@starci/eslint-canon-fe 8.2.15 → 8.2.17

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 8.2.17 - 2026-10-14
+
+- Fixed: `dead-exports` (`HFS_UNUSED_EXPORT`) counts an import by another public entry the slot declares in `entries` as a use: a `graphql/{queries,mutations}/types/<x>.ts` export its operation file `query-<x>.ts`/`mutation-<x>.ts` imports is part of that operation's signature and is no longer reported. A barrel or any other non-entry file of the owner still does not count, so an operation reached only through a re-export of `modules/api/index.ts` stays dead.
+
+## 8.2.16 - 2026-10-13
+
+- Changed: the heroicons family is the one application icon set again (owner ruling 2026-10-13): `heroicons-is-the-glyph-vendor` admits exactly `@heroicons/react/24/outline`, `@heroicons/react/16/solid` and the matching `@starci/heroicons` subpaths (read from the fe-stack `icons` concern), and refuses Phosphor and every other glyph catalogue, a package the catalog forbids included; `one-icon-set` (8.2.15) is gone. Only the Icon leaf and the toast module import a glyph. The bundled runtime mirror carries the fe-stack catalog and the canon pins with `@heroicons/react` 2.2.0 and `@starci/heroicons` 0.3.3.
+
 ## 8.2.15 - 2026-10-13
 
 - Changed: carry the runtime mirror of HFS manifest 3.0.0 (one front-end standard for the lite and the full edition, owner ruling 2026-10-13) and the canon pins for Grammar 0.9.14, HFS 4.2.14, jest-preset 2.2.7 and CLI 1.2.14.

package/icon.mjs

@@ -13,7 +13,7 @@
  */
 
 import { isClassAttribute, staticText } from "./lib/ast.mjs"
-import { canonicalPackages, forbiddingConcern, packageNameOf } from "./lib/fe-stack.mjs"
+import { canonicalPackages } from "./lib/fe-stack.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
 import { fileOf, inSlot, isComponentFile, isProductSource, kindOfFile, roleOfFile } from "./lib/scope.mjs"
 
@@ -45,11 +45,15 @@ const GLYPH_PACKAGES = [
 /** Package-name signal for a glyph catalogue not yet listed explicitly. */
 const GLYPH_PACKAGE_NAME = /(?:icon|glyph|lucide|feather|tabler|fortawesome)/i
 
+/** The two optical families of the heroicons family: the 24px outline heading cut and the 16px solid micro cut. */
+const GLYPH_CUTS = ["24/outline", "16/solid"]
+
 /**
- * True when an import names the one application icon set (fe-stack `icons`, `@phosphor-icons/react`), subpaths included
- * (`@phosphor-icons/react/dist/ssr` is its server-component entry). Read from the catalog, so the set is named once.
+ * The closed glyph surface: each package of the one application icon set (fe-stack `icons`: upstream `@heroicons/react`,
+ * used first, and StarCi's custom-only `@starci/heroicons` for the glyphs it lacks) on each of the two cuts. Read from the
+ * catalog, so the set is named once.
  */
-const isCanonicalIconSet = (source) => canonicalPackages("icons").includes(packageNameOf(source) ?? "")
+const glyphSurface = () => canonicalPackages("icons").flatMap((name) => GLYPH_CUTS.map((cut) => `${name}/${cut}`))
 
 /**
  * True when the file is the entry (slot role `entry`) of the component owner named `owner` in the layer `kind`.
@@ -107,19 +111,18 @@ export const noVendorIconOutsideIconLeaf = {
 // -- ICON-7 ----------------------------------------------------------------------------------------
 
 /**
- * The icon leaf owns the map, but that ownership does not license a second glyph vocabulary: every glyph comes from the one
- * application icon set of the front-end stack (fe-stack `icons`). A glyph package the catalog forbids by name is
- * `fe-stack-import`'s finding; this rule refuses every other glyph catalogue (Heroicons, Iconify, ...), which no list can name
- * in advance.
+ * The icon leaf owns the map, but that ownership does not license a second glyph vocabulary: every glyph comes from the
+ * heroicons family on its two cuts. Phosphor, Iconify, Lucide and every other glyph catalogue are refused, including the
+ * ones no list can name in advance.
  */
-export const oneIconSet = {
+export const heroiconsIsTheGlyphVendor = {
   meta: {
     type: "problem",
-    docs: { description: "Product glyphs come only from the one application icon set of the front-end stack (`@phosphor-icons/react`)." },
+    docs: { description: "Only the Heroicons heading and micro families (`@heroicons/react`, then `@starci/heroicons`) may supply product glyphs." },
     schema: [],
     messages: {
       vendor:
-        "`{{source}}` is a second glyph catalogue. The front end has one application icon set, {{canonical}}: two sets draw the same meaning with two strokes, two grids and two weights, and the screen looks assembled from parts. Take the glyph from {{canonical}} in the icon leaf.",
+        "`{{source}}` is outside StarCi's closed glyph surface ({{surface}}). Use upstream `@heroicons/react/24/outline` or `16/solid` when the icon exists; use the matching `@starci/heroicons` subpath only for a custom cut missing upstream, and add a missing glyph there. The StarCi package never re-exports upstream icons. Phosphor, Iconify and every other glyph catalogue are refused: two sets draw the same meaning with two strokes, two grids and two weights.",
     },
   },
   create(context) {
@@ -127,9 +130,9 @@ export const oneIconSet = {
     return {
       ImportDeclaration(node) {
         const source = node.source && node.source.value
-        if (!isGlyphImport(source) || isCanonicalIconSet(source) || forbiddingConcern(source)) return
-        const canonical = canonicalPackages("icons").map((name) => `\`${name}\``).join(", ")
-        context.report({ node, messageId: "vendor", data: { source, canonical } })
+        const surface = glyphSurface()
+        if (!isGlyphImport(source) || surface.includes(String(source))) return
+        context.report({ node, messageId: "vendor", data: { source, surface: surface.map((name) => `\`${name}\``).join(", ") } })
       },
     }
   },
@@ -195,7 +198,7 @@ export const noDecorativeIconInMetricCell = {
 /** The rules this law contributes to the plugin. */
 export const rules = {
   "no-vendor-icon-outside-icon-leaf": noVendorIconOutsideIconLeaf,
-  "one-icon-set": oneIconSet,
+  "heroicons-is-the-glyph-vendor": heroiconsIsTheGlyphVendor,
   "no-off-scale-glyph-size": noOffScaleGlyphSize,
   "no-decorative-icon-in-metric-cell": noDecorativeIconInMetricCell,
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.2.15",
+  "version": "8.2.17",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -14,8 +14,13 @@ purpose: >-
 pins:
   # --- @starci packages. Every @starci package is a PUBLISHED npm package (install: registry): a product repository
   # installs the exact pinned version from the npm registry in the root and every workspace package.json, never `file:`.
-  # @starci/heroicons has no pin since 1.0.0-alpha.13: the application icon set is @phosphor-icons/react (fe-stack.yaml
-  # icons) and eslint-canon-fe one-icon-set refuses every other glyph catalogue, so no product repository installs it.
+  '@starci/heroicons':
+    version: 0.3.4
+    group: starci
+    install: registry
+    side: fe
+    source: packages/heroicons/package.json
+    why: 'StarCi custom Heroicons-compatible cuts; eslint-canon-fe (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
     version: 0.9.14
     group: starci
@@ -24,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.2.16
+    version: 3.2.18
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.2.15
+    version: 8.2.17
     group: starci
     install: registry
     side: fe
@@ -71,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.2.14
+    version: 1.2.16
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.2.14
+    version: 4.2.16
     group: starci
     install: registry
     side: both
@@ -360,11 +365,11 @@ pins:
     group: framework
     side: fe
     why: 'the fan-out emitter behind the socket side-effect component (fe-stack realtime); version read from the starci-academy package-lock on 2026-10-13.'
-  '@phosphor-icons/react':
-    version: 2.1.10
+  '@heroicons/react':
+    version: 2.2.0
     group: ui
     side: fe
-    why: 'the one application icon set (fe-stack icons); version read from the starci-academy package-lock on 2026-10-13.'
+    why: 'the base of the one application icon set (fe-stack icons, with @starci/heroicons for the glyphs it lacks); eslint-canon-fe (icon.mjs) admits @heroicons/react/24/outline and /16/solid.'
   'next-themes':
     version: 0.4.6
     group: ui

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -99,11 +99,14 @@ concerns:
     why: the grammar renderers over HeroUI and Tailwind; no second UI kit and no CSS-in-JS.
   - id: icons
     tier: core
-    packages: ['@phosphor-icons/react']
+    packages: ['@heroicons/react', '@starci/heroicons']
     home: [fe.components]
     pattern: FE-ICON
-    forbids: [react-icons, lucide-react, '@iconify/react', '@gravity-ui/icons', '@tabler/icons-react', '@fortawesome/react-fontawesome']
-    why: one application icon set.
+    forbids: ['@phosphor-icons/react', react-icons, lucide-react, '@iconify/react', '@gravity-ui/icons', '@tabler/icons-react', '@fortawesome/react-fontawesome']
+    why: >-
+      one application icon set, the heroicons family (owner ruling 2026-10-13), on the 24/outline and 16/solid cuts. @heroicons/react
+      is the base set and is used first; @starci/heroicons holds only the glyphs heroicons lacks (brand or domain glyphs drawn in
+      heroicons style), never duplicates a heroicons glyph, and a missing glyph is added to it.
   - id: theme
     tier: core
     packages: [next-themes]

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -309,8 +309,3 @@ removed:
     name: anonymousActions
     use: 'the front end holds no Server Action (R243 FE_SERVER_ACTION_FORBIDDEN), so no slot lists anonymous ones'
     since: 1.0.0-alpha.13
-  - id: lint-heroicons-is-the-glyph-vendor
-    kind: vocabulary
-    name: heroicons-is-the-glyph-vendor
-    use: 'the eslint-fe rule is one-icon-set: the application icon set is @phosphor-icons/react (knowledge/hfs/fe-stack.yaml icons), imported only by the Icon leaf; the grammar Icon takes whatever glyph the app supplies'
-    since: 1.0.0-alpha.13

package/runtime/scripts/hfs/architecture/dead-exports.mjs

@@ -9,7 +9,10 @@
  *
  * Owner = every graph.ownerRoots unit whose tier is not `app` and whose public entry file is in the graph (index.ts or
  * index.tsx, a package's src/index.ts). The `entries` its slot declares (slot data: a second public entry file of the owner) are further
- * public entries of the same owner, judged exactly like the entry. The exported names of an entry are its named exports, `export { a as b }`,
+ * public entries of the same owner, judged like the entry, with one addition: a name another declared entry of the owner
+ * imports (not re-exports) is used, because it is part of that entry's public signature (an operation file
+ * `graphql/queries/query-<x>.ts` typing its request and answer with `graphql/queries/types/<x>.ts`). A barrel or any other
+ * non-entry file of the owner still does not count. The exported names of an entry are its named exports, `export { a as b }`,
  * `export { x } from`, declarations with `export`, and `default` for `export default`. `export *` is refused by owners.mjs
  * and contributes no name here.
  *
@@ -330,11 +333,22 @@ const unusedExportViolation = (publicEntry, name, line, owner) => ({
   message: `${publicEntry} exports ${name}, but no production file outside ${owner.root || 'the repository root'} imports it; remove the export (only a unit role spec, a fixture builder, a test world file, or an integration spec of this integration's own provider folder counts besides production files).`,
 });
 
-/** The unused-export violations and the export count of one public entry of an owner. */
-const publicEntryExports = (context, key, owner, publicEntry) => {
+/** Adds to `used` what another declared entry of the same owner imports from `publicEntry`: that entry's signature makes it public. */
+const addSiblingEntryUses = (context, publicEntry, declared, used) => {
+  for (const edge of context.edgesTo.get(publicEntry) ?? []) {
+    if (edge.reexport || edge.from === publicEntry || !declared.has(edge.from)) continue;
+    const bindings = bindingsOf(context.ts, edge.edge.declaration);
+    if (bindings.all) used.all = true;
+    for (const pair of bindings.pairs) used.names.add(pair.imported);
+  }
+};
+
+/** The unused-export violations and the export count of one public entry of an owner (`declared`: its slot's extra entries). */
+const publicEntryExports = (context, key, owner, publicEntry, declared) => {
   const names = exportedNames(context.ts, context.graph.files.get(publicEntry).sourceFile);
   const used = consumedNames(context, publicEntry, key, 0, new Set([publicEntry]));
   addReexportedUses(context, key, publicEntry, used);
+  if (declared.has(publicEntry)) addSiblingEntryUses(context, publicEntry, declared, used);
   const violations = [...names]
     .filter(([name]) => !(used.all || used.names.has(name)))
     .map(([name, line]) => unusedExportViolation(publicEntry, name, line, owner));
@@ -351,8 +365,9 @@ const ownerExportFindings = (context, config) => {
     const entry = entryOf(graph, config, key, owner);
     if (!entry) continue;
     owners += 1;
-    for (const publicEntry of [entry, ...extraEntries(graph, entry)]) {
-      const found = publicEntryExports(context, key, owner, publicEntry);
+    const declared = new Set(extraEntries(graph, entry));
+    for (const publicEntry of [entry, ...declared]) {
+      const found = publicEntryExports(context, key, owner, publicEntry, declared);
       exports += found.exports;
       violations.push(...found.violations);
     }