@stjoseph/prumo 0.0.1

package/.prumo-templates/api/routes.md

@@ -0,0 +1,89 @@
+# Routes
+
+## Rule
+
+Set a global prefix of `api` and enable `VersioningType.URI`. Every route is reachable at
+`/api/v<n>/<resource>`.
+
+Name resources in the plural, kebab-case for compound words. Use REST verbs and Nest's default status
+codes.
+
+Put input DTOs in `dto/`, named as the generator names them: `CreateUserDto`, `UpdateUserDto`.
+
+Configure the global `ValidationPipe` with `whitelist: true`, `forbidNonWhitelisted: true` and
+`transform: true`. Leave `enableImplicitConversion` off; convert a field that needs it with `@Type()`.
+
+Return the entity. Serialize it with `ClassSerializerInterceptor`, marking with `@Exclude` every
+property that must not leave. Where the value arrives as a plain object, add
+`@SerializeOptions({ type: Entity })`. Do not write a response DTO per route.
+
+A controller receives the request, calls the service and returns. Everything else on it is a
+decorator.
+
+Enable the `@nestjs/swagger` CLI plugin. Decorate by hand only what it cannot infer: error responses,
+non-obvious status codes, route descriptions.
+
+Serve the documentation UI outside production only.
+
+## Rationale
+
+The global prefix makes Better Auth's `/api/auth/*` fall out of the ordinary convention instead of
+becoming the one route with an exception in its path.
+
+Versioning costs five characters today and a coordinated migration of every consumer later, including
+a published mobile app that does not update when you want it to. It goes in the URI rather than a
+header because a version in the URL appears in logs, caches, a `curl` line and a Sentry report:
+exactly where you look when v1 breaks.
+
+`forbidNonWhitelisted` is what makes an unexpected property visible. Stripping it silently returns 200
+to a client that sent `role: "admin"`, which looks like success and hides the honest bug and the
+malicious attempt equally.
+
+Serialization is declared once on the entity rather than repeated in every response DTO that touches
+it. Three DTOs over one entity would each have to remember to omit `tenant_id`, and so would the
+fourth someone adds later.
+
+The swagger plugin reads the class-validator decorators that already exist. Declaring the same field a
+third time by hand produces the copy nobody updates, and API documentation that lies is worse than
+none, because consumers trust it.
+
+## Applies to
+
+Every controller under `src/`, and the application bootstrap where the prefix, versioning, pipe and
+documentation are configured.
+
+## Examples
+
+Resource naming and versioning:
+
+```
+✅  @Controller({ path: 'billing-accounts', version: '1' })
+❌  @Controller('billingAccount')
+```
+
+Keeping a property out of a response:
+
+```
+✅  @Exclude() tenantId!: string
+❌  tenantId!: string
+```
+
+A controller that delegates:
+
+```
+✅  findOne(@Param('id') id: string) { return this.users.findById(id) }
+❌  findOne(@Param('id') id: string) {
+      const u = await this.users.findById(id)
+      if (u.plan === 'trial' && u.createdAt < cutoff) u.plan = 'expired'
+      return u
+    }
+```
+
+## Enforcement
+
+**Boot.** The prefix, versioning, `ValidationPipe` and serializer are configured once at bootstrap, so
+a route cannot opt out of them by accident.
+
+**Review only.** Resource naming, controller thinness, and (most importantly) whether a new
+sensitive column carries `@Exclude`. Nothing checks that, and a column added without it is published
+to every client of that route.

package/.prumo-templates/client/data.md

@@ -0,0 +1,124 @@
+# Data
+
+## Rule
+
+Keep the wire contract with the project's API in `src/api-contract/`: `createClient`, which builds every URL
+including the `/api/v1` prefix, the `ApiError`, the hand-written request and response types, and the query
+factories. **Let the app inject the transport** (`createClient({ baseUrl, fetch })`) with
+`credentials: 'include'` on the web configured there, once. In a monorepo the same directory is
+`packages/api-contract`.
+
+Call Better Auth's routes through Better Auth's own client, `createAuthClient`, configured once. In `mobile`, give it
+the `expoClient` plugin, and let the transport for the project's API attach the session with `auth.getCookie()` and
+send `credentials: 'omit'`. Do not write
+its routes, bodies or responses by hand, and do not send them through the wrapper.
+
+Declare request and response types by hand, in `api-contract/`. Do not generate a client
+from the OpenAPI document, and **do not `import type` an entity from the API package**; see below.
+
+Give every query a factory in `api-contract/`, taking the client and returning the whole options object so the key and the fetch
+function travel together. Include in the key everything that changes the result: filters, cursor,
+ordering.
+
+Let the client parse every `application/problem+json` body into one `ApiError` carrying `status`,
+`title`, `detail`, `requestId` and the `errors` map, and throw it. Convert the auth client's `error` into the
+same `ApiError` in one adapter. No component reads a raw error body.
+
+Use `useInfiniteQuery` for paginated lists, with `getNextPageParam` returning `nextCursor`, or `undefined`
+once it is null.
+
+Invalidate explicitly in each mutation's `onSuccess`, building the key from the same factory. Never
+invalidate everything.
+
+## Rationale
+
+Types are written by hand because generated ones arrive as deeply nested `paths[…][…][…]` shapes that
+every project then wraps in aliases to make usable. The cost accepted in exchange is real and silent: the
+API renames a field, the client keeps compiling against its own copy, and the failure appears as
+`undefined` on a screen.
+
+**Importing the entity type from the API package looks like the obvious fix and is unsound.** Responses
+are entities passed through `ClassSerializerInterceptor`, so every `@Exclude`d property is missing from the
+JSON while remaining on the entity type. The shared type would promise `tenantId` on a payload that never
+carries it: a type that lies, which is worse than the duplication it removes.
+
+**The contract lives in one directory, not beside each feature, so that one template serves both
+architectures.** The monorepo form moves `api-contract/` whole into `packages/api-contract` and changes one
+import prefix. Scattered across features, the same code would need gathering at copy time, or a second copy
+of it. It also mirrors the API: every wire shape in one place, so a renamed field has one file to fix. **What it
+costs:** a project that stays `alone` passes its transport as a parameter it never varies.
+
+The query factory settles by construction what would otherwise be discipline. Wherever something
+prefetches and something else reads (a route loader on the web, a screen preloading the next one) a
+difference between their keys fills one cache entry while the other is read, paying twice and gaining
+nothing, with no warning. A key that omits a filter is the same class of fault: two screens share one
+entry and the second shows the first's data.
+
+**There are two doors because there are two contracts.** The project's API is ours, so its types are written
+here. Better Auth's routes are Better Auth's: hand-writing them would copy a contract we do not control, which
+drifts on every upgrade and grows with every plugin. Its client already carries those types and follows the
+library, and `multi-tenancy/client.md` depends on it. **Its errors are not problem+json**: `toNodeHandler`
+writes the response itself, past the exception filter, so the body is `{ message, code }` with no `requestId`.
+The adapter is what keeps that difference out of every form.
+
+One `ApiError` keeps the shape of problem+json in a single file instead of in every component that
+displays an error. It also puts `requestId` on every failure without anyone asking, which is what makes a
+500 that reveals nothing supportable: the user opening a ticket arrives with the identifier that finds the
+log line.
+
+Invalidating everything is never wrong and makes a screen with six queries fire six requests on any save,
+which reads as an application that is slow for no reason.
+
+## Applies to
+
+Every client (`web`, `mobile` and `site`) for every call to the API.
+
+The TanStack Query rules apply where Query is used, which is `web` and `mobile`. A `site` fetching on the
+server uses the wrapper, the hand-written types and the `ApiError`, and not the query factory or
+`useInfiniteQuery`.
+
+## Examples
+
+The query factory:
+
+```
+✅  export const ordersQuery = (filters) => ({ queryKey: ['orders', filters], queryFn: … })
+    // every caller builds the key the same way
+❌  prefetch:  queryKey: ['orders']
+    component: queryKey: ['orders', filters]
+```
+
+Reaching the server:
+
+```
+✅  api.get('/users/me')                         authClient.signIn.email({ email, password })
+❌  api.post('/auth/sign-in/email', { … })       // Better Auth's contract, copied by hand
+```
+
+Reading an error:
+
+```
+✅  catch (e: ApiError) { form.setErrors(e.errors); toast(e.title, e.requestId) }
+❌  catch (e) { const body = await e.response.json(); body['errors'] }
+```
+
+Invalidating:
+
+```
+✅  onSuccess: () => qc.invalidateQueries({ queryKey: ordersQuery().queryKey })
+❌  onSuccess: () => qc.invalidateQueries()
+```
+
+## Enforcement
+
+**Structural.** The key and the fetch function cannot disagree, because the factory returns both. The
+error shape is parsed in one place, so no component can depend on the wire format.
+
+**Review only, and two of these fail silently:**
+
+That a hand-written type still matches what the API returns. Nothing checks it, and the divergence appears
+as `undefined` at runtime. This is the known cost of not generating the client.
+
+That a query key includes every filter that changes the result.
+
+That a mutation touching two resources invalidates both. Forgetting one leaves that screen stale.

package/.prumo-templates/client/forms.md

@@ -0,0 +1,88 @@
+# Forms
+
+## Rule
+
+Keep a form's Zod schema in its feature, beside the component. Derive the request type from it with
+`z.infer` where the shapes match. Where they differ, let the schema describe the **form** and write an
+explicit function that builds the request.
+
+Configure `useForm` with `mode: 'onTouched'` and `reValidateMode: 'onChange'`.
+
+On a failed submission, walk the `errors` map from the `ApiError` and call `setError` on each matching
+field. **Turn anything that matches no field into a form-level error**, shown at the top with the
+`requestId`. Do it through one function in `features/forms/`, which sets the form-level error on
+`root.server`.
+
+Show an error carrying no field the same way: form-level, with `title` and the `requestId`. **Every
+authentication error is this case**: Better Auth's errors carry no field map.
+
+Disable the submit button while `isSubmitting`. Never clear the form on error.
+
+## Rationale
+
+Client types are written by hand and a form already carries a schema, so declaring both separately would
+be two declarations of one fact. `z.infer` removes the second wherever the shapes agree, and the explicit
+transform keeps the difference visible where they do not.
+
+**A form's schema is not the server's validation.** The API validates its own input and trusts no client;
+this schema exists for immediate feedback. When the two disagree, the server wins, which is why unmatched
+errors must surface rather than vanish.
+
+That is the hole the mapping rule exists for. The server can reject a field this form does not have,
+because its rules changed or the validation is business rather than shape. Walking only the form's own
+fields makes that disappear: the user presses save, nothing happens, nothing is shown. A button that does
+nothing is the most frustrating failure there is and leaves support nothing to work from.
+
+One function rather than a loop in each form, because the loop is where the silent failure lives, and three
+copies of it diverge. `root.server` is react-hook-form's place for an error belonging to no field, so it is not
+cleared when a field revalidates.
+
+`onTouched` separates two moments that look like one. Before a field has errored the user is not
+interrupted; after it has, they are correcting and want to know when it is right. `onChange` alone turns
+a field red while someone is still typing; `onSubmit` alone reports the third field's problem after twelve
+have been filled.
+
+Disabling the button prevents the most common cause of duplicate records. Preserving the form on error
+prevents losing twelve fields of typing over a problem that was not the user's.
+
+## Applies to
+
+Every form, in every client.
+
+## Examples
+
+Schema as the source of the type:
+
+```
+✅  const schema = z.object({ email: z.email() })
+    type CreateUser = z.infer<typeof schema>
+❌  const schema = z.object({ email: z.email() })
+    type CreateUser = { email: string }
+```
+
+Mapping the response:
+
+```
+✅  for (const [field, messages] of Object.entries(err.errors))
+      isKnown(field) ? setError(field, …) : addFormError(messages)
+❌  for (const field of Object.keys(form.getValues()))
+      if (err.errors[field]) setError(field, …)     // unknown fields vanish
+```
+
+Submission:
+
+```
+✅  <button disabled={isSubmitting}>
+❌  <button>                       // a double click creates two records
+```
+
+## Enforcement
+
+**The form library.** `isSubmitting` and the validation modes are configuration, not code that can drift
+per form.
+
+**A test, where one exists.** Rendering the form against a fake transport that returns `400` with an
+`errors` map, and asserting the message appears **inside that field**, fails the moment the mapping breaks.
+
+**Review only.** That unmatched field errors are surfaced rather than dropped; the failure is silent and
+looks like a button that does nothing. And that a form is not reset in an error branch.

package/.prumo-templates/core/conventions.md

@@ -0,0 +1,74 @@
+# Conventions
+
+## Rule
+
+Name every source file in kebab-case, with the role suffix the generator uses: `users.service.ts`,
+`users.controller.ts`, `create-user.dto.ts`, `button.tsx`.
+
+Write a comment only when it carries a fact the code cannot carry about itself. Before writing one, ask
+whether a careful reader could recover it anyway. If they could, delete it.
+
+Those three places are where the answer is no:
+
+- an outside constraint: *this vendor returns 200 with the error in the body*
+- code that looks wrong and is right
+- something tried that does not work
+
+Do not comment what the code says. Do not leave commented-out code. Do not write a file header, an author
+tag or a change log; git holds all three.
+
+## Rationale
+
+kebab-case is what `nest g resource` and shadcn's CLI both emit, so anything else adds a rename step after
+every generation, and a correction after generation is what people forget. It also never touches a problem
+PascalCase lives with: macOS and Windows are case-insensitive, so renaming `OrderList.tsx` to
+`orderList.tsx` does not register as a change in git, and the file ends up cased differently in the
+repository and on a Linux clone.
+
+The comment test exists because *comment the why, not the what* decides nothing in the moment. Every
+comment looks like a why to whoever is writing it, and
+`// increment the counter because we need a count` is a why and is rubbish. *Could a careful reader recover
+this?* can be applied by looking at the line, which makes it a ruler rather than a principle.
+
+The three cases are not categories to sort into. They are simply where the test answers no. An outside
+constraint is not in the code at all. Code that looks wrong and is right is the only place a comment stops
+somebody "fixing" it. And something tried that does not work is the information most often lost and most
+expensive to rediscover.
+
+## Applies to
+
+Every source file, in every type.
+
+## Examples
+
+Naming:
+
+```
+✅  create-user.dto.ts      users.service.ts      order-list.tsx
+❌  CreateUserDto.ts        UsersService.ts       OrderList.tsx
+```
+
+A comment that earns its place:
+
+```
+✅  // The gateway returns 200 with the failure in the body; status is not enough.
+    if (body.status !== 'ok') throw new BadGatewayException()
+
+❌  // check if the status is not ok and throw
+    if (body.status !== 'ok') throw new BadGatewayException()
+```
+
+Something tried that does not work:
+
+```
+✅  // Batching these breaks ordering: the gateway processes out of sequence.
+```
+
+## Enforcement
+
+**Review only.** No check can judge whether a sentence carries a fact. Counting comments would be satisfied
+by deleting the wrong ones, and a ratio is satisfied the same way.
+
+**What stands in for enforcement is the code around you.** An assistant (and a new colleague) imitates the
+code it reads before it obeys a document. If the files in this project carry comments that fail the test,
+the rule is already dead, whatever this document says.

package/.prumo-templates/core/testing.md

@@ -0,0 +1,100 @@
+# Testing
+
+## Rule
+
+Run tests with Vitest, **except in `mobile`, which runs Jest with the `jest-expo` preset.** Put a test beside the
+file it tests, named `*.spec.ts`.
+
+**Do not mock the database.** Test code that touches it against the real one. Write a test without a
+database only for code without a database.
+
+Do not mock `EntityManager`, a repository, or any concrete class from a library.
+
+**In a client, replace the network through the injected transport**: pass a fake `fetch` to `createClient`.
+Do not add a request-mocking library. Test a component that shows an error by rendering it and asserting
+**where** the error appears.
+
+Measure coverage and report it. Do not block a merge on a coverage threshold.
+
+Assert behaviour, not execution. A test that calls a function without asserting anything is not a test.
+
+## Rationale
+
+A mirrored test tree has to be moved when the code moves, and nobody moves it, so the old path survives
+as an orphan that still passes. Co-located, a test travels with its file without anyone thinking about it.
+`.spec.ts` follows the generator, so no rename step is needed after generating a module.
+
+**There are no interfaces to mock.** The architecture has no ports, so a service talks to MikroORM's
+concrete `EntityManager`. Mocking it means imitating identity map, unit of work and flush: the hardest
+thing in a suite to write and the least trustworthy. Each time the imitation is wrong, the test passes and
+production does not, and **a test that passes for the wrong reason is worse than no test, because it grants
+permission not to look.**
+
+A real Postgres is already provided, one per worker, with its schema built from the migrations. That also
+dissolves the *unit or integration* argument every project has and nobody wins: the answer is mechanical;
+the code touches the database or it does not.
+
+A client has no database, and a `web` generated `alone` has no API beside it to test against. The transport is
+already a parameter (the integration layer takes it from the app) so a fake `fetch` needs no library and
+imitates nothing internal. **What it costs:** the fake responses are written by hand and can drift from what the
+API really returns, unnoticed. That is the same cost already accepted for hand-written contract types. The rules
+worth testing in a client are the silent ones: an `errors` map reaching the right field, and an authentication
+error becoming a form-level message.
+
+**`mobile` is the one exception, and only the runner changes.** Expo's testing guide installs Jest with `jest-expo`,
+`@testing-library/react-native` peers `jest >=29`, and the community Vitest integration for React Native has not
+been published since January 2024. Every other rule here (placement, no database mocks, no threshold, asserting
+behaviour) holds unchanged. **What it costs:** two runners in one workspace with near-identical APIs, so `vi.fn`
+written in a mobile test is a mistake an assistant will make.
+
+**Three things a mobile test meets, verified with Expo SDK 57:** `render` from `@testing-library/react-native` 14
+is **asynchronous** and its matchers need no setup. `jest-expo` leaves the app manifest empty, which Better Auth's
+Expo plugin needs to build an origin, so a component test uses a Better Auth client without that plugin, which is
+why a form asks only for the auth methods it calls. And Better Auth ships ESM, partly as `.mjs`, so Jest extends
+`jest-expo`'s own transform settings to include it rather than restating them.
+
+A coverage threshold turns a proxy into a target. Whoever is below writes tests to raise the number rather
+than to check anything; whoever is above stops thinking. With no database mocks a test costs more to write,
+which pushes even harder towards the cheap way of raising coverage: the test that asserts nothing.
+Measuring without a threshold still answers the useful question, which is *where is there nothing at all*.
+
+## Applies to
+
+Every type. Anything specific to running tests against a database (containers, isolation between tests,
+factories) belongs to the database area, not here.
+
+## Examples
+
+Placement:
+
+```
+✅  features/orders/order-list.tsx
+    features/orders/order-list.spec.tsx
+❌  tests/features/orders/order-list.test.tsx
+```
+
+What a service test uses:
+
+```
+✅  const em = await testEntityManager()      // real Postgres
+❌  const em = { findOne: vi.fn(), flush: vi.fn() }
+```
+
+Asserting:
+
+```
+✅  expect(await service.activate(id)).toMatchObject({ status: 'active' })
+❌  await service.activate(id)                 // covers the line, checks nothing
+```
+
+## Enforcement
+
+**Structural.** With no mock of the database available as a convention, a service test has to use the real
+one.
+
+**Review only.** That a test asserts something, that a new module arrived with tests at all, and that
+nobody introduced a mock of a library class.
+
+**The known gap:** with no threshold, coverage can fall and CI stays green. Review is the only defence, and
+review tires. If a floor is ever added, the honest form is on the diff (new code arrives tested) rather
+than an average the existing code sustains.

package/.prumo-templates/core/tooling.md

@@ -0,0 +1,118 @@
+# Tooling
+
+## Rule
+
+Base the TypeScript configuration on `nestjs/typescript-starter`: `module` and `moduleResolution` both
+`nodenext`, `target` `ES2023`, `strict` on, `strictPropertyInitialization` off.
+
+Add `noUncheckedIndexedAccess`. Do not add `exactOptionalPropertyTypes`.
+
+Use `bundler` for `moduleResolution` in a client app (`web`, `mobile`, `site`) where a bundler resolves
+modules.
+
+Run Biome's recommended preset, configured in `biome.jsonc`. Write a one-line reason in the configuration
+for any rule added or disabled.
+
+In `api`, enable `javascript.parser.unsafeParameterDecoratorsEnabled` and turn `style.useImportType` off.
+
+In a client using shadcn, turn `a11y.noLabelWithoutControl` and `a11y.useSemanticElements` off for
+`components/ui/` only, through an override. Keep both on everywhere else.
+
+**Never import a class with `import type` where Nest reads its type at runtime**: a constructor
+dependency, or a DTO received through a decorated handler parameter.
+
+Run `biome check --staged --write` in `.githooks/pre-commit`. Run `tsc --noEmit` in `.githooks/pre-push`.
+Wire both with `"prepare": "node .githooks/install.mjs"`, which sets `core.hooksPath` inside a Git repository,
+does nothing outside one, and fails when Git is present and the setting cannot be written.
+
+## Rationale
+
+Following Nest's starter is not deference: it is what keeps the generator and the convention in agreement,
+so a freshly generated project needs no correction afterwards. `nodenext` also happens to be one of the
+three values MikroORM v7 accepts, so the ORM and the framework ask for the same thing.
+
+`strictPropertyInitialization` is off because a DTO's properties are filled by validation rather than by a
+constructor, so the flag reports an error about something correct. The cost is real and wider than DTOs:
+with it off, **any** class may declare a property that is never assigned and the compiler stays quiet.
+
+`noUncheckedIndexedAccess` is added because `rows[0]` treated as present is the most common source of a
+runtime `undefined`. `exactOptionalPropertyTypes` is left out because it is the one strictness flag whose
+friction lands in library types rather than in your own code.
+
+**The hooks are split by cost.** Most of this project's guarantees are compiler guarantees, so a hook that
+only formats lets through the class of error the rules most rely on. But `tsc` takes five to thirty
+seconds, and a slow hook is one somebody bypasses with `--no-verify`, after which Biome does not run
+either. Formatting is instant and belongs on every commit; type checking needs to run before code leaves
+the machine, which is what pre-push is.
+
+`biome.jsonc` rather than `biome.json`, because the reason has to live beside the rule and JSON cannot hold
+a comment.
+
+**Biome cannot parse Nest without the parser option.** Decorators on constructor and handler parameters
+(`@Inject()`, `@Body()`, `@CurrentUser()`) belong to the legacy proposal, and Biome reports every one as a
+syntax error, not a lint warning, until the option is on.
+
+**`useImportType` breaks injection, and nothing reports it.** Nest resolves a dependency from the type the
+compiler emits into the constructor's metadata. `import type` is erased from the output, so the emitted type
+becomes `Function` and the application refuses to boot. The rule's autofix makes that rewrite across the
+codebase in one pass; in this template it did, and lint, typecheck, build and every service test still
+passed. **On a DTO it is worse:** `ValidationPipe` receives `Object`, validates nothing, and raises nothing,
+so `whitelist` and `forbidNonWhitelisted` silently stop existing. Written by hand, the same `import type`
+does the same damage, which is why the rule forbids the import and not only the lint rule.
+
+**The shadcn override is scoped because both rules are right in application code.** A generated `Label`
+receives `htmlFor` through props the rule cannot see, and shadcn's `Field` uses `role="group"` deliberately.
+Turning them off project-wide would remove the protection from the screens, where a label without a control is
+a real defect.
+
+**The hooks are wired by a script, not by `git config` directly,** because `prepare` runs on every install and
+`git config` exits 128 outside a repository: an install inside a container, or from an archive, failed outright. A
+shell guard was refused: pnpm runs scripts in the system shell, which on Windows is `cmd`, and `|| true` would also
+swallow the real failure of a repository that could not be configured.
+
+A short lint configuration is one somebody reads before disagreeing with it. The written reason stops
+nobody from adjusting and guarantees the configuration explains itself a year later.
+
+## Applies to
+
+Every project, of every type. Client apps differ only in `moduleResolution`.
+
+## Examples
+
+Configuration changes:
+
+```
+✅  // disabled: our DTOs are validated at runtime, not constructed
+    "noUnusedVariables": "off"
+❌  "noUnusedVariables": "off"
+```
+
+Importing what Nest reads at runtime:
+
+```
+✅  import { UsersService } from './users.service'
+    import { UpdateProfileDto } from './dto/update-profile.dto'
+❌  import type { UsersService } from './users.service'        // boot fails: Function
+❌  import type { UpdateProfileDto } from './dto/update-profile.dto' // nothing is validated
+```
+
+Reading an array:
+
+```
+✅  const first = rows[0]; if (!first) return
+❌  const first = rows[0]!
+```
+
+## Enforcement
+
+**Compiler.** `strict` and `noUncheckedIndexedAccess` are enforced on every build and by the pre-push hook.
+
+**The hooks.** Formatting cannot reach a commit unformatted, and a type error cannot reach the remote,
+unless somebody uses `--no-verify`, or never ran an install and so never got `core.hooksPath` configured.
+
+**Boot, partially.** A constructor dependency imported as a type fails at boot. **A DTO imported as a type
+does not fail anywhere**, not at boot and not in a service test, so it is caught only by a request test
+that sends an invalid body, or by review.
+
+**Review only.** That a disabled rule carries its reason, and that `strictPropertyInitialization` being
+off did not leave an uninitialised property somewhere outside a DTO.