@starci/eslint-canon-be 2.1.2 → 3.0.0

package/log-safety.mjs

@@ -14,8 +14,14 @@
  *
  * A log line outlives the request, is copied to a vendor, and is read by people who never had the credential or the
  * consent. Log an id, a count, or a masked form instead.
+ *
+ * `no-secret-in-error` (R71) holds the same line for an error: a constructed error (its TYPE derives from `Error`) carries
+ * no `Secret` value and no text value named like a credential, because its message and params reach the same logs.
  */
-import { wordsOf } from "./lib/ast.mjs"
+import ts from "typescript"
+import { isCredentialName } from "./config-owner.mjs"
+import { keyName, wordsOf } from "./lib/ast.mjs"
+import { derivesFromBuiltinError, presentParts, typeOf } from "./lib/declared.mjs"
 import { isLoggerCall, isOwnedType } from "./lib/ports.mjs"
 import { isDeclarationFile } from "./lib/path.mjs"
 
@@ -205,12 +211,93 @@ export const noSecretInLog = {
   },
 }
 
+const STRINGY = ts.TypeFlags.String | ts.TypeFlags.StringLiteral | ts.TypeFlags.TemplateLiteral
+
+/** Whether a node's type is text (a string, with `null`/`undefined` removed): the shape a raw credential travels in. */
+const isText = (context, node) => {
+  const parts = presentParts(typeOf(context, node))
+  return parts.length > 0 && parts.every((part) => (part.flags & STRINGY) && !(part.flags & ts.TypeFlags.EnumLiteral))
+}
+
+/** The last name a value expression ends in (`token`, `request.headers.authorization`), or null. */
+const ownNameOf = (node) => {
+  if (node.type === "Identifier") return node.name
+  if (node.type === "MemberExpression" && !node.computed && node.property.type === "Identifier") return node.property.name
+  return null
+}
+
+/** The `key: value` pairs of an argument tree whose value is text, so a key can name what the value is (`{ token: raw }`). */
+const textPropertiesIn = (context, node, found = []) => {
+  if (node?.type === "ObjectExpression") {
+    for (const property of node.properties) {
+      if (property.type !== "Property" || property.computed || isHidingCall(property.value)) continue
+      const key = keyName(property.key)
+      if (key && isText(context, property.value)) found.push({ name: key, node: property.key })
+      textPropertiesIn(context, property.value, found)
+    }
+  } else if (node?.type === "ArrayExpression") node.elements.forEach((element) => textPropertiesIn(context, element, found))
+  return found
+}
+
+/**
+ * An error carries no secret. `no-secret-in-error` (R71) judges every `new X(...)` whose constructed TYPE derives from the
+ * language `Error` (a `DomainError` family, a library error, `Error` itself): no argument holds a value typed by the
+ * `Secret` brand of `platform/config` or read out of one, and no text value (a `string`) whose own name, or the key it is
+ * given under, says it is a credential (the same last-word test `secret-compare-timing-safe` uses: `password`,
+ * `accessToken`, `clientSecret`, `signingKey`). An error's message and params reach the error filter, the log line of the
+ * failure, the tracing vendor and, for a declared error, the client. Personal identifiers are not judged here: an error
+ * may name the account it refused.
+ */
+export const noSecretInError = {
+  meta: {
+    type: "problem",
+    docs: { description: "A constructed error carries no `Secret` value and no text value named like a credential." },
+    schema: [],
+    messages: {
+      secretType:
+        "`{{name}}` is a `Secret` (or is read out of one) and is put into an error. An error's message and params reach logs, tracing and sometimes the client. Name the failure with its code and pass an id or a masked form (`mask(...)`), never the value.",
+      secret:
+        "`{{name}}` reads as a credential and is put into an error. An error's message and params reach logs, tracing and sometimes the client. Name the failure with its code and pass an id or a masked form (`mask(...)`), never the value.",
+    },
+  },
+  create(context) {
+    const filename = context.filename || context.getFilename()
+    if (isDeclarationFile(filename)) return {}
+    const sourceCode = context.sourceCode || context.getSourceCode()
+    return {
+      NewExpression(node) {
+        if (node.arguments.length === 0 || !derivesFromBuiltinError(context, typeOf(context, node))) return
+        const reported = new Set()
+        const report = (at, messageId, name) => {
+          if (reported.has(at)) return
+          reported.add(at)
+          context.report({ node: at, messageId, data: { name } })
+        }
+        for (const argument of node.arguments) {
+          for (const value of valuesIn(argument)) {
+            if (isSecretType(context, value)) report(value, "secretType", sourceCode.getText(value))
+            else {
+              const name = ownNameOf(value)
+              if (name !== null && isCredentialName(name) && isText(context, value)) report(value, "secret", name)
+            }
+          }
+          for (const { name, node: at } of textPropertiesIn(context, argument)) {
+            if (isCredentialName(name)) report(at, "secret", name)
+          }
+        }
+      },
+    }
+  },
+}
+
 /** The rules this law contributes to the plugin. */
 export const rules = {
   "no-secret-in-log": noSecretInLog,
+  "no-secret-in-error": noSecretInError,
 }
 
-/** Starts at error: no baseline exists, and the repositories' fix lanes clear the debt. */
+/** Both start at error: no baseline exists, and the repositories' fix lanes clear the debt. */
 export const recommended = {
   "starci-be/no-secret-in-log": "error",
+  "starci-be/no-secret-in-error": "error",
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-be",
-  "version": "2.1.2",
+  "version": "3.0.0",
   "description": "The StarCi back-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "UNLICENSED",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -5,7 +5,14 @@ purpose: >-
   then the repositories' own upgrade lane (each sets the exact version and reinstalls; nothing else installs a @starci package). Read on 2026-09-29 from the packages under
   .claude/packages and from the installed node_modules of nivo-backend, nivo-fe, starci-next, starci-next-fe,
   mia-mia-backend and miamia-fe; where they disagreed the newest version installed in more than one repository
-  won, and the runtime's own version won for @starci packages.
+  won, and the runtime's own version won for @starci packages. An app (hfs 4) has ONE package.json for both sides, so a
+  dependency both sides declared at different versions takes one: its pin where it has one, otherwise the higher of the
+  two, pinned here with a why (2026-10-01, from nivo-backend/nivo-fe, starci-next/starci-next-fe and
+  mia-mia-backend/miamia-fe: every such conflict but graphql was already pinned). The runtime's example apps merged the
+  same way on 2026-10-01 (examples/todo-app from todo-app-backend/todo-app-frontend, examples/ecommerce-app from
+  ecommerce-app-be/ecommerce-app-fe): no dependency outside this file was declared at two versions across their sides, so
+  every choice is a pin (each side's older @starci pins and graphql moved to the version here). `side` names the side whose code uses
+  the dependency; the app root package.json carries the pins of both.
 pins:
   # --- @starci packages. Every @starci package is a PUBLISHED npm package (install: registry): a product repository
   # installs the exact pinned version from the npm registry in the root and every workspace package.json, never `file:`.
@@ -17,19 +24,19 @@ pins:
     source: packages/grammar/package.json
     why: nivo-fe pins 0.4.11 and 0.5.0 in one workspace, starci-next-fe 0.5.1, miamia-fe 0.5.0; the runtime source is 0.8.0 (the brand layer sets `--font-sans` and `--font-mono`; the grammar reads them; 0.7.2 added the Input tel kind and IconButton disclosure props).
   '@starci/eslint-canon-be':
-    version: 2.1.2
+    version: 3.0.0
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
-    why: '2.0.0 (C0 release): starciBeConfig({ hfs: loadHfs(import.meta.url) }) typed factory and the BE-CONVENTION laws (R36 sql-text-only, R83 no-repository-class, R85/R87/R89 service-deps, R43 config-parsed-in-main, R47/R48 test world, R95 operations, R98-R101 builders).'
+    why: '3.0.0: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side; the project graph is built per side. 2.0.0 (C0 release): starciBeConfig({ hfs: loadHfs(import.meta.url) }) typed factory and the BE-CONVENTION laws.'
   '@starci/eslint-canon-fe':
-    version: 7.1.2
+    version: 8.0.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
-    why: '7.0.0: the front end has no tests (test rules removed, FE_NO_TESTS R97 in hfs); no-vietnamese-in-source (R91).'
+    why: '8.0.0: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side; the project graph is built per side. 7.0.0: the front end has no tests (FE_NO_TESTS R97 in hfs); no-vietnamese-in-source (R91).'
   '@starci/stylelint-canon':
     version: 2.0.1
     group: starci
@@ -50,19 +57,26 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.1.0
+    version: 2.2.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
-    why: '2.1.0: four projects on the test world, the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+    why: '2.2.0: the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; 2.1.0: four projects on the test world, the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+  '@starci/test-world':
+    version: 1.0.0
+    group: starci
+    install: registry
+    side: be
+    source: packages/test-world/package.json
+    why: 'the shared e2e library of every back end (R47, R48): the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs, the outage lock and the starci-test-stack bin behind the managed test:stack script; a devDependency of every back end.'
   '@starci/hfs':
-    version: 3.0.0
+    version: 4.0.0
     group: starci
     install: registry
     side: both
     source: packages/hfs/package.json
-    why: '2.0.0 (C0 release): the BE-CONVENTION machine, emit-contracts (GraphQL SDL and OpenAPI from the typed operation table), the four-project test layout, FE has no tests, repo.scripts slot, secrets guard in work-hygiene, rule ids R<2-3 digits>.'
+    why: '4.0.0: the app monorepo standard: one app repository with the root package.json, lockfile and hfs.json of kind app, and the be/ and fe/ sides; `hfs scaffold app <name>` makes it, `hfs lint` at the root lints be/** with the BE canon and fe/** with the FE canon; the standalone be/fe repository kinds and `hfs init` are deleted.'
   # --- tooling
   typescript:
     version: 5.9.3
@@ -152,6 +166,11 @@ pins:
     group: framework
     side: fe
     why: every HFS front end uses next-intl with the [locale] segment (hfs sync --init writes it); nivo-fe resolves 4.13.6.
+  graphql:
+    version: 16.14.2
+    group: framework
+    side: both
+    why: 'one app package.json for both sides (hfs 4): nivo-backend declares ^16.14.1 and nivo-fe ^16.14.2, the higher wins; all four product installs resolve 16.14.2. The example apps: todo-app-backend declared ^16.14.2 (devDependencies) and ecommerce-app-be ^16.14.2 (dependencies and devDependencies); each app root now has one dependencies entry at the pin.'
   supertest:
     version: 7.3.0
     group: tooling