@starci/eslint-canon-be 3.2.19 → 3.3.0

package/runtime/scripts/hfs/architecture/backend.mjs

@@ -1,7 +1,8 @@
 import path from 'node:path';
 import { isInside } from './config.mjs';
-import { slotAdmitsFile } from '../allows.mjs';
+import { allowsFile, slotAdmitsFile } from '../allows.mjs';
 import { reachableViolation, relativePath } from './typescript.mjs';
+import { checkApplicationEnvironment } from './backend-app-files.mjs';
 import { sourceLocation } from '../../lib/ts-ast.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 
@@ -376,11 +377,23 @@ function checkApplicationComposition(config, ts, sourceFile, fileName, app, viol
       path: relativePath(config.root, fileName),
       line: 1,
       column: 1,
-      message: `Application source ${app.relative} is not a file its app slot requires or allows (main.ts, app.module.ts, <app>.options.ts).`,
+      message: `Application source ${app.relative} is not a file its app slot requires or allows (main.ts, app.module.ts, <app>.env.ts, <app>.options.ts, compose/<area>.ts).`,
     });
   }
 }
 
+/** The app's environment parser never depends on features, even through a type import or an internal barrel. */
+function checkApplicationEnvEdges(config, context, fileName, violations) {
+  const role = allowsFile(config.hfs, relativePath(config.root, fileName));
+  if (!role?.allowed || role.entry !== '<app>.env.ts') return;
+  const isFeature = target => config.hfs.tierOf(relativePath(config.root, target)) === 'feature';
+  for (const edge of context.edges.get(fileName) ?? []) {
+    const featureChain = reachableViolation(context.edges, edge, isFeature);
+    if (featureChain) violations.push(finding(config, edge, 'BE_APP_COMPOSITION_ONLY',
+      'The app environment file holds typed, fail-fast environment parsing only; it cannot depend on features, including through a type import or an internal barrel.', featureChain));
+  }
+}
+
 function checkApplicationTransport(config, context, sourceFile, fileName, violations) {
   for (const evidence of transportFrameworkEvidence(context.ts, sourceFile, context.checkerFor(fileName))) {
     violations.push({
@@ -409,7 +422,11 @@ function checkBackendSource(config, context, sourceFiles, roots, sourceFile, vio
   const fromFeatures = insideAny(featureRoots, fileName);
   const fromApplication = fromFeatures && insideFeatureLayer(featureRoots, fileName, 'application');
   const app = !fromModules && !fromFeatures ? appSource(config, fileName, nonAppRoots) : null;
-  if (app) checkApplicationComposition(config, context.ts, sourceFile, fileName, app, violations);
+  if (app) {
+    checkApplicationComposition(config, context.ts, sourceFile, fileName, app, violations);
+    checkApplicationEnvEdges(config, context, fileName, violations);
+    checkApplicationEnvironment(config, context, sourceFile, fileName, violations);
+  }
   if (!fromModules && !fromFeatures) return;
   if (fromApplication) checkApplicationTransport(config, context, sourceFile, fileName, violations);
   if (fromApplication) checkFeatureTransportEdges(config, context, sourceFiles, featureRoots, fileName, violations);

package/runtime/scripts/hfs/architecture/background-unowned.mjs

@@ -5,30 +5,45 @@ import { machineKit } from './machine-ast.mjs';
  * R46 `background-unowned` (BE_BACKGROUND_UNOWNED, BE-CONVENTION 1.6 and 1.13). Background work is a transport that only
  * a worker or api app runs (an api app composes the message transport of its own service; a separate worker is opt-in):
  *
- *   - every job processor (`*.processor.ts`, the jobs kind) and consumer (`*.consumer.ts`) is composed by an app of kind `worker` or
- *     `api`: the file is reachable, through runtime imports, from the root module of some such app declared in hfs.json; one no app
- *     reaches never runs. A schedule is a BullMQ job scheduler of a queue, so no scheduler decorator or timer is judged here: `@nestjs/schedule`
- *     and the timers are owned by platform capabilities (R90 BE_INFRA_OWNER);
- *   - a method whose name is one of the words the law names (`sweep`, `deliver`, `reconcile`, `retry`, alone or as the
- *     first word of a camelCase name) in a domain, integrations or feature class is reachable from a composed processor or
- *     consumer: from the processor or consumer files and everything they import, and from the files of the feature that holds them
- *     (its handlers are registered with the command bus, not imported by the processor). Mechanisms of platform are exempt.
+ *   - a processor, consumer, scheduler, saga or event handler is composed by an app of kind `worker` or `api`: its file is
+ *     reachable, through runtime imports, from an app root declared in hfs.json. Context comes from its file role or framework
+ *     decorators, never a method name. Infrastructure restrictions on scheduler libraries remain R90 BE_INFRA_OWNER's concern;
+ *   - methods in those contexts, and methods they call transitively, are reachable from a composed background entry point:
+ *     its imports and the files of its own feature (command handlers are registered with the bus). Platform mechanisms are
+ *     exempt. Resolvers and controllers are user entry points and never background, even when called by a background method.
  *
- * Reachability is static (imports, re-exports and the feature of the processor); it proves a processor or consumer could call the method,
- * not that it does.
+ * Classification follows statically resolved calls; ownership follows runtime imports, re-exports and the entry point's feature.
  */
 export const BACKGROUND_UNOWNED_RULE_IDS = ['BE_BACKGROUND_UNOWNED'];
 
 const RULE = 'BE_BACKGROUND_UNOWNED';
-const BACKGROUND_ROLES = new Set(['processor', 'consumer']);
-/** The words the law names for background methods (knowledge/hfs/README.md 5.7). */
-const BACKGROUND_WORDS = ['sweep', 'deliver', 'reconcile', 'retry'];
+const BACKGROUND_ROLES = new Set(['processor', 'consumer', 'scheduler', 'saga', 'event-handler']);
+const USER_ROLES = new Set(['resolver', 'controller']);
+const CLASS_DECORATORS = new Map([
+  ['@nestjs/bull:Processor', 'processor'], ['@nestjs/bullmq:Processor', 'processor'],
+  ['@nestjs/cqrs:EventsHandler', 'event-handler'],
+]);
+const METHOD_DECORATORS = new Map([
+  ['@nestjs/cqrs:Saga', 'saga'], ['@nestjs/event-emitter:OnEvent', 'event-handler'],
+  ...['Cron', 'Interval', 'Timeout'].map(name => [`@nestjs/schedule:${name}`, 'scheduler']),
+]);
+const USER_DECORATORS = new Map([['@nestjs/graphql:Resolver', 'resolver'], ['@nestjs/common:Controller', 'controller']]);
 
 const roleOf = rel => {
   const parts = path.posix.basename(rel).split('.');
-  return parts.length >= 3 && parts.at(-1) === 'ts' && BACKGROUND_ROLES.has(parts.at(-2)) ? parts.at(-2) : null;
+  return parts.length >= 3 && parts.at(-1) === 'ts' ? parts.at(-2) : null;
+};
+
+const decoratedRole = (kit, checker, node, roles) => {
+  for (const decorator of kit.decorators(node)) {
+    const expression = decorator.expression;
+    const callee = kit.ts.isCallExpression(expression) ? expression.expression : expression;
+    const binding = kit.importBinding(checker, callee);
+    const role = binding ? roles.get(`${binding.module}:${binding.name}`) : null;
+    if (role) return role;
+  }
+  return null;
 };
-const isBackgroundName = name => BACKGROUND_WORDS.some(word => name === word || (name.startsWith(word) && /[A-Z]/u.test(name[word.length] ?? '')));
 
 const adjacencyOf = edges => {
   const adjacency = new Map();
@@ -60,19 +75,16 @@ const appRootsOf = (apps, graph) => {
   return { workers, composed: [...workers, ...services] };
 };
 
-const backgroundFilesOf = graph => [...graph.files.values()].filter(file => roleOf(file.rel) && file.tier === 'feature');
-
 const reportUncomposedFiles = (background, composed, workerRoots, report) => {
-  for (const file of background) {
-    if (composed.has(file.rel)) continue;
-    const role = roleOf(file.rel);
-    report(file, file.sourceFile, `${file.rel} is a ${role} that no service app composes${workerRoots.length ? '' : ' (hfs.json declares no worker app)'}; a ${role} runs only when the ${role === 'processor' ? 'job' : 'message'} module of its feature is imported by the root module of an app of kind worker or api.`, { role });
+  for (const { file, role } of background) {
+    if (file.tier === 'platform' || composed.has(file.rel)) continue;
+    report(file, file.sourceFile, `${file.rel} is a ${role} that no service app composes${workerRoots.length ? '' : ' (hfs.json declares no worker app)'}; its module must be imported by the root module of an app of kind worker or api.`, { role });
   }
 };
 
 const rootsOfRunningFeatures = (running, files) => {
   const roots = new Set();
-  for (const file of running) {
+  for (const { file } of running) {
     roots.add(file.rel);
     const owner = file.owner?.root;
     if (owner) for (const other of files.values()) if (other.owner?.root === owner) roots.add(other.rel);
@@ -80,22 +92,125 @@ const rootsOfRunningFeatures = (running, files) => {
   return roots;
 };
 
-const backgroundMethodsOf = (node, kit, ts) => node.members.flatMap(member => {
-  if (!ts.isMethodDeclaration(member) || !member.name) return [];
-  const name = kit.propertyNameText(member.name);
-  return name && isBackgroundName(name) ? [{ name, node: member.name }] : [];
-});
+const callableKey = (kit, node) => `${kit.graphPath(node)}:${node.getStart()}`;
+const callableBody = (ts, declaration) => {
+  const node = declaration.initializer ?? declaration;
+  return ts.isFunctionLike(node) && node.body ? node : null;
+};
+const methodMember = (ts, node) => {
+  if (ts.isMethodDeclaration(node)) return node;
+  return ts.isPropertyDeclaration(node.parent) && node.parent.initializer === node ? node.parent : null;
+};
 
-const checkBackgroundMethods = ({ graph, kit, ts, reachable, report }) => {
-  let methods = 0;
-  const reportMethod = (file, method) => {
-    methods += 1;
-    if (!reachable.has(file.rel)) report(file, method.node, `${method.name} is background work (a ${BACKGROUND_WORDS.join(', ')} method) that no processor or consumer composed by a worker or api app can reach. Add a processor in features/jobs/<job> or a consumer in transport/message of a feature that runs it, and compose its module in a worker or api app.`, { method: method.name });
-  };
+const isUserClass = (kit, checker, node) => USER_ROLES.has(roleOf(kit.graphPath(node) ?? ''))
+  || Boolean(decoratedRole(kit, checker, node, USER_DECORATORS));
+
+const seedClass = (scope, file, checker, node, role) => {
+  scope.background.set(file.rel, { file, role });
+  scope.contextFiles.add(file.rel);
+  for (const symbol of checker.getTypeAtLocation(node).getProperties()) {
+    for (const declaration of symbol.declarations ?? []) {
+      const body = callableBody(scope.kit.ts, declaration);
+      if (body) scope.inherited.push(body);
+    }
+  }
+};
+
+const classContext = (scope, file, checker, node, state) => {
+  const user = state.user || isUserClass(scope.kit, checker, node);
+  if (!state.nested && user) scope.userFiles.add(file.rel);
+  let classRole = null;
+  if (!state.nested && !user) {
+    const fileRole = BACKGROUND_ROLES.has(state.fileRole) ? state.fileRole : null;
+    classRole = decoratedRole(scope.kit, checker, node, CLASS_DECORATORS) ?? fileRole;
+  }
+  if (classRole) seedClass(scope, file, checker, node, classRole);
+  return { ...state, user, classRole };
+};
+
+const recordCallable = (scope, file, checker, node, state) => {
+  const { kit } = scope;
+  const member = methodMember(kit.ts, node);
+  const canSeed = member && !state.user && !state.nested;
+  const role = canSeed ? decoratedRole(kit, checker, member, METHOD_DECORATORS) ?? state.classRole : null;
+  const entry = { file, node, checker, user: state.user, member, name: member ? kit.propertyNameText(member.name) : null };
+  scope.callables.set(callableKey(kit, node), entry);
+  if (role) {
+    scope.background.set(file.rel, { file, role });
+    scope.contextFiles.add(file.rel);
+    scope.seeds.push(entry);
+  }
+};
+
+const indexCallables = (scope, file, checker, node, state) => {
+  const { ts } = scope.kit;
+  if (ts.isClassDeclaration(node) || ts.isClassExpression(node)) state = classContext(scope, file, checker, node, state);
+  const callable = ts.isFunctionLike(node);
+  if (callable && node.body) recordCallable(scope, file, checker, node, state);
+  const childState = { ...state, nested: state.nested || callable };
+  ts.forEachChild(node, child => indexCallables(scope, file, checker, child, childState));
+};
+
+/** Index callable bodies once; a resolver/controller is a barrier to background propagation. */
+const backgroundContextOf = (graph, kit) => {
+  const callables = new Map();
+  const background = new Map();
+  const seeds = [];
+  const inherited = [];
+  const scope = { kit, callables, background, seeds, inherited, userFiles: new Set(), contextFiles: new Set() };
   for (const file of graph.files.values()) {
-    if (file.tier === 'platform') continue;
-    kit.walk(file.sourceFile, node => {
-      if (ts.isClassDeclaration(node)) for (const method of backgroundMethodsOf(node, kit, ts)) reportMethod(file, method);
+    const checker = kit.checkerOf(file.sourceFile);
+    const fileRole = roleOf(file.rel);
+    if (BACKGROUND_ROLES.has(fileRole)) background.set(file.rel, { file, role: fileRole });
+    indexCallables(scope, file, checker, file.sourceFile, { fileRole, classRole: null, user: USER_ROLES.has(fileRole), nested: false });
+  }
+  // Request context overrides a file suffix; mixed files can still hold a separate background class.
+  for (const rel of scope.userFiles) if (!scope.contextFiles.has(rel)) background.delete(rel);
+  for (const body of inherited) {
+    const entry = callables.get(callableKey(kit, body));
+    if (entry) seeds.push(entry);
+  }
+  return { callables, background: [...background.values()], seeds };
+};
+
+const calledBodies = (kit, checker, call) => {
+  const { ts } = kit;
+  const expression = call.expression;
+  if (ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression)) {
+    const receiver = checker.getNonNullableType(checker.getTypeAtLocation(expression.expression));
+    if (receiver.getSymbol()?.declarations?.some(declaration => isUserClass(kit, checker, declaration))) return [];
+  }
+  const target = ts.isPropertyAccessExpression(expression) ? expression.name : expression;
+  const declarations = [...kit.declarationsOf(checker, target)];
+  const signature = checker.getResolvedSignature(call)?.declaration;
+  if (signature) declarations.push(signature);
+  return declarations.map(declaration => callableBody(ts, declaration)).filter(Boolean);
+};
+
+const checkBackgroundMethods = ({ kit, context, reachable, report }) => {
+  const { callables, seeds } = context;
+  const seen = new Set();
+  const queue = [...seeds];
+  let methods = 0;
+  while (queue.length) {
+    const entry = queue.pop();
+    const { file, node, checker, user, member, name } = entry;
+    const key = callableKey(kit, node);
+    if (user || seen.has(key)) continue;
+    seen.add(key);
+    if (name && file.tier !== 'platform') {
+      methods += 1;
+      if (!reachable.has(file.rel)) report(file, member.name, `${name} is background work that no background entry point composed by a worker or api app can reach. Compose the processor, consumer, scheduler, saga or event handler that runs it in a worker or api app.`, { method: name });
+    }
+    kit.walk(node.body, inner => {
+      // Nested bodies run only through a resolved call or when passed as a callback.
+      if (kit.ts.isFunctionLike(inner) || kit.ts.isClassDeclaration(inner) || kit.ts.isClassExpression(inner)) return false;
+      if (!kit.ts.isCallExpression(inner)) return;
+      const callbacks = inner.arguments.filter(argument => kit.ts.isArrowFunction(argument) || kit.ts.isFunctionExpression(argument));
+      for (const body of [...calledBodies(kit, checker, inner), ...callbacks]) {
+        const called = callables.get(callableKey(kit, body));
+        if (called) queue.push(called);
+      }
     });
   }
   return methods;
@@ -104,7 +219,7 @@ const checkBackgroundMethods = ({ graph, kit, ts, reachable, report }) => {
 export function checkBackgroundUnowned(input) {
   const { graph } = input;
   const kit = machineKit(input);
-  const { ts, resolver } = kit;
+  const { resolver } = kit;
   const violations = [];
   const report = (file, node, message, extra = {}) => violations.push({ ruleId: RULE, path: file.rel, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
 
@@ -112,13 +227,14 @@ export function checkBackgroundUnowned(input) {
   const closure = starts => closureOf(adjacency, starts);
   const { workers: workerRoots, composed: appRoots } = appRootsOf(resolver.repo.apps, graph);
   const composed = closure(appRoots);
-  const background = backgroundFilesOf(graph);
-  const running = background.filter(file => composed.has(file.rel));
+  const context = backgroundContextOf(graph, kit);
+  const { background } = context;
+  const running = background.filter(({ file }) => composed.has(file.rel));
   reportUncomposedFiles(background, composed, workerRoots, report);
 
-  // Everything a composed processor or consumer can reach: its imports, and the files of its own feature (command handlers).
+  // Everything a composed background entry point can reach: its imports and its own feature's command handlers.
   const roots = rootsOfRunningFeatures(running, graph.files);
   const reachable = closure([...roots]);
-  const methods = checkBackgroundMethods({ graph, kit, ts, reachable, report });
+  const methods = checkBackgroundMethods({ kit, context, reachable, report });
   return { violations, coverage: { status: 'checked', workers: workerRoots.length, jobsAndConsumers: background.length, composed: running.length, backgroundMethods: methods } };
 }

package/runtime/scripts/hfs/architecture/canon-clones.mjs

@@ -0,0 +1,240 @@
+/**
+ * The repeated shapes taught by the BE scaffold are wiring, not copied decisions. Match their imported
+ * ports and their small bodies, never a filename suffix or an entire decorated class: a custom method
+ * or an extra statement still goes through the clone check.
+ */
+import { nameText } from '../../lib/ts-ast.mjs';
+import { importsOf, unwrapExpression } from '../../lib/ts-analysis.mjs';
+import { nodeDecorators } from './ast-walks.mjs';
+import { canonJsxCloneNodes } from './canon-jsx-clones.mjs';
+
+const READ_METHODS = new Set(['find', 'findBy', 'findAndCount', 'findOne', 'findOneBy', 'findOneOrFail', 'findOneByOrFail']);
+
+const unwrap = (ts, node) => unwrapExpression(ts, node, { awaitExpressions: true, typeAssertions: false });
+
+const imported = (env, node, name, source) => {
+  if (!node || !env.ts.isIdentifier(node)) return false;
+  const binding = env.imports.get(node.text);
+  return binding?.name === name && binding.source === source;
+};
+
+const decoratorsHave = (env, node, name, source) => nodeDecorators(env.ts, node)
+  .some(decorator => imported(env, env.ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression, name, source));
+
+const portType = (env, node, name, source) => Boolean(node && env.ts.isTypeReferenceNode(node) && imported(env, node.typeName, name, source));
+
+/** Data moves between shapes here; operators, arbitrary calls and executable callbacks remain compared. */
+function mapping(env, input, allowCall = () => false) {
+  const { ts } = env;
+  const node = unwrap(ts, input);
+  if (!node) return false;
+  if (ts.isIdentifier(node) || ts.isLiteralExpression(node) || [ts.SyntaxKind.NullKeyword, ts.SyntaxKind.TrueKeyword, ts.SyntaxKind.FalseKeyword, ts.SyntaxKind.ThisKeyword].includes(node.kind)) return true;
+  if (ts.isPropertyAccessExpression(node)) return mapping(env, node.expression, allowCall);
+  if (ts.isObjectLiteralExpression(node)) return node.properties.every(property => {
+    if (ts.isShorthandPropertyAssignment(property)) return !property.objectAssignmentInitializer;
+    if (ts.isSpreadAssignment(property)) return mapping(env, property.expression, allowCall);
+    return ts.isPropertyAssignment(property) && nameText(ts, property.name) !== null && mapping(env, property.initializer, allowCall);
+  });
+  if (ts.isArrayLiteralExpression(node)) return node.elements.every(item => mapping(env, ts.isSpreadElement(item) ? item.expression : item, allowCall));
+  return ts.isCallExpression(node) && allowCall(node);
+}
+
+const parameterNames = (ts, method) => new Set(method.parameters.filter(parameter => ts.isIdentifier(parameter.name)).map(parameter => parameter.name.text));
+const propertyParameters = (ts, constructor) => new Set((constructor?.parameters ?? []).filter(parameter => parameter.modifiers?.length && ts.isIdentifier(parameter.name)).map(parameter => parameter.name.text));
+const inertParameters = (ts, constructor) => constructor.parameters.every(parameter => ts.isIdentifier(parameter.name) && !parameter.initializer);
+
+function receiverMember(ts, call) {
+  if (!ts.isCallExpression(call) || !ts.isPropertyAccessExpression(call.expression)) return null;
+  const receiver = call.expression.expression;
+  return ts.isPropertyAccessExpression(receiver) && receiver.expression.kind === ts.SyntaxKind.ThisKeyword ? receiver.name.text : null;
+}
+
+const statementCall = (ts, statement) => (ts.isReturnStatement(statement) || ts.isExpressionStatement(statement)) ? unwrap(ts, statement.expression) : null;
+
+function delegation(env, method, statement, members, allowCall = () => false) {
+  const call = statementCall(env.ts, statement);
+  return Boolean(call && env.ts.isCallExpression(call) && members.has(receiverMember(env.ts, call))
+    && call.arguments.every(argument => mapping(env, argument, allowCall)));
+}
+
+function canonicalConstructor(env, constructor, logger = false) {
+  if (!constructor?.body || !inertParameters(env.ts, constructor)) return false;
+  if (!logger) return constructor.body.statements.length === 0;
+  const parameters = constructor.parameters.filter(parameter => decoratorsHave(env, parameter, 'InjectLogger', '@modules/platform/logging'));
+  if (parameters.length !== 1 || constructor.body.statements.length !== 1) return false;
+  const call = statementCall(env.ts, constructor.body.statements[0]);
+  return Boolean(call && env.ts.isCallExpression(call) && call.expression.kind === env.ts.SyntaxKind.SuperKeyword
+    && call.arguments.length === 1 && env.ts.isIdentifier(call.arguments[0]) && call.arguments[0].text === parameters[0].name.text);
+}
+
+function hasHeritage(env, declaration, name, source, kind) {
+  return declaration.heritageClauses?.some(clause => clause.token === kind && clause.types.some(type => imported(env, type.expression, name, source))) ?? false;
+}
+
+function fenceStatement(env, statement, claims, job) {
+  const call = statementCall(env.ts, statement);
+  if (!call || !env.ts.isCallExpression(call) || receiverMember(env.ts, call) !== claims || call.expression.name.text !== 'advance' || call.arguments.length !== 1) return false;
+  const options = unwrap(env.ts, call.arguments[0]);
+  if (!env.ts.isObjectLiteralExpression(options) || options.properties.length !== 3) return false;
+  const properties = new Map(options.properties.filter(env.ts.isPropertyAssignment).map(property => [nameText(env.ts, property.name), property.initializer]));
+  const jobField = (node, field) => env.ts.isPropertyAccessExpression(node) && env.ts.isIdentifier(node.expression) && node.expression.text === job && node.name.text === field;
+  return jobField(properties.get('jobId') ?? {}, 'jobId') && jobField(properties.get('expectedFencingToken') ?? {}, 'fencingToken')
+    && mapping(env, properties.get('step'));
+}
+
+function jobMethods(env, declaration, constructor, excluded) {
+  const claims = constructor?.parameters.find(parameter => portType(env, parameter.type, 'JobClaims', '@modules/platform/jobs')
+    && decoratorsHave(env, parameter, 'InjectJobClaims', '@modules/platform/jobs'));
+  if (!claims || !env.ts.isIdentifier(claims.name)) return;
+  const members = propertyParameters(env.ts, constructor);
+  const runKey = call => receiverMember(env.ts, call) === claims.name.text && call.expression.name.text === 'runKey'
+    && call.arguments.length === 2 && call.arguments.every(argument => mapping(env, argument));
+  for (const method of declaration.members) {
+    if (!env.ts.isMethodDeclaration(method) || nameText(env.ts, method.name) !== 'run' || !method.body || method.parameters.length !== 1
+      || !portType(env, method.parameters[0].type, 'ClaimedJob', '@modules/platform/jobs')) continue;
+    const statements = method.body.statements;
+    const job = [...parameterNames(env.ts, method)][0];
+    if (!statements.length || !fenceStatement(env, statements[0], claims.name.text, job)) continue;
+    if (statements.length === 1 || (statements.length === 2 && delegation(env, method, statements[1], members, runKey))) excluded.add(method);
+    else excluded.add(statements[0]);
+  }
+  if (canonicalConstructor(env, constructor)) excluded.add(constructor);
+}
+
+function queueMethods(env, declaration, constructor, excluded) {
+  const outbox = constructor?.parameters.find(parameter => portType(env, parameter.type, 'QueueOutbox', '@modules/platform/queue')
+    && decoratorsHave(env, parameter, 'InjectQueueOutbox', '@modules/platform/queue'));
+  if (!outbox || !env.ts.isIdentifier(outbox.name)) return;
+  for (const method of declaration.members) {
+    if (!env.ts.isMethodDeclaration(method) || !method.body || method.body.statements.length !== 1) continue;
+    const call = statementCall(env.ts, method.body.statements[0]);
+    if (call && env.ts.isCallExpression(call) && receiverMember(env.ts, call) === outbox.name.text && call.expression.name.text === 'write'
+      && call.arguments.length === 3 && call.arguments.every(argument => mapping(env, argument))) excluded.add(method);
+  }
+  if (canonicalConstructor(env, constructor)) excluded.add(constructor);
+}
+
+function rowMapper(env, call, row) {
+  const { ts } = env;
+  if (!call) return false;
+  if (ts.isObjectLiteralExpression(unwrap(ts, call))) return mapping(env, call, iso => ts.isPropertyAccessExpression(iso.expression)
+    && iso.expression.name.text === 'toISOString' && iso.arguments.length === 0 && mapping(env, iso.expression.expression));
+  if (!ts.isCallExpression(call) || call.arguments.length !== 1 || !ts.isIdentifier(call.arguments[0]) || call.arguments[0].text !== row || !ts.isIdentifier(call.expression)) return false;
+  const binding = env.imports.get(call.expression.text);
+  return Boolean(binding && /\.rows(?:\.[cm]?ts)?$/.test(binding.source)) || env.mappers.has(call.expression.text);
+}
+
+function readResult(env, expression, row) {
+  const { ts } = env;
+  const node = unwrap(ts, expression);
+  if (!node) return false;
+  if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && node.expression.name.text === 'map'
+    && ts.isIdentifier(node.expression.expression) && node.expression.expression.text === row && node.arguments.length === 1) {
+    const mapper = unwrap(ts, node.arguments[0]);
+    if (ts.isIdentifier(mapper)) return env.mappers.has(mapper.text) || /\.rows(?:\.[cm]?ts)?$/.test(env.imports.get(mapper.text)?.source ?? '');
+    return ts.isArrowFunction(mapper) && mapper.parameters.length === 1 && !ts.isBlock(mapper.body) && rowMapper(env, unwrap(ts, mapper.body), mapper.parameters[0].name.text);
+  }
+  if (!ts.isConditionalExpression(node)) return rowMapper(env, node, row);
+  const condition = unwrap(ts, node.condition);
+  const simpleNull = ts.isBinaryExpression(condition) && [ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsEqualsToken].includes(condition.operatorToken.kind)
+    && ts.isIdentifier(condition.left) && condition.left.text === row && condition.right.kind === ts.SyntaxKind.NullKeyword;
+  if (!(simpleNull || (ts.isIdentifier(condition) && condition.text === row))) return false;
+  return [node.whenTrue, node.whenFalse].every(branch => unwrap(ts, branch).kind === ts.SyntaxKind.NullKeyword || rowMapper(env, unwrap(ts, branch), row));
+}
+
+function readCall(env, call, managers) {
+  const { ts } = env;
+  if (!ts.isCallExpression(call) || !ts.isPropertyAccessExpression(call.expression) || !managers.has(receiverMember(ts, call))) return false;
+  if (READ_METHODS.has(call.expression.name.text)) return call.arguments.length <= 2 && call.arguments.every(argument => mapping(env, argument));
+  const sql = call.arguments[0];
+  return call.expression.name.text === 'query' && sql && ts.isIdentifier(sql) && /^(?:FIND|LIST)_/.test(sql.text)
+    && /\.sql(?:\.[cm]?ts)?$/.test(env.imports.get(sql.text)?.source ?? '') && call.arguments.every(argument => mapping(env, argument));
+}
+
+function ownedRead(env, statement) {
+  const { ts } = env;
+  const call = statementCall(ts, statement);
+  if (!call || !ts.isCallExpression(call) || !imported(env, call.expression, 'requireOwnedRow', '@modules/platform/database') || call.arguments.length !== 5) return false;
+  if (!call.arguments.slice(0, 4).every(argument => mapping(env, argument))) return false;
+  const callback = unwrap(ts, call.arguments[4]);
+  if (!ts.isArrowFunction(callback) || callback.parameters.length || !ts.isBlock(callback.body) || callback.body.statements.length !== 1) return false;
+  const thrown = callback.body.statements[0];
+  if (!ts.isThrowStatement(thrown) || !thrown.expression || !ts.isNewExpression(thrown.expression) || thrown.expression.arguments?.length !== 1) return false;
+  const options = thrown.expression.arguments[0];
+  if (!ts.isObjectLiteralExpression(options) || !mapping(env, options)) return false;
+  const code = options.properties.find(property => ts.isPropertyAssignment(property) && nameText(ts, property.name) === 'code');
+  return Boolean(code && ts.isPropertyAccessExpression(code.initializer) && code.initializer.name.text === 'NotFound');
+}
+
+function readMethods(env, declaration, constructor, excluded) {
+  const managers = new Set((constructor?.parameters ?? []).filter(parameter => portType(env, parameter.type, 'EntityManager', 'typeorm')
+    && nodeDecorators(env.ts, parameter).some(decorator => {
+      const call = env.ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
+      const binding = env.ts.isIdentifier(call) ? env.imports.get(call.text) : null;
+      return binding?.source === '@modules/platform/database' && /^Inject.*EntityManager$/.test(binding.name);
+    })).map(parameter => parameter.name.text));
+  for (const method of declaration.members) {
+    if (!env.ts.isMethodDeclaration(method) || !method.body) continue;
+    const statements = method.body.statements;
+    if (statements.length === 1 && ownedRead(env, statements[0])) { excluded.add(method); continue; }
+    if (statements.length !== 2 || !env.ts.isVariableStatement(statements[0]) || !env.ts.isReturnStatement(statements[1])) continue;
+    const variables = statements[0].declarationList.declarations;
+    if (variables.length !== 1 || !env.ts.isIdentifier(variables[0].name) || !variables[0].initializer) continue;
+    const call = unwrap(env.ts, variables[0].initializer);
+    if (readCall(env, call, managers) && readResult(env, statements[1].expression, variables[0].name.text)) excluded.add(method);
+  }
+  if (managers.size && canonicalConstructor(env, constructor)) excluded.add(constructor);
+}
+
+function queueDefinition(env, node) {
+  const { ts } = env;
+  if (!env.topLevelVariables.has(node) || !node.initializer) return false;
+  const value = unwrap(ts, node.initializer);
+  if (ts.isCallExpression(value) && imported(env, value.expression, 'defineQueue', '@modules/platform/queue'))
+    return value.arguments.length === 1 && ts.isObjectLiteralExpression(unwrap(ts, value.arguments[0])) && mapping(env, value.arguments[0]);
+  if (!ts.isArrowFunction(value) || !portType(env, value.type, 'QueueSchedulerDefinition', '@modules/platform/queue')) return false;
+  const body = ts.isBlock(value.body) && value.body.statements.length === 1 && ts.isReturnStatement(value.body.statements[0]) ? value.body.statements[0].expression : value.body;
+  const object = unwrap(ts, body);
+  return Boolean(object && ts.isObjectLiteralExpression(object) && mapping(env, object));
+}
+
+function canonEnvironment(ts, sourceFile) {
+  const env = { ts, imports: importsOf(ts, sourceFile, { moduleKey: 'source', stringLiteralsOnly: true }), mappers: new Set(), topLevelVariables: new Set(), topLevelClasses: new Set(sourceFile.statements.filter(ts.isClassDeclaration)) };
+  for (const statement of sourceFile.statements) {
+    if (!ts.isVariableStatement(statement)) continue;
+    for (const variable of statement.declarationList.declarations) {
+      env.topLevelVariables.add(variable);
+      const value = variable.initializer && unwrap(ts, variable.initializer);
+      if (ts.isIdentifier(variable.name) && value && ts.isArrowFunction(value) && ts.isObjectLiteralExpression(unwrap(ts, value.body)) && mapping(env, value.body)) env.mappers.add(variable.name.text);
+    }
+  }
+  return env;
+}
+
+function classScaffolding(env, node, excluded) {
+  const { ts } = env;
+  const constructor = node.members.find(ts.isConstructorDeclaration);
+  if (hasHeritage(env, node, 'ICQRSHandler', '@modules/platform/cqrs', ts.SyntaxKind.ExtendsKeyword)
+    && ['CommandHandler', 'QueryHandler'].some(name => decoratorsHave(env, node, name, '@nestjs/cqrs'))) {
+    if (canonicalConstructor(env, constructor, true)) excluded.add(constructor);
+    const members = propertyParameters(ts, constructor);
+    for (const method of node.members) if (ts.isMethodDeclaration(method) && nameText(ts, method.name) === 'process'
+      && method.body?.statements.length === 1 && delegation(env, method, method.body.statements[0], members)) excluded.add(method);
+  }
+  if (hasHeritage(env, node, 'JobStep', '@modules/platform/jobs', ts.SyntaxKind.ImplementsKeyword)) jobMethods(env, node, constructor, excluded);
+  queueMethods(env, node, constructor, excluded);
+  readMethods(env, node, constructor, excluded);
+}
+
+export function canonCloneNodes(ts, sourceFile, profile) {
+  if (profile === 'fe') return canonJsxCloneNodes(ts, sourceFile);
+  const excluded = new Set();
+  const env = canonEnvironment(ts, sourceFile);
+  const visit = node => {
+    if (queueDefinition(env, node)) { excluded.add(node); return; }
+    if (env.topLevelClasses.has(node)) classScaffolding(env, node, excluded);
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return excluded;
+}