@starci/eslint-canon-be 3.4.1 → 3.4.2

package/CHANGELOG.md

@@ -1,6 +1,8 @@
 # Changelog
 
-## Unreleased
+## 3.4.2 - 2026-10-17
+
+- Changed: bundled runtime copies follow runtime 1.0.0-alpha.20, including the canon pins and shared architecture checks.
 
 ## 3.4.1 - 2026-10-17
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-be",
-  "version": "3.4.1",
+  "version": "3.4.2",
   "description": "The StarCi back-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.1
+    version: 3.4.2
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.1
+    version: 8.4.2
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.4.1
+    version: 1.5.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.4.1
+    version: 4.5.0
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -3503,12 +3503,13 @@ rules:
       - {path: packages/hfs/templates/app/skeleton-lite/supabase/config.toml, edition: lite}
     templateNa: "Database types are generated from each app migration set, not static templates; full-edition Supabase configuration is app-owned."
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    law: "The database configuration and its types are checked facts: `supabase/config.toml` carries no literal value under a credential key (the value is `env(NAME)`), `auth.jwt_expiry` is at most 3600, and signup, site url and redirect urls equal the Supabase block of hfs.json where it declares them; `supabase/types/database.types.ts` is committed and equals the text `contract:emit` regenerates from the migrations."
+    law: "The database configuration and its types are checked facts: `supabase/config.toml` carries no literal value under a credential key (the value is `env(NAME)`), `auth.jwt_expiry` is at most 3600, and signup, site url and redirect urls equal the Supabase block of hfs.json where it declares them; `supabase/types/database.types.ts` is committed and equals the text `contract:emit` regenerates from the migrations. Type emission refuses HFS_EMIT_DB_TYPES_STALE unless the complete applied migration version set equals the SQL filename stamps; lint and check report drift without writing types."
     kinds: [check]
     gates: [land, ci]
-    failureCodes: ["DB_CONFIG_POLICY", "DB_TYPES_DRIFT"]
+    failureCodes: ["DB_CONFIG_POLICY", "DB_TYPES_DRIFT", "HFS_EMIT_DB_TYPES_STALE"]
     enforcers:
       - {kind: hfs, id: db-config-types, at: scripts/hfs/rules/database.mjs}
+      - {kind: hfs, id: db-types-emit, at: packages/hfs/emit/db-types.mjs}
   - id: R217
     code: "FE_SUPABASE_CLIENT_OWNER"
     editions: [lite, full]
@@ -4025,12 +4026,13 @@ rules:
       - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml, edition: lite}
       - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*] or workflow_dispatch, never on a branch push."
+    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*] or workflow_dispatch, never on a branch push."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DEPLOY_WORKFLOW", "HFS_WORKFLOW_PIN", "HFS_CI_TOOL_INSTALL", "HFS_APP_WORKFLOW_TRIGGER"]
     enforcers:
       - {kind: hfs, id: deploy-workflow, at: scripts/hfs/rules/deploy-workflow.mjs}
+      - {kind: hfs, id: supply-chain, at: scripts/hfs/rules/supply-chain.mjs}
     exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R252
     code: "HFS_SCRIPT_PLAINTEXT_LOAD"
@@ -4359,7 +4361,7 @@ rules:
     exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R269
     code: "HFS_DEPENDABOT_MISSING"
-    law: "In lite and full apps, .github/dependabot.yml declares scheduled npm, github-actions and docker updates. The CI workflow runs npm audit --omit=dev as an enabled gate whose failure stops the job. The images workflow generates an SBOM and provenance for release images; a disabled step, comment or label is not evidence."
+    law: "In lite and full apps, .github/dependabot.yml declares scheduled npm, github-actions and docker updates. Every npm entry declares a minor-and-patch version group and a security-updates group; every group explicitly restricts update-types to minor and patch, leaving majors per package, and npm entries ignore @starci/* without version or update-type restrictions. The CI workflow runs npm audit --omit=dev as an enabled gate whose failure stops the job. The images workflow generates an SBOM and provenance for release images; a disabled step, comment or label is not evidence."
     kinds: [check]
     gates: ["settle","land","ci"]
     failureCodes: ["HFS_DEPENDABOT_MISSING", "HFS_AUDIT_STEP_MISSING", "HFS_SBOM_MISSING"]
@@ -4876,3 +4878,92 @@ rules:
       - {path: packages/eslint/be/module-shape.spec.mjs, editions: [lite, full], codes: [BE_MODULE_DEFINITION_MISSING]}
     witness:
       - {path: packages/eslint/be/module-shape.spec.mjs, editions: [lite, full], codes: [BE_MODULE_DEFINITION_MISSING]}
+  - id: R296
+    code: "CI_SECRET_SEALED"
+    law: "A name declared in ci.secrets or ci.dependabot.secrets never names a key stored inside an app sealed .starcistacks/<env>/secrets/<member>.enc member. App runtime and CI custody are separate; checks inspect key names without decrypting or printing values."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["CI_SECRET_SEALED"]
+    enforcers:
+      - {kind: hfs, id: ci-custody, at: scripts/hfs/rules/ci-custody.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r296, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+  - id: R297
+    code: "APP_SECRET_IN_CI"
+    law: "A sealed member key granted to an app container by a deploy grant never appears in ci.secrets or ci.vars. The grant environment, member and selected key determine app custody; online GitHub custody is verified by starci app ci verify."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["APP_SECRET_IN_CI"]
+    enforcers:
+      - {kind: hfs, id: ci-custody, at: scripts/hfs/rules/ci-custody.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r297, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+  - id: R298
+    code: "CI_DECLARATION_DRIFT"
+    law: "Workflow secrets and vars references are declared in their matching top-level ci class, except automatic GITHUB_TOKEN. Non-optional Actions declarations are consumed by a workflow; Dependabot secrets need no Actions read. Service token and variable bindings name declarations in the matching class. Missing declarations produce migration findings; a tree with neither ci declarations nor references stays quiet."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["CI_DECLARATION_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: ci-custody, at: scripts/hfs/rules/ci-custody.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r298, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+  - id: R299
+    code: "HFS_WORKFLOW_CONTEXT"
+    law: "GitHub Actions expressions use only contexts available at their workflow key. Job env cannot read runner, job, steps or env; runner-local data paths belong to step env or shell RUNNER_TEMP. Every tracked workflow is checked in both app editions."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_WORKFLOW_CONTEXT"]
+    enforcers:
+      - {kind: hfs, id: workflow-contexts, at: scripts/hfs/rules/workflow-contexts.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r299, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): no runtime spec retained", date: "2026-10-17"}
+  - id: R300
+    code: "FE_PUBLIC_BUILD_ARG_MISSING"
+    law: "Every front-end app with a Dockerfile supplies each required NEXT_PUBLIC_* source/config/schema name through a Dockerfile ARG default or through that image's buildArgs.values/buildArgs.sealed.keys in every environment deploying the image. Source reads with literal string ?? or || fallbacks are optional. The finding names missing keys and environments at the Dockerfile; sealed values are never opened. CI release images use the same starci app stack build-args verb and environment as deployment."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_PUBLIC_BUILD_ARG_MISSING"]
+    enforcers:
+      - {kind: hfs, id: fe-build-args, at: scripts/hfs/rules/fe-build-args.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r300, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): external smoke fixtures", date: "2026-10-17"}

package/runtime/scripts/lib/secret-patterns.mjs

@@ -43,11 +43,11 @@ const SECRET_NAME = [
   String.raw`[A-Za-z_$][A-Za-z0-9_$.-]*\s*[:=]\s*`,
 ].join('');
 
-// `password = "hunter2hunter2"` — the quoted literal. `env(NAME)` is a reference, never a secret.
+// `password = "example-password-1"` — the quoted literal. `env(NAME)` is a reference, never a secret.
 const ASSIGNED_QUOTED = new RegExp(
   SECRET_NAME + String.raw`['"\`](?!env\([A-Z_][A-Z0-9_]*\)['"\`])([^'"\`\n\s$<{]{12,})['"\`]`,
 );
-// `DB_PASSWORD=hunter2hunter2` — the compose list-item and dotenv form; the dotenv value has no `:` so
+// `DB_PASSWORD=example-password-1` — the compose list-item and dotenv form; the dotenv value has no `:` so
 // `password: secret:db/password` and `token: ref:vault/api` stay references, and the end boundary keeps
 // calls and member/index references such as `secret = credentialsSource.current` out of the literals.
 const ASSIGNED_UNQUOTED = new RegExp(