@starci/eslint-canon-fe 7.1.0 → 7.1.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 7.1.1 - 2026-10-01
+
+- Fixed: every rule failed to load in product repositories ("the managed package-scripts template ... cannot be found next to the runtime"): the bundled runtime now carries the data files the architecture machine reads beside its code (the managed package-scripts templates, canon-pins and the Sonar gate). A new runtime spec, `tests/canon-packed-load.spec.mjs`, installs each canon from its packed tarball into a real HFS repository and requires every rule to load.
+
 ## 7.1.0 - 2026-10-01
 
 - New: the `project-graph` law: the TS-attached front-end architecture checks (routes, owners, paths) as eslint rules at error, from one cached project graph per lint run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "7.1.0",
+  "version": "7.1.1",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "UNLICENSED",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -0,0 +1,170 @@
+schema: starci/canon-pins@1
+purpose: >-
+  The exact version of every dependency a StarCi product repository pins. One version per dependency for the whole
+  family. Raising a version is a change to this file first (with the package bump when it is a @starci package),
+  then the repositories' own upgrade lane (each sets the exact version and reinstalls; nothing else installs a @starci package). Read on 2026-09-29 from the packages under
+  .claude/packages and from the installed node_modules of nivo-backend, nivo-fe, starci-next, starci-next-fe,
+  mia-mia-backend and miamia-fe; where they disagreed the newest version installed in more than one repository
+  won, and the runtime's own version won for @starci packages.
+pins:
+  # --- @starci packages. Every @starci package is a PUBLISHED npm package (install: registry): a product repository
+  # installs the exact pinned version from the npm registry in the root and every workspace package.json, never `file:`.
+  '@starci/grammar':
+    version: 0.8.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/grammar/package.json
+    why: nivo-fe pins 0.4.11 and 0.5.0 in one workspace, starci-next-fe 0.5.1, miamia-fe 0.5.0; the runtime source is 0.8.0 (the brand layer sets `--font-sans` and `--font-mono`; the grammar reads them; 0.7.2 added the Input tel kind and IconButton disclosure props).
+  '@starci/eslint-canon-be':
+    version: 2.1.1
+    group: starci
+    install: registry
+    side: be
+    source: packages/eslint/be/package.json
+    why: '2.0.0 (C0 release): starciBeConfig({ hfs: loadHfs(import.meta.url) }) typed factory and the BE-CONVENTION laws (R36 sql-text-only, R83 no-repository-class, R85/R87/R89 service-deps, R43 config-parsed-in-main, R47/R48 test world, R95 operations, R98-R101 builders).'
+  '@starci/eslint-canon-fe':
+    version: 7.1.1
+    group: starci
+    install: registry
+    side: fe
+    source: packages/eslint/fe/package.json
+    why: '7.0.0: the front end has no tests (test rules removed, FE_NO_TESTS R97 in hfs); no-vietnamese-in-source (R91).'
+  '@starci/stylelint-canon':
+    version: 2.0.1
+    group: starci
+    install: registry
+    side: fe
+    source: packages/stylelint/package.json
+    why: '2.0.1 accepts `--font-sans` and `--font-mono` in the brand layer (the vocabulary follows the grammar 0.8.0). 2.0.0 adds status-contrast (HeroUI soft pairs measured per theme), fixes brand-layer-shape on the shared :root,.light,.dark block and the info soft pair, and derives appTokens with loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
+  '@starci/tsconfig':
+    version: 2.0.0
+    group: starci
+    install: registry
+    side: both
+    source: packages/tsconfig/package.json
+  '@starci/prettier-config':
+    version: 1.0.0
+    group: starci
+    install: registry
+    side: both
+    source: packages/prettier-config/package.json
+  '@starci/jest-preset':
+    version: 2.1.0
+    group: starci
+    install: registry
+    side: be
+    source: packages/jest-preset/package.json
+    why: '2.1.0: four projects on the test world, the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+  '@starci/hfs':
+    version: 3.0.0
+    group: starci
+    install: registry
+    side: both
+    source: packages/hfs/package.json
+    why: '2.0.0 (C0 release): the BE-CONVENTION machine, emit-contracts (GraphQL SDL and OpenAPI from the typed operation table), the four-project test layout, FE has no tests, repo.scripts slot, secrets guard in work-hygiene, rule ids R<2-3 digits>.'
+  # --- tooling
+  typescript:
+    version: 5.9.3
+    group: tooling
+    side: both
+    why: all six repositories resolve 5.9.3 already; the declared ranges (^5, ^5.7.3) become exact.
+  prettier:
+    version: 3.9.6
+    group: tooling
+    side: both
+    why: only nivo-backend has it installed (3.9.6); the other five adopt it with the formatter change.
+  stylelint:
+    version: 17.15.0
+    group: tooling
+    side: fe
+    why: no repository has it installed; 17.15.0 is the current release, and the canon plugin needs the ESM-only 17 line.
+  postcss-value-parser:
+    version: 4.2.0
+    group: tooling
+    side: fe
+    why: peer of @starci/stylelint-canon (it parses declaration values); 4.2.0 is what stylelint 17.15.0 itself resolves.
+  eslint:
+    version: 9.39.5
+    group: tooling
+    side: both
+    why: five repositories resolve 9.39.5, nivo-backend 9.39.4.
+  eslint-plugin-react-hooks:
+    version: 7.1.1
+    group: tooling
+    side: fe
+    why: '2.0.0 (C0 release): the BE-CONVENTION machine, emit-contracts (GraphQL SDL and OpenAPI from the typed operation table), the four-project test layout, FE has no tests, repo.scripts slot, secrets guard in work-hygiene, rule ids R<2-3 digits>.'
+  '@types/node':
+    version: 22.20.4
+    group: tooling
+    side: both
+    why: nivo-fe resolves 20.19.43 and nivo-backend 22.20.0; the package engines are node >=22.
+  # --- test
+  jest:
+    version: 29.7.0
+    group: test
+    side: be
+  ts-jest:
+    version: 29.4.12
+    group: test
+    side: be
+  '@types/jest':
+    version: 29.5.14
+    group: test
+    side: be
+  # --- framework
+  next:
+    version: 16.1.6
+    group: framework
+    side: fe
+  react:
+    version: 19.2.3
+    group: framework
+    side: fe
+  react-dom:
+    version: 19.2.3
+    group: framework
+    side: fe
+  '@nestjs/core':
+    version: 11.2.5
+    group: framework
+    side: be
+    why: nivo-backend resolves 11.1.27, starci-next and mia-mia-backend 11.2.5.
+  '@nestjs/common':
+    version: 11.2.5
+    group: framework
+    side: be
+  '@nestjs/platform-express':
+    version: 11.2.5
+    group: framework
+    side: be
+  '@nestjs/testing':
+    version: 11.2.5
+    group: framework
+    side: be
+  '@nestjs/terminus':
+    version: 11.1.1
+    group: framework
+    side: be
+    why: readiness probes with dependency indicators use Terminus (the liveness route of the hfs sync --init skeleton does not, being a thin door over the liveness service); nivo-backend, starci-next and mia-mia-backend all resolve 11.1.1.
+  next-intl:
+    version: 4.13.6
+    group: framework
+    side: fe
+    why: every HFS front end uses next-intl with the [locale] segment (hfs sync --init writes it); nivo-fe resolves 4.13.6.
+  supertest:
+    version: 7.3.0
+    group: tooling
+    side: be
+    why: the e2e world of a back end calls the app over HTTP (/health/live in the skeleton); starci-next and mia-mia-backend resolve 7.3.0, nivo-backend 7.2.2.
+  # --- ui
+  '@heroui/react':
+    version: 3.2.6
+    group: ui
+    side: fe
+    why: nivo-fe resolves 3.2.4, starci-next-fe and miamia-fe 3.2.6.
+  '@heroui/styles':
+    version: 3.2.6
+    group: ui
+    side: fe
+    why: nivo-fe resolves 3.2.4, starci-next-fe and miamia-fe 3.2.6.

package/runtime/knowledge/sonar-gate.yaml

@@ -0,0 +1,86 @@
+schema: starci/sonar-gate@1
+id: sonar-gate
+title: The Sonar quality gate every product is held to
+purpose: |
+  The one place the Sonar thresholds live. A product repository never restates them: its
+  .starcistacks/application-stacks.yaml `services.sonar.qualityGate` names the gate below, and
+  scripts/checks/sonar-local.mjs (1) makes the local SonarQube's gate of that name carry exactly these
+  conditions and selects it for the project, and (2) judges an op's slice - the lines it changed - against
+  the same numbers. Code-writing ops cannot settle done while the slice is red
+  (scripts/kernel/sonar-settle.mjs). Changing a number here changes every repository on the next scan.
+  The gate has two parts: `newCode` (the recent work: duplication, blocker/critical issues, hotspots) and
+  `overall` (the whole code: no imported HFS, ESLint or stylelint finding, no duplicated-lines excess, no cognitive-
+  complexity issue). The one Sonar mechanism of the HFS canon is packages/hfs/README.md section "Sonar".
+gate:
+  name: starci-new-code
+  # A project with no new-code baseline judges the whole project as new code (nivo inc-f92febebbb64); a fixed
+  # window keeps "new code" the recent work on main, so the server gate is passable on a healthy main.
+  newCodePeriod: {type: NUMBER_OF_DAYS, value: 30}
+newCode:
+  # Sonar holds NO coverage condition: unit coverage is the runner's job (jest per-file 100 on `*.service.ts`), never an lcov import.
+  # SonarQube's ignoreSmallChanges: fewer changed lines than this are not held to duplication.
+  ignoreBelowChangedLines: 20
+  duplication:
+    metric: new_duplicated_lines_density
+    maxPercent: 3
+  issues:
+    # An open issue of these severities on a changed line fails the slice; lesser ones are listed, never blocking.
+    blockingSeverities: [BLOCKER, CRITICAL]
+    metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations}
+    max: 0
+  hotspots:
+    metric: new_security_hotspots_reviewed
+    minReviewedPercent: 100
+    unreviewedMax: 0
+# The whole code, not only the new code. Every finding of the HFS canon reaches Sonar through ONE entry, `hfs lint`
+# (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry), which writes ONE file, reports/lint.sonar.json
+# (`npm run lint -- --sonar reports/lint.sonar.json`), named by sonar.externalIssuesReportPaths; the gate holds the open-issue count of
+# the whole project at zero. The file carries three engines:
+#   starci-hfs   the repository findings of `hfs check` (managed files, tree, pins, CI, contracts; the rule id is the finding code)
+#   eslint       ESLint's json over the repository (the BE and FE canon plugins alike, per-file and project-graph rules)
+#   stylelint    stylelint's json over the style glob (front ends)
+# The engines share ONE placement rule (a finding on a file Sonar does not index is filed on the first source file); Sonar's own
+# ESLint import (sonar.eslint.reportPaths) is not used because it drops such issues.
+# A SonarQube gate condition cannot filter issues by engine, so the condition is the project's open issues (`violations`,
+# overall code): the three engines above are the imports it counts, and every native Sonar issue counts with them. That is
+# stricter than the engines alone and it is intended: a project that meets this gate has no open issue of any origin.
+overall:
+  issues:
+    metric: violations
+    max: 0
+    engines: [starci-hfs, eslint, stylelint]
+  # HFS_DUPLICATE_CODE (R21): duplicated lines density of the whole project, the Sonar enforcer of the machine's clone check.
+  # SonarJS runs its own token-based detection (sonar.cpd.* minimums are not read for TypeScript), so ruleParams.<profile>.duplicateBlock
+  # is enforced by the machine and imported as starci-hfs issues, and this density is the Sonar-side backstop.
+  duplication:
+    metric: duplicated_lines_density
+    maxPercent: 3
+  # HFS_SIZE_GROWTH (R20): the cognitive complexity of a function is the Sonar rule S3776 (typescript:S3776, Sonar way, default
+  # threshold); an open S3776 issue is an open issue of `overall.issues`, so the zero-issue condition is its gate.
+  cognitiveComplexity:
+    rule: typescript:S3776
+    via: overall.issues
+# The Sonar enforcers of the rule catalog (knowledge/hfs/rules.yaml): the failure code each condition above is the gate of.
+enforces:
+  - {rule: R20, code: HFS_SIZE_GROWTH, enforcer: cognitive-complexity, condition: cognitiveComplexity}
+  - {rule: R21, code: HFS_DUPLICATE_CODE, enforcer: duplicated-lines-density, condition: duplication}
+  - {rule: R21, code: HFS_DUPLICATE_SYMBOL, enforcer: duplicated-lines-density, condition: duplication}
+# Ops that write product code: each runs sonar-local on its own change and cannot settle done while the gate is red.
+enforcedOps: [backend.implement, interface.implement, code.refactor]
+reasoning: |
+  Chosen against the four projects the local server holds on 2026-09-29 (whole-project duplicated lines
+  1.6 / 2.1 / 1.7 / 0.0 percent), so new code that meets them is at or below what main already carries.
+  no coverage condition: the unit project fails below its per-file 100 threshold on `*.service.ts`, so Sonar never
+  imports an lcov report and never judges coverage.
+  duplication 3: the Sonar way value; the worst project today is 2.1, so 3 rejects a real copy-paste block and
+  passes ordinary work.
+  blocker/critical 0: the two severities that are defects, not style. main carries old debt of both kinds
+  (nivo-backend 3 blocker, 137 critical), so the SLICE verdict reads only changed lines and never main's backlog;
+  major and lower are reported on the summary and never fail a slice.
+  overall issues 0 and overall duplication 3: the server gate is also the owner's definition of done for the HFS canon:
+  a repository that carries any open ESLint, stylelint or HFS finding is not green, whatever the age of the line. The
+  op slice keeps judging changed lines (an op cannot fix a repository's whole backlog); the dashboard and CI show the
+  whole-project condition. Adopting a repository therefore means clearing its imported findings, which `hfs check`,
+  eslint and stylelint already demand at land.
+  hotspots 0 unreviewed: a hotspot is a question the author must answer; on changed lines it is answered in the
+  same slice.

package/runtime/packages/hfs/templates/be/package-scripts/package.json

@@ -0,0 +1,19 @@
+{
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json",
+    {{appScripts}}
+    "typecheck": "tsc -p tsconfig.json",
+    "typecheck:tests": "tsc -p src/tests/tsconfig.json",
+    "lint": "hfs lint",
+    "lint:fix": "hfs lint --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "test": "jest --selectProjects unit --coverage",
+    "test:affected": "jest --selectProjects unit --passWithNoTests",
+    "test:integration": "npm run typecheck:tests && jest --selectProjects integration",
+    "test:e2e": "npm run typecheck:tests && jest --selectProjects e2e",
+    "test:contract": "npm run typecheck:tests && jest --selectProjects contract",
+    "test:stack": "starci-test-stack",
+    "contract:emit": "hfs emit-contracts"
+  }
+}

package/runtime/packages/hfs/templates/fe/package-scripts/package.json

@@ -0,0 +1,13 @@
+{
+  "scripts": {
+    "prepare": "husky",
+    {{appScripts}}
+    "codegen": "npm run codegen --workspaces --if-present",
+    "build": "npm run build --workspaces --if-present",
+    "typecheck": "npm run typecheck --workspaces --if-present",
+    "lint": "npm run codegen --silent && hfs lint --stylelint \"{{styleGlob}}\"",
+    "lint:fix": "npm run codegen --silent && hfs lint --fix --stylelint \"{{styleGlob}}\"",
+    "format": "prettier --write .",
+    "format:check": "prettier --check ."
+  }
+}