@starci/hfs 4.11.21 → 4.12.0

package/runtime/scripts/hfs/rules/env-value-shape.d.mts

@@ -0,0 +1,21 @@
+import type { Parsed } from './rule-types.mjs';
+export declare const ENV_VALUE_SHAPE = "ENV_VALUE_SHAPE";
+/** The findings of R249 over the `*.env.example` files of an app judged at its root scope (both editions). */
+export declare function envValueShapeFindings({ repoRoot, all, isRoot }: {
+    repoRoot: string;
+    all?: string[];
+    isRoot: boolean;
+}): import("./rule-types.mjs").Finding[];
+/**
+ * `starci app secret verify --env <env>`: decrypt every member of `directory` in memory through the `sops` seam and check
+ * each value against the shape its EnvSource reader declares. Output names the environment, the member, the key and
+ * the violated shape, never a value. Returns the CLI exit code: 0 verified, 2 violations.
+ */
+export declare function verifySecrets({ repoRoot, directory, environment, sops, stdout, typescript }: {
+    repoRoot: string;
+    directory: string;
+    environment: Parsed;
+    sops: Parsed;
+    stdout: Parsed;
+    typescript: Parsed;
+}): 0 | 2;

package/runtime/scripts/hfs/rules/env-value-shape.mjs

@@ -2,7 +2,7 @@
 // read): a stored environment value parses as the type its `EnvSource` reader declares. The reader shapes come from
 // the same static TypeScript walk as the env-key parity (collectEnvReads).
 //   - the finder judges the concrete values of `*.env.example` files: a value that is not a placeholder must parse;
-//   - `starci app secret verify <env>` (verifySecrets) decrypts every member of the environment in memory through the
+//   - `starci app secret verify --env <env>` (verifySecrets) decrypts every member of the environment in memory through the
 //     sops seam and checks each stored value against its reader's shape; output names the environment, the member,
 //     the key and the violated shape - never a value.
 import fs from 'node:fs';
@@ -15,97 +15,112 @@ import { sealedFiles } from '../secret-store.mjs';
 import { SecretError } from '../secret-errors.mjs';
 import { collectEnvReads, envExampleEntries, isEnvSourcePath } from './env-parity.mjs';
 import { found, readText } from './read.mjs';
-
 export const ENV_VALUE_SHAPE = 'ENV_VALUE_SHAPE';
-
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const SKIP_DIRECTORY = new Set(['node_modules', 'dist', 'coverage', '.git']);
-
 const SHAPES = Object.freeze({
-  int: { text: 'an integer', ok: (value) => value.trim() !== '' && Number.isInteger(Number(value)) },
-  bool: { text: 'true or false', ok: (value) => value === 'true' || value === 'false' },
-  url: { text: 'an absolute URL', ok: (value) => URL.canParse(value) },
-  duration: { text: 'a duration (250, 250ms, 30s, 5m or 2h)', ok: (value) => /^\d+(?:ms|s|m|h)?$/u.test(value) },
-  string: { text: 'a nonempty value', ok: (value) => value.length > 0 },
+    int: { text: 'an integer', ok: (value) => value.trim() !== '' && Number.isInteger(Number(value)) },
+    bool: { text: 'true or false', ok: (value) => value === 'true' || value === 'false' },
+    url: { text: 'an absolute URL', ok: (value) => URL.canParse(value) },
+    duration: { text: 'a duration (250, 250ms, 30s, 5m or 2h)', ok: (value) => /^\d+(?:ms|s|m|h)?$/u.test(value) },
+    string: { text: 'a nonempty value', ok: (value) => value.length > 0 },
 });
-
 /** What a shape violation is called in output; the enum shape names its allowed values. */
 const shapeText = (shape) => (shape.kind === 'enum' ? `one of ${shape.allowed.join(', ')}` : SHAPES[shape.kind].text);
-
 /** Whether `value` parses as `shape` declares. */
 const shapeOk = (shape, value) => (shape.kind === 'enum' ? shape.allowed.includes(value) : SHAPES[shape.kind]?.ok(value) ?? true);
-
 /** An example line holds a documented stand-in, not a value to parse: empty, an `<...>` name or a `${...}` reference. */
 const isPlaceholder = (value) => value === '' || value.includes('${') || (value.startsWith('<') && value.endsWith('>'));
-
 /** The repository-relative env source files on disk: the be side of an app, else the src tree of a back-end repository. */
 function listEnvSourceFiles(repoRoot) {
-  const out = [];
-  const walk = (dir, rel) => {
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORY.has(entry.name)) walk(path.join(dir, entry.name), `${rel}${entry.name}/`);
-      } else if (isEnvSourcePath(rel + entry.name)) out.push(rel + entry.name);
+    const out = [];
+    const walk = (dir, rel) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRECTORY.has(entry.name))
+                    walk(path.join(dir, entry.name), `${rel}${entry.name}/`);
+            }
+            else if (isEnvSourcePath(rel + entry.name))
+                out.push(rel + entry.name);
+        }
+    };
+    const roots = ['be', 'src'].map((name) => path.join(repoRoot, name)).filter((dir) => { try {
+        return fs.statSync(dir).isDirectory();
     }
-  };
-  const roots = ['be', 'src'].map((name) => path.join(repoRoot, name)).filter((dir) => { try { return fs.statSync(dir).isDirectory(); } catch { return false; } });
-  for (const root of roots) walk(root, `${path.basename(root)}/`);
-  return out.sort(byCodeUnit);
+    catch {
+        return false;
+    } });
+    for (const root of roots)
+        walk(root, `${path.basename(root)}/`);
+    return out.sort(byCodeUnit);
 }
-
 /** The ENV_VALUE_SHAPE violations of one decrypted map against the walked reader shapes; keys and shapes only. */
 function shapeViolations(reads, map) {
-  const violations = [];
-  for (const [key, value] of Object.entries(map)) {
-    if (key.endsWith('_FILE')) continue;
-    const shape = reads.get(key)?.shape;
-    if (shape && !shapeOk(shape, value)) violations.push({ key, expected: shapeText(shape) });
-  }
-  return violations;
+    const violations = [];
+    for (const [key, value] of Object.entries(map)) {
+        if (key.endsWith('_FILE'))
+            continue;
+        const shape = reads.get(key)?.shape;
+        if (shape && !shapeOk(shape, value))
+            violations.push({ key, expected: shapeText(shape) });
+    }
+    return violations;
 }
-
 /** The findings of R249 over the `*.env.example` files of an app judged at its root scope (both editions). */
 export function envValueShapeFindings({ repoRoot, all = [], isRoot }) {
-  if (!isRoot) return [];
-  const examples = all.filter((file) => file.endsWith('.env.example'));
-  if (!examples.length) return [];
-  const reads = collectEnvReads(repoRoot, all);
-  if (reads === null) return [];
-  const findings = [];
-  for (const file of examples) {
-    const text = readText(repoRoot, file);
-    if (text === null) continue;
-    for (const { key, value } of envExampleEntries(text)) {
-      if (isPlaceholder(value)) continue;
-      const shape = reads.get(key)?.shape;
-      if (shape && !shapeOk(shape, value)) {
-        findings.push(found(ENV_VALUE_SHAPE, file, `${file} gives ${key} a value that is not ${shapeText(shape)}; an env example must parse as the EnvSource reader declares`));
-      }
+    if (!isRoot)
+        return [];
+    const examples = all.filter((file) => file.endsWith('.env.example'));
+    if (!examples.length)
+        return [];
+    const reads = collectEnvReads(repoRoot, all);
+    if (reads === null)
+        return [];
+    const findings = [];
+    for (const file of examples) {
+        const text = readText(repoRoot, file);
+        if (text === null)
+            continue;
+        for (const { key, value } of envExampleEntries(text)) {
+            if (isPlaceholder(value))
+                continue;
+            const shape = reads.get(key)?.shape;
+            if (shape && !shapeOk(shape, value)) {
+                findings.push(found(ENV_VALUE_SHAPE, file, `${file} gives ${key} a value that is not ${shapeText(shape)}; an env example must parse as the EnvSource reader declares`));
+            }
+        }
     }
-  }
-  return findings;
+    return findings;
 }
-
 /**
- * `starci app secret verify <env>`: decrypt every member of `directory` in memory through the `sops` seam and check
+ * `starci app secret verify --env <env>`: decrypt every member of `directory` in memory through the `sops` seam and check
  * each value against the shape its EnvSource reader declares. Output names the environment, the member, the key and
  * the violated shape, never a value. Returns the CLI exit code: 0 verified, 2 violations.
  */
 export function verifySecrets({ repoRoot, directory, environment, sops, stdout, typescript }) {
-  const ts = typescript ?? loadTypescript(repoRoot, HERE);
-  if (!ts) throw new SecretError('verify needs the app\'s TypeScript to read <app>.env.ts; install the app\'s dependencies');
-  const reads = collectEnvReads(repoRoot, listEnvSourceFiles(repoRoot), ts);
-  const violations = [];
-  let keys = 0;
-  for (const name of sealedFiles(directory)) {
-    const file = path.join(directory, name);
-    const map = sops.decrypt(file, envelopeOf(fs.readFileSync(file, 'utf8')).format);
-    keys += Object.keys(map).length;
-    for (const violation of shapeViolations(reads, map)) violations.push({ member: name, ...violation });
-  }
-  for (const violation of violations) stdout(`ENV_VALUE_SHAPE ${environment}/${violation.member}: ${violation.key} is not ${violation.expected}\n`);
-  if (!violations.length) stdout(`verified ${environment}: ${keys} key${keys === 1 ? '' : 's'} sealed\n`);
-  return violations.length ? 2 : 0;
+    const ts = typescript ?? loadTypescript(repoRoot, HERE);
+    if (!ts)
+        throw new SecretError('verify needs the app\'s TypeScript to read <app>.env.ts; install the app\'s dependencies');
+    const reads = collectEnvReads(repoRoot, listEnvSourceFiles(repoRoot), ts);
+    const violations = [];
+    let keys = 0;
+    for (const name of sealedFiles(directory)) {
+        const file = path.join(directory, name);
+        const map = sops.decrypt(file, envelopeOf(fs.readFileSync(file, 'utf8')).format);
+        keys += Object.keys(map).length;
+        for (const violation of shapeViolations(reads, map))
+            violations.push({ member: name, ...violation });
+    }
+    for (const violation of violations)
+        stdout(`ENV_VALUE_SHAPE ${environment}/${violation.member}: ${violation.key} is not ${violation.expected}\n`);
+    if (!violations.length)
+        stdout(`verified ${environment}: ${keys} key${keys === 1 ? '' : 's'} sealed\n`);
+    return violations.length ? 2 : 0;
 }

package/runtime/scripts/hfs/rules/event-bus.d.mts

@@ -0,0 +1,17 @@
+import type { Finding, Parsed, Repo } from './rule-types.mjs';
+/** The event-bus pattern file name of an event name: dots and underscores become dashes (`order.placed` -> `order-placed`,
+ * `installation_changed` -> `installation-changed`), the kebab case source-suffix gives every file. */
+export declare const stemOfEvent: (name: string) => string;
+/** Findings of BE_EVENT_CLASS_CONTRACT. */
+export declare function eventClassContractFindings({ repoRoot, files, repo }: {
+    repoRoot: string;
+    files: string[];
+    repo: Repo;
+}): Finding[];
+/** Full-edition proof scenarios; lite integration proofs are judged by lite-proof-lane.mjs. */
+export declare function patternSpecFindings({ repoRoot, files, repo, scenarios }: {
+    repoRoot: string;
+    files: string[];
+    repo: Repo;
+    scenarios?: Parsed;
+}): Finding[];

package/runtime/scripts/hfs/rules/event-bus.mjs

@@ -12,10 +12,8 @@ import { loadSlotManifest, ruleParams } from '../slots.mjs';
 import { loadTypescript } from '../../lib/package-at.mjs';
 import { literalText } from '../../lib/ts-ast.mjs';
 import { found, readJson, readText } from './read.mjs';
-
 const EVENT_CLASS_CONTRACT = 'BE_EVENT_CLASS_CONTRACT';
 const PATTERN_SPEC_MISSING = 'BE_PATTERN_SPEC_MISSING';
-
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const EVENT_FILE_PREFIX = 'be/src/modules/events/';
 const EVENT_SUFFIX = '.event.ts';
@@ -24,178 +22,192 @@ const CONTRACT_NAME = 'events.json';
 const TEST_FOLDERS = ['be/src/tests/e2e/', 'be/src/tests/integration/'];
 const SPEC_SUFFIXES = ['.e2e-spec.ts', '.integration-spec.ts'];
 const TEST_CALLEES = new Set(['it', 'test']);
-
 /** The TypeScript compiler of the app (else of the runtime), or null. */
 const typescriptFor = (repoRoot) => loadTypescript(repoRoot, HERE);
-
 /** The event-bus pattern file name of an event name: dots and underscores become dashes (`order.placed` -> `order-placed`,
  * `installation_changed` -> `installation-changed`), the kebab case source-suffix gives every file. */
 export const stemOfEvent = (name) => name.replaceAll(/[._]/gu, '-');
-
 /** The initializer of a `static` property member with an identifier name, parentheses and `as` casts stripped, else null. */
 function staticMemberValue(ts, member) {
-  if (!ts.isPropertyDeclaration(member) || !member.initializer || !member.name || !ts.isIdentifier(member.name)) return null;
-  const isStatic = member.modifiers?.some((m) => m.kind === ts.SyntaxKind.StaticKeyword);
-  if (!isStatic) return null;
-  let value = member.initializer;
-  while (ts.isAsExpression(value) || ts.isParenthesizedExpression(value)) value = value.expression;
-  return value;
+    if (!ts.isPropertyDeclaration(member) || !member.initializer || !member.name || !ts.isIdentifier(member.name))
+        return null;
+    const isStatic = member.modifiers?.some((m) => m.kind === ts.SyntaxKind.StaticKeyword);
+    if (!isStatic)
+        return null;
+    let value = member.initializer;
+    while (ts.isAsExpression(value) || ts.isParenthesizedExpression(value))
+        value = value.expression;
+    return value;
 }
-
 /** The `eventName` and `version` literals a class declares as `static readonly` members, with the line of the class. */
 function eventClassInfo(ts, node) {
-  let name = null;
-  let version = null;
-  for (const member of node.members) {
-    const value = staticMemberValue(ts, member);
-    if (!value) continue;
-    if (member.name.text === 'eventName') name = literalText(ts, value);
-    if (member.name.text === 'version' && ts.isNumericLiteral(value)) version = Number(value.text);
-  }
-  if (name !== null || version !== null || node.name) return { className: node.name?.text ?? '<anonymous>', name, version };
-  return null;
+    let name = null;
+    let version = null;
+    for (const member of node.members) {
+        const value = staticMemberValue(ts, member);
+        if (!value)
+            continue;
+        if (member.name.text === 'eventName')
+            name = literalText(ts, value);
+        if (member.name.text === 'version' && ts.isNumericLiteral(value))
+            version = Number(value.text);
+    }
+    if (name !== null || version !== null || node.name)
+        return { className: node.name?.text ?? '<anonymous>', name, version };
+    return null;
 }
-
 function readEventClass(ts, text, file) {
-  const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
-  const classes = [];
-  const visit = (node) => {
-    if (ts.isClassDeclaration(node)) {
-      const info = eventClassInfo(ts, node);
-      if (info) classes.push(info);
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(source);
-  return classes;
+    const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+    const classes = [];
+    const visit = (node) => {
+        if (ts.isClassDeclaration(node)) {
+            const info = eventClassInfo(ts, node);
+            if (info)
+                classes.push(info);
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return classes;
 }
-
 /** The service and file stem of a `be/src/modules/events/<service>/<event>.event.ts` path, else null. */
 function eventFileParts(file) {
-  if (!file.startsWith(EVENT_FILE_PREFIX) || !file.endsWith(EVENT_SUFFIX)) return null;
-  const rest = file.slice(EVENT_FILE_PREFIX.length).split('/');
-  if (rest.length !== 2) return null;
-  const [service, base] = rest;
-  return { service, stem: base.slice(0, -EVENT_SUFFIX.length) };
+    if (!file.startsWith(EVENT_FILE_PREFIX) || !file.endsWith(EVENT_SUFFIX))
+        return null;
+    const rest = file.slice(EVENT_FILE_PREFIX.length).split('/');
+    if (rest.length !== 2)
+        return null;
+    const [service, base] = rest;
+    return { service, stem: base.slice(0, -EVENT_SUFFIX.length) };
 }
-
 function recordEventClass(ts, text, file, { service, stem }, findings, classesByService) {
-  const classes = readEventClass(ts, text, file).filter((c) => c.name !== null || c.version !== null);
-  if (classes.length !== 1 || classes[0].name === null || classes[0].version === null) {
-    const candidates = classes.length === 1 ? 'one without both literals' : `${classes.length} candidates`;
-    findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} must declare exactly one event class with literal \`static readonly eventName\` and \`static readonly version\` members (the typed event of be/contracts/${service}/${CONTRACT_NAME}); found ${candidates}.`, { service }));
-    return;
-  }
-  const [event] = classes;
-  if (stemOfEvent(event.name) !== stem) findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} declares the event \`${event.name}\`, so the file is \`${stemOfEvent(event.name)}${EVENT_SUFFIX}\`: a class file is named after its event.`, { service, event: event.name }));
-  if (!classesByService.has(service)) classesByService.set(service, new Map());
-  classesByService.get(service).set(event.name, { file, version: event.version });
+    const classes = readEventClass(ts, text, file).filter((c) => c.name !== null || c.version !== null);
+    if (classes.length !== 1 || classes[0].name === null || classes[0].version === null) {
+        const candidates = classes.length === 1 ? 'one without both literals' : `${classes.length} candidates`;
+        findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} must declare exactly one event class with literal \`static readonly eventName\` and \`static readonly version\` members (the typed event of be/contracts/${service}/${CONTRACT_NAME}); found ${candidates}.`, { service }));
+        return;
+    }
+    const [event] = classes;
+    if (stemOfEvent(event.name) !== stem)
+        findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} declares the event \`${event.name}\`, so the file is \`${stemOfEvent(event.name)}${EVENT_SUFFIX}\`: a class file is named after its event.`, { service, event: event.name }));
+    if (!classesByService.has(service))
+        classesByService.set(service, new Map());
+    classesByService.get(service).set(event.name, { file, version: event.version });
 }
-
 function eventClassesOf(repoRoot, files, ts) {
-  const findings = [];
-  const classesByService = new Map();
-  for (const file of files) {
-    const parts = eventFileParts(file);
-    if (!parts) continue;
-    const text = readText(repoRoot, file);
-    if (text === null) continue;
-    recordEventClass(ts, text, file, parts, findings, classesByService);
-  }
-  return { findings, classesByService };
+    const findings = [];
+    const classesByService = new Map();
+    for (const file of files) {
+        const parts = eventFileParts(file);
+        if (!parts)
+            continue;
+        const text = readText(repoRoot, file);
+        if (text === null)
+            continue;
+        recordEventClass(ts, text, file, parts, findings, classesByService);
+    }
+    return { findings, classesByService };
 }
-
 function eventContractsOf(repoRoot, files) {
-  const contracts = new Map();
-  for (const file of files) {
-    if (!file.startsWith(CONTRACT_PREFIX) || !file.endsWith(`/${CONTRACT_NAME}`)) continue;
-    const rest = file.slice(CONTRACT_PREFIX.length).split('/');
-    if (rest.length !== 2) continue;
-    contracts.set(rest[0], { file, doc: readJson(repoRoot, file) });
-  }
-  return contracts;
+    const contracts = new Map();
+    for (const file of files) {
+        if (!file.startsWith(CONTRACT_PREFIX) || !file.endsWith(`/${CONTRACT_NAME}`))
+            continue;
+        const rest = file.slice(CONTRACT_PREFIX.length).split('/');
+        if (rest.length !== 2)
+            continue;
+        contracts.set(rest[0], { file, doc: readJson(repoRoot, file) });
+    }
+    return contracts;
 }
-
 function classContractFindings(classesByService, contracts) {
-  const findings = [];
-  for (const [service, byName] of classesByService) {
-    const contract = contracts.get(service);
-    for (const [name, { file, version }] of byName) {
-      const entry = contract?.doc?.events?.[name];
-      if (!contract) findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} declares the event \`${name}\` but ${CONTRACT_PREFIX}${service}/${CONTRACT_NAME} is not tracked; every event class is an entry of the vendored contract of its service.`, { service, event: name }));
-      else if (entry === undefined) findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} declares the event \`${name}\` which ${contract.file} does not list; emit the contract (\`starci app emit\`) so the class and the contract agree.`, { service, event: name }));
-      else if (entry.version !== version) findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} declares \`${name}\` at version ${version} but ${contract.file} lists version ${entry.version}; a version changes in the class and the contract together.`, { service, event: name }));
+    const findings = [];
+    for (const [service, byName] of classesByService) {
+        const contract = contracts.get(service);
+        for (const [name, { file, version }] of byName) {
+            const entry = contract?.doc?.events?.[name];
+            if (!contract)
+                findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} declares the event \`${name}\` but ${CONTRACT_PREFIX}${service}/${CONTRACT_NAME} is not tracked; every event class is an entry of the vendored contract of its service.`, { service, event: name }));
+            else if (entry === undefined)
+                findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} declares the event \`${name}\` which ${contract.file} does not list; emit the contract (\`starci app emit\`) so the class and the contract agree.`, { service, event: name }));
+            else if (entry.version !== version)
+                findings.push(found(EVENT_CLASS_CONTRACT, file, `${file} declares \`${name}\` at version ${version} but ${contract.file} lists version ${entry.version}; a version changes in the class and the contract together.`, { service, event: name }));
+        }
     }
-  }
-  return findings;
+    return findings;
 }
-
 function contractClassFindings(classesByService, contracts) {
-  const findings = [];
-  for (const [service, contract] of contracts) {
-    const events = contract.doc?.events;
-    if (events === null || typeof events !== 'object') continue;
-    for (const name of Object.keys(events)) {
-      if (!classesByService.get(service)?.has(name)) findings.push(found(EVENT_CLASS_CONTRACT, contract.file, `${contract.file} lists the event \`${name}\` but ${EVENT_FILE_PREFIX}${service}/${stemOfEvent(name)}${EVENT_SUFFIX} declares no such class; every contract entry has its typed event class.`, { service, event: name }));
+    const findings = [];
+    for (const [service, contract] of contracts) {
+        const events = contract.doc?.events;
+        if (events === null || typeof events !== 'object')
+            continue;
+        for (const name of Object.keys(events)) {
+            if (!classesByService.get(service)?.has(name))
+                findings.push(found(EVENT_CLASS_CONTRACT, contract.file, `${contract.file} lists the event \`${name}\` but ${EVENT_FILE_PREFIX}${service}/${stemOfEvent(name)}${EVENT_SUFFIX} declares no such class; every contract entry has its typed event class.`, { service, event: name }));
+        }
     }
-  }
-  return findings;
+    return findings;
 }
-
 /** Findings of BE_EVENT_CLASS_CONTRACT. */
 export function eventClassContractFindings({ repoRoot, files, repo }) {
-  const patterns = repo.sides?.be?.patterns ?? [];
-  if (!patterns.includes('event-bus')) return [];
-  const ts = typescriptFor(repoRoot);
-  if (!ts) return [];
-  const classes = eventClassesOf(repoRoot, files, ts);
-  const contracts = eventContractsOf(repoRoot, files);
-  return [...classes.findings, ...classContractFindings(classes.classesByService, contracts), ...contractClassFindings(classes.classesByService, contracts)];
+    const patterns = repo.sides?.be?.patterns ?? [];
+    if (!patterns.includes('event-bus'))
+        return [];
+    const ts = typescriptFor(repoRoot);
+    if (!ts)
+        return [];
+    const classes = eventClassesOf(repoRoot, files, ts);
+    const contracts = eventContractsOf(repoRoot, files);
+    return [...classes.findings, ...classContractFindings(classes.classesByService, contracts), ...contractClassFindings(classes.classesByService, contracts)];
 }
-
 /** Adds the `<pattern>` of every `<pattern>/<scenario>:` test title (the first argument of an `it(` or `test(` call) of the source. */
 function addProvenScenarios(ts, source, proven) {
-  const visit = (node) => {
-    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && TEST_CALLEES.has(node.expression.text)) {
-      const title = literalText(ts, node.arguments[0]);
-      const colon = title === null ? -1 : title.indexOf(':');
-      if (colon > 0) proven.add(title.slice(0, colon));
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(source);
+    const visit = (node) => {
+        if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && TEST_CALLEES.has(node.expression.text)) {
+            const title = literalText(ts, node.arguments[0]);
+            const colon = title === null ? -1 : title.indexOf(':');
+            if (title !== null && colon > 0)
+                proven.add(title.slice(0, colon));
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
 }
-
 /** The scenario ids a back end proves: every `<pattern>/<scenario>:` test title of an e2e or integration spec. */
 function provenScenarios(ts, repoRoot, files) {
-  const proven = new Set();
-  for (const file of files) {
-    if (!TEST_FOLDERS.some((folder) => file.startsWith(folder)) || !SPEC_SUFFIXES.some((suffix) => file.endsWith(suffix))) continue;
-    const text = readText(repoRoot, file);
-    if (text === null) continue;
-    addProvenScenarios(ts, ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true), proven);
-  }
-  return proven;
+    const proven = new Set();
+    for (const file of files) {
+        if (!TEST_FOLDERS.some((folder) => file.startsWith(folder)) || !SPEC_SUFFIXES.some((suffix) => file.endsWith(suffix)))
+            continue;
+        const text = readText(repoRoot, file);
+        if (text === null)
+            continue;
+        addProvenScenarios(ts, ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true), proven);
+    }
+    return proven;
 }
-
 let memoScenarios;
 /** ruleParams.be.patternScenarios of the slot manifest this runtime ships. */
 const scenariosTable = () => (memoScenarios ??= ruleParams(loadSlotManifest(), 'be').patternScenarios ?? {});
-
 /** Full-edition proof scenarios; lite integration proofs are judged by lite-proof-lane.mjs. */
 export function patternSpecFindings({ repoRoot, files, repo, scenarios = scenariosTable() }) {
-  if (repo.edition === 'lite') return [];
-  const patterns = (repo.sides?.be?.patterns ?? []).filter((name) => (scenarios[name] ?? []).length > 0);
-  if (patterns.length === 0) return [];
-  const ts = typescriptFor(repoRoot);
-  if (!ts) return [];
-  const proven = provenScenarios(ts, repoRoot, files);
-  const findings = [];
-  for (const pattern of patterns) {
-    for (const scenario of scenarios[pattern]) {
-      const id = `${pattern}/${scenario}`;
-      if (!proven.has(id)) findings.push(found(PATTERN_SPEC_MISSING, 'hfs.json', `The pattern \`${pattern}\` is declared but no e2e or integration spec (be/src/tests/e2e, be/src/tests/integration) holds a test titled \`${id}: ...\`; each scenario of a declared pattern is proven on the test world.`, { pattern, scenario: id }));
+    if (repo.edition === 'lite')
+        return [];
+    const patterns = (repo.sides?.be?.patterns ?? []).filter((name) => (scenarios[name] ?? []).length > 0);
+    if (patterns.length === 0)
+        return [];
+    const ts = typescriptFor(repoRoot);
+    if (!ts)
+        return [];
+    const proven = provenScenarios(ts, repoRoot, files);
+    const findings = [];
+    for (const pattern of patterns) {
+        for (const scenario of scenarios[pattern]) {
+            const id = `${pattern}/${scenario}`;
+            if (!proven.has(id))
+                findings.push(found(PATTERN_SPEC_MISSING, 'hfs.json', `The pattern \`${pattern}\` is declared but no e2e or integration spec (be/src/tests/e2e, be/src/tests/integration) holds a test titled \`${id}: ...\`; each scenario of a declared pattern is proven on the test world.`, { pattern, scenario: id }));
+        }
     }
-  }
-  return findings;
+    return findings;
 }

package/runtime/scripts/hfs/rules/event-tables.d.mts

@@ -0,0 +1,7 @@
+import type { Ts } from './rule-types.mjs';
+export declare function eventTableFindings({ ts, repoRoot, files }: {
+    ts: Ts;
+    repoRoot: string;
+    files: string[];
+}): import("./rule-types.mjs").Finding[];
+export declare const eventTableServices: (files: string[]) => (string | undefined)[];