@starci/eslint-canon-be 3.4.3 → 3.4.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 3.4.5 - 2026-10-18
+- Changed: bundled runtime copies follow runtime 1.0.0-alpha.22 (failure codes, the rule catalog with R301 and the candidate trigger laws, canon pins); canon rules are unchanged.
+
+## 3.4.4 - 2026-10-18
+- Changed: bundled runtime copies follow runtime 1.0.0-alpha.21 (canon pins, failure codes, the narrowed secret patterns); canon rules are unchanged.
+
 ## 3.4.3 - 2026-10-18
 - Changed: bundled runtime copies include the refreshed canon pins for the alpha.20 patch set; canon rules are unchanged.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-be",
-  "version": "3.4.3",
+  "version": "3.4.5",
   "description": "The StarCi back-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.3
+    version: 3.4.5
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.3
+    version: 8.4.5
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.5.1
+    version: 1.7.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.5.1
+    version: 4.7.0
     group: starci
     install: registry
     side: both
@@ -466,6 +466,11 @@ pins:
     group: framework
     side: be
     why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13. Stays on 13.x for alpha.18: the npm-audit advisory fixed by 14.0.3 (semver major) is a documented accepted exception, upgrade deferred to alpha.19 (owner ruling graphql-13-advisory-accepted-until-a19, 2026-10-16).'
+  '@graphql-tools/utils':
+    version: 12.1.0
+    group: framework
+    side: be
+    why: 'an npm override of every app root (and of the examples that serve GraphQL), never a declared dependency: @nestjs/graphql 13.x pulls @graphql-tools/utils <=12.0.0, which npm audit --audit-level=high reports (GHSA-7mx3-vvmw-hjmv, prototype pollution in mergeDeep). 12.1.0 is a fixed release on the same major and the lowest one every declared range accepts (@graphql-tools/schema and /merge, used at runtime, require ^12.1.0; NIVO v0.2.1 6a1d8e80 overrides 12.0.4, below that range), so the advisory closes without the breaking @nestjs/graphql 14. DROP this pin and the override when @nestjs/graphql 14 is adopted (owner ruling graphql-tools-utils-override, 2026-10-18).'
   '@nestjs/apollo':
     version: 13.4.5
     group: framework

package/runtime/knowledge/hfs/rules.yaml

@@ -3558,7 +3558,7 @@ rules:
       - {kind: hfs, id: lite-secret-custody, at: scripts/hfs/rules/supabase-secrets.mjs}
   - id: R221
     code: "CI_TRIGGERS_RELEASE_ONLY"
-    law: "The only workflow triggers are a push of release tags, a person dispatching it and, in the runtime's own workflows (`.github/workflows/` at the root), a push to `main`: every tracked workflow declares an `on` that holds only `push` filtered to `tags: ['v*']` (and, in the runtime's own workflows, `branches: [main]`; no paths or ignore filter beside them) and `workflow_dispatch`. The examples and the hfs app templates (so every scaffolded app inherits it) take the tag and the dispatch only: an app's CI runs once per release, on its tag. A push to any other branch, a pull_request, a schedule, a workflow_call or any other event refuses the workflow."
+    law: "The only workflow triggers are a push of release tags, a push of release candidate branches `release/candidate-*`, a person dispatching it and, in the runtime's own workflows (`.github/workflows/` at the root), a push to `main`: every tracked workflow declares an `on` that holds only `push` filtered to `tags: ['v*']` and/or `branches` naming only `release/candidate-*` (and, in the runtime's own workflows, `main`; no paths or ignore filter beside them) and `workflow_dispatch`. Every `ci.yml`, and the runtime's `examples.yml`, must name `release/candidate-*`: `starci release cut` and `starci app release push` push the exact release sha there and move main and the tag only when that run is green (owner ruling candidate-ci, 2026-10-18). A push to any other branch, a pull_request, a schedule, a workflow_call or any other event refuses the workflow."
     scope: runtime
     editions: [lite, full]
     docs: [docs/git-governance.md#r221]
@@ -4026,7 +4026,7 @@ rules:
       - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml, edition: lite}
       - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*] or workflow_dispatch, never on a branch push."
+    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*], the release candidate branches release/candidate-* (required in ci.yml: starci app release push waits for that run, owner ruling candidate-ci 2026-10-18) or workflow_dispatch, never on another branch push."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DEPLOY_WORKFLOW", "HFS_WORKFLOW_PIN", "HFS_CI_TOOL_INSTALL", "HFS_APP_WORKFLOW_TRIGGER"]
@@ -4967,3 +4967,20 @@ rules:
       - {path: packages/hfs/templates/app/skeleton/.starcistacks, edition: full}
     specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): external smoke fixtures", date: "2026-10-17"}
+  - id: R301
+    code: "CI_STANDARD"
+    law: "The managed app CI, the example apps (the reference) and the runtime repository's own workflows follow the ONE CI standard of knowledge/hfs/ci-standard.yaml (owner ruling ci-standard, 2026-10-18): the job shape fast/test/build(/sonar) with the unit run and the Codecov upload in test alone, full history with STARCI_BASE_REF written before the lint, NODE_OPTIONS --max-old-space-size=6144 on every heavy step, the Sonar lint per side, optional providers probed before they skip, a timeout on every job and every action pinned to a commit sha; the other items (candidate trigger R221, per-fe-app build env, prettier-stable renders, R299 contexts) are owned by the rules the standard names. Apps get the standard only through starci app sync."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["CI_STANDARD"]
+    enforcers:
+      - {kind: hfs, id: ci-standard, at: scripts/hfs/rules/ci-standard.mjs}
+      - {kind: runtime, id: ci-standard-runtime, at: scripts/hfs/runtime-rules/runtime-ci-standard.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r301, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
+      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the scaffold e2e (e2e/hfs-scaffold-app.spec.mjs: a fresh scaffold has no finding) and the example apps prove it"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the runtime has no spec fixtures", date: "2026-10-18"}

package/runtime/knowledge/sonar-gate.yaml

@@ -41,8 +41,8 @@ newCode:
     minReviewedPercent: 100
     unreviewedMax: 0
 # The whole code, not only the new code. Every finding of the HFS canon reaches Sonar through ONE entry, `starci app lint`
-# (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry), which writes ONE file, reports/lint.sonar.json
-# (`starci app lint --sonar reports/lint.sonar.json`), named by sonar.externalIssuesReportPaths; the gate holds the open-issue count of
+# (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry). CI runs it per side with --side and --sonar,
+# then merges rules by id and joins issues into ONE file, reports/lint.sonar.json, named by sonar.externalIssuesReportPaths; the gate holds the open-issue count of
 # the whole project at zero. The file carries three engines:
 #   starci-hfs   the repository findings of `starci app check` (managed files, tree, pins, CI, contracts; the rule id is the finding code)
 #   eslint       ESLint's json over the repository (the BE and FE canon plugins alike, per-file and project-graph rules)

package/runtime/scripts/hfs/rules/secrets.mjs

@@ -7,7 +7,7 @@
 // A finding names the file, the line and the pattern, never the value.
 import fs from 'node:fs';
 import path from 'node:path';
-import { FORBIDDEN_FILES, secretHits } from '../../lib/secret-patterns.mjs';
+import { FORBIDDEN_FILES, secretHitsInFile } from '../../lib/secret-patterns.mjs';
 import { isSopsEnvelope } from '../../lib/sops-envelope.mjs';
 import { found, readText } from './read.mjs';
 
@@ -34,20 +34,17 @@ export function untrackedSecretFindings({ repoRoot, files, repo }) {
  * no sops envelope, or a line that matches a secret pattern. `text` is the file's text, or null when it cannot be read (binary, too
  * large, absent). The whole-tree check reads the work tree and the commit hook (`starci app hygiene`) reads the staged blob: one judgement.
  */
-export function secretFileFindings({ file, text }) {
+export function secretFileFindings({ file, text, manifestText }) {
   const being = FORBIDDEN_FILES.find((rule) => rule.test(file));
   if (being) return [found(PLAINTEXT_SECRET, file, `${file} is a plaintext secret by being (${being.name}); a secret is committed only as a sops envelope at .starcistacks/<env>/secrets/<slug>.enc`, { pattern: being.name })];
   if (text === null || text === undefined || NOT_SCANNED.test(file)) return [];
   if (file.endsWith('.enc')) return isSopsEnvelope(text) ? [] : [found(PLAINTEXT_SECRET, file, `${file} is named like a sealed secret but is not a sops envelope; encrypt the value with sops and commit only the envelope`, { pattern: 'sops-not-envelope' })];
   const findings = [];
-  const lines = text.split(/\r?\n/);
   const seen = new Set();
-  for (const [index, line] of lines.entries()) {
-    for (const pattern of secretHits(file, line)) {
-      if (seen.has(pattern)) continue;
-      seen.add(pattern);
-      findings.push(found(PLAINTEXT_SECRET, file, `${file}:${index + 1} holds a plaintext secret (${pattern}); seal it with sops at .starcistacks/<env>/secrets/<slug>.enc and read it by *_FILE`, { line: index + 1, pattern }));
-    }
+  for (const { line, pattern } of secretHitsInFile(file, text, { manifestText })) {
+    if (seen.has(pattern)) continue;
+    seen.add(pattern);
+    findings.push(found(PLAINTEXT_SECRET, file, `${file}:${line} holds a plaintext secret (${pattern}); seal it with sops at .starcistacks/<env>/secrets/<slug>.enc and read it by *_FILE`, { line, pattern }));
   }
   return findings;
 }
@@ -62,7 +59,8 @@ export function secretFindings({ repoRoot, files, resolver }) {
       findings.push(found(PLAINTEXT_SECRET, file, `${file} is a plaintext secret file tracked in ${slot.slot}${destination}`, { slot: slot.slot, goesTo: slot.goesTo }));
       continue;
     }
-    findings.push(...secretFileFindings({ file, text: readText(repoRoot, file) }));
+    const manifestText = /(?:^|\/)README\.md$/.test(file) ? readText(repoRoot, path.posix.join(path.posix.dirname(file), '.starcistacks/application-stacks.yaml')) : undefined;
+    findings.push(...secretFileFindings({ file, text: readText(repoRoot, file), manifestText }));
   }
   return findings;
 }

package/runtime/scripts/lib/secret-patterns.mjs

@@ -1,3 +1,5 @@
+import { parseYaml } from '../../engine/yaml.mjs';
+
 // secret-patterns.mjs — the one list of secret shapes the runtime refuses to carry: the push secret scan
 // (scripts/supervisor/push-mains.mjs scanDiff) refuses an outgoing range that adds one, and the typed-log
 // redaction (scripts/kernel/typed-logs.mjs redactText) blanks the value before a log row is stored.
@@ -102,3 +104,78 @@ export function secretHits(file, text) {
   }
   return names;
 }
+
+const BADGE_BEGIN = '<!-- >>> starci app sync (managed block; do not edit) >>> -->';
+const BADGE_END = '<!-- <<< starci app sync <<< -->';
+
+/** Provider-shaped credentials remain refused even where the keyword heuristic admits public badge tokens. */
+function blankBadgeValue(value) {
+  return secretHits('badge.mjs', value).length ? value : ' '.repeat(value.length);
+}
+
+/** Only scalar values at the two block-mapping service paths qualify; every other YAML substring remains scanned. */
+function manifestBadgeText(text) {
+  try { parseYaml(text); } catch { return text; }
+  const parents = [];
+  return text.split('\n').map(line => {
+    if (/^\s*(?:#.*)?$/.test(line)) return line;
+    const indent = /^ */.exec(line)[0].length;
+    while (parents.length && parents.at(-1).indent >= indent) parents.pop();
+    const match = /^( *)(?:([A-Za-z0-9_-]+)|"([A-Za-z0-9_-]+)"|'([A-Za-z0-9_-]+)'):(.*)$/.exec(line);
+    if (!match) { parents.push({ indent, key: null }); return line; }
+    match[5] = match[5].trimStart();
+    const key = match[2] ?? match[3] ?? match[4];
+    const keys = [...parents.map(parent => parent.key), key].join('.');
+    const container = /^(?:#.*)?$/.test(match[5].trim());
+    const nestedScalar = parents.some(parent => parent.container === false);
+    parents.push({ indent, key, container });
+    if (nestedScalar) return line;
+    if (!['services.codecov.badgeToken', 'services.sonar.badgeToken'].includes(keys)) return line;
+    const scalar = /^(?:"([A-Za-z0-9_-]{6,128})"|'([A-Za-z0-9_-]{6,128})'|([A-Za-z0-9_-]{6,128}))(?=\s*(?:#|$))/.exec(match[5]);
+    if (!scalar) return line;
+    const start = line.length - match[5].length;
+    return line.slice(0, start) + blankBadgeValue(scalar[0]) + match[5].slice(scalar[0].length);
+  }).join('\n');
+}
+
+/** Unreadable manifests admit only the default badge hosts; readable Sonar declarations select their own hosts. */
+function badgeHosts(manifestText) {
+  const hosts = new Set(['codecov.io']);
+  let doc;
+  try { doc = parseYaml(manifestText); } catch { hosts.add('sonarcloud.io'); return hosts; }
+  const sonar = doc?.services?.sonar;
+  if (sonar?.provider === 'sonarcloud') hosts.add('sonarcloud.io');
+  else for (const host of [sonar?.host?.public, sonar?.host?.local]) {
+    try { hosts.add(new URL(host).host); } catch { /* Invalid hosts admit nothing. */ }
+  }
+  return hosts;
+}
+
+/** Only token query values in managed Markdown badge images on declared hosts are blanked; links and other parameters remain scanned. */
+function readmeBadgeText(text, manifestText) {
+  const begin = text.indexOf(BADGE_BEGIN), end = text.indexOf(BADGE_END, begin + BADGE_BEGIN.length);
+  if (begin < 0 || end < 0) return text;
+  const hosts = badgeHosts(manifestText);
+  const start = begin + BADGE_BEGIN.length;
+  const block = text.slice(start, end).replace(/!\[[^\]\n]*\]\((https?:\/\/[^\s)]+)\)/g, (image, address) => {
+    let url;
+    try { url = new URL(address); } catch { return image; }
+    if (!hosts.has(url.host) || url.username || url.password) return image;
+    const badgePath = url.host === 'codecov.io' ? /\/graph\/badge\.svg$/.test(url.pathname) : url.pathname === '/api/project_badges/measure';
+    if (!badgePath) return image;
+    const fragment = address.indexOf('#');
+    const queryEnd = fragment < 0 ? address.length : fragment;
+    const safe = address.slice(0, queryEnd).replace(/([?&]token=)([^&#)\s]*)/g, (_, prefix, value) => prefix + blankBadgeValue(value));
+    return image.replace(address, () => safe + address.slice(queryEnd));
+  });
+  return text.slice(0, start) + block + text.slice(end);
+}
+
+/** Whole-file secret judgement exempts only declared public badge values and preserves original line numbers and every provider shape. */
+export function secretHitsInFile(file, fullText, { manifestText } = {}) {
+  const normalized = file.replace(/\\/g, '/');
+  let text = fullText;
+  if (/(?:^|\/)\.starcistacks\/application-stacks\.yaml$/.test(normalized)) text = manifestBadgeText(text);
+  if (/(?:^|\/)README\.md$/.test(normalized)) text = readmeBadgeText(text, manifestText);
+  return text.split(/\r?\n/).flatMap((line, index) => secretHits(file, line).map(pattern => ({ line: index + 1, pattern })));
+}