@starci/eslint-canon-fe 7.1.2 → 8.0.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 8.0.1 - 2026-10-01
+
+- Changed: the bundled runtime copy of knowledge/hfs/canon-pins.yaml pins @starci/hfs 4.0.1 (the scaffold resolves a real lockfile) and this canon at 8.0.1. No rule changed.
+
+## 8.0.0 - 2026-10-01
+
+- Breaking: the app monorepo standard (hfs 4.0.0). `loadHfs(import.meta.url)` in `fe/eslint.config.mjs` finds the app-root `hfs.json` (kind `app`) one level up and gives every linted file the view of the fe side (paths relative to `fe/`); a standalone front-end `hfs.json` (`profile: fe`) is refused. The project graph (`project-graph` law) is built per side from the side folder. The config stays the managed one-liner.
+- New (lane c0-orphan): `props-fields-readonly` (R110 `FE_PROPS_MUTABLE`, law props-and-slots). The props type of an exported rendering function in product source is readonly all the way down: every field and index signature is `readonly`, and every collection it holds, directly or in a nested object declared in the file, is `readonly T[]`, `readonly [A, B]` or `ReadonlyArray<T>`. Replaces the unrun readonly-props script adapter of the retired code-pattern folder.
+- New (lane AUTHCHK): `response-cookie-attributes` (R107 `FE_COOKIE_ATTRIBUTES`, law client-boundary). A `set` on Next's `ResponseCookies` (`response.cookies.set`, `(await cookies()).set`), identified by the method's declaring class of `next`, must state `httpOnly` as a literal, carry `secure` and use `sameSite` `lax` or `strict`, judged on the TYPE of the options. The typed fixture's `next/server` and `next/headers` stubs gain the cookie classes.
+- Fixed (false positives): `route-files-thin` counts a feature owner a route file mounts through the app alias `@/` (the project graph gives each file to the deepest tsconfig project that holds it, the app's own, whose paths define the alias). `alias-reexport` does not report a route file binding a declaration to a Next.js segment export (`export const generateMetadata = homeMetadata`): the framework fixes that name. Each former false positive is a valid RuleTester case.
+
 ## 7.1.2 - 2026-10-01
 
 - Fixed: the bundled machine no longer crashes on a local export list (shared with eslint-canon-be 2.1.2).

package/client-boundary.mjs

@@ -272,6 +272,75 @@ export const noDangerousHtml = {
   },
 }
 
+// -- FE-CLIENT-5 (R107 FE_COOKIE_ATTRIBUTES) -------------------------------------------------------
+
+/** Forward-slash file name of a declaration, and the package a `node_modules/<pkg>/` (or `@scope/<pkg>`) file belongs to. */
+const packageOfDeclaration = (declaration) => {
+  const match = /\/node_modules\/((?:@[^/]+\/)?[^/]+)\//.exec(String(declaration.getSourceFile().fileName).split("\\").join("/"))
+  return match ? match[1] : null
+}
+
+/** Whether a call is `set` of Next's `ResponseCookies` (a `Set-Cookie` write), whatever the receiver is called: `response.cookies.set`, `(await cookies()).set`. */
+const isResponseCookieWrite = (checker, toTs, call) => {
+  const tsCall = toTs(call)
+  const declaration = tsCall ? checker.getResolvedSignature(tsCall)?.declaration : undefined
+  if (!declaration || !ts.isMethodDeclaration(declaration) || declaration.name.getText() !== "set") return false
+  const owner = declaration.parent
+  return ts.isClassDeclaration(owner) && owner.name?.text === "ResponseCookies" && packageOfDeclaration(declaration) === "next"
+}
+
+/** The present (non-nullish) members of a property's type on an options type, or [] when the property is absent or only nullish. */
+const presentPropertyParts = (checker, type, name, at) => {
+  const symbol = type.getProperty(name)
+  if (!symbol) return []
+  const propertyType = checker.getTypeOfSymbolAtLocation(symbol, at)
+  const parts = propertyType.isUnion() ? propertyType.types : [propertyType]
+  return parts.filter((part) => !(part.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Null | ts.TypeFlags.Void)))
+}
+
+const isBooleanLiteral = (part, value) => Boolean(part.flags & ts.TypeFlags.BooleanLiteral) && part.intrinsicName === String(value)
+const SAME_SITE = new Set(["lax", "strict"])
+
+/** The attributes a written cookie is missing, judged on the TYPE of its options (a spread `as const` constant keeps its literals). */
+const missingAttributes = (checker, type, at) => {
+  const missing = []
+  // httpOnly is a stated decision: `true` for a session, `false` only for a preference page script reads; a bare `boolean` decides nothing
+  const httpOnly = presentPropertyParts(checker, type, "httpOnly", at)
+  const stated = httpOnly.length > 0 && (httpOnly.every((part) => isBooleanLiteral(part, true)) || httpOnly.every((part) => isBooleanLiteral(part, false)))
+  if (!stated) missing.push("`httpOnly` stated as `true` or `false`")
+  const secure = presentPropertyParts(checker, type, "secure", at)
+  if (secure.length === 0 || secure.every((part) => isBooleanLiteral(part, false))) missing.push("`secure`")
+  const sameSite = presentPropertyParts(checker, type, "sameSite", at)
+  if (sameSite.length === 0 || !sameSite.every((part) => part.isStringLiteral() && SAME_SITE.has(part.value))) missing.push('`sameSite: "lax"` or `"strict"`')
+  return missing
+}
+
+/** A cookie the app writes states its script reach, is sent only over TLS and is kept off cross-site requests. */
+export const responseCookieAttributes = {
+  meta: {
+    type: "problem",
+    docs: { description: "A cookie written through Next's response cookies states `httpOnly` as a literal, carries `secure` and `sameSite` `lax` or `strict`." },
+    schema: [],
+    messages: {
+      attributes:
+        "This cookie is written without {{missing}}. A cookie left to the defaults is readable by page script and sent on cross-site requests: state `httpOnly: true` for a session (`false` only for a preference page script must read), `secure` (from `modules/config`) to keep it off plain HTTP, and `sameSite` `lax` or `strict`. Pass one options constant that states all three, declared `as const` by the module that owns the cookie.",
+    },
+  },
+  create(context) {
+    const { checker, toTs } = typed(context)
+    return {
+      CallExpression(node) {
+        if (node.callee.type !== "MemberExpression" || !isResponseCookieWrite(checker, toTs, node)) return
+        // `set(name, value, options)` or `set({ name, value, ...options })`; `set(name, value)` states nothing
+        const options = node.arguments.length === 1 ? node.arguments[0] : node.arguments[2]
+        const tsOptions = options ? toTs(options) : undefined
+        const missing = tsOptions ? missingAttributes(checker, checker.getTypeAtLocation(tsOptions), tsOptions) : ["`httpOnly` stated as `true` or `false`", "`secure`", '`sameSite: "lax"` or `"strict"`']
+        if (missing.length > 0) context.report({ node, messageId: "attributes", data: { missing: missing.join(", ") } })
+      },
+    }
+  },
+}
+
 /** The rules this law contributes to the plugin. */
 export const rules = {
   "use-client-only-at-boundary": useClientOnlyAtBoundary,
@@ -279,6 +348,7 @@ export const rules = {
   "server-module-marks-server-only": serverModuleMarksServerOnly,
   "web-storage-only-in-modules": webStorageOnlyInModules,
   "no-dangerous-html": noDangerousHtml,
+  "response-cookie-attributes": responseCookieAttributes,
 }
 
 /** Every rule is an error. */

package/docs/client-boundary.md

@@ -122,3 +122,27 @@ const draft = useTopUpDraft()
 **Why:** `dangerouslySetInnerHTML` on `<tag>` in `<file>`: an arbitrary string becomes executable HTML.
 
 **Fix:** Render content as elements; only a `<script>` carrying JSON-LD or theme code from an app constant may use it.
+
+## `starci-fe/response-cookie-attributes`
+
+A cookie written through Next's response cookies (`response.cookies.set`, `(await cookies()).set`, found by the method's declaring class `ResponseCookies` of `next`, never by a name) states `httpOnly` as a literal, carries `secure` and has `sameSite` `lax` or `strict`. The options are judged by their TYPE, so an `as const` constant and a spread of it (`{ ...SESSION_COOKIE_OPTIONS, maxAge: 0 }`) keep their literals (R107 `FE_COOKIE_ATTRIBUTES`).
+
+**Invalid** (`src/app/api/session/route.ts`)
+
+```ts
+response.cookies.set(SESSION_COOKIE, token)
+response.cookies.set(SESSION_COOKIE, token, { sameSite: "none", secure: true })
+```
+
+**Valid** (`src/app/api/session/route.ts`)
+
+```ts
+export const SESSION_COOKIE_OPTIONS = { httpOnly: true, sameSite: "lax", path: "/", secure: SESSION_COOKIE_SECURE } as const
+response.cookies.set(SESSION_COOKIE, token, SESSION_COOKIE_OPTIONS)
+```
+
+**Finding code:** `FE_COOKIE_ATTRIBUTES`
+
+**Why:** `<file>` writes a cookie without a literal `httpOnly`, without `secure`, or with `sameSite` other than `lax`/`strict`; a session cookie left to the defaults is readable by page script and rides cross-site requests.
+
+**Fix:** Pass one `as const` options constant of the module that owns the cookie: `httpOnly: true` (`false` only for a preference page script reads), `secure` from `modules/config`, `sameSite` `lax` or `strict`.

package/lib/config.mjs

@@ -39,7 +39,7 @@ export const buildFeConfig = ({ hfs, plugin, source, reactHooks }) => {
   if (!hfs || typeof hfs.slotOf !== "function" || typeof hfs.repoRoot !== "string") {
     throw new Error("starciFeConfig needs { hfs: loadHfs(import.meta.url) } - the rules read the repository's slots through it")
   }
-  if (hfs.profile !== "fe") throw new Error(`starciFeConfig lints a front end; hfs.json declares profile ${hfs.profile}`)
+  if (hfs.profile !== "fe") throw new Error(`starciFeConfig lints the fe side of an app (its eslint.config.mjs lives in fe/); this view is ${hfs.side ? `the ${hfs.side} side` : "the app root"}`)
   if (Object.keys(source).length === 0) throw new Error("starciFeConfig received an empty source recommendation - a config with no rules is not adoption")
   const weak = Object.entries(source).filter(([, setting]) => levelOf(setting) !== "error").map(([name]) => name)
   if (weak.length > 0) throw new Error(`starciFeConfig refuses source rules not at error: ${weak.join(", ")}`)

package/lib/hfs.mjs

@@ -2,7 +2,8 @@
  * The one door between the front-end lint rules and the HFS slot manifest of the repository being linted.
  *
  * A consuming `eslint.config.mjs` is the managed one-liner `export default starciFeConfig({ hfs: loadHfs(import.meta.url) })`.
- * `loadHfs` reads the repository's `hfs.json` beside that config file and the slot manifest this package ships in
+ * The config lives in the fe/ side folder of an app; `loadHfs` finds the app-root `hfs.json` one level up and gives every file
+ * linted under that folder the view of the fe side (paths relative to fe/), with the slot manifest this package ships in
  * `runtime/` (a byte copy of the runtime's `knowledge/hfs/slots.yaml`, `scripts/lib/hfs-slots.mjs` and
  * `scripts/lib/hfs-view.mjs`, refreshed by `packages/hfs/scripts/sync-runtime.mjs`), and returns the view the factory puts
  * in `settings.starci.hfs`.
@@ -17,7 +18,7 @@ import { declaredHfsView, openHfsView } from "../runtime/scripts/lib/hfs-view.mj
 const RUNTIME = join(dirname(fileURLToPath(import.meta.url)), "..", "runtime")
 
 /**
- * The HFS view of the repository whose `eslint.config.mjs` calls this.
+ * The HFS view of the side whose `eslint.config.mjs` (in fe/) calls this.
  *
  * @param {string} configUrl - `import.meta.url` of the repository's `eslint.config.mjs`.
  * @returns {object} The frozen HFS view.
@@ -25,13 +26,13 @@ const RUNTIME = join(dirname(fileURLToPath(import.meta.url)), "..", "runtime")
 export const loadHfs = (configUrl) => openHfsView({ runtimeRoot: RUNTIME, repoRoot: dirname(fileURLToPath(configUrl)) })
 
 /**
- * The HFS view of an in-memory declaration, for rule tests.
+ * The HFS view of the fe side of an in-memory app declaration, for rule tests.
  *
- * @param {object} declaration - An `hfs.json` object.
- * @param {string} repoRoot - The absolute root the linted filenames live under.
+ * @param {object} declaration - An app `hfs.json` object.
+ * @param {string} repoRoot - The absolute fe side folder the linted filenames live under.
  * @returns {object} The frozen HFS view.
  */
-export const hfsFromDeclaration = (declaration, repoRoot) => declaredHfsView({ runtimeRoot: RUNTIME, declaration, repoRoot })
+export const hfsFromDeclaration = (declaration, repoRoot) => declaredHfsView({ runtimeRoot: RUNTIME, declaration, repoRoot, side: "fe" })
 
 /**
  * The HFS view a rule runs under; a rule that needs it and gets none refuses to guess.

package/lib/next.mjs

@@ -1,6 +1,6 @@
 /**
  * Next.js's own contract for route segment files, read from the runtime's one statement of it
- * (`scripts/lib/next-contract.mjs`, shipped in `runtime/` by `packages/hfs/scripts/sync-runtime.mjs`): the architecture
- * machine and these laws hold the same list by construction.
+ * (`scripts/lib/next-contract.mjs`, shipped in `runtime/` by `packages/hfs/scripts/sync-runtime.mjs`), so every law
+ * holds the same list by construction.
  */
 export { NEXT_RESERVED_EXPORTS, NEXT_ROUTE_SEGMENT_STEMS } from "../runtime/scripts/lib/next-contract.mjs"

package/lib/why.mjs

@@ -53,8 +53,8 @@ export const why = {
   },
   "no-hand-typed-wire": {
     code: "FE_WIRE_GENERATED",
-    vi: "`<file>` tự gõ kiểu wire hoặc ép kiểu phản hồi. Dùng kiểu sinh từ `contract/`.",
-    fixVi: "Chạy codegen từ bản sao hợp đồng ở `modules/api/contract/` và nhập kiểu sinh ra; đưa tài liệu GraphQL vào tệp `.graphql`.",
+    vi: "`<file>` tự gõ kiểu wire hoặc ép kiểu phản hồi. Dùng kiểu sinh từ `be/contracts/`.",
+    fixVi: "Chạy codegen từ ảnh chụp hợp đồng của be (`be/contracts/`) và nhập kiểu sinh ra; đưa tài liệu GraphQL vào tệp `.graphql`.",
   },
   "use-client-only-at-boundary": {
     code: "FE_CLIENT_BOUNDARY",
@@ -231,6 +231,16 @@ export const why = {
     vi: "`dangerouslySetInnerHTML` trên `<tag>` ở `<file>`: chuỗi bất kỳ trở thành HTML chạy được.",
     fixVi: "Render nội dung thành phần tử; chỉ `<script>` mang JSON-LD hoặc mã theme từ hằng số của app mới được dùng.",
   },
+  "response-cookie-attributes": {
+    code: "FE_COOKIE_ATTRIBUTES",
+    vi: "`<file>` ghi cookie qua cookie phản hồi của Next mà không nêu `httpOnly` cố định, thiếu `secure` hoặc `sameSite` không phải `lax`/`strict`.",
+    fixVi: "Truyền một hằng số options `as const` của module sở hữu cookie: `httpOnly: true` (chỉ `false` cho cookie tùy chọn script cần đọc), `secure` từ `modules/config`, `sameSite: \"lax\"` hoặc `\"strict\"`.",
+  },
+  "props-fields-readonly": {
+    code: "FE_PROPS_MUTABLE",
+    vi: "Kiểu props của component ở `<file>` có field hoặc collection không `readonly`, nên component có thể ghi vào thứ nó được truyền.",
+    fixVi: "Đánh dấu `readonly` cho mọi field và index signature, viết collection là `readonly T[]`, `readonly [A, B]` hoặc `ReadonlyArray<T>`.",
+  },
   "no-native-img": {
     code: "FE_NATIVE_IMAGE",
     vi: "`<img>` thô ở `<file>`: tải ảnh gốc, không giữ chỗ nên trang nhảy khi ảnh tải xong.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "7.1.2",
+  "version": "8.0.1",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "UNLICENSED",

package/props-and-slots.mjs

@@ -142,8 +142,128 @@ export const noCssDoorTypeLaundering = {
   },
 }
 
+/** The top-level declaration of a type name in this file (`interface X` or `type X = ...`), or null. */
+const localTypeDeclaration = (program, name) => {
+  for (const statement of program.body) {
+    const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement
+    if ((declaration?.type === "TSInterfaceDeclaration" || declaration?.type === "TSTypeAliasDeclaration") && declaration.id.name === name) return declaration
+  }
+  return null
+}
+
+/** The type the first parameter of a function declares, or null. */
+const firstParameterType = (fn) => {
+  const param = fn.params?.[0]
+  const annotated = param?.type === "AssignmentPattern" ? param.left : param
+  return annotated?.typeAnnotation?.typeAnnotation ?? null
+}
+
+/** The exported functions of a file that render (contain JSX): a component, whatever it is called. */
+const exportedRenderers = (program) => program.body.flatMap((statement) => {
+  const declaration = statement.type === "ExportNamedDeclaration" || statement.type === "ExportDefaultDeclaration" ? statement.declaration : null
+  if (!declaration) return []
+  const functions = declaration.type === "VariableDeclaration"
+    ? declaration.declarations.map((item) => item.init).filter((init) => init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression")
+    : declaration.type === "FunctionDeclaration" || declaration.type === "ArrowFunctionExpression" || declaration.type === "FunctionExpression" ? [declaration] : []
+  return functions.filter((fn) => fn.params.length === 1 && containsJsx(fn.body))
+})
+
+/** Props are readonly all the way down: every field, index signature, nested object and collection (FE-TYPING-2). */
+export const propsFieldsReadonly = {
+  meta: {
+    type: "problem",
+    docs: { description: "Every field of a component's props type, nested objects and collections included, is readonly." },
+    schema: [],
+    messages: {
+      field: "Props field `{{name}}` is not readonly. A component reads its props and never writes them: mark it `readonly` so a write is a type error.",
+      index: "This props index signature is not readonly. Mark it `readonly [key: ...]` so no entry can be written through props.",
+      collection: "This props collection is mutable. Write `readonly T[]`, `readonly [A, B]` or `ReadonlyArray<T>` so the component cannot change what it was given.",
+    },
+  },
+  create(context) {
+    if (!isProductSource(context)) return {}
+    const sourceCode = context.sourceCode || context.getSourceCode()
+    return {
+      "Program:exit"(program) {
+        const seen = new Set()
+        /** Checks one type: object members, collections and the local declarations it names. */
+        const checkType = (type) => {
+          if (!type || seen.has(type)) return
+          seen.add(type)
+          if (type.type === "TSTypeOperator" && type.operator === "readonly") {
+            checkElements(type.typeAnnotation)
+            return
+          }
+          if (type.type === "TSArrayType" || type.type === "TSTupleType") {
+            context.report({ node: type, messageId: "collection" })
+            checkElements(type)
+            return
+          }
+          if (type.type === "TSUnionType" || type.type === "TSIntersectionType") {
+            for (const part of type.types) checkType(part)
+            return
+          }
+          if (type.type === "TSTypeLiteral") {
+            checkMembers(type.members)
+            return
+          }
+          if (type.type !== "TSTypeReference" || type.typeName.type !== "Identifier") return
+          const name = type.typeName.name
+          const args = type.typeArguments?.params ?? type.typeParameters?.params ?? []
+          // `Readonly<T>` makes the top level readonly; what T nests is still judged
+          if (name === "Readonly" && args.length === 1 && !isShadowed(type.typeName)) {
+            checkNested(args[0])
+            return
+          }
+          if (name === "Array" && !isShadowed(type.typeName)) context.report({ node: type, messageId: "collection" })
+          if ((name === "Array" || name === "ReadonlyArray") && !isShadowed(type.typeName)) {
+            for (const arg of args) checkType(arg)
+            return
+          }
+          const declaration = localTypeDeclaration(program, name)
+          if (!declaration || seen.has(declaration)) return
+          seen.add(declaration)
+          if (declaration.type === "TSTypeAliasDeclaration") checkType(declaration.typeAnnotation)
+          else {
+            checkMembers(declaration.body.body)
+            for (const heritage of declaration.extends ?? []) {
+              if (heritage.expression.type === "Identifier") checkType({ type: "TSTypeReference", typeName: heritage.expression, typeArguments: heritage.typeArguments })
+            }
+          }
+        }
+        /** The element types of a collection, judged like any other props type. */
+        const checkElements = (collection) => {
+          if (collection?.type === "TSArrayType") checkType(collection.elementType)
+          else if (collection?.type === "TSTupleType") for (const element of collection.elementTypes) checkType(element.type === "TSNamedTupleMember" ? element.elementType : element)
+          else checkType(collection)
+        }
+        /** A `Readonly<T>` argument: its own fields are readonly, its nested values are judged. */
+        const checkNested = (type) => {
+          if (type?.type === "TSTypeLiteral") for (const member of type.members) checkType(member.typeAnnotation?.typeAnnotation)
+          else checkType(type)
+        }
+        const checkMembers = (members) => {
+          for (const member of members) {
+            if (member.type === "TSPropertySignature") {
+              if (!member.readonly) context.report({ node: member, messageId: "field", data: { name: sourceCode.getText(member.key) } })
+              checkType(member.typeAnnotation?.typeAnnotation)
+            } else if (member.type === "TSIndexSignature") {
+              if (!member.readonly) context.report({ node: member, messageId: "index" })
+              checkType(member.typeAnnotation?.typeAnnotation)
+            }
+          }
+        }
+        /** True when a built-in name is redeclared in this file, so it is not the built-in. */
+        const isShadowed = (identifier) => localTypeDeclaration(program, identifier.name) !== null
+        for (const fn of exportedRenderers(program)) checkType(firstParameterType(fn))
+      },
+    }
+  },
+}
+
 export const rules = {
   "no-inline-parameter-type": noInlineParameterType,
+  "props-fields-readonly": propsFieldsReadonly,
   "public-component-signature": publicComponentSignature,
   "no-per-part-classname-prop": noPerPartClassNameProp,
   "no-public-classname-prop": noPublicClassNameProp,

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -5,7 +5,14 @@ purpose: >-
   then the repositories' own upgrade lane (each sets the exact version and reinstalls; nothing else installs a @starci package). Read on 2026-09-29 from the packages under
   .claude/packages and from the installed node_modules of nivo-backend, nivo-fe, starci-next, starci-next-fe,
   mia-mia-backend and miamia-fe; where they disagreed the newest version installed in more than one repository
-  won, and the runtime's own version won for @starci packages.
+  won, and the runtime's own version won for @starci packages. An app (hfs 4) has ONE package.json for both sides, so a
+  dependency both sides declared at different versions takes one: its pin where it has one, otherwise the higher of the
+  two, pinned here with a why (2026-10-01, from nivo-backend/nivo-fe, starci-next/starci-next-fe and
+  mia-mia-backend/miamia-fe: every such conflict but graphql was already pinned). The runtime's example apps merged the
+  same way on 2026-10-01 (examples/todo-app from todo-app-backend/todo-app-frontend, examples/ecommerce-app from
+  ecommerce-app-be/ecommerce-app-fe): no dependency outside this file was declared at two versions across their sides, so
+  every choice is a pin (each side's older @starci pins and graphql moved to the version here). `side` names the side whose code uses
+  the dependency; the app root package.json carries the pins of both.
 pins:
   # --- @starci packages. Every @starci package is a PUBLISHED npm package (install: registry): a product repository
   # installs the exact pinned version from the npm registry in the root and every workspace package.json, never `file:`.
@@ -17,19 +24,19 @@ pins:
     source: packages/grammar/package.json
     why: nivo-fe pins 0.4.11 and 0.5.0 in one workspace, starci-next-fe 0.5.1, miamia-fe 0.5.0; the runtime source is 0.8.0 (the brand layer sets `--font-sans` and `--font-mono`; the grammar reads them; 0.7.2 added the Input tel kind and IconButton disclosure props).
   '@starci/eslint-canon-be':
-    version: 2.1.2
+    version: 3.0.1
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
-    why: '2.0.0 (C0 release): starciBeConfig({ hfs: loadHfs(import.meta.url) }) typed factory and the BE-CONVENTION laws (R36 sql-text-only, R83 no-repository-class, R85/R87/R89 service-deps, R43 config-parsed-in-main, R47/R48 test world, R95 operations, R98-R101 builders).'
+    why: '3.0.1: its bundled canon-pins copy pins hfs 4.0.1. 3.0.0: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side; the project graph is built per side. 2.0.0 (C0 release): starciBeConfig({ hfs: loadHfs(import.meta.url) }) typed factory and the BE-CONVENTION laws.'
   '@starci/eslint-canon-fe':
-    version: 7.1.2
+    version: 8.0.1
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
-    why: '7.0.0: the front end has no tests (test rules removed, FE_NO_TESTS R97 in hfs); no-vietnamese-in-source (R91).'
+    why: '8.0.1: its bundled canon-pins copy pins hfs 4.0.1. 8.0.0: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side; the project graph is built per side. 7.0.0: the front end has no tests (FE_NO_TESTS R97 in hfs); no-vietnamese-in-source (R91).'
   '@starci/stylelint-canon':
     version: 2.0.1
     group: starci
@@ -50,19 +57,26 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.1.0
+    version: 2.2.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
-    why: '2.1.0: four projects on the test world, the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+    why: '2.2.0: the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; 2.1.0: four projects on the test world, the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+  '@starci/test-world':
+    version: 1.0.0
+    group: starci
+    install: registry
+    side: be
+    source: packages/test-world/package.json
+    why: 'the shared e2e library of every back end (R47, R48): the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs, the outage lock and the starci-test-stack bin behind the managed test:stack script; a devDependency of every back end.'
   '@starci/hfs':
-    version: 3.0.0
+    version: 4.0.1
     group: starci
     install: registry
     side: both
     source: packages/hfs/package.json
-    why: '2.0.0 (C0 release): the BE-CONVENTION machine, emit-contracts (GraphQL SDL and OpenAPI from the typed operation table), the four-project test layout, FE has no tests, repo.scripts slot, secrets guard in work-hygiene, rule ids R<2-3 digits>.'
+    why: '4.0.1: `hfs scaffold app` resolves the real lockfile with npm (`npm install --package-lock-only`) instead of writing a root-only stub that `npm ci` refuses. 4.0.0: the app monorepo standard: one app repository with the root package.json, lockfile and hfs.json of kind app, and the be/ and fe/ sides; `hfs scaffold app <name>` makes it, `hfs lint` at the root lints be/** with the BE canon and fe/** with the FE canon; the standalone be/fe repository kinds and `hfs init` are deleted.'
   # --- tooling
   typescript:
     version: 5.9.3
@@ -152,6 +166,11 @@ pins:
     group: framework
     side: fe
     why: every HFS front end uses next-intl with the [locale] segment (hfs sync --init writes it); nivo-fe resolves 4.13.6.
+  graphql:
+    version: 16.14.2
+    group: framework
+    side: both
+    why: 'one app package.json for both sides (hfs 4): nivo-backend declares ^16.14.1 and nivo-fe ^16.14.2, the higher wins; all four product installs resolve 16.14.2. The example apps: todo-app-backend declared ^16.14.2 (devDependencies) and ecommerce-app-be ^16.14.2 (dependencies and devDependencies); each app root now has one dependencies entry at the pin.'
   supertest:
     version: 7.3.0
     group: tooling