@starci/eslint-canon-fe 8.4.11 → 8.4.13

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 8.4.13 - 2026-10-19
+- Fixed: shared import classification selects an existing module file before virtual slot inference, so public auth barrels retain their resolved owner while impure redirect helpers remain refused.
+
 ## 8.4.11 - 2026-10-18
 - Changed: bundled canon pins follow @starci/hfs 4.7.5 and @starci/cli 1.7.5 for the managed Codecov coverage scope correction; canon rules are unchanged.
 

package/lib/scope.mjs

@@ -7,6 +7,7 @@
  */
 
 import { dirname, join, resolve } from "node:path"
+import ts from "typescript"
 import { hfsOf } from "./hfs.mjs"
 import { normalizePath } from "./path.mjs"
 
@@ -139,19 +140,26 @@ export const resolveImport = (context, specifier) => {
 }
 
 /**
- * The classification of the file an import specifier resolves to, trying the extensions a module file has. Null when the
- * specifier resolves to no path.
+ * The classification of an existing module file, resolving explicit files before extension and directory-index candidates.
+ * Virtual rule inputs with no existing candidate retain the path-only slot classification.
  *
  * @param {object} context - The ESLint rule context.
  * @param {string} specifier - The module specifier.
- * @returns {object | null} The slot classification (`{ slot, root, role, ... }`) of the first candidate a slot owns.
+ * @returns {object | null} The resolved file's owned slot classification, or the virtual-input classification when no file exists.
  */
 export const classifyImport = (context, specifier) => {
   const target = resolveImport(context, specifier)
   if (target === null) return null
   const hfs = hfsOf(context)
-  // The specifier names no extension: try the ones a module file has and take the candidate a slot gives a role, else the first a slot owns.
-  const owned = [`${target}.ts`, `${target}.tsx`, `${target}/index.ts`, `${target}/index.tsx`, target]
+  const candidates = [`${target}.ts`, `${target}.tsx`, `${target}/index.ts`, `${target}/index.tsx`, target]
+  // Match the owner helper's on-disk module order; a nonexistent auth.ts must not shadow auth/index.ts.
+  const existing = [target, ...candidates].find((candidate) => ts.sys.fileExists(candidate))
+  if (existing !== undefined) {
+    const found = hfs.classify(existing)
+    return found.slot && found.status === "owned" ? found : null
+  }
+  // RuleTester deliberately accepts virtual source paths; preserve its existing slot/role inference only without a real target.
+  const owned = candidates
     .map((candidate) => hfs.classify(candidate))
     .filter((found) => found.slot && found.status === "owned")
   return owned.find((found) => found.role) ?? owned[0] ?? null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.4.11",
+  "version": "8.4.13",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.11
+    version: 3.4.13
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.11
+    version: 8.4.13
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.5
+    version: 1.7.7
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.5
+    version: 4.7.7
     group: starci
     install: registry
     side: both