@starci/eslint-canon-be 3.4.27 → 3.4.29

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 3.4.29 - 2026-10-22
+- Changed: the bundled canon pins select @starci/hfs 4.7.21 and @starci/cli 1.7.21.
+
+## 3.4.28 - 2026-10-22
+- Fixed: Sonar way parity with the server: the injected-constructor-aware `max-params` (S107) replaces core `max-params`, and the ports that report what the server does not on the same source (S1481 `no-unused-vars`, S3403 `different-types-comparison`, S3782 `argument-type`, S3800 `function-return-type`, S6582 `prefer-optional-chain`) are left to the server; NIVO (0 issues on the server) lints at 0 instead of 205 under 1.7.19.
+- Changed: the bundled canon-pins and failure-code copies follow the 1.7.20 cohort; lint behavior is unchanged.
+
 ## 3.4.27 - 2026-10-21
 - Changed: supersedes 3.4.26 (app lint broken: the canons' Sonar way block carries its own ignores, which `starci app lint` refused as an unsupported source scope, so it exited 2 without running ESLint and reported 0 findings); 3.4.26 is not used.
 - Changed: the bundled canon-pins copy follows the 1.7.19 cohort (cli 1.7.19, hfs 4.7.19); lint behavior is unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-be",
-  "version": "3.4.27",
+  "version": "3.4.29",
   "description": "The StarCi back-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.27
+    version: 3.4.29
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.26
+    version: 8.4.28
     group: starci
     install: registry
     side: fe
@@ -50,7 +50,7 @@ pins:
     source: packages/stylelint/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.4
+    version: 2.0.5
     group: starci
     install: registry
     side: both
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.19
+    version: 1.7.21
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.19
+    version: 4.7.21
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -3754,7 +3754,7 @@ rules:
       - {path: packages/eslint/be/sonar-parity-editions.spec.mjs, edition: full}
       - {path: packages/eslint/fe/sonar-parity-editions.spec.mjs, edition: lite}
       - {path: packages/eslint/fe/sonar-parity-editions.spec.mjs, edition: full}
-    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), no `<video>` or `<audio>` without a captions track unless muted (S4084, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). Every other rule of the Sonar way TypeScript profile with an ESLint equivalent (scripts/lib/sonar-way.mjs: eslint-plugin-sonarjs' Sonar way set, the core, typescript-eslint and unicorn rules it builds on) is on at error in both canons. The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
+    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), no `<video>` or `<audio>` without a captions track unless muted (S4084, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). No function takes more than seven parameters (S107), except the constructor of an injectable class, whose parameters are its injected dependencies. Every other rule of the Sonar way TypeScript profile with an ESLint equivalent that reports what the server reports on the same source (scripts/lib/sonar-way.mjs: eslint-plugin-sonarjs' Sonar way set and the core and unicorn rules it builds on) is on at error in both canons; a port that does not match the server is left to the server. The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
     kinds: [lint, codemod]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["SCAN_SMELL"]
@@ -3775,6 +3775,8 @@ rules:
       - {kind: eslint-fe, id: prefer-export-from}
       - {kind: eslint-fe, id: no-unused-prop-types}
       - {kind: eslint-fe, id: media-has-caption}
+      - {kind: eslint-be, id: max-params}
+      - {kind: eslint-fe, id: max-params}
   - id: R236
     code: "RT_GATE_LOOSENING"
     editions: [lite, full]

package/runtime/scripts/lib/path-key.mjs

@@ -40,7 +40,7 @@ export const pathsOverlap = (a, b) => sameOrUnder(a, b) || sameOrUnder(b, a);
  * `trim` blanks at the ends, `collapse` folds '//' runs to '/', `dot` drops a leading './',
  * `glob` strips a trailing glob ('star': '*'/'**' with their slash, 'double': a '/**' only),
  * `fold` lowercases. A trailing '/' always goes. Null reads as ''.
- * @param {unknown} p
+ * @param {string|number|null|undefined} p
  * @param {{trim?: boolean, collapse?: boolean, dot?: boolean, glob?: string|null, fold?: boolean}} [options]
  */
 export const normPath = (p, { trim = false, collapse = false, dot = false, glob = null, fold = false } = {}) => {

package/runtime/scripts/lib/sonar-syntax-rules.mjs

@@ -5,6 +5,8 @@
 // scan (`sonar.exclusions`), so it is outside these rules. The rules that need the type checker (S1874, S6551, S7503) are borrowed from
 // typescript-eslint by the canon factories; the one that needs a regex ambiguity analysis (S8786) runs in the runtime's own `sonar-rules` check.
 
+import { MAX_PARAMETERS } from './sonar-way.mjs';
+
 const FUNCTIONS = new Set(['FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression']);
 const REPEATED = Object.freeze({
   ForStatement: ['body', 'test', 'update'],
@@ -206,6 +208,26 @@ const noUnusedPropTypes = {
   },
 };
 
+/** The decorators of a class whose constructor parameters are injected (Sonar's S107 spares these constructors). */
+const INJECTED = new Set(['Injectable', 'Component', 'Directive', 'Pipe']);
+const decoratorName = (decorator) => {
+  const expression = decorator.expression.type === 'CallExpression' ? decorator.expression.callee : decorator.expression;
+  return expression.type === 'Identifier' ? expression.name : null;
+};
+const injectedConstructor = (node) => node.parent?.type === 'MethodDefinition' && node.parent.kind === 'constructor'
+  && (node.parent.parent?.parent?.decorators ?? []).some((decorator) => INJECTED.has(decoratorName(decorator)));
+
+/** S107: a function takes at most MAX_PARAMETERS parameters; the constructor of an injectable class is a dependency list, not a call shape. */
+const maxParams = {
+  meta: { type: 'suggestion', schema: [], messages: { many: 'S107: this function has {{count}} parameters; at most {{max}} are allowed. Pass an options object.' } },
+  create(context) {
+    const check = (node) => {
+      if (node.params.length > MAX_PARAMETERS && !injectedConstructor(node)) context.report({ node, messageId: 'many', data: { count: String(node.params.length), max: String(MAX_PARAMETERS) } });
+    };
+    return { FunctionDeclaration: check, FunctionExpression: check, ArrowFunctionExpression: check };
+  },
+};
+
 /** S4084: a `<video>` or `<audio>` element plays captions: a `<track kind="captions">` child, or it is `muted`. */
 const MEDIA = new Set(['video', 'audio']);
 const jsxName = (node) => (node?.name?.type === 'JSXIdentifier' ? node.name.name : null);
@@ -243,4 +265,5 @@ export const SONAR_SYNTAX_RULES = Object.freeze({
   'prefer-export-from': scanned(preferExportFrom),
   'no-unused-prop-types': scanned(noUnusedPropTypes),
   'media-has-caption': scanned(mediaHasCaption),
+  'max-params': scanned(maxParams),
 });

package/runtime/scripts/lib/sonar-way.mjs

@@ -10,23 +10,30 @@
 export const COGNITIVE_COMPLEXITY_LIMIT = 15;
 export const MAX_PARAMETERS = 7;
 
-/** sonarjs rules of Sonar way another canon rule already reports: the owner that reports the same Sonar id. */
+/**
+ * sonarjs rules of Sonar way the local lint does not run: another canon owner reports the same Sonar id, or the port does not match what the
+ * server reports on the same source and is left to the server. Parity is measured, not assumed: a product scan with 0 issues on the server
+ * (Sonar way, 2026-10-21) while these ports reported 130 findings on it; a rule that cannot match the server is not a lint error.
+ */
 const SONAR_WAY_OWNED = Object.freeze({
   'sonarjs/no-nested-conditional': 'S3358, the canon syntax rule no-nested-conditional',
   'sonarjs/unused-import': 'S1128, the canon syntax rule no-unused-import',
   'sonarjs/void-use': 'S3735, the canon syntax rule no-void-operator',
   'sonarjs/deprecation': 'S1874, the borrowed @typescript-eslint/no-deprecated',
+  'sonarjs/no-unused-vars': 'S1481, the TypeScript compiler (noUnusedLocals in @starci/tsconfig); the port also reports a rest-sibling omit the server accepts',
+  'sonarjs/different-types-comparison': 'S3403, the server: the port reads control-flow-narrowed types (`x !== null` after an aliased guard) the server does not report',
+  'sonarjs/function-return-type': 'S3800, the server: the port reports nullable and union returns the server accepts',
+  'sonarjs/argument-type': 'S3782, the server: the port reports optional arguments the server accepts',
 });
 
 /**
- * The Sonar way rules SonarSource implements on an ESLint rule outside eslint-plugin-sonarjs: `{ sonar, rule, options? }`. S4084 (a
- * `<video>`/`<audio>` without captions) is the front-end canon's syntax rule media-has-caption. S7785 (top-level await) is left out: an
- * app's TypeScript compiles to CommonJS (`module: nodenext` without `type: module`), where top-level await does not exist.
+ * The Sonar way rules SonarSource implements on an ESLint rule outside eslint-plugin-sonarjs: `{ sonar, rule, options? }`. The canon syntax
+ * rules carry S107 (`max-params`, which spares the constructor of an injectable class as the server does) and S4084 (`media-has-caption`,
+ * front end). Left out: S7785 (top-level await; an app's TypeScript compiles to CommonJS, `module: nodenext` without `type: module`) and
+ * S6582 (typescript-eslint's optional-chain rule reports guards whose optional chain would change the value's type, which the server accepts).
  */
 export const SONAR_WAY_EXTRA = Object.freeze([
-  { sonar: 'S107', rule: 'max-params', options: [{ max: MAX_PARAMETERS }] },
   { sonar: 'S3863', rule: 'no-duplicate-imports', options: [{ allowSeparateTypeImports: true }] },
-  { sonar: 'S6582', rule: '@typescript-eslint/prefer-optional-chain' },
   { sonar: 'S4138', rule: 'unicorn/no-for-loop' },
   { sonar: 'S7721', rule: 'unicorn/consistent-function-scoping', options: [{ checkArrowFunctions: false }] },
   { sonar: 'S7732', rule: 'unicorn/no-instanceof-builtins' },

package/sonar-parity.mjs

@@ -11,7 +11,7 @@
  */
 import { SONAR_SYNTAX_RULES } from "./runtime/scripts/lib/sonar-syntax-rules.mjs"
 
-const NAMES = ["no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import", "prefer-export-from"]
+const NAMES = ["no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import", "prefer-export-from", "max-params"]
 
 /** The rules this law contributes to the plugin. */
 export const rules = Object.fromEntries(NAMES.map((name) => [name, SONAR_SYNTAX_RULES[name]]))