@starci/eslint-canon-be 3.4.39 → 3.4.41

package/runtime/scripts/hfs/architecture/transport-owner.mjs

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
+import { propertyValue } from './function-spec-providers.mjs';
 
 /**
  * R50 `transport-owner` (FE_TRANSPORT_OWNER), the machine half of the eslint transport rules. ESLint judges one file at a time by
@@ -14,14 +15,16 @@ import { machineKit } from './machine-ast.mjs';
  *   - two or more client folders, or two or more unions, in the repository (two apps each keeping one, or a package one plus an
  *     app one) are findings on every copy;
  *   - an app client or app union in a repository where more than one app calls the back end is a finding (it belongs to the package);
- *   - no file outside the client folder references the global `fetch`: a call, `globalThis.fetch`, `window.fetch`, or a
+ *   - no file outside the client folder and the stream reader folder (`fe.transport.stream`, `modules/api/sse/clients/`) references the global `fetch`: a call, `globalThis.fetch`, `window.fetch`, or a
  *     reference passed as a value (`useSWR(key, fetch)`, `const send = fetch`), all of which a spelling-based rule misses; with no
  *     client at all every such reference is a finding that says the repository has no client;
  *   - axios is imported only by the api owner (modules/api, the api package) for its rest calls; every other HTTP library is a
  *     second transport wherever it is imported, by static import, `import()` or `require()`;
  *   - an `ApolloClient` is constructed only inside the client folder;
- *   - every GraphQL operation (`graphql/queries/query-*.ts`, `graphql/mutations/mutation-*.ts`) imports the client (or the api
+ *   - every GraphQL operation (`graphql/queries/query-*.ts`, `graphql/mutations/mutation-*.ts`, `graphql/subscriptions/subscription-*.ts`) imports the client (or the api
  *     package that holds it), so an operation is a caller of the one transport and not a second one.
+ *   - every stream operation (`sse/<area>/stream-*.ts`) imports the stream reader, so a server-sent-events stream is read by the
+ *     transport client layer and not by a fetch of its own.
  */
 export const TRANSPORT_OWNER_RULE_IDS = ['FE_TRANSPORT_OWNER'];
 
@@ -34,11 +37,14 @@ const APP_CLIENT_SLOT = 'fe.transport.client';
 const APP_OUTCOME_SLOT = 'fe.transport.outcome';
 const PACKAGE_API_SLOT = 'fe.package.api';
 const CLIENT_SLOTS = new Set([APP_CLIENT_SLOT, 'fe.package.api.client']);
+/** The stream reader (server-sent events) is the second half of the transport client layer: it may call `fetch`, and it is no second Apollo client folder. */
+const STREAM_SLOT = 'fe.transport.stream';
 /** The api owner: the slots whose files may import axios (the rest calls and the client's own links). */
 const API_OWNER_SLOTS = new Set(['fe.modules.api', PACKAGE_API_SLOT, ...CLIENT_SLOTS]);
 /** The slots that hold the GraphQL operations of an app or of the api package. */
 const OPERATION_SLOTS = new Set(['fe.modules.api', PACKAGE_API_SLOT]);
-const OPERATION_FILE = /^(?:query|mutation)-[^/]+\.ts$/u;
+const OPERATION_FILE = /^(?:query|mutation|subscription)-[^/]+\.ts$/u;
+const STREAM_OPERATION_FILE = /^stream-[^/]+\.ts$/u;
 const NO_CLIENT = "the repository has no transport client. Create the one Apollo client folder (packages/<family>-api/src/graphql/clients/, or the only app's modules/api/graphql/clients/) and call the back end through it.";
 
 /** True when `node` names the global fetch: no import, and no declaration outside a lib declaration file. */
@@ -108,11 +114,25 @@ function inspectLibraryImport({ ts, file, node, transport, report }) {
   report(file, node, `${specifier.text} is a second HTTP transport in ${file.rel}; ${where}.`, { library: specifier.text });
 }
 
+/** True when a call of fetch declares, in its init object literal, the request header accept: "text/event-stream". */
+function asksForEventStream(ts, node) {
+  const call = node.parent && ts.isCallExpression(node.parent) && node.parent.expression === node ? node.parent : null;
+  const init = call?.arguments[1];
+  if (!init || !ts.isObjectLiteralExpression(init)) return false;
+  const headers = propertyValue(ts, init, 'headers');
+  const accept = headers && ts.isObjectLiteralExpression(headers) ? propertyValue(ts, headers, 'accept') : null;
+  return Boolean(accept && ts.isStringLiteralLike(accept) && accept.text === 'text/event-stream');
+}
+
 function inspectTransportNode(scope, node) {
   const { ts, kit, checker, file, isClient, owned, report } = scope;
   const fetchUse = globalFetchUse(ts, kit, checker, node);
   if (fetchUse !== null) {
     if (isClient) return false;
+    if (file.slot === STREAM_SLOT) {
+      if (!asksForEventStream(ts, node)) report(file, node, `${file.rel} fetches something other than an event stream; the stream reader folder reads server-sent events only (accept: "text/event-stream"), every other request is an operation of modules/api run by Apollo or axios.`);
+      return false;
+    }
     if (fetchUse === 'property') report(file, node, `${node.getText(file.sourceFile)} reaches the global fetch outside the transport client; ${owned}`);
     else report(file, node, `fetch is used outside the transport client (called, aliased or passed as a value); ${owned}`);
     return false;
@@ -131,6 +151,27 @@ function reachesClient(graph, file, clientRels) {
   });
 }
 
+/** True for a stream operation of the app's api layer: `modules/api/sse/<area>/stream-<channel>.ts`. */
+function isStreamOperation(file) {
+  return file.slot === 'fe.modules.api' && STREAM_OPERATION_FILE.test(path.posix.basename(file.rel)) && path.posix.basename(path.posix.dirname(path.posix.dirname(file.rel))) === 'sse';
+}
+
+/** True when the stream operation imports a file of the stream reader folder. */
+function reachesStreamReader(graph, file) {
+  return graph.edges.some(edge => edge.from === file.rel && edge.runtime && graph.files.get(edge.to)?.slot === STREAM_SLOT);
+}
+
+/** Only a stream operation (or the reader folder itself) imports the stream reader: a REST call, a GraphQL operation or a hook never does. */
+function inspectReaderImporters({ files, graph, report }) {
+  const byRel = new Map(files.map(file => [file.rel, file]));
+  for (const edge of graph.edges) {
+    if (!edge.runtime || graph.files.get(edge.to)?.slot !== STREAM_SLOT) continue;
+    const from = byRel.get(edge.from);
+    if (!from || from.slot === STREAM_SLOT || isStreamOperation(from)) continue;
+    report(from, from.sourceFile, `${from.rel} imports the stream reader (modules/api/sse/clients); only a stream operation (sse/<area>/stream-<channel>.ts) reads a server-sent-events stream.`);
+  }
+}
+
 function inspectTransportFiles({ files, graph, kit, ts, clientRels, transport, owned, report }) {
   const appsWithFiles = new Set();
   let operations = 0;
@@ -142,7 +183,12 @@ function inspectTransportFiles({ files, graph, kit, ts, clientRels, transport, o
       operations += 1;
       if (!reachesClient(graph, file, clientRels)) report(file, file.sourceFile, `${file.rel} is a GraphQL operation that does not import the transport client; an operation runs through the repository's one Apollo client, never through its own transport.`);
     }
+    if (isStreamOperation(file)) {
+      operations += 1;
+      if (!reachesStreamReader(graph, file)) report(file, file.sourceFile, `${file.rel} is a stream operation that does not import the stream reader (modules/api/sse/clients); a stream operation runs on the transport client layer's reader, never on a fetch of its own.`);
+    }
   }
+  inspectReaderImporters({ files, graph, report });
   return { appsWithFiles, operations };
 }
 

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -1,7 +1,7 @@
 // declaration-shape.mjs - the dependency-free hfs.json shape validation used by the HFS slot loader. Semantic checks
 // against a loaded manifest remain in slots.mjs; this module mirrors modules/schemas/hfs-repo.schema.yaml only.
 import { isPlainObject } from '../../engine/plain-object.mjs';
-import { APP_KIND, connectionShapeProblems, NAME, RUNTIME_KIND, SLOT_ID } from './manifest-shape.mjs';
+import { APP_KIND, connectionShapeProblems, NAME, PACKAGE_NAME, RUNTIME_KIND, SLOT_ID } from './manifest-shape.mjs';
 import { kindShapeProblems, patternShapeProblems } from './declaration-slots.mjs';
 import { byCodeUnit } from '../lib/list.mjs';
 
@@ -60,8 +60,6 @@ function connectionProblems(side, value) {
 /** Whether a declared list is present but not a list of distinct entries that all satisfy `valid`. */
 const isBadUniqueList = (list, valid) => list !== undefined && (!Array.isArray(list) || !list.every((entry) => valid(entry)) || new Set(list).size !== list.length);
 
-const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
-
 function validExtraPackage(entry) {
   return isPlainObject(entry) && Object.keys(entry).every(key => key === 'name' || key === 'reason')
     && typeof entry.name === 'string' && entry.name.length <= 214 && PACKAGE_NAME.test(entry.name)
@@ -79,9 +77,11 @@ function declarationSideProblems(side, value, names) {
   const bad = [];
   const at = `sides.${side}`;
   if (!isPlainObject(value)) return [`${at} must be an object`];
-  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'backing'].includes(key)) bad.push(`${at} has unknown key ${key}`);
   bad.push(...appShapeProblems(value.apps, at, side, names));
   if (isBadUniqueList(value.optionalSlots, (slot) => SLOT_ID.test(String(slot)))) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
+  if (value.backing !== undefined && side !== 'be') bad.push('backing belongs to the be side');
+  else if (isBadUniqueList(value.backing, (name) => NAME.test(String(name)))) bad.push(`${at}.backing must be a unique list of backing service names`);
   bad.push(...patternShapeProblems(value, at, NAME), ...kindShapeProblems(value, at, NAME));
   if (isBadUniqueList(value.reads, (read) => typeof read === 'string' && read.length > 0)) bad.push(`${at}.reads must be a unique list of paths`);
   if (value.connections !== undefined) bad.push(...connectionProblems(side, value));

package/runtime/scripts/hfs/declaration-slots.mjs

@@ -1,7 +1,7 @@
 // declaration-slots.mjs - how an app declaration (hfs.json) switches on the opt-in slots of a side: by name (`optionalSlots`), by app kind
 // (a slot with `appKind`) and by declared pattern (a slot with `pattern: <name>` is enabled by `sides.<side>.patterns: [<name>]`, one
-// mechanism for every pattern: saga, event-bus, fenced-job, ...). slots.mjs asks this file to judge a side's lists and to say whether a
-// slot is enabled for a repository.
+// mechanism for pattern slots). A cross-cutting pattern can instead be owned by the side's canonical proof scenario catalog.
+// slots.mjs asks this file to judge a side's lists and to say whether a slot is enabled for a repository.
 
 /** The problems of a side's `optionalSlots` and `patterns` against the manifest. */
 export function optionalSlotProblems(manifest, side, s) {
@@ -13,7 +13,9 @@ export function optionalSlotProblems(manifest, side, s) {
     else if (slot.appKind !== undefined) bad.push(`sides.${side}.optionalSlots names ${id}; an app of kind ${slot.appKind} enables it`);
   }
   for (const name of s.patterns ?? []) {
-    if (!manifest.slots.some((slot) => slot.profiles.includes(side) && slot.pattern === name)) bad.push(`sides.${side}.patterns names ${name}, which no ${side} slot declares as its pattern`);
+    const ownsSlot = manifest.slots.some((slot) => slot.profiles.includes(side) && slot.pattern === name);
+    const ownsProof = Object.hasOwn(manifest.ruleParams?.[side]?.patternScenarios ?? {}, name);
+    if (!ownsSlot && !ownsProof) bad.push(`sides.${side}.patterns names ${name}, which neither a ${side} slot nor its proof scenario catalog declares`);
   }
   if (s.kinds !== undefined && side !== 'be') bad.push(`sides.${side}.kinds belongs to the be side`);
   for (const kind of s.kinds ?? []) {
@@ -22,6 +24,13 @@ export function optionalSlotProblems(manifest, side, s) {
   return bad;
 }
 
+/** The problems of a side's `backing` list: every name is a backing service of ruleParams.be.backing (ruling:R212/case-10). */
+export function backingProblems(manifest, side, s) {
+  const services = Object.keys(manifest.ruleParams?.be?.backing ?? {});
+  return (s.backing ?? []).filter((name) => !services.includes(name))
+    .map((name) => `sides.${side}.backing names ${name}, which is not one of ruleParams.be.backing (${services.join(', ')})`);
+}
+
 /** The problems of the shape of a side's `patterns` list (a unique list of pattern names). */
 export function patternShapeProblems(s, at, namePattern) {
   const list = s.patterns;

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -8,6 +8,8 @@ import { stringList, byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
 
 export const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
 export const NAME = /^[a-z][a-z0-9-]*$/;
+/** An npm package name, scoped or not. */
+export const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
 const ENV_PREFIX =/^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$/;
 /** How a bounded context (a connection) is isolated: its own logical database, or its own schema of a shared one. */
 const CONTEXT_ISOLATIONS = Object.freeze(["database", "schema"]);
@@ -66,14 +68,15 @@ export function unitRolesProblems(be) {
   return [];
 }
 
-/** Shape problems of ruleParams.be.logicRoles and thinRoles: each a non-empty list of unique roles of the suffix vocabulary; every unit role is a logic role. */
+/** Shape problems of ruleParams.be.logicRoles, valueRoles and thinRoles: each a non-empty list of unique roles of the suffix vocabulary; every unit role is a logic role. */
 export function roleListProblems(be) {
   const bad = [];
-  for (const key of ['logicRoles', 'thinRoles']) {
+  for (const key of ['logicRoles', 'valueRoles', 'thinRoles']) {
     const list = be[key];
     if (!strList(list) || !list.length || new Set(list).size !== list.length || !list.every((role) => NAME.test(role))) bad.push(`ruleParams.be.${key} must be a non-empty list of unique kebab-case roles`);
     else if (Array.isArray(be.suffixes) && list.some((role) => !be.suffixes.includes(role))) bad.push(`ruleParams.be.${key} names a role that is not in ruleParams.be.suffixes`);
   }
+  if (strList(be.valueRoles) && strList(be.logicRoles) && be.valueRoles.some((role) => !be.logicRoles.includes(role))) bad.push('every ruleParams.be.valueRoles role is a logic role (ruleParams.be.logicRoles)');
   if (strList(be.logicRoles) && Array.isArray(be.unitRoles) && be.unitRoles.some((r) => r?.slot === undefined && !be.logicRoles.includes(r?.role))) bad.push('every ruleParams.be.unitRoles role that is not tied to a slot is a logic role (ruleParams.be.logicRoles)');
   return bad;
 }
@@ -359,13 +362,14 @@ function runtimeParamProblems(rp) {
 const folderKindsValid = list => strList(list) && list.length > 0 && new Set(list).size === list.length && list.every(kind => NAME.test(kind));
 const kindPairValid = pair => isPlainObject(pair) && Object.keys(pair).sort(byCodeUnit).join() === 'from,to'
   && ['from', 'to'].every(side => folderKindsValid(pair[side]));
-const kindRestrictionValid = kinds => isPlainObject(kinds) && Object.keys(kinds).length > 0
-  && Object.entries(kinds).every(([target, pair]) => NAME.test(target) && kindPairValid(pair));
+/** A non-empty map whose every key is a name and every value satisfies `valid`. */
+export const namedMapValid = (map, valid) => isPlainObject(map) && Object.keys(map).length > 0
+  && Object.entries(map).every(([name, entry]) => NAME.test(name) && valid(entry));
+const kindRestrictionValid = kinds => namedMapValid(kinds, kindPairValid);
 const slotIdsValid = list => strList(list) && list.length > 0 && new Set(list).size === list.length
   && list.every(id => SLOT_ID.test(id) || RUNTIME_SLOT_ID.test(id));
 const slotRestrictionPairValid = pair => isPlainObject(pair) && Object.keys(pair).join() === 'from' && slotIdsValid(pair.from);
-const slotRestrictionValid = slots => isPlainObject(slots) && Object.keys(slots).length > 0
-  && Object.entries(slots).every(([target, pair]) => NAME.test(target) && slotRestrictionPairValid(pair));
+const slotRestrictionValid = slots => namedMapValid(slots, slotRestrictionPairValid);
 
 function tierDefinitionProblems(profile, tier, def) {
   const bad = [];

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -4,11 +4,15 @@
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { paramNamesOk } from './param-names.mjs';
 import { kindParamProblems, scenarioProblem } from './declaration-slots.mjs';
-import { NAME, roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
+import { NAME, namedMapValid, PACKAGE_NAME, roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
 import { byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
 
 const PROFILES = ['be', 'fe'];
-const BE_OWN = ['infraOwners', 'eventBus', 'specDoubles', 'paramNames', 'suffixes', 'bannedSuffixes', 'contractShape', 'unitRoles', 'logicRoles', 'thinRoles', 'patternScenarios', 'kindPatterns', 'addKinds'];
+const BE_OWN = ['infraOwners', 'eventBus', 'specDoubles', 'paramNames', 'suffixes', 'bannedSuffixes', 'contractShape', 'unitRoles', 'logicRoles', 'valueRoles', 'thinRoles', 'patternScenarios', 'kindPatterns', 'addKinds', 'backing'];
+const backingEntryOk = (entry) => isPlainObject(entry) && Object.keys(entry).sort(byCodeUnit).join() === 'clients,images,patterns'
+  && nonemptyUniqueList(entry.clients, (name) => PACKAGE_NAME.test(String(name)))
+  && Array.isArray(entry.patterns) && entry.patterns.every((name) => NAME.test(String(name))) && new Set(entry.patterns).size === entry.patterns.length
+  && nonemptyUniqueList(entry.images, (name) => PACKAGE_NAME.test(String(name)));
 const FORM_NAMES = new Set(['call', 'new', 'curried', 'object', 'primitive', 'array']);
 const blockOk = (v) => isPlainObject(v) && Number.isInteger(v.lines) && v.lines >= 2 && Number.isInteger(v.tokens) && v.tokens >= 1 && Object.keys(v).length === 2;
 const fileLinesOk = (v) => isPlainObject(v) && Number.isInteger(v.soft) && v.soft >= 1 && typeof v.hardGrowth === 'boolean' && Object.keys(v).length === 2;
@@ -30,7 +34,12 @@ const formsOk = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => FORM_N
 const doubleOk = (v) => isPlainObject(v) && /^[A-Za-z][A-Za-z0-9]*$/.test(String(v.double)) && formsOk(v.forms);
 const regexOk = (v) => { try { return typeof v === 'string' && v.length > 0 && Boolean(new RegExp(v)); } catch { return false; } };
 const dbExtensionsOk = (value) => Array.isArray(value) && value.every((name) => typeof name === 'string' && name.length > 0) && new Set(value).size === value.length;
-const dbParamsOk = (db) => db === undefined || (isPlainObject(db) && Object.entries(db).every(([key, value]) => key === 'extensions' && dbExtensionsOk(value)));
+const SQL_NAME = /^[a-z_][a-z0-9_]*$/;
+const queueOutboxOk = (value) => isPlainObject(value) && Object.keys(value).sort(byCodeUnit).join() === 'columns,table'
+  && typeof value.table === 'string' && value.table.split('.').length === 2 && value.table.split('.').every((part) => SQL_NAME.test(part))
+  && nonemptyUniqueList(value.columns, (column) => SQL_NAME.test(String(column))) && value.columns.includes('queue');
+const DB_PARAMS = { extensions: dbExtensionsOk, queueOutbox: queueOutboxOk };
+const dbParamsOk = (db) => db === undefined || (isPlainObject(db) && Object.entries(db).every(([key, value]) => Object.hasOwn(DB_PARAMS, key) && DB_PARAMS[key](value)));
 
 function beSpecificProblems(be, manifest) {
   const bad = [];
@@ -42,11 +51,12 @@ function beSpecificProblems(be, manifest) {
   const eventBus = be.eventBus;
   if (!isPlainObject(eventBus) || Object.keys(eventBus).sort(byCodeUnit).join() !== 'classes,imports' || !memberMap(eventBus.imports, true) || !memberMap(eventBus.classes, false)) bad.push('ruleParams.be.eventBus must be {imports: {<module>: [unique PascalCase members]}, classes: {<module>: [non-empty unique PascalCase classes]}}');
   if (!paramNamesOk(be.paramNames)) bad.push('ruleParams.be.paramNames must be a non-empty list of unique {type | typeSuffix, names, nameSuffix?} entries');
+  if (!namedMapValid(be.backing, backingEntryOk)) bad.push('ruleParams.be.backing must map a backing service name to {clients: [unique package names], patterns: [unique pattern names], images: [unique image repositories]}');
   if (!roleList(be.suffixes)) bad.push('ruleParams.be.suffixes must be a non-empty list of unique kebab-case role suffixes');
   if (!roleList(be.bannedSuffixes)) bad.push('ruleParams.be.bannedSuffixes must be a non-empty list of unique kebab-case suffixes');
   else if (roleList(be.suffixes) && be.suffixes.some((x) => be.bannedSuffixes.includes(x))) bad.push('ruleParams.be.suffixes and bannedSuffixes must be disjoint');
   const sd = be.specDoubles;
-  if (!isPlainObject(sd) || Object.keys(sd).sort(byCodeUnit).join() !== 'doubles,fallback,kit' || typeof sd.kit !== 'string' || !sd.kit || !Array.isArray(sd.doubles) || !sd.doubles.length || !sd.doubles.every((e) => doubleOk(e) && regexOk(e.token) && Object.keys(e).length === 3) || !doubleOk(sd.fallback) || Object.keys(sd.fallback).length !== 2) bad.push('ruleParams.be.specDoubles must be {kit, doubles: [{token: regex, double, forms}], fallback: {double, forms}} with forms drawn from call, new, curried, object, primitive, array');
+  if (!isPlainObject(sd) || Object.keys(sd).sort(byCodeUnit).join() !== 'doubles,fallback,kit' || typeof sd.kit !== 'string' || !sd.kit || !Array.isArray(sd.doubles) || !sd.doubles.length || !sd.doubles.every((e) => doubleOk(e) && regexOk(e.token) && (e.from === undefined || regexOk(e.from)) && Object.keys(e).length === (e.from === undefined ? 3 : 4)) || !doubleOk(sd.fallback) || Object.keys(sd.fallback).length !== 2) bad.push('ruleParams.be.specDoubles must be {kit, doubles: [{token: regex, double, forms}], fallback: {double, forms}} with forms drawn from call, new, curried, object, primitive, array');
   return bad;
 }
 
@@ -59,10 +69,10 @@ export function ruleParamsProblems(m) {
     // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
     // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
     if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns and addKinds (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
     bad.push(...beSpecificProblems(rp.be, m));
     if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
-    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions: a list of unique non-empty extension names');
+    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names) and queueOutbox ({table: <schema>.<table>, columns: [unique column names including queue]})');
   }
   return bad;
 }

package/runtime/scripts/hfs/rules/database-constants.mjs

@@ -0,0 +1,26 @@
+// Single source of database-rule finding codes and owned Supabase paths.
+export const DB_MIGRATION_SHAPE = 'DB_MIGRATION_SHAPE';
+export const DB_RLS_REQUIRED = 'DB_RLS_REQUIRED';
+export const DB_DYNAMIC_DDL = 'DB_DYNAMIC_DDL';
+export const DB_POLICY_SHAPE = 'DB_POLICY_SHAPE';
+export const DB_DEFINER_SAFE = 'DB_DEFINER_SAFE';
+export const DB_STORAGE_POLICY = 'DB_STORAGE_POLICY';
+export const DB_CONFIG_POLICY = 'DB_CONFIG_POLICY';
+export const DB_TYPES_DRIFT = 'DB_TYPES_DRIFT';
+export const DB_BASELINE_SHAPE = 'DB_BASELINE_SHAPE';
+export const DB_ARCHIVE_MUTATED = 'DB_ARCHIVE_MUTATED';
+export const DB_PGMQ_DECLARED = 'DB_PGMQ_DECLARED';
+export const DB_CRON_OWNED = 'DB_CRON_OWNED';
+export const DB_EXTENSION_ALLOWED = 'DB_EXTENSION_ALLOWED';
+export const DB_API_EXPOSED = 'DB_API_EXPOSED';
+export const DB_MIGRATION_DESTRUCTIVE = 'DB_MIGRATION_DESTRUCTIVE';
+export const HFS_SEED_PII = 'HFS_SEED_PII';
+export const DB_VAULT_WRITE = 'DB_VAULT_WRITE';
+
+export const MIGRATIONS_DIR = 'supabase/migrations';
+/** The migrations retired at a baseline cutover (slot app.supabase.migrations.archive): never applied, never judged by L02-L08. */
+export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/_archive`;
+/** True for a migration the Supabase CLI applies: a path under supabase/migrations/ outside the archive. */
+export const isActiveMigration = (file) => file.startsWith(`${MIGRATIONS_DIR}/`) && !file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`);
+export const CONFIG_FILE = 'supabase/config.toml';
+export const TYPES_FILE = 'supabase/types/database.types.ts';