localhost or default host fallback, logic, module composition, business code or feature imports; `<app>.options.ts` holds env-derived options and port bindings only, with no parsing. Both refuse an array listing `*Module` classes, module or queue registrations (`register`, `forRoot`, `registerQueue`) or scheduler entries, and an `imports`, `modules`, `schedulers` or `processors` list; the env file also refuses standalone module or queue registration calls. Composition belongs in a `compose/<area>.ts` group that `app.module.ts` spreads (`app-options-composition-free`, `BE_APP_OPTIONS_COMPOSITION`). Each app file stays within its slot's line budget: `main.ts` 80, env 150, options 200, group 120, root 250 (`app-file-budget`, `BE_APP_COMPOSITION_BUDGET`). The interface and reader exports are a documented scaffold contract; they need no new lint rule |
 | **Sonar parity** (R235) | The smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (`no-await-in-loop`, S9382; `for (;;)` and `while (true)` are spared), no `charCodeAt`/`fromCharCode` (`prefer-code-point`), no string that only escapes backslashes (`prefer-string-raw`), no nested conditional (`no-nested-conditional`), `void` only on a call (`no-void-operator`), no unused import (`no-unused-import`), `export ... from` for an import that is only handed on (`prefer-export-from`); the factory also turns on typescript-eslint `no-deprecated`, `no-base-to-string` and `require-await`. The files `*.spec.ts` and `*.e2e-spec.ts` are outside the scan, so outside these rules |
 | **Cookies** (R141) | A cookie a door writes through the response of Express or Fastify (`cookie`, `setCookie`) states `httpOnly: true`, `secure: true` and `sameSite` `lax` or `strict` in options typed with those literals, and `Set-Cookie` is never written as a header; the call is recognised by where its signature is declared (`response-cookie-attributes`). A secret-derived value is compared with `timingSafeEqual`: a `Secret` of `platform/config` and the `.digest()` of a `Hash` or `Hmac` of Node's crypto are recognised by type (`secret-compare-timing-safe`) |
 | **Default deny** | Typed bodies and arguments, no `GraphQLJSON` tunnel, no `switch (operation)`, `@Public` carries a `PublicReason` member of `domain/identity`, and no `@UseGuards` (the global `APP_GUARD` chain decides) (`no-untyped-body`, `public-needs-reason`, `no-auth-use-guards`) |
@@ -59,9 +60,9 @@ A sample, not the list:
 | **Data access** | The database is reached through the shared `EntityManager` only, received as a constructor parameter with the named injector of a declared connection - a lookalike name, property injection, an injected `DataSource` or `QueryRunner` outside `platform/database` and the cli (`apps/cli`, `src/features/cli/`), `getRepository` and repository types are refused, specs included (`must-inject-entity-manager`, `named-entity-manager-only`, `no-injected-repository`); a `DataSource` or `QueryRunner` is not written as a type, awaited value or `provide:` token outside those places, and a class that receives a wrapper exposing one is refused (`named-entity-manager-only`); a class outside an application handler, a domain service and a platform persistence capability takes, holds or returns no `EntityManager`, `Repository`, `DataSource` or `QueryRunner` whatever it is called, and no exported function takes an `EntityManager` first (a statement module); `src/tests` is exempt (`no-repository-class`); a `DataSource` or `QueryRunner` is not written as a type, awaited value or `provide:` token outside those places, and a class that receives a wrapper exposing one is refused (`named-entity-manager-only`); a class outside an application handler, a domain service and a platform persistence capability takes, holds or returns no `EntityManager`, `Repository`, `DataSource` or `QueryRunner`, whatever it is called, and no exported function takes an `EntityManager` first (a statement module); the test tree (`src/tests`) is exempt (`no-repository-class`); inside a transaction callback only the manager it received is used (`no-outer-manager-in-transaction`); no call through an integration, `HttpClient` or `MessagePublisher` typed receiver spans a transaction (`no-external-call-in-transaction`); the manager is injected only in application handlers, domain services and the platform database, inbox, outbox and lease capabilities (`em-injection-slots`) |
 | **Connections** | One database is one connection and one `Inject<Conn>EntityManager()` injector: `InjectEntityManager(`, `InjectDataSource(` and `getEntityManagerToken(` are called only in `platform/database/<conn>.decorators.ts`, the cli and the test world; an exported EntityManager injector is exactly the declared connection's; `TypeOrmModule.forRoot*` and `new DataSource(` live in the platform database capability and the cli; the connection name is written once, in its `<conn>.connection.ts`; a `<conn>.config.ts` reads only keys of its `envPrefix` (`one-connection-per-database`) |
 | **Operations** | A versioned operation is declared once in the app's typed operation table (`query<Input, Output, RefusalCode>()` / `mutation<...>()` registered by `defineOperations`, declared by the platform capability `operations`): its input and output are closed types (no `any`, `unknown`, `Record<string, unknown>`, unbound generic, function or `Date`) and its refusal codes a closed union of string literals; a route that takes or answers the table's types takes `OperationRequest<Table>` and answers `Promise<OperationReply<Table>>` of one table (`operation-contract-decidable`, `operation-route-driven-by-table`) |
-| **Webhooks and realtime** | A provider webhook door injects only the `WebhookSignatureService` and domain services, starts with the unconditional `verify` call, makes exactly one domain call and returns nothing (`webhook-shape`, `webhook-verify-first`); a realtime door is one gateway or subscription that injects only the `RealtimeHub` and subscribes to a topic built from its `@CurrentPrincipal()` (`realtime-shape`, `realtime-read-only`, `realtime-topic-scope`) |
+| **Webhooks and realtime** | A provider webhook door injects only the `WebhookSignatureService` and domain services, verifies first (awaited when async), and hands the POST delivery to exactly one domain intake that records the inbox receipt and outbox event; a domain method may combine proof and intake. The POST returns nothing or the own-feature exported literal `PROVIDER_ACK`. One optional GET challenge handler returns only its declared domain verifier's result. The door and HTTP module import or inject no `CommandBus`, `QueryBus` or feature command handler, and its resolved domain intake dispatches no command/query bus or feature handler; a reactor or job dispatches after commit (`webhook-shape`, `webhook-verify-first`, `feature-thin`). A realtime door is one gateway or subscription that injects only the `RealtimeHub` and subscribes to a topic built from its `@CurrentPrincipal()` (`realtime-shape`, `realtime-read-only`, `realtime-topic-scope`) |
 | **Transport** | A door injects only `CommandBus` / `QueryBus` (and `RequestLocale` in REST) and dispatches exactly one message per handler, holding no branch, loop, EntityManager or call other than the bus, and pure `*.mapper.ts` functions and `unwrapOutcome` of `platform/primitives` (`transport-is-thin`); no response envelope, no `GraphQLJSON`, no `unknown` body, no `switch (input.operation)`; a REST door lives in `transport/http` and shows a public reason, a byte stream or a redirect; a capability never imports a feature (`transport-is-thin`, `no-response-envelope`, `no-graphql-json`, `door-lives-in-features`, `rest-door-needs-a-reason`, `no-capability-imports-features`) |
-| **Feature thin** (R203 BE_FEATURE_THIN) | A feature-tier file of a thin role (`<name>.handler.ts`, `.resolver.ts`, `.controller.ts`, `.consumer.ts`, `.processor.ts`, `.step.ts`, `.saga.ts`, `.saga-step.ts`, `.compensation.ts`, `.webhook.ts`, `.gateway.ts`, `.subscription.ts`, `.cli.ts`, `.mapper.ts`, `.service.ts`) maps its parameters and makes exactly one delegating call into the modules - an injected member, a bus `execute` or a modules function in statement position - with no branch, loop, `try`, `throw` or computation; free calls are pure `*.mapper.ts` functions, the `Logger` port and a webhook's `verify`; orchestration (step order, compensation, claim, fencing, retry) belongs to the platform (`feature-thin`) |
+| **Feature thin** (R203 BE_FEATURE_THIN) | A feature-tier file of a thin role (`<name>.handler.ts`, `.resolver.ts`, `.controller.ts`, `.consumer.ts`, `.processor.ts`, `.step.ts`, `.saga.ts`, `.saga-step.ts`, `.compensation.ts`, `.webhook.ts`, `.gateway.ts`, `.subscription.ts`, `.cli.ts`, `.mapper.ts`, `.service.ts`) maps its parameters and makes exactly one delegating call into the modules - an injected member, a bus `execute` or a modules function in statement position - with no branch, loop, `try`, `throw` or computation; free calls are pure `*.mapper.ts` functions, the `Logger` port and a webhook's first verification call when followed by one separate intake (a combined domain verification and intake call counts as the delegation). A webhook POST may return its declared literal `PROVIDER_ACK`; its optional GET challenge has one domain verifier call and echoes only that result. Webhook doors and their HTTP modules reach no command/query bus or feature command handler; orchestration (step order, compensation, claim, fencing, retry) belongs to the platform (`feature-thin`) |
 | **Infrastructure owners** | Each raw library (HTTP, cache, queue, scheduler, logger, date, config, events) is imported or reached as a global only inside the capability the manifest names for it (`ruleParams.be.infraOwners`); `@nestjs/config`, `dotenv` and `@nestjs/event-emitter` nowhere; the `HttpClient` port of `platform/http` (found by the receiver's type) is called only in an `integrations` owner, `platform/http` and the test world (`infra-import-owner`, `http-client-only-in-integrations`) |
 | **Observability** | Logs leave through the `Logger` port of `platform/logging`, never the framework's `Logger`; a log call's first argument is a member of an owner's `<owner>.log-events.ts` enum; a failure log carries the exception's identity, not only its wording (`no-framework-logger`, `no-interpolated-log-message`, `no-error-wording-as-log-identity`) |
 | **Testing** | A unit spec is `<name>.<role>.spec.ts` beside its subject: REQUIRED beside every file of a spec-required role of `ruleParams.be.unitRoles` (every `<name>.service.ts` its `<name>.service.spec.ts`, every `<name>.cli.ts` of `src/features/cli/` its `<name>.cli.spec.ts`) and beside a webhook or realtime door that has no service of its own; OPTIONAL beside any other file of a `ruleParams.be.logicRoles` role inside a slot whose `coverage` is `required` (the file owes 100 per file, not a spec of its own); any other `*.spec.ts` outside `src/tests/{e2e,integration,contract,world}` (handler, resolver, controller, consumer, entity, module, composition) is a finding; there is no `.test.ts`, `int-spec` or `harness-spec`; a spec asserts a result or a state, not only a call; an e2e reads persisted state back through a typeorm `EntityManager` and reaches no model provider outside `src/tests/e2e/live/` (`unit-test-colocated`, `no-call-only-spec`, `e2e-asserts-persisted-state`, `no-model-call-in-e2e`, `no-api-shaped-e2e-filename`, `no-marker-model-stub`) |
@@ -79,6 +80,48 @@ A sample, not the list:
 Every rule names the law that declares it — `ruleOwners` maps rule name to law, so a failing build
 line leads straight to the document that explains why.
 
+## Domain webhook verification
+
+The first call may be a method on a domain service whose declared class name ends in `Verifier` or `verify`.
+The service must resolve to a domain `<name>.service.ts`; a local alias or a lookalike class from another tier does not grant proof.
+For an existing service with another name, declare the exact verification method in the adjacent
+`<provider>-http.module.ts`:
+
+```ts
+export const webhookVerifiers = [BillingService.prototype.receiveCassoWebhook] as const
+```
+
+The declaration names TypeScript method symbols, never strings. Its first unconditional call must finish proof before
+processing the delivery and must be awaited when async. A method may combine verification and intake as the handler's only
+call, or a dedicated verification call may precede exactly one separate intake call. No data read, nested call or side effect
+may run in the door before proof; the domain verifier owns connection-secret resolution. The verifier's service spec proves
+that invalid proof refuses the delivery before intake, because lint establishes the call's declaration and order, not its
+cryptographic behavior.
+
+The POST intake records the delivery through the shared inbox and publishes its receipt event in the same transaction.
+The existing `Inbox` port supplies `claim`; `inbox.record` describes this domain recording method, such as
+`recordProviderDelivery`, rather than a second inbox API. A reactor or job consumes the durable receipt and dispatches the
+processing command. The webhook door and its HTTP module may not import or inject `CommandBus`, `QueryBus` or a feature
+command handler. Lint also refuses typed command/query-bus and feature-handler receivers in the resolved called intake method; calls hidden behind
+helpers, dynamic receivers or unavailable implementations need semantic review.
+
+For a provider that requires a fixed response, declare the constant in the door or its own HTTP module:
+
+```ts
+export const PROVIDER_ACK = { success: true } as const
+```
+
+After proof and its one intake call, the POST may `return PROVIDER_ACK`. A readonly literal object type or literal string
+is also supported. Only literal contents qualify: an inline returned object, computed value, call, spread, interpolated
+template, input-derived constant or another feature's constant remains a `returns` finding. The constant never replaces
+the first-statement proof.
+
+A subscription provider may have one GET handler beside the one POST. Its first statement calls a declared domain verifier
+and it echoes exactly that result, for example `const challenge = this.verifier.challenge(query); return challenge`.
+The awaited form is required for an async verifier. GET has no intake and no other computed response. Both handlers carry
+the signed-webhook public reason and strict rate tier. See `knowledge/patterns/be/webhooks.yaml` for the full Meta-style
+door, receipt and reactor file tree.
+
 ## Companion
 
 - **[@starci/eslint-canon-fe](https://www.npmjs.com/package/@starci/eslint-canon-fe)** — the
@@ -103,4 +146,3 @@ ESLint 9+ (flat config), Node 20.9+.
 Every rule of this plugin is an enforcer of one HFS rule. The relation (rule id -> HFS rule -> catalogued Vietnamese why code)
 lives in exactly one place, `knowledge/hfs/rules.yaml` (`enforcers`), and `scripts/checks/check-hfs-rules.mjs` refuses a
 rule of this plugin that no catalog entry names. There is no second table here.
-

package/app-composition.mjs

@@ -0,0 +1,176 @@
+/**
+ * The rules that hold the composition files of a back-end app (catalog R245 `BE_APP_OPTIONS_COMPOSITION` and R246
+ * `BE_APP_COMPOSITION_BUDGET`, owner ruling 2026-10-14). An app's `src/` holds five roles, named by the entries of its `be.app.*` slot (`lib/app-roles.mjs`):
+ * `main.ts`, `app.module.ts`, `<app>.env.ts`, `<app>.options.ts` and the composition groups `compose/<area>.ts`.
+ *
+ *   - `app-options-composition-free` (`BE_APP_OPTIONS_COMPOSITION`) keeps `<app>.env.ts` to typed, fail-fast environment
+ *     parsing only and `<app>.options.ts` to options types and port bindings (provider maps such as `{ approvalGate: X }`): an array that lists Nest modules (a
+ *     `*Module` class, a `X.register(...)`/`forRoot(...)`/`registerQueue(...)` call), queue registrations or scheduler entries
+ *     (a `*SchedulerOf(...)`, `*Scheduler(...)` or `*Queue(...)` call), a spread of such a list, and an `imports`, `modules`,
+ *     `schedulers` or `processors` array are refused. Those lists are composition: they live in `compose/<area>.ts`, one
+ *     group per area, which `app.module.ts` spreads. The env role also refuses registration and scheduler calls outside arrays.
+ *     `config-owner.mjs` keeps process environment access and owned `EnvSource` reads in `main.ts` or the matching env role;
+ *     options files and composition groups receive the typed result of `read<App>Env(env: EnvSource)`.
+ *   - `app-file-budget` (`BE_APP_COMPOSITION_BUDGET`) holds each composition file to the line budget its app slot names
+ *     (`budget` of the slot, keyed by the same entry: `app.module.ts` 250, `<app>.env.ts` 150, `<app>.options.ts` 200, `compose/<area>.ts` 120,
+ *     `main.ts` 80). The budget is absolute, not a ratchet: an app root that outgrows it moves an area into a new group.
+ *
+ * Both rules ask the slot view which entry a file matches; neither keeps a path of its own.
+ */
+import { lineCount } from "./runtime/scripts/lib/line-count.mjs"
+import { APP_ENV_ROLE, APP_OPTIONS_ROLE, appRoleOf } from "./lib/app-roles.mjs"
+import { hfsOf } from "./lib/hfs.mjs"
+import { keyName, staticText } from "./lib/ast.mjs"
+import { isDeclarationFile, normalizePath } from "./lib/path.mjs"
+
+/** Static factories that register a Nest module (a dynamic module), a queue or a flow producer. */
+const REGISTRATION_CALLS = new Set([
+    "register",
+    "registerAsync",
+    "forRoot",
+    "forRootAsync",
+    "forFeature",
+    "forFeatureAsync",
+    "registerQueue",
+    "registerQueueAsync",
+    "registerFlowProducer",
+])
+
+/** Keys whose array value is a composition list whatever it holds. */
+const COMPOSITION_KEYS = new Set(["imports", "modules", "schedulers", "processors"])
+
+/** A name that is a Nest module class. */
+const MODULE_NAME = /Module$/
+/** A name that is a list of modules, queues, schedulers or processors (the operand of a spread). */
+const LIST_NAME = /(?:Modules|Queues|Schedulers|Processors)$/
+/** A call that builds a scheduler entry or a queue registration: `orderExpirySchedulerOf(...)`, `ordersQueue(...)`. */
+const ENTRY_CALL = /(?:Scheduler|Queue)(?:Of)?$/
+
+/** Type-only wrappers do not change whether an expression composes modules. */
+const WRAPPERS = new Set(["TSAsExpression", "TSTypeAssertion", "TSSatisfiesExpression", "TSNonNullExpression", "TSInstantiationExpression", "ChainExpression"])
+const unwrap = (node) => {
+    while (node && WRAPPERS.has(node.type)) node = node.expression
+    return node
+}
+
+/** The known name of a member, including a static computed string. */
+const memberName = (node) => node.computed ? staticText(node.property) : keyName(node.property)
+
+/** The last name of an identifier or a statically named member expression, else null. */
+const lastName = (node) => {
+    node = unwrap(node)
+    if (node?.type === "Identifier") return node.name
+    if (node?.type === "MemberExpression") return memberName(node)
+    return null
+}
+
+/** What an array element composes (`module`, `registration`, `scheduler`, `list`), or null when it is plain options data. */
+const compositionOf = (element) => {
+    element = unwrap(element)
+    if (!element) return null
+    if (element.type === "SpreadElement") {
+        const argument = unwrap(element.argument)
+        const spread = argument?.type === "CallExpression" ? lastName(argument.callee) : lastName(argument)
+        return spread !== null && (LIST_NAME.test(spread) || MODULE_NAME.test(spread)) ? "list" : null
+    }
+    if (element.type === "CallExpression") {
+        const callee = unwrap(element.callee)
+        if (callee.type === "MemberExpression" && REGISTRATION_CALLS.has(memberName(callee))) return "registration"
+        const name = lastName(callee)
+        return name !== null && ENTRY_CALL.test(name) ? "scheduler" : null
+    }
+    const name = lastName(element)
+    return name !== null && MODULE_NAME.test(name) ? "module" : null
+}
+
+/** Env parsing and options bindings hold no module, queue or scheduler composition. */
+export const appOptionsCompositionFree = {
+    meta: {
+        type: "problem",
+        docs: { description: "`<app>.env.ts` holds environment parsing only and `<app>.options.ts` holds options types and port bindings; module, queue and scheduler composition lives in `compose/<area>.ts`." },
+        schema: [],
+        messages: {
+            list: "`{{key}}` is a composition list in {{role}}. `<app>.env.ts` holds typed, fail-fast environment parsing only and `<app>.options.ts` holds options types and port bindings; move this list into `apps/<app>/src/compose/<area>.ts` (one group per area) and spread the group in `app.module.ts`.",
+            element: "This array lists a {{what}} in {{role}}. `<app>.env.ts` holds environment parsing only and `<app>.options.ts` holds options types and port bindings; module lists, queue registrations and scheduler entries live in `apps/<app>/src/compose/<area>.ts`, which `app.module.ts` spreads.",
+            call: "This {{what}} composes modules, queues or schedulers in `<app>.env.ts`. Keep typed, fail-fast environment parsing here and move composition into `apps/<app>/src/compose/<area>.ts`, which `app.module.ts` spreads.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename)) return {}
+        const role = appRoleOf(hfsOf(context), filename)?.entry
+        if (role !== APP_OPTIONS_ROLE && role !== APP_ENV_ROLE) return {}
+        const judged = new WeakSet()
+        return {
+            CallExpression(node) {
+                if (role !== APP_ENV_ROLE) return
+                let element = node
+                while (WRAPPERS.has(element.parent?.type)) element = element.parent
+                if (element.parent?.type === "ArrayExpression") return
+                const what = compositionOf(node)
+                if (what !== "registration" && what !== "scheduler") return
+                context.report({ node, messageId: "call", data: { what: what === "registration" ? "registration call" : "scheduler or queue call" } })
+            },
+            Property(node) {
+                const value = unwrap(node.value)
+                if (value?.type !== "ArrayExpression") return
+                const key = node.computed ? staticText(node.key) : keyName(node.key)
+                if (key === null || !COMPOSITION_KEYS.has(key)) return
+                judged.add(value)
+                context.report({ node, messageId: "list", data: { key, role } })
+            },
+            "ArrayExpression:exit"(node) {
+                if (judged.has(node)) return
+                const what = node.elements.map(compositionOf).find((kind) => kind !== null)
+                if (what === undefined) return
+                const label = { module: "Nest module", registration: "module or queue registration", scheduler: "scheduler or queue entry", list: "spread of a module, queue or scheduler list" }[what]
+                context.report({ node, messageId: "element", data: { what: label, role } })
+            },
+        }
+    },
+}
+
+/** Each composition file of an app stays within the line budget its app slot names. */
+export const appFileBudget = {
+    meta: {
+        type: "problem",
+        docs: { description: "`main.ts`, `app.module.ts`, `<app>.env.ts`, `<app>.options.ts` and `compose/<area>.ts` stay within the line budget of their app slot." },
+        schema: [],
+        messages: {
+            over: "This {{role}} has {{lines}} lines, over its budget of {{max}} (the `budget` of slot {{slot}}). {{fix}}",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename)) return {}
+        const hfs = hfsOf(context)
+        const role = appRoleOf(hfs, filename)
+        const max = role ? hfs.slot(role.slot)?.budget?.[role.entry] : undefined
+        if (!Number.isInteger(max)) return {}
+        const fix = role.entry === APP_ENV_ROLE
+            ? "Keep typed, fail-fast environment parsing only here; move module composition into `compose/<area>.ts` and business code into its owning module."
+            : role.entry === APP_OPTIONS_ROLE
+            ? "Keep options types and port bindings here; move environment parsing into `<app>.env.ts` and module, queue or scheduler lists into `compose/<area>.ts`."
+            : role.entry === "main.ts"
+            ? "Move environment parsing into `<app>.env.ts` and module composition into `compose/<area>.ts`; keep the bootstrap here."
+            : "Move one area of the composition into its own group `apps/<app>/src/compose/<area>.ts` and spread it in `app.module.ts`."
+        return {
+            "Program:exit"(node) {
+                const lines = lineCount((context.sourceCode || context.getSourceCode()).text)
+                if (lines > max) context.report({ node, loc: { line: 1, column: 0 }, messageId: "over", data: { role: role.entry, lines, max, slot: role.slot, fix } })
+            },
+        }
+    },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "app-options-composition-free": appOptionsCompositionFree,
+    "app-file-budget": appFileBudget,
+}
+
+/** Both start at error: every rule is an error, and an app already over a budget migrates its lists into compose/. */
+export const recommended = {
+    "starci-be/app-options-composition-free": "error",
+    "starci-be/app-file-budget": "error",
+}

package/config-owner.mjs

@@ -3,15 +3,16 @@
  * and the secret-comparison half of R41 `BE_DEFAULT_DENY`).
  *
  *   - `no-direct-env-read` keeps the process environment inside the one file that declares the `EnvSource` class of
- *     `platform/config`. Everything else receives typed options from `<capability>.config.ts`. `process.env` in any form
+ *     `platform/config`, `main.ts` or the matching `<app>.env.ts`. Everything else receives typed options. `process.env` in any form
  *     (member access, destructuring, `Reflect.get(process, "env")`, an `env` import of `node:process`), an import of
  *     `@nestjs/config` or `dotenv`, and a `process.cwd()` path joined into `src` or
  *     `.starcistacks` are refused everywhere else. The test world (slot `be.tests.world`) may read and write `process.env`:
  *     it hands the run state file path to the jest workers. A config getter that reads `process.env` itself is caught here at its
  *     definition.
- *   - `config-parsed-in-main` keeps the parsing of configuration in `main.ts`: a call of a function exported by a
+ *   - `config-parsed-in-main` keeps the parsing of configuration in `main.ts` or `<app>.env.ts`: a call of a function exported by a
  *     `<capability>.config.ts` (or of a function returning a `<capability>.options.ts` type, at module scope) is refused
- *     outside the app entry (`main.ts` and `<app>.options.ts`), the config file itself, its own spec, the test world and a provider contract spec. The callee is found through the type
+ *     outside the app entry (`main.ts` and the matching `<app>.env.ts`), the config file itself, its own spec, the test world and a provider contract spec.
+ *     Other app files also cannot call the app's env parser or the typed `EnvSource` readers. The callee is found through the type
  *     checker, so no function name is matched.
  *   - `no-secret-default` refuses a default for a value typed `Secret` or `Url` by `platform/config`: a default argument
  *     to an `EnvSource` reader, a `??`/`||` fallback on such a value, and a string literal default (`""`, `"localhost"`,
@@ -24,6 +25,7 @@
  * No test lane is exempt: a spec builds its `EnvSource` from a literal record and never touches the process environment.
  */
 import ts from "typescript"
+import { APP_ENV_ROLE, appRoleOf } from "./lib/app-roles.mjs"
 import { keyName, staticText, walk, wordsOf } from "./lib/ast.mjs"
 import { isOwnedBy, isOwnedType, originsOf } from "./lib/declared.mjs"
 import { hfsOf, inTestWorld } from "./lib/hfs.mjs"
@@ -49,15 +51,15 @@ const isGlobalProcess = (node) =>
 /** True when the property of a member expression spells `env`. */
 const spellsEnv = (node) => (node.computed ? staticText(node.property) === "env" : keyName(node.property) === "env")
 
-/** Only the file that declares `EnvSource` (and the test world) reads the process environment. */
+/** Only EnvSource, the app bootstrap roles and the test world read the process environment. */
 export const noDirectEnvRead = {
     meta: {
         type: "problem",
-        docs: { description: "The process environment is read only by the `EnvSource` class of `platform/config`." },
+        docs: { description: "The process environment is read only by `EnvSource` of `platform/config`, app `main.ts`, the matching `<app>.env.ts` and the test world." },
         schema: [],
         messages: {
-            env: "The process environment is read outside the `EnvSource` of `platform/config`. Add the key to the capability's `<capability>.config.ts` (`parse<C>Config(env: EnvSource)`) and receive the value through its `<capability>.options.ts`.",
-            package: "`{{source}}` is a second config path. Configuration is parsed once in `main.ts` by `platform/config` typed readers and reaches a module through `register(options)`.",
+            env: "The process environment is read outside `EnvSource` of `platform/config`, app `main.ts`, the matching `<app>.env.ts` or the test world. Read app keys through `read<App>Env(env: EnvSource)` and capability keys through `<capability>.config.ts`, then receive typed options here.",
+            package: "`{{source}}` is a second config path. Configuration is parsed once in `main.ts` or `<app>.env.ts` by `platform/config` typed readers and reaches a module through `register(options)`.",
             cwdPath: "A path built from `process.cwd()` and `{{segment}}` depends on where the process was started. Resolve it from a configured root.",
         },
     },
@@ -78,8 +80,10 @@ export const noDirectEnvRead = {
         const isProcess = (node) => (node.type === "Identifier" && processNames.has(node.name) && !isLocal(node)) || isGlobalProcess(node)
         const isEnvSourceFile = () => inConfigOwner && declaresEnvSource
         const inWorld = isTestWorld(hfs, filename)
+        const appRole = appRoleOf(hfs, filename)?.entry
+        const inAppEntry = appRole === "main.ts" || appRole === APP_ENV_ROLE
         const reportEnv = (node) => {
-            if (!isEnvSourceFile() && !inWorld) context.report({ node, messageId: "env" })
+            if (!isEnvSourceFile() && !inWorld && !inAppEntry) context.report({ node, messageId: "env" })
         }
         const reportSource = (node, source) => {
             if (isConfigPackage(source)) context.report({ node, messageId: "package", data: { source } })
@@ -97,7 +101,7 @@ export const noDirectEnvRead = {
                 if (!PROCESS_MODULES.has(source)) return
                 for (const specifier of node.specifiers) {
                     if (specifier.type === "ImportSpecifier" && (specifier.imported.name ?? specifier.imported.value) === "env") reportEnv(specifier)
-                    else if (specifier.type !== "ImportSpecifier") processNames.add(specifier.local.name)
+                    else if (specifier.type !== "ImportSpecifier" || (specifier.imported.name ?? specifier.imported.value) === "default") processNames.add(specifier.local.name)
                 }
             },
             ImportExpression(node) {
@@ -166,15 +170,15 @@ const isModuleScope = (node) => {
     return true
 }
 
-/** Config is parsed once, in `main.ts`; nothing else calls a config parser or getter. */
+/** Config is parsed once, in `main.ts` or its app's env file; other app roles do not read the environment. */
 export const configParsedInMain = {
     meta: {
         type: "problem",
-        docs: { description: "A function of a `<capability>.config.ts` is called only from the app entry, its own config file or spec, and the test world." },
+        docs: { description: "Configuration is parsed in `main.ts` or its matching `<app>.env.ts`; other app files do not call parsers or EnvSource readers." },
         schema: [],
         messages: {
-            parsed: "`{{name}}` is declared by `{{file}}` and parses configuration. Configuration is parsed once in `apps/<app>/src/main.ts` and reaches a module through `register(options)`; read it here with `Inject<C>Options()`.",
-            moduleScope: "`{{name}}` returns configuration options and is called when the module loads. Options are built once in `main.ts` and injected with `Inject<C>Options()`.",
+            parsed: "`{{name}}` is declared by `{{file}}` and parses configuration. Configuration is parsed once in `apps/<app>/src/main.ts` or its matching `<app>.env.ts` and reaches a module through `register(options)`; receive typed options here.",
+            moduleScope: "`{{name}}` returns configuration options and is called when the module loads. Options are built once in `main.ts` or its matching `<app>.env.ts` and injected with `Inject<C>Options()`.",
         },
     },
     create(context) {
@@ -182,11 +186,13 @@ export const configParsedInMain = {
         if (isDeclarationFile(filename)) return {}
         const hfs = hfsOf(context)
         const slot = hfs.slotOf(filename) ?? ""
-        // the composition roots: the app entry and its `<app>.options.ts` (which `main.ts` calls to build `AppOptions`), the test world,
-        // and a provider contract spec (it registers one module with options parsed from the declared sandbox keys, as the world does)
-        const isEntry = slot.startsWith("be.app.") && (baseOf(filename) === "main.ts" || baseOf(filename).endsWith(OPTIONS_SUFFIX))
+        // The app entry and its matching env file parse options; options files and composition groups only consume them.
+        // The test world and provider contract specs parse the declared sandbox keys to register their modules.
+        const inApp = slot.startsWith("be.app.")
+        const role = appRoleOf(hfs, filename)?.entry
+        const isEntry = role === "main.ts" || role === APP_ENV_ROLE
         const isComposingTest = isTestWorld(hfs, filename) || slot === "be.tests.contract"
-        const isOwnSpec = baseOf(filename).endsWith(CONFIG_SPEC_SUFFIX)
+        const isOwnSpec = !inApp && baseOf(filename).endsWith(CONFIG_SPEC_SUFFIX)
         if (isEntry || isComposingTest || isOwnSpec) return {}
         const { checker, toTs } = typed(context)
         return {
@@ -194,11 +200,20 @@ export const configParsedInMain = {
                 const tsCall = toTs(node)
                 if (!tsCall) return
                 const signature = checker.getResolvedSignature(tsCall)
-                const declaration = functionDeclarationOf(signature?.declaration)
+                const resolvedDeclaration = signature?.declaration
+                if (inApp && resolvedDeclaration && ts.isMethodDeclaration(resolvedDeclaration)
+                    && ts.isClassDeclaration(resolvedDeclaration.parent) && resolvedDeclaration.parent.name?.text === "EnvSource") {
+                    const declaredIn = normalizePath(resolvedDeclaration.getSourceFile().fileName)
+                    if (isOwnedBy(hfs, declaredIn, "platform", "config")) {
+                        context.report({ node, messageId: "parsed", data: { name: context.sourceCode.getText(node.callee), file: baseOf(declaredIn) } })
+                        return
+                    }
+                }
+                const declaration = functionDeclarationOf(resolvedDeclaration)
                 if (!declaration) return
                 const declaredIn = normalizePath(declaration.getSourceFile().fileName)
                 const name = context.sourceCode.getText(node.callee)
-                if (isConfigFile(hfs, declaredIn)) {
+                if (isConfigFile(hfs, declaredIn) || appRoleOf(hfs, declaredIn)?.entry === APP_ENV_ROLE) {
                     if (declaredIn !== filename) context.report({ node, messageId: "parsed", data: { name, file: baseOf(declaredIn) } })
                     return
                 }

package/feature-thin.mjs

@@ -14,15 +14,19 @@
  * the file-name suffix the closed role vocabulary defines - never a path regex. What a receiver is comes
  * from its TYPE (`Logger` of `platform/logging`, `WebhookSignatureService` of `platform/http-security`) and
  * from whether the member is injected (`injectedMembers`); what a free function is comes from the file its
- * import resolves to. A job `step` records its fence through `JobClaims` (`advance`, `runKey`) and a webhook proves its signature through `verify`: those gate calls
- * are free, the one effect each makes is the delegating call. `.spec.ts` and `.d.ts` are never judged, and neither is a file whose tier is not
+ * import resolves to. A job `step` records its fence through `JobClaims` (`advance`, `runKey`), and a webhook proves its signature through the shared `verify`
+ * or a declared domain verifier as its first call: a separate gate call is free beside the one intake delegation.
+ * A combined domain proof and intake counts as the delegation. `.spec.ts` and `.d.ts` are never judged, and neither is a file whose tier is not
  * `feature` or whose role is not a thin role. A clean thin file is never flagged: that is the bar.
  */
 import { keyName, walk } from "./lib/ast.mjs"
-import { aliasTarget, injectedMembers } from "./lib/doors.mjs"
+import { aliasTarget, callsOf, decoratorsFrom, injectedMembers } from "./lib/doors.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
 import { importOf } from "./lib/import-source.mjs"
 import { baseName, isLoggerType, isOwnedType } from "./lib/ports.mjs"
+import { firstWebhookVerification, isWebhookDomainServiceType } from "./lib/webhook-verifiers.mjs"
+import { isWebhookForbiddenReceiver } from "./lib/webhook-handoff.mjs"
+import { isProviderAcknowledgement } from "./lib/webhook-ack.mjs"
 
 /** The statements and expressions that are a decision, a repetition or an exit: none lives in a thin file. */
 const BRANCH_NODES = new Set(["IfStatement", "SwitchStatement", "ConditionalExpression", "ForStatement", "ForInStatement", "ForOfStatement", "WhileStatement", "DoWhileStatement", "TryStatement", "ThrowStatement", "LogicalExpression"])
@@ -65,6 +69,27 @@ const isClaimsReceiver = (context, node) => isOwnedType(context, node, { name: "
 /** The `Logger` port of `platform/logging` - the one call that is always free. */
 const isLoggerReceiver = isLoggerType
 
+/** A direct, non-computed member call; other callee shapes keep their ordinary call classification. */
+const memberOf = (callee) => callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" ? callee : null
+
+/** Nest-commander's group help is transport bookkeeping in a CLI door. */
+const isCliHelp = (role, member) => role === "cli" && member?.property.name === "help" && member.object.type === "MemberExpression"
+    && member.object.object.type === "ThisExpression" && member.object.property.type === "Identifier" && member.object.property.name === "command"
+
+/** A signed number inside the validated immutable provider literal is data, rather than door computation. */
+const isLiteralAcknowledgementInitializer = (context, hfs, node) => {
+    let child = node
+    for (let parent = node.parent; parent; parent = parent.parent) {
+        if (parent.type === "VariableDeclarator") return parent.init === child && isProviderAcknowledgement(context, hfs, parent.id)
+        child = parent
+    }
+    return false
+}
+
+/** A signed numeric literal in a TypeScript type annotation executes no expression. */
+const isSignedNumericLiteralType = (node) => node.type === "UnaryExpression" && node.parent?.type === "TSLiteralType"
+    && ["+", "-"].includes(node.operator) && node.argument.type === "Literal" && typeof node.argument.value === "number"
+
 /** The name of a thin file's law is `feature-thin` (R203). */
 export const featureThin = {
     meta: {
@@ -74,7 +99,7 @@ export const featureThin = {
         messages: {
             branch: "{{what}} is a decision or a repetition in a thin file. A feature `<name>.{{role}}.ts` maps its parameters and makes one delegating call into the modules; a branch, a loop, a `try` or a `throw` is business logic that belongs in a service of the modules (where a unit spec covers it) - and orchestration (step order, compensation, claim, fencing, retry) belongs to the platform.",
             compute: "{{what}} computes a value in a thin file. A feature `<name>.{{role}}.ts` maps its parameters and hands them over; an expression that computes is logic that belongs in the modules. Map the value there and read it back.",
-            call: "`{{what}}` is a call a thin file does not make. It calls exactly one injected member (a service, a bus `execute`, an event bus, a queue producer) or one function of the modules, and pure `*.mapper.ts` functions and the `Logger` port are free{{webhook}}; everything else - parsing, mapping by hand, a helper, a second dependency - is logic that belongs in the modules.",
+            call: "`{{what}}` is a call a thin file does not make. It calls exactly one injected member (a service, a bus `execute`, an event bus, a queue producer) or one function of the modules, and pure `*.mapper.ts` functions and the `Logger` port are free{{webhook}}; a webhook hands off through domain intake and the inbox/outbox, never a command/query bus or a feature handler. Everything else - parsing, mapping by hand, a helper, a second dependency - is logic that belongs in the modules.",
             many: "`{{name}}` makes a second delegating call here. A thin file makes exactly one; a second is orchestration - step order, compensation, claim, fencing, retry - and belongs to a capability of the platform or inside the service the file calls.",
         },
     },
@@ -87,6 +112,7 @@ export const featureThin = {
         if (hfs.tierOf(context.filename) !== "feature") return {}
         const sourceCode = context.sourceCode
         const mapperFile = role === "mapper"
+        const webhookDoor = role === "webhook" && hfs.slotOf(context.filename) === "be.feature.webhooks.http"
 
         /** The injected member names of a class: constructor parameter properties and properties carrying an injector decorator. */
         const memberNames = new Map()
@@ -154,20 +180,28 @@ export const featureThin = {
          * `free` (a mapper, a logger method, a webhook `verify`, a job step's `JobClaims` fence call, a modules function in a mapping position)
          * or `call` (a call a thin file does not make). A `mapper` file holds only mapper calls and `new`.
          */
+        const classifyMapperOrCli = (member, call) => {
+            if (mapperFile && member !== null && MAPPER_SHAPE_METHODS.has(member.property.name) && injectedMemberOf(member.object, call) === null) return "free"
+            if (isCliHelp(role, member)) return "free"
+            return mapperFile ? "call" : null
+        }
+
+        /** The free bookkeeping calls beside an injected member's one delegate. */
+        const classifyInjected = (member) => {
+            if (webhookDoor && isWebhookForbiddenReceiver(context, hfs, member.object)) return "call"
+            if (isLoggerReceiver(context, member.object)) return "free"
+            if (role === "webhook" && member.property.name === "verify" && isSignatureReceiver(context, member.object)) return "free"
+            if (role === "step" && isClaimsReceiver(context, member.object)) return "free"
+            return "delegating"
+        }
+
         const classify = (call) => {
             const callee = call.callee
             if (callee.type === "Identifier" && isMapperCall(callee)) return "free"
-            const member = callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" ? callee : null
-            if (mapperFile && member !== null && MAPPER_SHAPE_METHODS.has(member.property.name) && injectedMemberOf(member.object, call) === null) return "free"
-            // a cli group command shows its help without a sub-command: the `help` of the command nest-commander gives it
-            if (role === "cli" && member !== null && member.property.name === "help" && member.object.type === "MemberExpression" && member.object.object.type === "ThisExpression" && member.object.property.type === "Identifier" && member.object.property.name === "command") return "free"
-            if (mapperFile) return "call"
-            if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && injectedMemberOf(callee.object, call) !== null) {
-                if (isLoggerReceiver(context, callee.object)) return "free"
-                if (role === "webhook" && callee.property.name === "verify" && isSignatureReceiver(context, callee.object)) return "free"
-                if (role === "step" && isClaimsReceiver(context, callee.object)) return "free"
-                return "delegating"
-            }
+            const member = memberOf(callee)
+            const special = classifyMapperOrCli(member, call)
+            if (special !== null) return special
+            if (member !== null && injectedMemberOf(member.object, call) !== null) return classifyInjected(member)
             if (callee.type === "Identifier" && isModulesCall(callee)) return isStatementCall(call) ? "delegating" : "free"
             return "call"
         }
@@ -201,7 +235,11 @@ export const featureThin = {
             visitors[type] = (node) => context.report({ node, messageId: "branch", data: { what: type === "LogicalExpression" ? `a \`${node.operator}\`` : BRANCH_WHAT[type], role } })
         }
         for (const type of COMPUTE_NODES) {
-            visitors[type] = (node) => context.report({ node, messageId: "compute", data: { what: `an \`${node.operator}\``, role } })
+            visitors[type] = (node) => {
+                if (isSignedNumericLiteralType(node)) return
+                if (webhookDoor && isLiteralAcknowledgementInitializer(context, hfs, node)) return
+                context.report({ node, messageId: "compute", data: { what: `an \`${node.operator}\``, role } })
+            }
         }
         visitors.TemplateLiteral = (node) => {
             if (node.expressions.length > 0) context.report({ node, messageId: "compute", data: { what: "a template literal with an expression", role } })
@@ -210,10 +248,14 @@ export const featureThin = {
             for (const root of rootFunctionsOf(program)) {
                 const body = root.type === "MethodDefinition" ? root.value?.body : root.body
                 if (!body) continue
+                const proof = role === "webhook" && hfs.slotOf(context.filename) === "be.feature.webhooks.http" && root.type === "MethodDefinition" && decoratorsFrom(context, root, "@nestjs/common", "Post").length > 0
+                    ? firstWebhookVerification(context, hfs, root) : null
+                const separateDomainProof = proof !== null && callsOf(root).filter(({ receiver }) => receiver !== null && isWebhookDomainServiceType(context, hfs, receiver)).length > 1
                 let delegating = 0
                 walk(body, (node) => {
                     if (node.type !== "CallExpression") return
-                    const kind = classify(node)
+                    const classified = classify(node)
+                    const kind = separateDomainProof && node === proof && classified === "delegating" ? "free" : classified
                     if (kind === "call") context.report({ node, messageId: "call", data: { what: sourceCode.getText(node.callee), webhook: role === "webhook" ? ", plus `verify` of the signature service" : "" } })
                     else if (kind === "delegating") {
                         delegating += 1

package/index.mjs

@@ -19,6 +19,7 @@
 import { buildBeConfig } from "./lib/config.mjs"
 import { pluginForEdition } from "./lib/edition.mjs"
 import { recommended as ambientIdRecommended, rules as ambientIdRules } from "./ambient-id.mjs"
+import { recommended as appCompositionRecommended, rules as appCompositionRules } from "./app-composition.mjs"
 import { recommended as asyncDisciplineRecommended, rules as asyncDisciplineRules } from "./async-discipline.mjs"
 import { recommended as authorizationRecommended, rules as authorizationRules } from "./authorization.mjs"
 import { recommended as buildersRecommended, rules as buildersRules } from "./builders.mjs"
@@ -71,6 +72,7 @@ import { recommended as sonarParityRecommended, rules as sonarParityRules } from
 const CONTRIBUTIONS = [
     { law: "project-graph", rules: projectGraphRules, recommended: projectGraphRecommended },
     { law: "ambient-id", rules: ambientIdRules, recommended: ambientIdRecommended },
+    { law: "app-composition", rules: appCompositionRules, recommended: appCompositionRecommended },
     { law: "async-discipline", rules: asyncDisciplineRules, recommended: asyncDisciplineRecommended },
     { law: "authorization", rules: authorizationRules, recommended: authorizationRecommended },
     { law: "builders", rules: buildersRules, recommended: buildersRecommended },