@starci/eslint-canon-be 3.2.18 → 3.3.0

package/lib/app-roles.mjs

@@ -0,0 +1,48 @@
+/**
+ * The roles of the files of a back-end app (`apps/<app>/src/`, the `be.app.*` slots), read from the slot manifest: the name of a
+ * file is the `requires` or `allows` entry of its app slot that it matches, so no rule keeps a path list of its own.
+ *
+ *   - `main.ts`               the entry: builds the environment source once, parses options and boots the app.
+ *   - `app.module.ts`         the composition root: spreads the composition groups and binds the app-wide guards and filter.
+ *   - `<app>.env.ts`          the typed, fail-fast environment parsing only; no module composition or business code.
+ *   - `<app>.options.ts`      the options types and port bindings (provider maps); no environment reads.
+ *   - `compose/<area>.ts`     a composition group: the module list of one area of the app, spread by the root.
+ */
+import { normalizePath } from "./path.mjs"
+
+/** The composition root of an app. */
+const APP_ROOT_ROLE = "app.module.ts"
+/** The options of an app. */
+export const APP_OPTIONS_ROLE = "<app>.options.ts"
+/** The environment parsing of an app. */
+export const APP_ENV_ROLE = "<app>.env.ts"
+/** A composition group of an app. */
+const COMPOSE_GROUP_ROLE = "compose/<area>.ts"
+
+/**
+ * The app-slot entry a file matches (`main.ts`, `app.module.ts`, `<app>.env.ts`, `<app>.options.ts`, `compose/<area>.ts`, ...), or null for a
+ * file outside the `be.app.*` slots or one its slot does not name.
+ *
+ * @param {object} hfs - The HFS view of the repository.
+ * @param {string} filename - The linted file.
+ * @returns {{slot: string, entry: string} | null} The app slot and the entry the file matches.
+ */
+export const appRoleOf = (hfs, filename) => {
+    const file = normalizePath(filename)
+    const slot = hfs.slotOf(file) ?? ""
+    if (!slot.startsWith("be.app.") || typeof hfs.allows !== "function") return null
+    const verdict = hfs.allows(file)
+    return verdict?.allowed && verdict.entry ? { slot, entry: verdict.entry } : null
+}
+
+/**
+ * Whether a file composes the app: its root `app.module.ts` or a composition group `compose/<area>.ts`.
+ *
+ * @param {object} hfs - The HFS view of the repository.
+ * @param {string} filename - The linted file.
+ * @returns {boolean} True for a composition file of a back-end app.
+ */
+export const isAppComposition = (hfs, filename) => {
+    const role = appRoleOf(hfs, filename)?.entry
+    return role === APP_ROOT_ROLE || role === COMPOSE_GROUP_ROLE
+}

package/lib/webhook-ack.mjs

@@ -0,0 +1,87 @@
+/** A provider's only POST body is its own exported, immutable literal acknowledgement. */
+import ts from "typescript"
+import { aliasTarget } from "./doors.mjs"
+import { typed } from "./types.mjs"
+
+/** Static wrappers carry a type, never permission to compute the acknowledgement. */
+const unwrap = (node) => {
+    while (node && (ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isParenthesizedExpression(node))) node = node.expression
+    return node
+}
+
+/** A scalar literal includes JSON null and a signed numeric literal, but no identifier or template. */
+const scalarLiteral = (node) => {
+    if (!node) return false
+    if (ts.isStringLiteral(node) || ts.isNumericLiteral(node)) return true
+    if ([ts.SyntaxKind.TrueKeyword, ts.SyntaxKind.FalseKeyword, ts.SyntaxKind.NullKeyword].includes(node.kind)) return true
+    return ts.isPrefixUnaryExpression(node) && [ts.SyntaxKind.PlusToken, ts.SyntaxKind.MinusToken].includes(node.operator) && ts.isNumericLiteral(node.operand)
+}
+
+/** Literal data recursively excludes spreads, computed keys, methods, accessors and input references. */
+const literalData = (expression) => {
+    const node = unwrap(expression)
+    if (scalarLiteral(node)) return true
+    if (node && ts.isArrayLiteralExpression(node)) return node.elements.every(literalData)
+    if (!node || !ts.isObjectLiteralExpression(node)) return false
+    return node.properties.every((property) => ts.isPropertyAssignment(property)
+        && (ts.isIdentifier(property.name) || ts.isStringLiteral(property.name) || ts.isNumericLiteral(property.name))
+        && literalData(property.initializer))
+}
+
+/** The declaration has a const assertion anywhere in its static initializer wrappers. */
+const constAsserted = (expression) => {
+    let node = expression
+    while (node && (ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isParenthesizedExpression(node))) {
+        if (ts.isAsExpression(node) && ts.isTypeReferenceNode(node.type) && ts.isIdentifier(node.type.typeName) && node.type.typeName.text === "const") return true
+        node = node.expression
+    }
+    return false
+}
+
+/** A readonly literal annotation cannot widen the provider's fixed body to arbitrary data. */
+const builtinReadonly = (node, services) => {
+    if (!ts.isTypeReferenceNode(node) || !ts.isIdentifier(node.typeName) || node.typeName.text !== "Readonly" || node.typeArguments?.length !== 1) return false
+    const symbol = services.checker.getSymbolAtLocation(node.typeName)
+    return (symbol?.getDeclarations() ?? []).some((declaration) => services.program.isSourceFileDefaultLibrary(declaration.getSourceFile()))
+}
+
+/** Readonly's built-in mapped type is trusted; a locally shadowed alias is not. */
+const readonlyLiteralType = (node, services, readonly = false) => {
+    if (!node) return false
+    if (ts.isLiteralTypeNode(node)) return scalarLiteral(node.literal)
+    if (ts.isTypeOperatorNode(node) && node.operator === ts.SyntaxKind.ReadonlyKeyword) return readonlyLiteralType(node.type, services, true)
+    if (builtinReadonly(node, services)) return readonlyLiteralType(node.typeArguments[0], services, true)
+    if (ts.isTupleTypeNode(node)) return readonly && node.elements.every((entry) => readonlyLiteralType(entry, services))
+    if (!ts.isTypeLiteralNode(node) || node.members.length === 0) return false
+    return node.members.every((member) => ts.isPropertySignature(member) && !member.questionToken
+        && (readonly || member.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ReadonlyKeyword))
+        && readonlyLiteralType(member.type, services))
+}
+
+/** The actual symbol is exported by the source module, including a separate export declaration. */
+const exportedByModule = (checker, declaration, symbol) => {
+    const sourceSymbol = checker.getSymbolAtLocation(declaration.getSourceFile())
+    if (!sourceSymbol) return false
+    return checker.getExportsOfModule(sourceSymbol).some((entry) => {
+        const target = entry.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(entry) : entry
+        return entry.name === "PROVIDER_ACK" && target === symbol
+    })
+}
+
+/** A return names the declared PROVIDER_ACK itself, with identity and ownership resolved by TypeScript/HFS. */
+export const isProviderAcknowledgement = (context, hfs, expression) => {
+    if (expression?.type !== "Identifier") return false
+    const symbol = aliasTarget(context, expression)
+    if (!symbol || symbol.name !== "PROVIDER_ACK") return false
+    const services = typed(context)
+    const { checker } = services
+    const owner = hfs.ownerOf(context.filename)
+    return (symbol.getDeclarations() ?? []).some((declaration) => {
+        if (!ts.isVariableDeclaration(declaration) || !(declaration.parent.flags & ts.NodeFlags.Const)) return false
+        if (owner === null || hfs.ownerOf(declaration.getSourceFile().fileName) !== owner) return false
+        if (!exportedByModule(checker, declaration, symbol)) return false
+        const value = unwrap(declaration.initializer)
+        if (!value || !(ts.isObjectLiteralExpression(value) || ts.isStringLiteral(value)) || !literalData(value)) return false
+        return constAsserted(declaration.initializer) || readonlyLiteralType(declaration.type, services)
+    })
+}

package/lib/webhook-handoff.mjs

@@ -0,0 +1,138 @@
+/** Typed webhook handoff checks: the HTTP door records a delivery; only a later consumer dispatches commands. */
+import ts from "typescript"
+import { walk } from "./ast.mjs"
+import { injectedMembers } from "./doors.mjs"
+import { moduleReferences } from "./import-source.mjs"
+import { baseName } from "./ports.mjs"
+import { moduleOf, originsOfType, typed } from "./types.mjs"
+
+const CQRS = "@nestjs/cqrs"
+const BUSES = new Set(["CommandBus", "QueryBus"])
+
+/** A feature handler has a feature owner and the closed handler role, regardless of its imported alias. */
+const isFeatureHandler = (hfs, file) => hfs.tierOf(file) === "feature" && baseName(file).endsWith(".handler.ts")
+
+/** The bus's package and declared name, or the feature handler's declaring file, establish the forbidden origin. */
+const forbiddenOrigin = (hfs, origin, buses) =>
+    (origin.module === CQRS && buses.has(origin.name)) || isFeatureHandler(hfs, origin.file)
+
+/** Include unions, intersections and class inheritance, so an alias or a subclass cannot conceal the bus. */
+const hasForbiddenType = (checker, hfs, type, buses = BUSES, seen = new Set()) => {
+    if (!type || seen.has(type)) return false
+    seen.add(type)
+    if (originsOfType(checker, type).some((origin) => forbiddenOrigin(hfs, origin, buses))) return true
+    const parts = type.isUnionOrIntersection() ? type.types : []
+    const bases = type.isClassOrInterface() ? checker.getBaseTypes(type) ?? [] : []
+    return [...parts, ...bases].some((part) => hasForbiddenType(checker, hfs, part, buses, seen))
+}
+
+/** A bus or feature handler receiver is never a webhook's delegating call. */
+export const isWebhookForbiddenReceiver = (context, hfs, node) => {
+    const { checker, toTs } = typed(context)
+    const reference = toTs(node)
+    return reference ? hasForbiddenType(checker, hfs, checker.getTypeAtLocation(reference)) : false
+}
+
+/** Resolve an imported/exported alias once before inspecting the actual declaration. */
+const targetOf = (checker, symbol) => symbol?.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+
+/** A module export's origin, including a bus subclass or an alias of its type. */
+const forbiddenExport = (checker, hfs, original) => {
+    const symbol = targetOf(checker, original)
+    if (!symbol) return false
+    const declarations = symbol.getDeclarations() ?? []
+    if (declarations.some((declaration) => {
+        const file = declaration.getSourceFile().fileName.replace(/\\/g, "/")
+        return isFeatureHandler(hfs, file) || (moduleOf(declaration, file) === CQRS && BUSES.has(symbol.getName()))
+    })) return true
+    if (declarations.length === 0) return false
+    const type = checker.getTypeOfSymbolAtLocation(symbol, declarations[0])
+    if (hasForbiddenType(checker, hfs, type)) return true
+    return !!(symbol.flags & (ts.SymbolFlags.Class | ts.SymbolFlags.Interface | ts.SymbolFlags.TypeAlias))
+        && hasForbiddenType(checker, hfs, checker.getDeclaredTypeOfSymbol(symbol))
+}
+
+/** Inspect selected exports of the referenced module, so barrels and renamed imports keep their real owner. */
+const forbiddenModuleReference = (checker, toTs, hfs, reference) => {
+    const { source, value, names } = reference
+    if (value === CQRS && names.some((name) => BUSES.has(name) || name === "*" || name === "default")) return true
+    const sourceNode = toTs(source)
+    const module = sourceNode ? targetOf(checker, checker.getSymbolAtLocation(sourceNode)) : null
+    if (!module) return false
+    const exports = checker.getExportsOfModule(module)
+    const wholeModule = names.includes("*") || (names.includes("default") && !exports.some((symbol) => symbol.getName() === "default"))
+    return exports.some((symbol) => (wholeModule || names.includes(symbol.getName())) && forbiddenExport(checker, hfs, symbol))
+}
+
+/**
+ * Forbidden import sites in a door or its declaring HTTP module. Named, type-only, namespace, dynamic and re-exported
+ * imports all resolve to the actual export; an inline import type is judged by its resolved type.
+ */
+export const webhookForbiddenReferences = (context, hfs, program) => {
+    const { checker, toTs } = typed(context)
+    const nodes = new Set()
+    const visitors = moduleReferences((reference) => {
+        if (forbiddenModuleReference(checker, toTs, hfs, reference)) nodes.add(reference.node)
+    })
+    walk(program, (node) => {
+        visitors[node.type]?.(node)
+        if (node.type !== "TSImportType") return
+        const typeNode = toTs(node)
+        if (typeNode && hasForbiddenType(checker, hfs, checker.getTypeAtLocation(typeNode))) nodes.add(node)
+    })
+    // An ambiently supplied type still cannot be injected; an import finding already refuses the same dependency.
+    if (nodes.size === 0) walk(program, (node) => {
+        if (node.type !== "ClassDeclaration") return
+        for (const member of injectedMembers(context, node)) {
+            if (member.annotation && isWebhookForbiddenReceiver(context, hfs, member.annotation)) nodes.add(member.node)
+        }
+    })
+    return [...nodes]
+}
+
+/** The symbol of a called member, including a statically resolved bracket access. */
+const calledSymbol = (checker, expression) => {
+    if (ts.isPropertyAccessExpression(expression)) return targetOf(checker, checker.getSymbolAtLocation(expression.name))
+    if (ts.isElementAccessExpression(expression)) return targetOf(checker, checker.getSymbolAtLocation(expression.argumentExpression))
+    return targetOf(checker, checker.getSymbolAtLocation(expression))
+}
+
+/** Overload declarations point back to their implementation; arrow-valued service members also carry a body. */
+const bodyOf = (declaration) => {
+    if (declaration?.body) return declaration.body
+    const initializer = declaration?.initializer
+    return initializer && (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer)) ? initializer.body : null
+}
+
+/** Bodies the checker actually resolves at the intake call, never every other method of the service. */
+const calledBodies = (checker, call) => {
+    const signature = checker.getResolvedSignature(call)?.declaration
+    const declarations = calledSymbol(checker, call.expression)?.getDeclarations() ?? []
+    return [...new Set([signature, ...declarations].map(bodyOf).filter(Boolean))]
+}
+
+/** A method body dispatches on a CQRS bus or feature handler when the receiver's genuine declared type proves it. */
+const dispatchesCommand = (checker, hfs, body) => {
+    let found = false
+    const visit = (node) => {
+        if (found) return
+        if (ts.isCallExpression(node) && (ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression))) {
+            const type = checker.getTypeAtLocation(node.expression.expression)
+            if (hasForbiddenType(checker, hfs, type)) found = true
+        }
+        ts.forEachChild(node, visit)
+    }
+    visit(body)
+    return found
+}
+
+/**
+ * Inspect a resolved domain intake's own body, closures included. Dynamic receivers, erased types, external signatures and
+ * calls through further helpers remain semantic review: this check does not prove the full inbox/outbox transaction.
+ */
+export const webhookIntakeDispatchesCommand = (context, hfs, call) => {
+    const { checker, toTs } = typed(context)
+    const reference = toTs(call)
+    if (!reference || !ts.isCallExpression(reference)) return false
+    return calledBodies(checker, reference).some((body) => dispatchesCommand(checker, hfs, body))
+}

package/lib/webhook-verifiers.mjs

@@ -0,0 +1,147 @@
+/** Typed webhook proofs shared by the webhook and thin-feature laws. */
+import { dirname } from "node:path"
+import ts from "typescript"
+import { walk } from "./ast.mjs"
+import { baseName, isOwnedType } from "./ports.mjs"
+import { originsOfType, typeOrigins, typed } from "./types.mjs"
+
+/** The shared platform proof, identified by its declared owner. */
+export const isWebhookSignatureType = (context, node) => isOwnedType(context, node, { name: "WebhookSignatureService", capability: "http-security", tier: "platform" })
+
+/** A service declared by a domain owner, rather than a similarly named local or package type. */
+export const isWebhookDomainServiceType = (context, hfs, node) =>
+    typeOrigins(context, node).some((origin) => origin.module === null && hfs.tierOf(origin.file) === "domain" && baseName(origin.file).endsWith(".service.ts"))
+
+/** The method symbol named by a property access, resolving imported aliases. */
+const methodSymbol = (checker, expression) => {
+    if (!expression || !ts.isPropertyAccessExpression(expression)) return null
+    const symbol = checker.getSymbolAtLocation(expression.name)
+    return symbol && symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol ?? null
+}
+
+/** Unwrap static TypeScript annotations around a declaration's array literal. */
+const arrayOf = (expression) => {
+    while (expression && (ts.isAsExpression(expression) || ts.isSatisfiesExpression(expression) || ts.isParenthesizedExpression(expression))) expression = expression.expression
+    return expression && ts.isArrayLiteralExpression(expression) ? expression : null
+}
+
+/** All possible receiver types must be declared verifier classes; a type alias cannot rename a general service into one. */
+const isDomainVerifierType = (context, hfs, receiver) => {
+    const { checker, toTs } = typed(context)
+    const type = checker.getTypeAtLocation(toTs(receiver))
+    const parts = type.isUnion() ? type.types : [type]
+    return parts.every((part) => part.getSymbol()?.getDeclarations()?.some((declaration) => {
+        const file = declaration.getSourceFile().fileName.replace(/\\/g, "/")
+        return ts.isClassDeclaration(declaration) && declaration.name && /(?:Verifier|verify)$/.test(declaration.name.text)
+            && hfs.tierOf(file) === "domain" && baseName(file).endsWith(".service.ts")
+    }))
+}
+
+/**
+ * A provider's adjacent HTTP module may export webhookVerifiers as an array of
+ * domain methods, e.g. [BillingService.prototype.receiveCassoWebhook] as const.
+ * Compare symbols, so spelling an arbitrary receiver or alias as a verifier grants nothing.
+ */
+const declaresMethod = (checker, statement, method) => {
+    if (!ts.isVariableStatement(statement) || !(statement.declarationList.flags & ts.NodeFlags.Const)) return false
+    if (!statement.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword)) return false
+    return statement.declarationList.declarations.some((declaration) => ts.isIdentifier(declaration.name)
+        && declaration.name.text === "webhookVerifiers"
+        && arrayOf(declaration.initializer)?.elements.some((entry) => methodSymbol(checker, entry) === method))
+}
+
+/** The module declaration is adjacent to this exact provider door, not another feature's proof list. */
+const isProviderModule = (context, source) => {
+    const file = source.fileName.replace(/\\/g, "/")
+    const directory = dirname(context.filename).replace(/\\/g, "/")
+    const moduleName = `${baseName(context.filename).slice(0, -".webhook.ts".length)}-http.module.ts`
+    return dirname(file).replace(/\\/g, "/") === directory && baseName(file) === moduleName
+}
+
+/** A general domain service method is a verifier only when this provider's module declares its resolved symbol. */
+const isModuleDeclaredVerifier = (context, call) => {
+    const { program, checker, toTs } = typed(context)
+    const method = methodSymbol(checker, toTs(call.callee))
+    if (method === null) return false
+    return program.getSourceFiles().some((source) => isProviderModule(context, source)
+        && source.statements.some((statement) => declaresMethod(checker, statement, method)))
+}
+
+/** A direct, unconditional method call to the shared proof or a declared domain verifier. */
+const isWebhookVerificationCall = (context, hfs, call, domainOnly = false) => {
+    if (call?.type !== "CallExpression" || call.optional) return false
+    const callee = call.callee
+    if (callee.type !== "MemberExpression" || callee.computed || callee.optional || callee.property.type !== "Identifier") return false
+    const { checker, toTs } = typed(context)
+    const receiverType = checker.getTypeAtLocation(toTs(callee.object))
+    const parts = receiverType.isUnion() ? receiverType.types : [receiverType]
+    if (!domainOnly && callee.property.name === "verify" && parts.every((part) => originsOfType(checker, part).some((origin) => origin.module === null && origin.name === "WebhookSignatureService" && hfs.tierOf(origin.file) === "platform" && hfs.ownerOf(origin.file)?.split("/").at(-1) === "http-security"))) return true
+    if (!isWebhookDomainServiceType(context, hfs, callee.object)) return false
+    return isDomainVerifierType(context, hfs, callee.object) || isModuleDeclaredVerifier(context, call)
+}
+
+/** Expressions that can execute work or skip the proof before its call is entered. */
+const PRE_PROOF_WORK = new Set(["CallExpression", "NewExpression", "ImportExpression", "TaggedTemplateExpression", "AssignmentExpression", "UpdateExpression", "AwaitExpression", "YieldExpression", "ChainExpression", "ConditionalExpression", "LogicalExpression", "SequenceExpression"])
+
+/**
+ * The first statement must itself be the proof (awaited if it returns a thenable).
+ * Its receiver and arguments may pass delivery data, but cannot run another call first.
+ */
+const completedVerification = (context, hfs, expression, domainOnly = false) => {
+    let call = expression
+    const awaited = call?.type === "AwaitExpression"
+    if (awaited) call = call.argument
+    if (!isWebhookVerificationCall(context, hfs, call, domainOnly)) return null
+    let work = false
+    walk(call, (child) => {
+        if (child !== call && (PRE_PROOF_WORK.has(child.type) || (child.type === "UnaryExpression" && child.operator === "delete"))) work = true
+    })
+    if (work) return null
+    const { checker, toTs } = typed(context)
+    const signature = checker.getResolvedSignature(toTs(call))
+    if (!signature) return null
+    const returned = checker.getReturnTypeOfSignature(signature)
+    const parts = returned.isUnion() ? returned.types : [returned]
+    if (!awaited && parts.some((part) => checker.getApparentType(part).getProperty("then"))) return null
+    return call
+}
+
+/** POST's first statement remains the proof itself, before the intake or acknowledgement. */
+export const firstWebhookVerification = (context, hfs, method) => {
+    const first = method.value.body?.body[0]
+    return completedVerification(context, hfs, first?.type === "ExpressionStatement" ? first.expression : null)
+}
+
+/** A challenge verifier must produce an echo value, rather than a void proof. */
+const hasChallengeResult = (context, call) => {
+    const { checker, toTs } = typed(context)
+    const signature = checker.getResolvedSignature(toTs(call))
+    const returned = signature && checker.getReturnTypeOfSignature(signature)
+    const value = returned && (checker.getAwaitedType(returned) ?? returned)
+    const parts = value?.isUnion() ? value.types : [value]
+    return parts.every((part) => part && !(part.flags & (ts.TypeFlags.Void | ts.TypeFlags.Undefined | ts.TypeFlags.Never)))
+}
+
+/** The optional GET proves once, binding its result with const or returning the verifier call directly. */
+export const firstWebhookChallenge = (context, hfs, method) => {
+    const statements = method.value.body?.body ?? []
+    const first = statements[0]
+    if (first?.type === "ReturnStatement") {
+        const call = completedVerification(context, hfs, first.argument, true)
+        return call && hasChallengeResult(context, call) ? { call, result: null, echo: first, statements } : null
+    }
+    if (first?.type !== "VariableDeclaration" || first.kind !== "const" || first.declarations.length !== 1) return null
+    const binding = first.declarations[0]
+    if (binding.id.type !== "Identifier") return null
+    const call = completedVerification(context, hfs, binding.init, true)
+    return call && hasChallengeResult(context, call) ? { call, result: binding.id, echo: statements[1], statements } : null
+}
+
+/** The GET echoes only the original proof's value, with no intervening work or transformation. */
+export const isWebhookChallengeReturn = (context, node, challenge) => {
+    if (!challenge || node !== challenge.echo || node.type !== "ReturnStatement") return false
+    if (challenge.result === null) return challenge.statements.length === 1
+    if (challenge.statements.length !== 2 || node.argument?.type !== "Identifier") return false
+    const { checker, toTs } = typed(context)
+    return checker.getSymbolAtLocation(toTs(node.argument)) === checker.getSymbolAtLocation(toTs(challenge.result))
+}

package/module-layering.mjs

@@ -67,9 +67,9 @@ const onSpecifiers = (check) => ({
   },
 })
 
-/** The public-surface width: the `budget.indexExports` of the slot that owns the file, else of the first back-end owner slot that states one. */
+/** The public-surface width: the file's slot budget, else its tier's owner-slot budget, else a back-end owner default. */
 const indexExportBudget = (hfs, filename) =>
-  [hfs.slotOf(filename), "be.domain", "be.feature"].map((id) => (id ? hfs.slot(id)?.budget?.indexExports : undefined)).find(Number.isInteger)
+  [hfs.slotOf(filename), `be.${hfs.tierOf(filename)}`, "be.domain", "be.feature"].map((id) => (id ? hfs.slot(id)?.budget?.indexExports : undefined)).find(Number.isInteger)
 
 // -- R30: import-owner-entry -----------------------------------------------------------------------
 

package/module-shape.mjs

@@ -6,7 +6,7 @@
  *
  *   - `no-global-decorator` refuses `@Global()` anywhere, specs included.
  *   - `is-global-only-in-app` refuses `isGlobal: true` (and a dynamic module literal `global: true`) outside
- *     `apps/<app>/src/app.module.ts`.
+ *     `apps/<app>/src/app.module.ts` and the composition groups `apps/<app>/src/compose/<area>.ts` it spreads.
  *   - `no-cross-owner-module-import` refuses a `@Module({ imports })` entry whose module class is declared by another
  *     owner of the repository (the declaring owner is found by resolving the class, not by reading its name): a
  *     capability's representative module is reached through its `Inject*()` decorators, never by import. One owner may
@@ -28,6 +28,7 @@
 import ts from "typescript"
 import { decoratorName, keyName, walk } from "./lib/ast.mjs"
 import { importsFrom } from "./lib/declared.mjs"
+import { isAppComposition } from "./lib/app-roles.mjs"
 import { hfsOf, inTestWorld } from "./lib/hfs.mjs"
 import { isDeclarationFile, isSpecFile, normalizePath } from "./lib/path.mjs"
 import { typed } from "./lib/types.mjs"
@@ -61,8 +62,8 @@ export const noGlobalDecorator = {
     },
 }
 
-/** The app composition file: `apps/<app>/src/app.module.ts`, judged by the app slot and the file's role name. */
-const isAppModule = (hfs, filename) => (hfs.slotOf(filename) ?? "").startsWith("be.app.") && filename.split("/").at(-1) === "app.module.ts"
+/** The app composition files: `apps/<app>/src/app.module.ts` and its groups `compose/<area>.ts`, judged by the app slot's entries. */
+const isAppModule = isAppComposition
 
 /**
  * The test world (slot `be.tests.world`, `src/tests/world`) is the TEST COMPOSITION ROOT: `use-test-world.ts` assembles
@@ -77,10 +78,10 @@ const isTrue = (node) => node?.type === "Literal" && node.value === true
 export const isGlobalOnlyInApp = {
     meta: {
         type: "problem",
-        docs: { description: "`isGlobal: true` appears only in `apps/<app>/src/app.module.ts`." },
+        docs: { description: "`isGlobal: true` appears only in `apps/<app>/src/app.module.ts` and its composition groups `compose/<area>.ts`." },
         schema: [],
         messages: {
-            isGlobal: "`{{key}}: true` outside `apps/<app>/src/app.module.ts` makes a module global from the wrong place. Only the app registers a capability, once, with `isGlobal: true`; here keep the module's own default.",
+            isGlobal: "`{{key}}: true` outside `apps/<app>/src/app.module.ts` and its `compose/<area>.ts` groups makes a module global from the wrong place. Only the app registers a capability, once, with `isGlobal: true`; here keep the module's own default.",
         },
     },
     create(context) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-be",
-  "version": "3.2.18",
+  "version": "3.3.0",
   "description": "The StarCi back-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.2.18
+    version: 3.3.0
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.2.17
+    version: 8.3.0
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.2.16
+    version: 1.3.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.2.16
+    version: 4.3.0
     group: starci
     install: registry
     side: both