@starci/eslint-canon-fe 8.3.0 → 8.4.0

package/next-conventions.mjs

@@ -12,12 +12,13 @@
  */
 
 import { attribute, attributeValue, calleeName, leadingTextOf, stringOf } from "./lib/ast.mjs"
+import { variableOf } from "./lib/bindings.mjs"
 import { forbiddingConcern } from "./lib/fe-stack.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
-import { baseName, classOf, fileOf, inSlot, roleOfFile, slotOfFile, stem } from "./lib/scope.mjs"
+import { baseName, classOf, fileOf, inSlot, roleOfFile, slotOfFile } from "./lib/scope.mjs"
 
 /** Another i18n stack: a second place that decides which language a reader sees (one the fe-stack catalog forbids by name is fe-stack-import's finding). */
-const OTHER_I18N = /^(?:react-i18next|i18next|next-i18next|react-intl|next-translate|@lingui\/.+|typesafe-i18n|rosetta)(?:\/.*)?$/
+const OTHER_I18N = /^(?:react-i18next|i18next|next-i18next|react-intl|next-translate|typesafe-i18n|rosetta)(?:\/.*)?$|^@lingui\/.+$/
 
 // -- FE-NEXT-1 -------------------------------------------------------------------------------------
 
@@ -137,21 +138,23 @@ export const htmlLangFromLocale = {
 
 // -- FE-NEXT-5 -------------------------------------------------------------------------------------
 
-/** The names a module exports, from declarations and specifiers. */
-const exportedNames = (program) => {
-  const names = new Set()
-  for (const statement of program.body) {
-    if (statement.type !== "ExportNamedDeclaration") continue
-    const declaration = statement.declaration
-    if (declaration && declaration.id) names.add(declaration.id.name)
-    if (declaration && declaration.type === "VariableDeclaration") {
-      for (const entry of declaration.declarations) if (entry.id.type === "Identifier") names.add(entry.id.name)
+/** The names one named-export statement introduces. */
+const statementExportNames = (statement) => {
+  if (statement.type !== "ExportNamedDeclaration") return []
+  const declaration = statement.declaration
+  const names = (statement.specifiers ?? []).map((specifier) => specifier.exported.name)
+  if (declaration?.id) names.push(declaration.id.name)
+  if (declaration?.type === "VariableDeclaration") {
+    for (const entry of declaration.declarations) {
+      if (entry.id.type === "Identifier") names.push(entry.id.name)
     }
-    for (const specifier of statement.specifiers ?? []) names.add(specifier.exported.name)
   }
   return names
 }
 
+/** The names a module exports, from declarations and specifiers. */
+const exportedNames = (program) => new Set(program.body.flatMap(statementExportNames))
+
 /** Every page names itself: `metadata` or `generateMetadata`. */
 export const pageExportsMetadata = {
   meta: {
@@ -338,34 +341,34 @@ const STACK_FACTORIES = new Map([
   ["next-intl/middleware", new Set(["default"])],
 ])
 
-/** The variable a name binds to, walking up from the scope of a node. */
-const bindingOf = (context, identifier) => {
-  let scope = (context.sourceCode ?? context.getSourceCode()).getScope(identifier)
-  while (scope) {
-    const variable = scope.set.get(identifier.name)
-    if (variable) return variable.defs[0] ?? null
-    scope = scope.upper
-  }
+/** The public name selected by a named or default import. */
+const importedName = (specifier) => {
+  if (specifier.type === "ImportSpecifier") return specifier.imported.name ?? specifier.imported.value
+  if (specifier.type === "ImportDefaultSpecifier") return "default"
   return null
 }
 
+/** The known next-intl factory selected from an import. */
+const stackFactory = (definition, exported) => {
+  const source = String(definition.parent.source.value)
+  if (!STACK_FACTORIES.get(source)?.has(exported)) return null
+  return { source, name: exported === "default" ? "createMiddleware" : exported }
+}
+
+/** A factory called through a namespace import, else null. */
+const namespaceFactory = (context, callee) => {
+  if (callee.type !== "MemberExpression" || callee.computed || callee.object.type !== "Identifier" || callee.property.type !== "Identifier") return null
+  const definition = variableOf(context, callee.object)?.defs[0] ?? null
+  if (definition?.type !== "ImportBinding" || definition.node.type !== "ImportNamespaceSpecifier") return null
+  return stackFactory(definition, callee.property.name)
+}
+
 /** The name a stack factory has where the call reads it: "defineRouting" (next-intl/routing), else null. */
 const stackFactoryOf = (context, callee) => {
-  if (callee.type === "Identifier") {
-    const definition = bindingOf(context, callee)
-    if (definition?.type !== "ImportBinding") return null
-    const source = String(definition.parent.source.value)
-    const specifier = definition.node
-    const exported = specifier.type === "ImportSpecifier" ? specifier.imported.name ?? specifier.imported.value : specifier.type === "ImportDefaultSpecifier" ? "default" : null
-    return exported !== null && STACK_FACTORIES.get(source)?.has(exported) ? { source, name: exported === "default" ? "createMiddleware" : exported } : null
-  }
-  if (callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.property.type === "Identifier") {
-    const definition = bindingOf(context, callee.object)
-    if (definition?.type !== "ImportBinding" || definition.node.type !== "ImportNamespaceSpecifier") return null
-    const source = String(definition.parent.source.value)
-    return STACK_FACTORIES.get(source)?.has(callee.property.name) ? { source, name: callee.property.name } : null
-  }
-  return null
+  if (callee.type !== "Identifier") return namespaceFactory(context, callee)
+  const definition = variableOf(context, callee)?.defs[0] ?? null
+  if (definition?.type !== "ImportBinding") return null
+  return stackFactory(definition, importedName(definition.node))
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.3.0",
+  "version": "8.4.0",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.3.1
+    version: 3.4.0
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.3.0
+    version: 8.4.0
     group: starci
     install: registry
     side: fe
@@ -62,28 +62,28 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.2.7
+    version: 2.3.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
     why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
-    version: 1.2.1
+    version: 1.2.2
     group: starci
     install: registry
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.3.0
+    version: 1.4.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.3.0
+    version: 4.4.0
     group: starci
     install: registry
     side: both
@@ -180,7 +180,7 @@ pins:
     side: be
   # --- framework
   next:
-    version: 16.1.6
+    version: 16.4.2
     group: framework
     side: fe
   react:
@@ -206,7 +206,7 @@ pins:
     group: framework
     side: be
   '@nestjs/platform-express':
-    version: 11.2.5
+    version: 11.2.7
     group: framework
     side: be
   '@nestjs/testing':
@@ -316,7 +316,7 @@ pins:
     side: fe
     why: 'the codegen preset of the front-end wire types (fe-stack codegen); the latest registry version on 2026-10-13.'
   'axios':
-    version: 1.15.2
+    version: 1.20.0
     group: framework
     side: fe
     why: 'the REST client of the front end for uploads, presigned URLs and auth endpoints (fe-stack rest); version read from the starci-academy package-lock on 2026-10-13.'
@@ -465,12 +465,12 @@ pins:
     version: 13.4.5
     group: framework
     side: be
-    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13.'
+    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13. Stays on 13.x for alpha.18: the npm-audit advisory fixed by 14.0.3 (semver major) is a documented accepted exception, upgrade deferred to alpha.19 (owner ruling graphql-13-advisory-accepted-until-a19, 2026-10-16).'
   '@nestjs/apollo':
     version: 13.4.5
     group: framework
     side: be
-    why: 'the Apollo driver of @nestjs/graphql; the ecommerce-app resolution on 2026-10-13.'
+    why: 'the Apollo driver of @nestjs/graphql; the ecommerce-app resolution on 2026-10-13. Stays on 13.x with @nestjs/graphql (accepted advisory, major deferred to alpha.19).'
   '@apollo/server':
     version: 5.5.1
     group: framework

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -1,6 +1,6 @@
 schema: starci/fe-stack@1
 purpose: >-
-  The front-end stack of every app, lite and full alike (owner ruling 2026-10-13, R212 case-2): for each common front-end concern the
+  The front-end stack of every app, lite and full alike (owner ruling 2026-10-13, R212 case-2 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4): for each common front-end concern the
   ONE canonical library, its HFS home (slot ids of knowledge/hfs/slots.yaml), the pattern id that teaches it
   (knowledge/patterns/fe/*.yaml) and the alternatives a front end never depends on or imports. Versions live in
   knowledge/hfs/canon-pins.yaml only. `tier: core` packages are installed by every scaffold; `opt` packages are added when a feature
@@ -219,3 +219,24 @@ concerns:
     pattern: FE-LINT
     forbids: []
     why: the canon lint and format configuration.
+  - id: auth-supabase
+    tier: opt
+    packages: ['@supabase/supabase-js', '@supabase/ssr']
+    home: [fe.modules.auth]
+    pattern: FE-AUTH
+    forbids: []
+    why: the lite auth provider client and PKCE server cookie adapter, confined to modules/auth; data still goes through the back end.
+  - id: framework-support
+    tier: opt
+    packages: [server-only, rxjs]
+    home: [fe.source-root-pinned]
+    pattern: FE-ROUTE
+    forbids: []
+    why: the Next server boundary marker and Apollo peer support used by canonical workspaces.
+  - id: tool-support
+    tier: opt
+    packages: ['@types/node', '@types/react', '@types/react-dom', '@starci/tsconfig', '@starci/stylelint-canon', '@tailwindcss/postcss', postcss-value-parser, stylelint, eslint-plugin-react-hooks]
+    home: [fe.tool-config]
+    pattern: FE-LINT
+    forbids: []
+    why: the compiler, CSS and lint support packages of the canonical front-end configs.