@starci/eslint-canon-be 3.3.1 → 3.4.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## Unreleased
+
+## 3.4.1 - 2026-10-17
+
+- Changed: the bundled runtime copies follow the runtime of 1.0.0-alpha.19 (owner ruling no-runtime-specs, 2026-10-17): the failure codes, the slot manifest (`exampleNa`) and the rule catalog (`specNa`, `exampleNa`) carry the removal of the runtime's own specs; package behavior is unchanged.
+- Fixed (R263 `BE_WEBHOOK_SCOPE`, a18.1 NIVO requests G and J): a third-party OAuth redirect (a GET route with `PublicReason.AuthHandshake` on a path that is not a webhook or events path) is no longer judged as a webhook door (owner ruling `oauth-redirect-not-webhook`); a call on a domain receipt port (no base class, constructor of platform ports only, one of them the Inbox) inside the receipt transaction is the inbox record and not processing (owner ruling `webhook-receipt-port`); an intake that does process the delivery is now reported with its own `intake` finding instead of the signed-metadata text.
+- Known gaps (planned for alpha.19, Nest lifecycle conformance): no enforcer yet for exactly one validation pipe per app, for interceptors limited to logging, timeout and serialization and registered once, or for the absence of authentication middleware. Templates and examples conform today: one `APP_PIPE`, no interceptor, security-headers middleware only.
+- Added: `no-guard-injects-guard` (R41 `BE_DEFAULT_DENY`, a18 lifecycle conformance): a guard class (implements `CanActivate` or named `...Guard`) has no constructor parameter that is another guard (a `...Guard` or `CanActivate` type, `Type<CanActivate>`, or `@Inject(SomeGuard)`); the app registers `RateLimitGuard`, `OriginGuard`, `CredentialGuard` and `AuthGuard` as four global `APP_GUARD`s and `@Credential({ kind })` selects the credential behavior.
+- Added: R278 `BE_REST_DOOR_EVIDENCE` / `BE_REST_ROUTE_UNDECLARED` accept a credential-guarded route (owner ruling `credential-guarded-rest-door`, 2026-10-16): `@Credential({ kind: "<literal>" })` from the domain identity capability on the route or controller, with the capability declaring a `CredentialGuard implements CanActivate`, resolved by TypeScript symbol. A local decorator, another `@UseGuards` guard and a computed kind still fail.
+- Fixed (R281 `BE_SPEC_FORM_ALL_ROLES`, a18 NIVO request A): `spec-infra-double-from-kit` judges a function subject by the callable subset of the sibling's exports (constants, enums, `export ... from` re-exports and overload signatures no longer disable the check; overloads collapse to the implementation); a value-object subject (an undecorated class whose constructor parameters carry no injection token) may be built with `new` (`spec-no-new-subject`, `spec-builds-with-testing-module`, and `useValue: new Subject(...)` in `spec-infra-double-from-kit`) while a decorated or token-injected class stays mandatory; a member of a kit `mock<T>()` object (`mock<{ open: F }>().open`) counts as a kit double.
+
+## 3.4.0 - 2026-10-15
+- Added: `module-definition-required` (R295 `BE_MODULE_DEFINITION_MISSING`, owner ruling 2026-10-15 `owner:module-definition-everywhere`): every `<x>.module.ts` of a feature, capability or projection has a sibling `<x>.module-definition.ts` and `<x>.options.ts`, its class extends the `ConfigurableModuleClass` of that definition, and a module of the product is listed in an `imports` array only as `X.register(...)`.
+- Changed: `capability-module-shape` judges the definition of every module: the representative module of a capability keeps `.setExtras({ isGlobal: false }, ...)` and the one `register` override; a sub-module, feature, transport module or cli group builds `.setClassMethodName("register").build()` and overrides nothing. A module definition in a feature is no longer refused.
+
 ## 3.3.1 - 2026-10-15
 - Changed: version-only republish. 3.3.0 was published first and the bundled canon-pins copy then moved with the rest of the alpha.14 package set (hfs 4.3.0, canon-fe 8.3.0, cli 1.3.0); 3.3.0 is superseded and no longer pinned anywhere.
 

package/README.md

@@ -44,8 +44,8 @@ A sample, not the list:
 | **App composition** (R245, R246) | `apps/<app>/src/<app>.env.ts` exports an explicit typed `<App>Env` interface and `read<App>Env(env: EnvSource): <App>Env` (for example `ApiEnv` and `readApiEnv`). The interface declares its own readonly parsed members, such as `readonly server: ReturnType<typeof parseServerConfig>`, structurally compatible with the app's options. The role name stays `<app>.env.ts`, never `env.ts`; capability `<capability>.config.ts` files stay unchanged. `main.ts` creates `EnvSource` once, imports and calls the reader, builds options and boots. The env file holds fail-fast parsing only, with no localhost or default host fallback, logic, module composition, business code or feature imports; `<app>.options.ts` holds env-derived options and port bindings only, with no parsing. Both refuse an array listing `*Module` classes, module or queue registrations (`register`, `forRoot`, `registerQueue`) or scheduler entries, and an `imports`, `modules`, `schedulers` or `processors` list; the env file also refuses standalone module or queue registration calls. Composition belongs in a `compose/<area>.ts` group that `app.module.ts` spreads (`app-options-composition-free`, `BE_APP_OPTIONS_COMPOSITION`). Each app file stays within its slot's line budget: `main.ts` 80, env 150, options 200, group 120, root 250 (`app-file-budget`, `BE_APP_COMPOSITION_BUDGET`). The interface and reader exports are a documented scaffold contract; they need no new lint rule |
 | **Sonar parity** (R235) | The smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (`no-await-in-loop`, S9382; `for (;;)` and `while (true)` are spared), no `charCodeAt`/`fromCharCode` (`prefer-code-point`), no string that only escapes backslashes (`prefer-string-raw`), no nested conditional (`no-nested-conditional`), `void` only on a call (`no-void-operator`), no unused import (`no-unused-import`), `export ... from` for an import that is only handed on (`prefer-export-from`); the factory also turns on typescript-eslint `no-deprecated`, `no-base-to-string` and `require-await`. The files `*.spec.ts` and `*.e2e-spec.ts` are outside the scan, so outside these rules |
 | **Cookies** (R141) | A cookie a door writes through the response of Express or Fastify (`cookie`, `setCookie`) states `httpOnly: true`, `secure: true` and `sameSite` `lax` or `strict` in options typed with those literals, and `Set-Cookie` is never written as a header; the call is recognised by where its signature is declared (`response-cookie-attributes`). A secret-derived value is compared with `timingSafeEqual`: a `Secret` of `platform/config` and the `.digest()` of a `Hash` or `Hmac` of Node's crypto are recognised by type (`secret-compare-timing-safe`) |
-| **Default deny** | Typed bodies and arguments, no `GraphQLJSON` tunnel, no `switch (operation)`, `@Public` carries a `PublicReason` member of `domain/identity`, and no `@UseGuards` (the global `APP_GUARD` chain decides) (`no-untyped-body`, `public-needs-reason`, `no-auth-use-guards`) |
-| **Module shape** | No `@Global()`; `isGlobal: true` only in an app's `app.module.ts`; no import of another owner's module; typed `ConfigurableModuleBuilder`; `static register` is the only factory; a capability's representative module extends the `ConfigurableModuleClass` of its own module definition and every sub-module or feature module is plain (`capability-module-shape`); one module per file; no `new` of a provider; no module-level `let` (`no-global-decorator`, `is-global-only-in-app`, `no-cross-owner-module-import`, `static-module-register`) |
+| **Default deny** | Typed bodies and arguments, no `GraphQLJSON` tunnel, no `switch (operation)`, `@Public` carries a `PublicReason` member of `domain/identity`, no `@UseGuards` (the global `APP_GUARD` chain decides) and no guard injected into another guard (`no-untyped-body`, `public-needs-reason`, `no-auth-use-guards`, `no-guard-injects-guard`) |
+| **Module shape** | No `@Global()`; `isGlobal: true` only in an app's `app.module.ts`; no import of another owner's module; typed `ConfigurableModuleBuilder`; `static register` is the only factory; every module (capability, sub-module, feature, transport, cli group) has a sibling `<x>.module-definition.ts` and `<x>.options.ts`, extends its own `ConfigurableModuleClass` and is listed only as `X.register(...)` (`module-definition-required`); only a capability's representative module keeps `.setExtras({ isGlobal: false })` and the `register` override (`capability-module-shape`); one module per file; no `new` of a provider; no module-level `let` (`no-global-decorator`, `is-global-only-in-app`, `no-cross-owner-module-import`, `static-module-register`) |
 | **Suppression** | No `eslint-disable`, `eslint-env`, `/* global */`, `@ts-ignore`, `@ts-expect-error`, `@ts-nocheck`, `istanbul`, `c8` or `v8 ignore`, `NOSONAR`, `sonar-disable`, or `prettier-ignore` comment, anywhere (`no-inline-suppression`) |
 | **Size** | A source file, a spec included, over the manifest's line budget is not new and does not grow past its size at the parent commit; the rule takes no option (`file-size-growth`) |
 | **Query safety** | `.query(...)` takes only a `SqlText` built with the `sql` tag in a persistence `<name>.sql.ts`, and no query builder exists (`sql-text-only`, `no-query-builder`); the tag's only substitution is a `SqlIdent` and a `.query` string is never built by template or `+` (`no-interpolated-sql`); `find`, `findBy` and `findAndCount` on an `EntityManager` state `take` and no `EntityManager` read runs per loop element (`query-needs-limit`, `no-query-in-loop`) |

package/app-composition.mjs

@@ -1,5 +1,6 @@
 /**
- * The rules that hold the composition files of a back-end app (catalog R245 `BE_APP_OPTIONS_COMPOSITION` and R246
+ * The rules that hold the composition files of a back-end app (catalog R245 `BE_APP_OPTIONS_COMPOSITION`, R265
+ * `BE_COMPOSITION_UNTYPED` and R246
  * `BE_APP_COMPOSITION_BUDGET`, owner ruling 2026-10-14). An app's `src/` holds five roles, named by the entries of its `be.app.*` slot (`lib/app-roles.mjs`):
  * `main.ts`, `app.module.ts`, `<app>.env.ts`, `<app>.options.ts` and the composition groups `compose/<area>.ts`.
  *
@@ -15,13 +16,17 @@
  *     (`budget` of the slot, keyed by the same entry: `app.module.ts` 250, `<app>.env.ts` 150, `<app>.options.ts` 200, `compose/<area>.ts` 120,
  *     `main.ts` 80). The budget is absolute, not a ratchet: an app root that outgrows it moves an area into a new group.
  *
- * Both rules ask the slot view which entry a file matches; neither keeps a path of its own.
+ * R265 resolves composition from types, including renamed constructors, factories, maps and scheduler tables. All
+ * three rules ask the slot view which entry a file matches; none keeps a path of its own.
  */
 import { lineCount } from "./runtime/scripts/lib/line-count.mjs"
+import ts from "typescript"
 import { APP_ENV_ROLE, APP_OPTIONS_ROLE, appRoleOf } from "./lib/app-roles.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
+import { isOwnedBy } from "./lib/declared.mjs"
 import { keyName, staticText } from "./lib/ast.mjs"
 import { isDeclarationFile, normalizePath } from "./lib/path.mjs"
+import { moduleOf, originsOfType, packageOfExport, typed } from "./lib/types.mjs"
 
 /** Static factories that register a Nest module (a dynamic module), a queue or a flow producer. */
 const REGISTRATION_CALLS = new Set([
@@ -130,6 +135,340 @@ export const appOptionsCompositionFree = {
     },
 }
 
+/** Composition is a value's type, independent of the spelling of its class, factory or helper. */
+const compositionTypes = (checker) => {
+    const propertyType = (type, name) => {
+        const property = type.getProperty(name)
+        const declaration = property?.valueDeclaration ?? property?.getDeclarations?.()?.[0]
+        return declaration ? checker.getTypeOfSymbolAtLocation(property, declaration) : null
+    }
+    const constructor = (type) => (type?.getConstructSignatures().length ?? 0) > 0
+    const dynamicModule = (type) => constructor(propertyType(type, "module"))
+    const moduleConstructor = (type) => {
+        if (!constructor(type)) return false
+        for (const declaration of type.getSymbol()?.getDeclarations?.() ?? []) {
+            if (!ts.isClassDeclaration(declaration) && !ts.isClassExpression(declaration)) continue
+            for (const decorator of ts.getDecorators(declaration) ?? []) {
+                const expression = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression
+                const symbol = checker.getSymbolAtLocation(ts.isPropertyAccessExpression(expression) ? expression.name : expression)
+                const resolved = symbol?.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+                if (resolved?.name === "Module" && resolved.getDeclarations()?.some((origin) => moduleOf(origin, normalizePath(origin.getSourceFile().fileName)) === "@nestjs/common")) return true
+            }
+        }
+        // A factory returning DynamicModule identifies a module even if it has no decorator or conventional name.
+        return type.getProperties().some((property) => {
+            const factory = propertyType(type, property.name)
+            return factory?.getCallSignatures().some((signature) => dynamicModule(checker.getReturnTypeOfSignature(signature)))
+        })
+    }
+    const arrayElement = (type) => checker.isArrayType(type) || checker.isTupleType(type)
+        ? checker.getIndexTypeOfType(type, ts.IndexKind.Number)
+        : type.getSymbol()?.name === "ReadonlyArray" ? checker.getTypeArguments(type)[0] : null
+    const MAX_DEPTH = 12
+    const contains = (type, constructors = false, seen = new Set(), depth = 0) => {
+        // A library type graph (the application, an HTTP adapter) can be deep and cyclic through member types: a bounded walk never overflows the stack.
+        if (depth > MAX_DEPTH) return false
+        if (!type || seen.has(type) || type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown | ts.TypeFlags.TypeParameter)) return false
+        seen.add(type)
+        if (type.isUnionOrIntersection()) return type.types.some((part) => contains(part, constructors, new Set(seen), depth + 1))
+        // Async bootstrap returns Promise<void>; walk its result rather than recursively instantiating .then/.catch.
+        const awaited = checker.getAwaitedType(type)
+        if (awaited && awaited !== type) return contains(awaited, constructors, seen, depth + 1)
+        const origins = originsOfType(checker, type)
+        if (origins.some((origin) => origin.module === "@nestjs/common" && ["DynamicModule", "Type", "Provider"].includes(origin.name))) return true
+        if (constructor(type)) return constructors || moduleConstructor(type)
+        if (dynamicModule(type)) return true
+        const properties = new Set(type.getProperties().map((property) => property.name))
+        if (properties.has("provide") && ["useClass", "useFactory", "useValue", "useExisting"].some((key) => properties.has(key))) return true
+        if (properties.has("queue") && ["cron", "everyMs", "pattern", "repeat"].some((key) => properties.has(key))) return true
+        // Primitive options values and their library methods never compose an app.
+        if (!(type.flags & ts.TypeFlags.Object)) return false
+        const element = arrayElement(type)
+        if (element) return contains(element, true, seen, depth + 1)
+        // Index signatures retain the Type<unknown> contract of a module map, unlike a plain adapter port map.
+        for (const index of checker.getIndexInfosOfType(type)) {
+            if (contains(index.type, false, new Set(seen), depth + 1)) return true
+        }
+        for (const signature of type.getCallSignatures()) {
+            if (contains(checker.getReturnTypeOfSignature(signature), false, new Set(seen), depth + 1)) return true
+        }
+        return type.getProperties().some((property) => contains(propertyType(type, property.name), false, new Set(seen), depth + 1))
+    }
+    const typedList = (type) => {
+        const element = arrayElement(type)
+        if (!element || element.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) return false
+        const parts = element.isUnion() ? element.types : [element]
+        return parts.every((part) => contains(part, true))
+    }
+    return { arrayElement, contains, typedList }
+}
+
+/** R265: app values compose only in typed groups, never in env/options/bootstrap lists. */
+export const appCompositionTyped = {
+    meta: {
+        type: "problem",
+        docs: { description: "Module, provider, queue and scheduler composition is judged by its resolved type and lives in typed compose groups." },
+        schema: [],
+        messages: {
+            outside: "[BE_COMPOSITION_UNTYPED] This value composes modules, providers, queues or schedules in `{{role}}`. Move it into a typed `compose/<area>.ts` group and spread the group in `app.module.ts`.",
+            group: "[BE_COMPOSITION_UNTYPED] Declare this composition group's array type or return type explicitly (for example `Array<DynamicModule | Type<unknown>>`); every element must be a module, provider, queue or scheduler entry.",
+            business: "[BE_APP_BUSINESS_ROLE] Composition groups only wire modules, providers, queues and schedules. Move business functions and branching into their owning feature or module.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename)) return {}
+        const role = appRoleOf(hfsOf(context), filename)?.entry
+        if (![APP_ENV_ROLE, APP_OPTIONS_ROLE, "main.ts", "compose/<area>.ts"].includes(role)) return {}
+        const { checker, toTs } = typed(context)
+        const { arrayElement, contains, typedList } = compositionTypes(checker)
+        const reported = new WeakSet()
+        const hasReport = (node) => {
+            for (let ancestor = node; ancestor; ancestor = ancestor.parent) if (reported.has(ancestor)) return true
+            return false
+        }
+        const report = (node, messageId) => {
+            if (hasReport(node)) return
+            reported.add(node)
+            context.report({ node, messageId, data: { role } })
+        }
+        const typeOf = (node) => checker.getTypeAtLocation(toTs(node))
+        const bootstrapArgument = (node) => {
+            // The root module's registration belongs here; inline lists and metadata still belong in compose/.
+            if (role !== "main.ts" || node.type !== "CallExpression") return false
+            let expression = node
+            while (WRAPPERS.has(expression.parent?.type)) expression = expression.parent
+            const parent = expression.parent
+            if (parent?.type !== "CallExpression" || !parent.arguments.includes(expression) || parent.callee.type !== "MemberExpression") return false
+            const owner = (callee) => packageOfExport(context, callee) ?? packageOfExport(context, callee.object)
+            // An api boots through NestFactory; a cli app boots its root module through nest-commander's CommandFactory.run (R148).
+            return (["create", "createApplicationContext", "createMicroservice"].includes(memberName(parent.callee)) && owner(parent.callee) === "@nestjs/core")
+                || (memberName(parent.callee) === "run" && parent.arguments[0] === expression && owner(parent.callee) === "nest-commander")
+        }
+        const checkValue = (node) => {
+            if (role === "compose/<area>.ts" || hasReport(node) || bootstrapArgument(node)) return
+            if (contains(typeOf(node))) report(node, "outside")
+        }
+        const checkGroup = (node, value, annotation) => {
+            if (role !== "compose/<area>.ts") return
+            const type = typeOf(value)
+            const signatures = type.getCallSignatures()
+            const result = signatures.length ? checker.getReturnTypeOfSignature(signatures[0]) : type
+            if (signatures.length && !arrayElement(result) && !contains(result)) {
+                report(node, "business")
+                return
+            }
+            if (!annotation || !typedList(result)) report(node, "group")
+        }
+        const annotationOf = (node) => {
+            if (!node) return null
+            if (node.type === "TSSatisfiesExpression") return node.typeAnnotation
+            if (WRAPPERS.has(node.type)) return annotationOf(node.expression)
+            if (node.type === "VariableDeclarator") return node.id.typeAnnotation ?? annotationOf(node.init)
+            if (node.returnType) return node.returnType
+            if (node.type !== "Identifier") return null
+            const symbol = checker.getSymbolAtLocation(toTs(node))
+            const resolved = symbol?.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+            return resolved?.getDeclarations()?.some((declaration) => {
+                const initializer = declaration.initializer
+                return declaration.type || initializer && (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer) || ts.isSatisfiesExpression(initializer)) && initializer.type
+            }) ?? false
+        }
+        return {
+            ExportNamedDeclaration(node) {
+                if (role !== "compose/<area>.ts" || node.exportKind === "type") return
+                const declaration = node.declaration
+                if (!declaration) {
+                    for (const specifier of node.specifiers) {
+                        if (specifier.exportKind !== "type") checkGroup(specifier, specifier.local, annotationOf(specifier.local))
+                    }
+                    return
+                }
+                if (declaration.type === "FunctionDeclaration" && declaration.body) checkGroup(declaration, declaration, declaration.returnType)
+                if (declaration.type !== "VariableDeclaration") return
+                for (const binding of declaration.declarations) {
+                    if (!binding.init) continue
+                    checkGroup(binding, binding.id, annotationOf(binding))
+                }
+            },
+            ExportDefaultDeclaration(node) {
+                if (role === "compose/<area>.ts") checkGroup(node, node.declaration, annotationOf(node.declaration))
+            },
+            VariableDeclarator(node) {
+                if (node.init) checkValue(node.init)
+            },
+            FunctionDeclaration(node) {
+                if (node.body && role !== "compose/<area>.ts" && contains(typeOf(node))) report(node, "outside")
+            },
+            ArrowFunctionExpression(node) {
+                if (role !== "compose/<area>.ts" || hasReport(node)) return
+                const signature = typeOf(node).getCallSignatures()[0]
+                if (signature && !contains(checker.getReturnTypeOfSignature(signature))) report(node, "business")
+            },
+            IfStatement(node) { if (role === "compose/<area>.ts") report(node, "business") },
+            SwitchStatement(node) { if (role === "compose/<area>.ts") report(node, "business") },
+            ConditionalExpression(node) { if (role === "compose/<area>.ts") report(node, "business") },
+            ForStatement(node) { if (role === "compose/<area>.ts") report(node, "business") },
+            ForOfStatement(node) { if (role === "compose/<area>.ts") report(node, "business") },
+            WhileStatement(node) { if (role === "compose/<area>.ts") report(node, "business") },
+            ArrayExpression: checkValue,
+            ObjectExpression: checkValue,
+            CallExpression: checkValue,
+            ReturnStatement(node) {
+                if (node.argument) checkValue(node.argument)
+            },
+        }
+    },
+}
+
+/** Resolve an imported or local binding without relying on its local spelling. */
+const resolvedSymbol = (checker, node) => {
+    const symbol = checker.getSymbolAtLocation(ts.isPropertyAccessExpression(node) ? node.name : node)
+    return symbol?.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol
+}
+
+/** The app's declared name comes from its matching env filename, not its kind's slot name. */
+const appEnvNames = (filename, role) => {
+    const root = filename.slice(0, filename.lastIndexOf("/"))
+    const app = role === APP_ENV_ROLE ? filename.split("/").at(-1).slice(0, -".env.ts".length) : root.split("/").at(-2)
+    const pascal = app.replace(/(?:^|[-_])([a-z\d])/g, (_, letter) => letter.toUpperCase())
+    return { file: `${root}/${app}.env.ts`, reader: `read${pascal}Env` }
+}
+
+/** R289: the typed app env reader owns parsing; main acquires one source and delegates once. */
+export const appEnvRequired = {
+    meta: {
+        type: "problem",
+        docs: { description: "Every app exports its typed EnvSource reader; main builds one source and delegates parsing to that reader." },
+        schema: [],
+        messages: {
+            shape: "[BE_APP_ENV_REQUIRED] Export an environment interface and `{{reader}}(env: EnvSource)` returning that interface from the matching app env file.",
+            inline: "[BE_APP_ENV_REQUIRED] Bootstrap builds EnvSource once and delegates environment parsing only to the matching app env reader. Move this environment read or parser into `<app>.env.ts`.",
+            delegate: "[BE_APP_ENV_REQUIRED] Main must build EnvSource once and call `{{reader}}` from `{{file}}` with that source once.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename)) return {}
+        const hfs = hfsOf(context)
+        const role = appRoleOf(hfs, filename)?.entry
+        if (role !== APP_ENV_ROLE && role !== "main.ts") return {}
+        const { checker, toTs } = typed(context)
+        const names = appEnvNames(filename, role)
+        const ownedEnv = (type) => originsOfType(checker, type).some((origin) => origin.name === "EnvSource" && isOwnedBy(hfs, origin.file, "platform", "config"))
+        const envValue = (node) => node && ownedEnv(checker.getTypeAtLocation(toTs(node)))
+        const matchingReader = (node) => {
+            const symbol = resolvedSymbol(checker, toTs(node))
+            return symbol?.name === names.reader && symbol.getDeclarations()?.some((declaration) => normalizePath(declaration.getSourceFile().fileName) === names.file)
+        }
+        const envContract = (node) => {
+            const source = toTs(node)
+            if (!source.symbol) return false
+            const exported = checker.getExportsOfModule(source.symbol)
+            const reader = exported.find((symbol) => symbol.name === names.reader)
+            const declaration = reader?.valueDeclaration ?? reader?.getDeclarations()?.[0]
+            if (!declaration) return false
+            const signatures = checker.getTypeOfSymbolAtLocation(reader, declaration).getCallSignatures()
+            return signatures.some((signature) => {
+                const parameters = signature.getParameters()
+                if (parameters.length !== 1 || !signature.declaration?.type) return false
+                const parameter = parameters[0]
+                if (!parameter.valueDeclaration?.type || !ownedEnv(checker.getTypeOfSymbolAtLocation(parameter, parameter.valueDeclaration))) return false
+                const result = checker.getReturnTypeOfSignature(signature)
+                return result.getSymbol()?.getDeclarations()?.some((item) => ts.isInterfaceDeclaration(item)
+                    && item.getSourceFile() === source && exported.some((symbol) => symbol.name === item.name.text))
+            })
+        }
+        let sources = 0
+        let delegates = 0
+        let inline = false
+        const reported = new WeakSet()
+        const reportInline = (node) => {
+            for (let parent = node; parent; parent = parent.parent) if (reported.has(parent)) return
+            reported.add(node)
+            inline = true
+            context.report({ node, messageId: "inline" })
+        }
+        return {
+            CallExpression(node) {
+                if (role !== "main.ts") return
+                const declaration = checker.getResolvedSignature(toTs(node))?.declaration
+                if (declaration && ts.isMethodDeclaration(declaration) && declaration.name.getText() === "fromProcess"
+                    && envValue(node) && isOwnedBy(hfs, normalizePath(declaration.getSourceFile().fileName), "platform", "config")) {
+                    sources += 1
+                    if (sources > 1 || node.arguments.length) reportInline(node)
+                    return
+                }
+                if (matchingReader(node.callee) && node.arguments.length === 1 && envValue(node.arguments[0])) {
+                    delegates += 1
+                    if (delegates > 1) reportInline(node)
+                    return
+                }
+                const callee = unwrap(node.callee)
+                if (callee.type === "MemberExpression" && envValue(callee.object) || node.arguments.some(envValue)) reportInline(node)
+            },
+            MemberExpression(node) {
+                if (role !== "main.ts") return
+                if (memberName(node) === "env" && lastName(node.object) === "process") reportInline(node)
+                if (envValue(node.object) && !node.parent?.type.startsWith("CallExpression") && memberName(node) !== "fromProcess") reportInline(node)
+            },
+            "Program:exit"(node) {
+                if (role === APP_ENV_ROLE) {
+                    if (!envContract(node)) context.report({ node, messageId: "shape", data: names })
+                } else if (!inline && (sources !== 1 || delegates !== 1)) context.report({ node, messageId: "delegate", data: names })
+            },
+        }
+    },
+}
+
+/** R289: module lists in the app root contain only spreads of its own compose groups. */
+export const appModuleListInline = {
+    meta: {
+        type: "problem",
+        docs: { description: "The app root spreads compose groups; its only inline provider registrations are app-wide guards and filters." },
+        schema: [],
+        messages: {
+            inline: "[BE_APP_MODULE_LIST_INLINE] Move module, provider, queue or schedule entries into typed `compose/<area>.ts` groups and spread those groups here. Only app-wide guards and filters may be inline.",
+        },
+    },
+    create(context) {
+        const filename = normalizePath(context.filename || context.getFilename())
+        if (isDeclarationFile(filename)) return {}
+        const hfs = hfsOf(context)
+        if (appRoleOf(hfs, filename)?.entry !== "app.module.ts") return {}
+        const { checker, toTs } = typed(context)
+        const { contains } = compositionTypes(checker)
+        const composeRoot = filename.slice(0, filename.lastIndexOf("/")) + "/compose/"
+        const groupSpread = (node) => {
+            if (node.type !== "SpreadElement") return false
+            const value = unwrap(node.argument)
+            const reference = value.type === "CallExpression" ? unwrap(value.callee) : value
+            const symbol = resolvedSymbol(checker, toTs(reference))
+            return symbol?.getDeclarations()?.some((declaration) => {
+                const file = normalizePath(declaration.getSourceFile().fileName)
+                return file.startsWith(composeRoot) && appRoleOf(hfs, file)?.entry === "compose/<area>.ts"
+            }) ?? false
+        }
+        const globalProvider = (node) => {
+            node = unwrap(node)
+            if (node?.type !== "ObjectExpression") return false
+            const binding = node.properties.find((property) => property.type === "Property" && keyName(property.key) === "provide")
+            const value = binding && unwrap(binding.value)
+            if (!value || !["APP_GUARD", "APP_FILTER"].includes(resolvedSymbol(checker, toTs(value))?.name)) return false
+            return packageOfExport(context, value) === "@nestjs/core"
+        }
+        return {
+            ArrayExpression(node) {
+                const parent = node.parent
+                const key = parent?.type === "Property" ? parent.computed ? staticText(parent.key) : keyName(parent.key) : null
+                if (![...COMPOSITION_KEYS, "providers"].includes(key) && !contains(checker.getTypeAtLocation(toTs(node)))) return
+                const violation = node.elements.find((element) => !element || !groupSpread(element) && !(key === "providers" && globalProvider(element)))
+                if (violation || node.elements.includes(null)) context.report({ node: violation ?? node, messageId: "inline" })
+            },
+        }
+    },
+}
+
 /** Each composition file of an app stays within the line budget its app slot names. */
 export const appFileBudget = {
     meta: {
@@ -166,11 +505,17 @@ export const appFileBudget = {
 /** The rules this law contributes to the plugin. */
 export const rules = {
     "app-options-composition-free": appOptionsCompositionFree,
+    "app-composition-typed": appCompositionTyped,
+    "app-env-required": appEnvRequired,
+    "app-module-list-inline": appModuleListInline,
     "app-file-budget": appFileBudget,
 }
 
-/** Both start at error: every rule is an error, and an app already over a budget migrates its lists into compose/. */
+/** Every rule starts at error; an app already over a budget migrates its lists into compose/. */
 export const recommended = {
     "starci-be/app-options-composition-free": "error",
+    "starci-be/app-composition-typed": "error",
+    "starci-be/app-env-required": "error",
+    "starci-be/app-module-list-inline": "error",
     "starci-be/app-file-budget": "error",
 }

package/authorization.mjs

@@ -1,8 +1,8 @@
 /**
  * The rule that holds the guard half of HFS default-deny (catalog R41 `BE_DEFAULT_DENY`, law `authorization`).
  *
- * Authentication and authorization are the global `APP_GUARD` chain of the app (throttler, CSRF origin guard, then the
- * `AuthGuard` of `domain/identity`), registered once and read by the architecture machine. A route therefore never picks
+ * Authentication and authorization are the global `APP_GUARD` chain of the app (RateLimitGuard, OriginGuard, the `CredentialGuard` and the
+ * `AuthGuard` of `domain/identity`, in that order), registered once and read by the architecture machine. A route therefore never picks
  * its own guard: `@UseGuards(...)` has no legitimate use in product code, and a door that names a guard is a door that
  * can also forget one. `@Public({ reason: PublicReason.X })` is the only way to open a door.
  *
@@ -45,12 +45,78 @@ export const noAuthUseGuards = {
     },
 }
 
+const GUARD_NAME = /Guard$/
+
+/** The identifier a type reference or expression ends in, or undefined. */
+const nameOf = (node) => {
+    if (node === undefined || node === null) return undefined
+    if (node.type === "Identifier") return node.name
+    if (node.type === "TSQualifiedName") return node.right.name
+    if (node.type === "MemberExpression" && !node.computed) return node.property.name
+    return undefined
+}
+
+/** True when the class is a guard: it implements CanActivate or is named `...Guard`. */
+const isGuardClass = (node) =>
+    GUARD_NAME.test(node.id?.name ?? "") || (node.implements ?? []).some((item) => nameOf(item.expression) === "CanActivate")
+
+/** True when the type mentions CanActivate or a `...Guard` class, directly or as `Type<...>` / a union member. */
+const namesGuardType = (type) => {
+    if (type === undefined || type === null) return false
+    if (type.type === "TSTypeReference") {
+        const name = nameOf(type.typeName)
+        if (name === "CanActivate" || GUARD_NAME.test(name ?? "")) return true
+        return (type.typeArguments ?? type.typeParameters)?.params?.some(namesGuardType) ?? false
+    }
+    if (type.type === "TSUnionType" || type.type === "TSIntersectionType") return type.types.some(namesGuardType)
+    return false
+}
+
+const parameterOf = (parameter) => (parameter.type === "TSParameterProperty" ? parameter.parameter : parameter)
+
+/** True when an `@Inject(SomeGuard)` style decorator names a guard class. */
+const injectsGuardToken = (parameter) =>
+    (parameter.decorators ?? []).some(
+        (decorator) =>
+            decorator.expression.type === "CallExpression" &&
+            decorator.expression.arguments.some((argument) => GUARD_NAME.test(nameOf(argument) ?? "")),
+    )
+
+/** A guard never calls, extends or receives another guard: the app registers each one as its own APP_GUARD. */
+export const noGuardInjectsGuard = {
+    meta: {
+        type: "problem",
+        docs: { description: "A guard class has no constructor parameter that is another guard (no CanActivate-typed parameter)." },
+        schema: [],
+        messages: {
+            guardInGuard:
+                "A guard must not inject another guard (found a `{{name}}` constructor parameter). Each guard is its own global `APP_GUARD` in the fixed order RateLimitGuard, OriginGuard, CredentialGuard, AuthGuard; share logic through a service or a port, and let metadata (`@Credential`, `@Public`) select the behavior.",
+        },
+    },
+    create(context) {
+        const check = (node) => {
+            if (!isGuardClass(node)) return
+            const constructor = node.body.body.find((member) => member.type === "MethodDefinition" && member.kind === "constructor")
+            for (const raw of constructor?.value.params ?? []) {
+                const parameter = parameterOf(raw)
+                const annotation = parameter.typeAnnotation?.typeAnnotation
+                if (namesGuardType(annotation) || injectsGuardToken(raw) || injectsGuardToken(parameter)) {
+                    context.report({ node: raw, messageId: "guardInGuard", data: { name: parameter.name ?? "guard" } })
+                }
+            }
+        }
+        return { ClassDeclaration: check, ClassExpression: check }
+    },
+}
+
 /** Every rule this module ships, by the name a config switches it on under. */
 export const rules = {
     "no-auth-use-guards": noAuthUseGuards,
+    "no-guard-injects-guard": noGuardInjectsGuard,
 }
 
 /** The level a consuming repository switches this on at. */
 export const recommended = {
     "starci-be/no-auth-use-guards": "error",
+    "starci-be/no-guard-injects-guard": "error",
 }

package/builders.mjs

@@ -72,7 +72,7 @@ const isEntityClass = (checker, declaration) => {
         const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression
         const symbol = checker.getSymbolAtLocation(callee)
         if (!symbol) return false
-        const target = (symbol.flags & ts.SymbolFlags.Alias) !== 0 ? checker.getAliasedSymbol(symbol) : symbol
+        const target = ts.skipAlias(symbol, checker)
         return (target.getDeclarations?.() ?? []).some((found) => moduleOf(found, String(found.getSourceFile().fileName).replace(/\\/g, "/")) === "typeorm")
     })
 }
@@ -212,7 +212,7 @@ export const builderArrangesOnly = {
         }
         return {
             ImportDeclaration(node) {
-                if (node.source.value === "@jest/globals") context.report({ node, messageId: "assertion", data: { name: "@jest/globals" } })
+                if (["expect", "@jest/globals"].includes(node.source.value)) context.report({ node, messageId: "assertion", data: { name: node.source.value } })
             },
             Identifier(node) {
                 const parent = node.parent

package/config-owner.mjs

@@ -40,14 +40,6 @@ const PROCESS_MODULES = new Set(["process", "node:process"])
 /** `@nestjs/config`, `dotenv` and their subpaths. */
 const isConfigPackage = (source) => /^(?:@nestjs\/config|dotenv)(?:\/|$)/.test(source)
 
-/** `globalThis.process` and `global.process`. */
-const isGlobalProcess = (node) =>
-    node.type === "MemberExpression" &&
-    !node.computed &&
-    keyName(node.property) === "process" &&
-    node.object.type === "Identifier" &&
-    (node.object.name === "globalThis" || node.object.name === "global")
-
 /** True when the property of a member expression spells `env`. */
 const spellsEnv = (node) => (node.computed ? staticText(node.property) === "env" : keyName(node.property) === "env")
 
@@ -69,15 +61,49 @@ export const noDirectEnvRead = {
         const hfs = hfsOf(context)
         const inConfigOwner = isOwnedBy(hfs, filename, "platform", "config")
         let declaresEnvSource = false
-        const processNames = new Set(["process"])
-        const isLocal = (identifier) => {
+        const variableOf = (identifier) => {
             for (let scope = context.sourceCode.getScope(identifier); scope; scope = scope.upper) {
                 const variable = scope.set.get(identifier.name)
-                if (variable) return variable.defs.length > 0 && !variable.defs.every((definition) => definition.type === "ImportBinding")
+                if (variable) return variable
             }
-            return false
+            return null
+        }
+        const isGlobal = (node) => node?.type === "Identifier" && ["globalThis", "global"].includes(node.name) && !variableOf(node)?.defs.length
+        // Resolve aliases by their lexical binding: an identically named local or parameter is not Node's process.
+        const isProcess = (node, seen = new Set()) => {
+            if (!node) return false
+            if (["TSAsExpression", "TSTypeAssertion", "TSNonNullExpression", "TSSatisfiesExpression", "ChainExpression"].includes(node.type)) return isProcess(node.expression, seen)
+            if (node.type === "MemberExpression") {
+                return isGlobal(node.object) && (node.computed ? staticText(node.property) : keyName(node.property)) === "process"
+            }
+            if (node.type !== "Identifier") return false
+            const variable = variableOf(node)
+            if (!variable?.defs.length) return node.name === "process"
+            if (seen.has(node)) return false
+            seen.add(node)
+            return variable.defs.some((definition) => {
+                if (definition.type === "ImportBinding") {
+                    const specifier = definition.node
+                    return PROCESS_MODULES.has(definition.parent.source.value)
+                        && (specifier.type !== "ImportSpecifier" || keyName(specifier.imported) === "default")
+                }
+                if (definition.type !== "Variable") return false
+                const readScope = context.sourceCode.getScope(node).variableScope
+                const write = variable.references.filter((reference) => reference.isWrite()
+                    && [readScope, variable.scope.variableScope].includes(reference.from.variableScope)
+                    && reference.writeExpr?.range[1] <= node.range[0])
+                    .sort((left, right) => right.identifier.range[0] - left.identifier.range[0])[0]
+                // A const captured by a function keeps its initializer even when the function is declared first.
+                const source = write?.writeExpr ?? (definition.parent.kind === "const" ? definition.node.init : null)
+                if (!source) return false
+                const identifier = write?.identifier ?? definition.name
+                const parent = identifier.parent
+                if (parent.type === "Property" && parent.value === identifier && parent.parent.type === "ObjectPattern") {
+                    return isGlobal(source) && (parent.computed ? staticText(parent.key) : keyName(parent.key)) === "process"
+                }
+                return isProcess(source, seen)
+            })
         }
-        const isProcess = (node) => (node.type === "Identifier" && processNames.has(node.name) && !isLocal(node)) || isGlobalProcess(node)
         const isEnvSourceFile = () => inConfigOwner && declaresEnvSource
         const inWorld = isTestWorld(hfs, filename)
         const appRole = appRoleOf(hfs, filename)?.entry
@@ -101,7 +127,6 @@ export const noDirectEnvRead = {
                 if (!PROCESS_MODULES.has(source)) return
                 for (const specifier of node.specifiers) {
                     if (specifier.type === "ImportSpecifier" && (specifier.imported.name ?? specifier.imported.value) === "env") reportEnv(specifier)
-                    else if (specifier.type !== "ImportSpecifier" || (specifier.imported.name ?? specifier.imported.value) === "default") processNames.add(specifier.local.name)
                 }
             },
             ImportExpression(node) {
@@ -113,7 +138,11 @@ export const noDirectEnvRead = {
             },
             VariableDeclarator(node) {
                 if (!node.init || !isProcess(node.init) || node.id.type !== "ObjectPattern") return
-                if (node.id.properties.some((property) => property.type === "Property" && keyName(property.key) === "env")) reportEnv(node)
+                if (node.id.properties.some((property) => property.type === "Property" && (property.computed ? staticText(property.key) : keyName(property.key)) === "env")) reportEnv(node)
+            },
+            AssignmentExpression(node) {
+                if (node.operator !== "=" || node.left.type !== "ObjectPattern" || !isProcess(node.right)) return
+                if (node.left.properties.some((property) => property.type === "Property" && (property.computed ? staticText(property.key) : keyName(property.key)) === "env")) reportEnv(node)
             },
             CallExpression(node) {
                 const callee = node.callee