@starci/eslint-canon-be 3.3.0 → 3.4.0

package/lib/subject-values.mjs

@@ -0,0 +1,55 @@
+import fs from "node:fs"
+import path from "node:path"
+import ts from "typescript"
+import { functionSubjectExports, valueObjectSubjects } from "../runtime/scripts/hfs/architecture/function-spec-providers.mjs"
+import { importOf } from "./import-source.mjs"
+import { typed } from "./types.mjs"
+
+/** The exported real function of a function-only sibling subject, with aliases resolved by TypeScript. */
+const realSubjectFunction = (context, value) => {
+    if (value.type !== "Identifier") return null
+    const imported = importOf(context, value)
+    if (!imported || !imported.source.startsWith(".")) return null
+    const { checker, toTs } = typed(context)
+    const tsNode = toTs(value)
+    const symbol = ts.isShorthandPropertyAssignment(tsNode.parent)
+        ? checker.getShorthandAssignmentValueSymbol(tsNode.parent) : checker.getSymbolAtLocation(tsNode)
+    const alias = symbol?.declarations?.some(declaration => ts.isImportSpecifier(declaration))
+    const target = alias ? checker.getAliasedSymbol(symbol) : symbol
+    const declaration = target?.valueDeclaration
+    if (!declaration) return null
+    const sourceFile = declaration.getSourceFile()
+    const sibling = (context.filename || context.getFilename()).replace(/\.spec\.ts$/u, ".ts")
+    if (path.resolve(sourceFile.fileName) !== path.resolve(sibling)) return null
+    const names = functionSubjectExports(ts, sourceFile)
+    return names?.includes(imported.imported) ? imported.imported : null
+}
+
+const VALUE_OBJECTS = new Map()
+
+/** The sibling module's value-object classes (undecorated, no constructor injection token), read from disk once per file; `[]` when none. */
+export const valueObjectsOfSibling = (context) => {
+    const sibling = path.resolve((context.filename || context.getFilename()).replace(/\.spec\.ts$/u, ".ts"))
+    const stamp = fs.existsSync(sibling) ? fs.statSync(sibling).mtimeMs : -1
+    const cached = VALUE_OBJECTS.get(sibling)
+    if (cached?.stamp === stamp) return cached.names
+    const names = stamp < 0 ? [] : valueObjectSubjects(ts, ts.createSourceFile(sibling, fs.readFileSync(sibling, "utf8"), ts.ScriptTarget.Latest, true)) ?? []
+    VALUE_OBJECTS.set(sibling, { stamp, names })
+    return names
+}
+
+/** `new Subject(...)` where Subject is a value-object class imported from the sibling module. */
+const isValueObjectSubject = (context, value) => {
+    if (value.type !== "NewExpression" || value.callee.type !== "Identifier") return false
+    const imported = importOf(context, value.callee)
+    return Boolean(imported && imported.source.startsWith(".") && valueObjectsOfSibling(context).includes(imported.imported))
+}
+
+/** Real functions under test are subject values; an inline fake or a collaborator remains a kit double. */
+export const isRealSubjectValue = (context, value) => {
+    if (isValueObjectSubject(context, value)) return true
+    if (value.type === "Identifier") return realSubjectFunction(context, value) !== null
+    if (value.type !== "ObjectExpression" || value.properties.length === 0) return false
+    return value.properties.every((property) => property.type === "Property" && !property.computed
+        && (property.key.name ?? property.key.value) === realSubjectFunction(context, property.value))
+}

package/lib/unit-spec.mjs

@@ -80,9 +80,6 @@ export const unitRoleOfSubject = (hfs, filename) => {
     return unitRoles(hfs).find((role) => name.endsWith(`.${role.role}.ts`) && !name.endsWith(`.${role.spec}.ts`) && inRoleSlot(hfs, role, filename)) ?? null
 }
 
-/** The `<name>` of a `<name>.service.spec.ts`. */
-export const serviceNameOfSpec = (filename) => baseOf(filename).replace(/\.service\.spec\.ts$/, "")
-
 /** The slots of the feature kinds whose door carries its own unit spec beside it. */
 const DOOR_SPEC_SLOTS = new Set(["be.feature.webhooks.http", "be.feature.realtime.graphql", "be.feature.realtime.websocket"])
 

package/lib/webhook-handoff-inbox.mjs

@@ -0,0 +1,260 @@
+/** R263 extends inbox dedupe to scalar delivery ids and signed raw-body intakes. */
+import ts from "typescript"
+import { walk } from "./ast.mjs"
+import { hfsOf } from "./hfs.mjs"
+import { baseName, isOwnedType, ownerNameOf } from "./ports.mjs"
+import { resolveVariable } from "./transactions.mjs"
+import { isPackageType, typed } from "./types.mjs"
+import { webhookIntakeProcessesDelivery } from "./webhook-handoff-intake.mjs"
+
+const DELIVERY_ID = /Id$/
+
+/** The slot of provider webhook doors (`<provider>.webhook.ts`), the only entrance of a delivery intake. */
+const DOOR_SLOT = "be.feature.webhooks.http"
+
+/** The method declarations each program's webhook doors call, computed once per program. */
+const reachedByProgram = new WeakMap()
+
+/** Declarations a call resolves to: its signature's declaration and its (alias-resolved) callee symbol's declarations. */
+const calledDeclarations = (checker, call) => {
+    const expression = call.expression
+    const name = ts.isPropertyAccessExpression(expression) ? expression.name
+        : ts.isElementAccessExpression(expression) ? expression.argumentExpression : expression
+    const symbol = checker.getSymbolAtLocation(name)
+    const target = symbol && symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+    return [checker.getResolvedSignature(call)?.declaration, ...(target?.getDeclarations() ?? [])].filter(Boolean)
+}
+
+/** Every method a webhook door file (slot be.feature.webhooks.http, `*.webhook.ts`) calls, by resolved declaration. */
+const doorCalledDeclarations = (context, hfs) => {
+    const { program, checker } = typed(context)
+    const cached = reachedByProgram.get(program)
+    if (cached) return cached
+    const reached = new Set()
+    for (const source of program.getSourceFiles()) {
+        if (hfs.slotOf(source.fileName) !== DOOR_SLOT || !baseName(source.fileName).endsWith(".webhook.ts")) continue
+        const visit = (node) => {
+            if (ts.isCallExpression(node)) for (const declaration of calledDeclarations(checker, node)) reached.add(declaration)
+            ts.forEachChild(node, visit)
+        }
+        visit(source)
+    }
+    reachedByProgram.set(program, reached)
+    return reached
+}
+
+/** A method is a webhook delivery intake only when a webhook door's call resolves to it. */
+const isDoorIntake = (context, hfs, method) => {
+    const declaration = typed(context).toTs(method)
+    return !!declaration && doorCalledDeclarations(context, hfs).has(declaration)
+}
+
+/** Defaults keep the same first-parameter binding. */
+const parameterOf = (parameter) => parameter?.type === "AssignmentPattern" ? parameter.left : parameter
+
+/** The extra delivery contracts missed by the existing eventId-object rule. */
+const deliveryKey = (context, method) => {
+    const first = parameterOf(method.value.params[0])
+    if (!first) return null
+    if (first.type === "Identifier" && DELIVERY_ID.test(first.name)) return { parameter: first }
+    const { checker, toTs } = typed(context)
+    const type = checker.getTypeAtLocation(toTs(first))
+    const parts = type.isUnion() ? type.types : [type]
+    const ids = [...new Set(parts.flatMap((part) => checker.getPropertiesOfType(part).map((property) => property.getName()).filter((name) => DELIVERY_ID.test(name))))]
+    if (ids.length) return { parameter: first, properties: ids }
+    const raw = first.type === "Identifier" && first.name === "rawBody"
+        && method.value.params.slice(1).some((parameter) => parameterOf(parameter)?.name === "signature")
+        || parts.some((part) => checker.getPropertyOfType(part, "rawBody") && checker.getPropertyOfType(part, "signature"))
+    // A declared verifier class proves authenticity; its ordinary domain intake owns dedupe.
+    const owner = method.parent?.parent
+    if (raw && !/(?:Verifier|verify)$/.test(owner?.id?.name ?? "")) return { parameter: first, raw: true }
+    return null
+}
+
+/** Identifiers are compared by lexical binding, so a same-spelled shadow is not a key. */
+const sameBinding = (context, left, right) => left?.type === "Identifier" && right?.type === "Identifier"
+    && resolveVariable(context.sourceCode, left) !== null
+    && resolveVariable(context.sourceCode, left) === resolveVariable(context.sourceCode, right)
+
+/** A decoded key comes from the raw input or a later delivery-id parameter, never a widened constant. */
+const rawKeySource = (context, expression, key, seen = new Set()) => {
+    if (!expression || seen.has(expression)) return false
+    seen.add(expression)
+    let sourced = false
+    walk(expression, (node) => {
+        if (node.type !== "Identifier") return
+        if (sameBinding(context, node, key.parameter)) sourced = true
+        const variable = resolveVariable(context.sourceCode, node)
+        for (const definition of variable?.defs ?? []) {
+            if (definition.type === "Parameter" && (DELIVERY_ID.test(node.name)
+                || node.parent?.type === "MemberExpression" && node.parent.object === node
+                    && DELIVERY_ID.test(node.parent.computed ? node.parent.property.value : node.parent.property.name))) sourced = true
+            if (definition.type === "Variable" && rawKeySource(context, definition.node.init, key, seen)) sourced = true
+        }
+    }, { intoFunctions: false })
+    return sourced
+}
+
+/** Scalar ids and object ids must actually key the claim; a raw payload itself is never a delivery key. */
+const usesKey = (context, argument, key) => {
+    if (!argument) return false
+    if (key.raw) {
+        if (sameBinding(context, argument, key.parameter) || argument.type === "Literal") return false
+        const name = argument.type === "Identifier" ? argument.name
+            : argument.type === "MemberExpression" ? argument.computed ? argument.property.value : argument.property.name : null
+        if (!name || !DELIVERY_ID.test(name)) return false
+        const { checker, toTs } = typed(context)
+        const type = checker.getTypeAtLocation(toTs(argument))
+        const parts = type.isUnion() ? type.types : [type]
+        return parts.every((part) => part.flags & ts.TypeFlags.StringLike && !(part.flags & ts.TypeFlags.StringLiteral))
+            && rawKeySource(context, argument, key)
+    }
+    if (key.parameter.type === "ObjectPattern") {
+        return key.parameter.properties.some((property) => property.type === "Property"
+            && key.properties?.includes(property.key.name ?? property.key.value)
+            && sameBinding(context, argument, parameterOf(property.value)))
+    }
+    if (!key.properties) return sameBinding(context, argument, key.parameter)
+    return argument.type === "MemberExpression" && !argument.optional
+        && sameBinding(context, argument.object, key.parameter)
+        && key.properties.includes(argument.computed ? argument.property.value : argument.property.name)
+}
+
+/** Find the first completed await, without treating a nested helper as work performed here. */
+const firstAwait = (body) => {
+    let result = null
+    walk(body, (node) => {
+        if (node.type === "AwaitExpression" && (!result || node.range[1] < result.range[1])) result = node
+    }, { intoFunctions: false })
+    return result
+}
+
+/** A parameter's binding cannot be overwritten before the claim and still prove the delivered id. */
+const preservesKey = (context, key, call) => {
+    const parameter = key.raw ? call.arguments[1] : key.parameter
+    if (parameter.type !== "Identifier") return true
+    const variable = resolveVariable(context.sourceCode, parameter)
+    return variable && !variable.references.some((reference) => reference.isWrite() && !reference.init
+        && reference.identifier.range[0] < call.range[1])
+}
+
+/** Scalar/DTO claims are the first statement; a raw intake may first bind its decoded key. */
+const claimsBeforeWork = (context, body, statement, key, call) => {
+    const index = body.body.indexOf(statement)
+    if (index === 0) return true
+    if (index < 0 || !key.raw) return false
+    const dependencies = new Set()
+    const read = (expression) => {
+        if (!expression) return
+        walk(expression, (node) => {
+            if (node.type !== "Identifier") return
+            const variable = resolveVariable(context.sourceCode, node)
+            if (!variable || dependencies.has(variable)) return
+            dependencies.add(variable)
+            for (const definition of variable.defs) if (definition.type === "Variable") read(definition.node.init)
+        }, { intoFunctions: false })
+    }
+    read(call.arguments[1])
+    return body.body.slice(0, index).every((entry) => entry.type === "VariableDeclaration" && entry.kind === "const"
+        && entry.declarations.every((declaration) => declaration.id.type === "Identifier" && dependencies.has(resolveVariable(context.sourceCode, declaration.id))))
+}
+
+/** A claim cannot be made conditionally or after another operation in its own statement. */
+const priorWork = (expression, call) => {
+    let found = false
+    walk(expression, (node) => {
+        if (node !== call && ["CallExpression", "NewExpression", "AssignmentExpression", "UpdateExpression", "ConditionalExpression", "LogicalExpression"].includes(node.type)
+            && node.range[1] < call.range[1]) found = true
+    }, { intoFunctions: false })
+    return found
+}
+
+/** Select TypeORM's actual inline transaction callback, never a later ignored callback. */
+const claimBody = (context, body) => {
+    if (body.body.length !== 1) return { body, manager: null }
+    const statement = body.body[0]
+    const expression = statement.type === "ReturnStatement" ? statement.argument
+        : statement.type === "ExpressionStatement" && statement.expression.type === "AwaitExpression" ? statement.expression : null
+    const call = expression?.type === "AwaitExpression" ? expression.argument : expression
+    const callee = call?.callee
+    if (call?.type !== "CallExpression" || callee.type !== "MemberExpression" || callee.computed
+        || callee.property.name !== "transaction" || !isPackageType(context, callee.object, "EntityManager", "typeorm")
+        || priorWork(call, call)) return { body, manager: null }
+    const first = call.arguments[0]
+    const callback = call.arguments.length === 1 ? first
+        : call.arguments.length === 2 && first.type === "Literal"
+            && ["READ UNCOMMITTED", "READ COMMITTED", "REPEATABLE READ", "SERIALIZABLE"].includes(first.value) ? call.arguments[1] : null
+    if (!callback || !["ArrowFunctionExpression", "FunctionExpression"].includes(callback.type)
+        || !callback.async || callback.body.type !== "BlockStatement" || callback.params.length !== 1) return { body, manager: null }
+    const manager = callback.params[0]
+    return manager.type === "Identifier" && isPackageType(context, manager, "EntityManager", "typeorm")
+        ? { body: callback.body, manager } : { body, manager: null }
+}
+
+/** Match an immediate false refusal with no work before the return. */
+const rejectsDuplicate = (context, awaited, body) => {
+    const rejects = (test, target) => test?.type === "UnaryExpression" && test.operator === "!" && (test.argument === target || sameBinding(context, test.argument, target))
+        || test?.type === "BinaryExpression" && test.operator === "==="
+            && ((test.left === target && test.right.type === "Literal" && test.right.value === false)
+                || (test.right === target && test.left.type === "Literal" && test.left.value === false))
+    const returns = (statement) => statement?.type === "ReturnStatement" && !statement.argument
+        || statement?.type === "BlockStatement" && statement.body.length === 1 && returns(statement.body[0])
+    const parent = awaited.parent
+    if (["UnaryExpression", "BinaryExpression"].includes(parent.type)) {
+        const branch = parent.parent
+        return body.body.includes(branch) && branch.type === "IfStatement" && rejects(branch.test, awaited) && returns(branch.consequent)
+    }
+    if (parent.type !== "VariableDeclarator" || parent.id.type !== "Identifier" || parent.init !== awaited) return false
+    const declaration = parent.parent
+    const index = body.body.indexOf(declaration)
+    const branch = body.body[index + 1]
+    return index !== -1 && declaration.declarations.length === 1
+        && branch?.type === "IfStatement" && rejects(branch.test, parent.id) && returns(branch.consequent)
+}
+
+/** A public service intake with a delivery key claims that same key first and refuses replays. */
+export const webhookInboxKey = {
+    meta: {
+        type: "problem",
+        docs: { description: "Delivery methods with first *Id parameters or DTO properties, or raw-body signature contracts, claim the real Inbox with a stable delivery key before work and return on duplicates. Receipt transactions publish events and leave processing to a reactor/job." },
+        schema: [],
+        messages: {
+            key: "[BE_WEBHOOK_INBOX_KEY] This delivery intake must first await the real platform/inbox claim(source, deliveryId), using its first *Id parameter or DTO property, or a decoded id for a signed raw-body intake, and return immediately when the claim is false. A transaction claim uses that callback's own manager; raw payloads and fixed literals are not delivery keys.",
+            handoff: "[BE_WEBHOOK_INBOX_KEY] A receipt transaction records the inbox delivery and publishes the typed event. Remove the process callback and domain/command processing from this transaction; a reactor or job processes the delivery after commit.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const slot = hfs.slotOf(context.filename)
+        if (!slot || slot.startsWith("be.tests.") || !baseName(context.filename).endsWith(".service.ts")) return {}
+        if (slot.startsWith("be.platform") && ["event-bus", "http-security"].includes(ownerNameOf(hfs, context.filename))) return {}
+        return {
+            MethodDefinition(method) {
+                if (method.kind !== "method" || method.static || method.key.type === "PrivateIdentifier" || !method.value.body
+                    || ["private", "protected"].includes(method.accessibility)) return
+                // A service no webhook door reaches is an ordinary domain service, whatever its first parameter is called.
+                if (!isDoorIntake(context, hfs, method)) return
+                const key = deliveryKey(context, method)
+                if (!key) return
+                if (webhookIntakeProcessesDelivery(context, hfs, method)) context.report({ node: method.key, messageId: "handoff" })
+                const { body, manager } = claimBody(context, method.value.body)
+                const awaited = firstAwait(body)
+                const call = awaited?.argument
+                const parent = awaited?.parent
+                const statement = parent?.type === "VariableDeclarator" ? parent.parent
+                    : ["UnaryExpression", "BinaryExpression"].includes(parent?.type) ? parent.parent : parent
+                const claims = call?.type === "CallExpression" && !call.optional
+                    && call.callee.type === "MemberExpression" && !call.callee.computed && !call.callee.optional
+                    && call.callee.property.name === "claim" && call.arguments.length >= 2
+                    && isOwnedType(context, call.callee.object, { name: "Inbox", capability: "inbox", tier: "platform" })
+                    && usesKey(context, call.arguments[1], key)
+                    && preservesKey(context, key, call)
+                    && (!manager || sameBinding(context, call.arguments[2], manager))
+                    && claimsBeforeWork(context, body, statement, key, call)
+                    && !priorWork(statement, call)
+                    && rejectsDuplicate(context, awaited, body)
+                if (!claims) context.report({ node: method.key, messageId: "key" })
+            },
+        }
+    },
+}

package/lib/webhook-handoff-intake.mjs

@@ -0,0 +1,140 @@
+/** R263: a receipt transaction records and publishes; a reactor/job processes after commit. */
+import ts from "typescript"
+import { baseName, ownerNameOf } from "./ports.mjs"
+import { originsOfType, typed } from "./types.mjs"
+
+/** Imported aliases and overload signatures retain the implementation's actual body. */
+const bodiesOf = (checker, call) => {
+    const expression = call.expression
+    let name = expression
+    if (ts.isPropertyAccessExpression(expression)) name = expression.name
+    if (ts.isElementAccessExpression(expression)) name = expression.argumentExpression
+    const symbol = checker.getSymbolAtLocation(name)
+    const target = symbol?.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+    const declarations = [checker.getResolvedSignature(call)?.declaration, ...(target?.getDeclarations() ?? [])]
+    return [...new Set(declarations.map((declaration) => declaration?.body ?? declaration?.initializer?.body).filter(Boolean))]
+}
+
+/** Receiver ownership is established by its declared type, including aliases and inherited ports; `accepts` also sees the type it came from. */
+const hasOrigin = (checker, receiver, accepts, seen = new Set()) => {
+    const type = receiver && checker.getTypeAtLocation(receiver)
+    const read = (current) => {
+        if (!current || seen.has(current)) return false
+        seen.add(current)
+        if (originsOfType(checker, current).some((origin) => accepts(origin, current))) return true
+        const parts = current.isUnionOrIntersection() ? current.types : []
+        const bases = current.isClassOrInterface() ? checker.getBaseTypes(current) ?? [] : []
+        return [...parts, ...bases].some(read)
+    }
+    return read(type)
+}
+
+/** Bracket access with a literal key has the same meaning as a dotted method/property. */
+const memberName = (expression) => {
+    if (ts.isPropertyAccessExpression(expression)) return expression.name.text
+    if (ts.isElementAccessExpression(expression) && ts.isStringLiteralLike(expression.argumentExpression)) return expression.argumentExpression.text
+    return null
+}
+
+/** A callback named process is the former in-transaction processing contract, including aliases and methods. */
+const isProcessCallback = (checker, node) => {
+    if (!(ts.isPropertyAssignment(node) || ts.isShorthandPropertyAssignment(node) || ts.isMethodDeclaration(node))) return false
+    const name = ts.isComputedPropertyName(node.name) ? node.name.expression : node.name
+    if (!(ts.isIdentifier(name) || ts.isStringLiteralLike(name)) || name.text !== "process") return false
+    return !!node.body || checker.getTypeAtLocation(node.initializer ?? node.name).getCallSignatures().length > 0
+}
+
+/** Persisting receipt data and publishing through platform ports are allowed; domain/CQRS processing is deferred. */
+const isBusinessOrigin = (hfs, origin) => {
+    if (origin.module === "@nestjs/cqrs") return ["CommandBus", "QueryBus"].includes(origin.name)
+    return origin.module === null && hfs.tierOf(origin.file) === "domain" && baseName(origin.file).endsWith(".service.ts")
+}
+
+/**
+ * A domain receipt port records a delivery and processes nothing: a class with no base class whose constructor takes only platform
+ * ports (and TypeORM), at least one of them the platform `Inbox`. It cannot reach another domain service or the CQRS buses, so a call
+ * on it inside the receipt transaction is the inbox record itself (owner ruling 2026-10-17 "Theo y tro": the owner delegated the decision to main).
+ */
+const isReceiptPort = (checker, hfs, type) => {
+    const declaration = type.getSymbol()?.getDeclarations()?.find(ts.isClassDeclaration)
+    const constructor = declaration && !declaration.heritageClauses ? declaration.members.find(ts.isConstructorDeclaration) : undefined
+    if (!constructor || constructor.parameters.length === 0) return false
+    const dependencies = constructor.parameters.map((parameter) => originsOfType(checker, checker.getTypeAtLocation(parameter)))
+    const isPort = (origin) => origin.module === "typeorm" || (origin.module === null && hfs.tierOf(origin.file) === "platform")
+    const isInbox = (origin) => origin.module === null && origin.name === "Inbox" && hfs.tierOf(origin.file) === "platform" && ownerNameOf(hfs, origin.file) === "inbox"
+    return dependencies.every((origins) => origins.length > 0 && origins.every(isPort)) && dependencies.some((origins) => origins.some(isInbox))
+}
+
+/** The transaction port's package establishes when the callback runs before commit. */
+const isTransactionCall = (checker, call, receiver) => memberName(call.expression) === "transaction"
+    && hasOrigin(checker, receiver, (origin) => origin.module === "typeorm" && ["EntityManager", "DataSource"].includes(origin.name))
+
+/** Extracting, binding or destructuring a method preserves its domain/bus receiver. */
+const isBusinessCall = (checker, hfs, expression, seen = new Set()) => {
+    if (!expression || seen.has(expression)) return false
+    seen.add(expression)
+    const accepts = (origin, type) => isBusinessOrigin(hfs, origin) && !isReceiptPort(checker, hfs, type)
+    if (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression) || ts.isSatisfiesExpression(expression)) return isBusinessCall(checker, hfs, expression.expression, seen)
+    if (ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression)) {
+        if (hasOrigin(checker, expression.expression, accepts)) return true
+        if (["bind", "call", "apply"].includes(memberName(expression))) return isBusinessCall(checker, hfs, expression.expression, seen)
+    }
+    if (ts.isCallExpression(expression)) return isBusinessCall(checker, hfs, expression.expression, seen)
+    const name = ts.isPropertyAccessExpression(expression) ? expression.name
+        : ts.isElementAccessExpression(expression) ? expression.argumentExpression : expression
+    const symbol = checker.getSymbolAtLocation(name)
+    const target = symbol?.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+    return target?.getDeclarations()?.some((declaration) => {
+        if (ts.isBindingElement(declaration)) return hasOrigin(checker, declaration.parent.parent.initializer, accepts)
+        return isBusinessCall(checker, hfs, declaration.initializer, seen)
+    }) ?? false
+}
+
+/** Passing a const callback into transaction does not move its work past commit. */
+const callbackBodies = (checker, expression, seen = new Set()) => {
+    if (!expression || seen.has(expression)) return []
+    seen.add(expression)
+    if (expression.body) return [expression.body]
+    if (ts.isAsExpression(expression) || ts.isSatisfiesExpression(expression) || ts.isParenthesizedExpression(expression)) return callbackBodies(checker, expression.expression, seen)
+    if (ts.isCallExpression(expression) && memberName(expression.expression) === "bind") return callbackBodies(checker, expression.expression.expression, seen)
+    const reference = ts.isPropertyAccessExpression(expression) ? expression.name : expression
+    const symbol = checker.getSymbolAtLocation(reference)
+    return symbol?.getDeclarations()?.flatMap((declaration) => declaration.body ? [declaration.body] : callbackBodies(checker, declaration.initializer, seen)) ?? []
+}
+
+/** Old inline process callbacks and business dispatch inside the receipt transaction violate handoff. */
+const processesDelivery = (checker, hfs, body) => {
+    let found = false
+    const visited = [new Set(), new Set()]
+    const visit = (node, inTransaction = false) => {
+        const nodes = visited[Number(inTransaction)]
+        if (found || nodes.has(node)) return
+        nodes.add(node)
+        if (isProcessCallback(checker, node)) found = true
+        if (ts.isCallExpression(node)) {
+            if (inTransaction && isBusinessCall(checker, hfs, node.expression)) found = true
+            const member = ts.isPropertyAccessExpression(node.expression) || ts.isElementAccessExpression(node.expression)
+            if (member && isTransactionCall(checker, node, node.expression.expression)) {
+                for (const argument of node.arguments) {
+                    visit(argument, true)
+                    for (const callback of callbackBodies(checker, argument)) visit(callback, true)
+                }
+                return
+            }
+            if (inTransaction) for (const callback of callbackBodies(checker, node.expression)) visit(callback, true)
+        }
+        ts.forEachChild(node, (child) => visit(child, inTransaction))
+    }
+    visit(body)
+    return found
+}
+
+/** Inspect the linted intake method or the implementation resolved at a webhook door's domain call. */
+export const webhookIntakeProcessesDelivery = (context, hfs, node) => {
+    const { checker, toTs } = typed(context)
+    const reference = toTs(node)
+    if (!reference) return false
+    let bodies = reference.body ? [reference.body] : []
+    if (ts.isCallExpression(reference)) bodies = [reference, ...bodiesOf(checker, reference)]
+    return bodies.some((body) => processesDelivery(checker, hfs, body))
+}

package/lib/why.mjs

@@ -0,0 +1,13 @@
+/**
+ * The catalogue sub-codes the back-end laws publish: `{ <rule id>: { code } }`.
+ * A rule's own code comes from its enforcer row in knowledge/hfs/rules.yaml; a SECOND code a rule emits
+ * (one rule, several failure codes) is named here so scripts/checks/check-hfs-rules.mjs sees it as emitted.
+ * Append-only: each alpha.15 batch adds its own secondary codes at the end (union-merged).
+ */
+export const why = {
+  "webhook-inbox-key": { code: "BE_WEBHOOK_INBOX_KEY" },
+  "rest-route-declared": { code: "BE_REST_ROUTE_UNDECLARED" },
+  "security-headers": { code: "BE_SECURITY_HEADERS" },
+  "trust-proxy": { code: "BE_TRUST_PROXY" },
+  "health-signals": { code: "BE_HEALTH_SIGNALS" },
+}