@starci/eslint-canon-be 3.4.34 → 3.4.36

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 3.4.36 - 2026-10-23
+- Changed: the bundled rule catalog and slot manifest name the specs that moved into this package (they drive its rules and fixtures and now pass from its own clean install); 3.4.35 was published with the old spec paths and is superseded.
+
+## 3.4.35 - 2026-10-23
+- Changed: `BE_AMBIENT_ID` has no exemption for the test world (owner ruling 2026-10-22: a loosening is always red); the world asks the injected `Ids` port like everything else.
+- Changed: the bundled canon pins select @starci/hfs 4.7.28 and @starci/cli 1.7.28.
+
 ## 3.4.34 - 2026-10-23
 - Changed: the bundled canon pins select @starci/hfs 4.7.27 and @starci/cli 1.7.27.
 

package/ambient-id.mjs

@@ -7,12 +7,11 @@
  *     `ulid` packages. Business code asks `ids.next()`; a spec provides `fakeIds()`, so an id is exactly what the spec said
  *     and a failing run reproduces.
  *
- * The owner that may mint ids is asked of the slot view (`platform` tier, capability `ids`), as the clock is, and the test
- * world (slot `be.tests.world`) is exempt like it is from the clock: it is the composition root of tests and names real
- * resources. Specs are NOT exempt. The generators are found by the module they are imported from, never by a local name,
+ * The owner that may mint ids is asked of the slot view (`platform` tier, capability `ids`), as the clock is. Nothing else is
+ * exempt: not a spec, and not the test world (slot `be.tests.world`), which asks the same `Ids` port. The generators are found by the module they are imported from, never by a local name,
  * so `import { randomUUID as newId } from "node:crypto"` is the same reference.
  */
-import { hfsOf, inTestWorld } from "./lib/hfs.mjs"
+import { hfsOf } from "./lib/hfs.mjs"
 import { isOwnedBy } from "./lib/ports.mjs"
 
 /** Modules of Node's crypto: `randomUUID` of them mints an id. */
@@ -54,7 +53,7 @@ export const noAmbientId = {
     create(context) {
         const hfs = hfsOf(context)
         const filename = context.filename || context.getFilename()
-        if (isOwnedBy(hfs, filename, "platform", "ids") || inTestWorld(hfs, filename)) return {}
+        if (isOwnedBy(hfs, filename, "platform", "ids")) return {}
         return {
             ImportDeclaration(node) {
                 const source = node.source.value

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-be",
-  "version": "3.4.34",
+  "version": "3.4.36",
   "description": "The StarCi back-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "MIT",

package/runtime/engine/yaml.mjs

@@ -4,7 +4,7 @@
 // rather than importing node_modules; yaml is a devDependency and a direct import breaks that
 // install. tests/engine/yaml-vendored-parity.spec.mjs proves the vendored parseYaml/stringifyYaml behave
 // exactly like yaml@2.9.0 with these options for every tracked *.yaml/*.yml file (parsed values
-// deep-equal, stringify output byte-identical). License: engine/yaml-license.json.
+// deep-equal, stringify output byte-identical). License: engine/yaml-license.yaml.
 // Rebuild only when deliberately upgrading yaml. The entry source is:
 //   import * as YAML from 'yaml';
 //   export function parseYaml(source) {

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.34
+    version: 3.4.36
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.33
+    version: 8.4.35
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.27
+    version: 1.7.28
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.27
+    version: 4.7.28
     group: starci
     install: registry
     side: both