@starci/eslint-canon-fe 8.4.29 → 8.4.30

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 8.4.30 - 2026-10-23
+- Changed: the bundled canon pins select @starci/hfs 4.7.24 and @starci/cli 1.7.24.
+- Added: the type-aware rules the back end already borrowed, at error: `@typescript-eslint/no-floating-promises`, `no-misused-promises`, `switch-exhaustiveness-check` and the `no-unsafe-assignment`, `-member-access`, `-call`, `-return`, `-argument` family.
+- Changed: no Sonar way rule is left to the server (owner ruling 2026-10-22, no loosening): S3403, S3800, S3782 and S6582 run at error, `unicorn/consistent-function-scoping` runs with its default options, and S7785 (`unicorn/prefer-top-level-await`) runs in the front end (ESM).
+- Added: `starciPlainSourceConfig({ root })` for a TypeScript front-end tree that is no HFS app (a runtime package, the harness UI): typed linting, the inline-directive fence, the React Hooks, type-aware and Sonar way rules and every canon rule that needs no slot view (`SLOT_FREE_RULES`), all at error.
+
 ## 8.4.29 - 2026-10-22
 - Changed: the bundled canon pins select @starci/hfs 4.7.23 and @starci/cli 1.7.23.
 

package/index.mjs

@@ -49,7 +49,7 @@ import { recommended as typographyRecommended, rules as typographyRules } from "
 import { recommended as vendorRecommended, rules as vendorRules } from "./vendor-boundary.mjs"
 import { recommended as projectGraphRecommended, rules as projectGraphRules } from "./project-graph.mjs"
 import { recommended as sonarParityRecommended, rules as sonarParityRules } from "./sonar-parity.mjs"
-import { buildFeConfig } from "./lib/config.mjs"
+import { buildFeConfig, buildPlainSourceConfig } from "./lib/config.mjs"
 import { why } from "./lib/why.mjs"
 
 /** Each law's contribution, kept separate so a duplicate name is detectable rather than silent. */
@@ -246,6 +246,33 @@ export const starciFeConfig = ({ hfs } = {}) => {
   })
 }
 
+/**
+ * The flat config of a TypeScript front-end tree that is no HFS app (a runtime package, the harness UI):
+ * `export default starciPlainSourceConfig({ root: import.meta.dirname })`. It lints the tree's `src/` with types, with the inline-directive fence, the
+ * React Hooks rules, the type-aware rules and the Sonar way rules, and with every canon rule that needs no slot view, all at `error`.
+ *
+ * @param {{ root: string }} input - The absolute directory holding the tree's `tsconfig.json` and `src/`.
+ * @returns {object[]} The flat config: ignores, the typed source block and the Sonar way block.
+ */
+export const starciPlainSourceConfig = ({ root } = {}) => {
+  const reactHooks = loadReactHooks()
+  return buildPlainSourceConfig({ root, plugin, hooks: reactHooksRules(reactHooks), reactHooks, tsPlugin: loadTsPlugin(), sonar: loadSonarPlugins() })
+}
+
+/**
+ * The flat config of a TypeScript front-end tree that adopts the typed half of the canon first: the inline-directive fence, typed linting, the
+ * React Hooks rules, the type-aware typescript-eslint rules and the Sonar way rules over the tree's `src/`, all at `error`. It is
+ * `starciPlainSourceConfig` without the canon's own product-structure rules (`SLOT_FREE_RULES`: jsdoc on exports, arrow exports, English-only
+ * source, grammar controls, ...), for a tree that has not been brought to them yet; a tree that has uses `starciPlainSourceConfig`.
+ *
+ * @param {{ root: string }} input - The absolute directory holding the tree's `tsconfig.json` and `src/`.
+ * @returns {object[]} The flat config: ignores, the typed source block and the Sonar way block.
+ */
+export const starciTypedSourceConfig = ({ root } = {}) => {
+  const reactHooks = loadReactHooks()
+  return buildPlainSourceConfig({ root, plugin, hooks: reactHooksRules(reactHooks), reactHooks, tsPlugin: loadTsPlugin(), sonar: loadSonarPlugins(), canon: false })
+}
+
 // A21 append-only registration: keep the already exported plugin and recommendation live.
 import { recommended as functionBudgetRecommended, rules as functionBudgetRules } from "./function-budget.mjs"
 CONTRIBUTIONS.push({ law: "function-budget", rules: functionBudgetRules, recommended: functionBudgetRecommended })

package/lib/config.mjs

@@ -25,8 +25,20 @@ export const SOURCE_FILES = Object.freeze(["apps/*/src/**/*.{ts,tsx}", "packages
 /** Build output, installed packages, generated wire types and the harness's report directory are never linted. */
 export const IGNORED = Object.freeze(["**/node_modules/**", "**/.next/**", "**/dist/**", "**/coverage/**", "**/__generated__/**", ".starci/**"])
 
-/** The type-aware typescript-eslint rules the canon borrows for Sonar S1874 (a deprecated API), S6551 (an object turned into text) and S7503 (an `async` function that never awaits), all `error`. */
+/**
+ * The type-aware typescript-eslint rules the canon borrows, all `error` and the same set the back-end canon borrows for the type-aware laws: a promise is awaited or
+ * handled (`no-floating-promises`, `no-misused-promises`), a `switch` over a union names every member, nothing flows out of an `any` (the `no-unsafe-*` family),
+ * and the Sonar rules that need the checker: S1874 (a deprecated API), S6551 (an object turned into text) and S7503 (an `async` function that never awaits).
+ */
 export const BORROWED = Object.freeze({
+  "@typescript-eslint/no-floating-promises": "error",
+  "@typescript-eslint/no-misused-promises": "error",
+  "@typescript-eslint/switch-exhaustiveness-check": "error",
+  "@typescript-eslint/no-unsafe-assignment": "error",
+  "@typescript-eslint/no-unsafe-member-access": "error",
+  "@typescript-eslint/no-unsafe-call": "error",
+  "@typescript-eslint/no-unsafe-return": "error",
+  "@typescript-eslint/no-unsafe-argument": "error",
   "@typescript-eslint/no-deprecated": "error",
   "@typescript-eslint/no-base-to-string": "error",
   "@typescript-eslint/require-await": "error",
@@ -71,6 +83,60 @@ export const buildFeConfig = ({ hfs, plugin, source, reactHooks, tsPlugin, sonar
       rules: { ...source, ...BORROWED },
     },
     // Sonar way: what the scan raises is refused while the code is written; a spec is outside the scan, so outside this block.
-    { files: [...SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs: sonar.sonarjs, unicorn: sonar.unicorn }, rules: sonarWayRules(sonar.sonarjs).rules },
+    { files: [...SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs: sonar.sonarjs, unicorn: sonar.unicorn }, rules: sonarWayRules(sonar.sonarjs, "fe").rules },
+  ]
+}
+
+/**
+ * The canon rules that need no slot view: they judge a node and its types, never where the file sits in an app. A tree that is no HFS front end (a
+ * runtime package, the harness UI) is linted by exactly these plus the type-aware, React Hooks and Sonar way rules. The set is closed by
+ * config.spec.mjs: every other rule of the plugin refuses to run without `settings.starci.hfs`, so a rule added to the plugin is either listed here
+ * or proven slot-bound there.
+ */
+export const SLOT_FREE_RULES = Object.freeze([
+  "client-no-server-import", "no-server-action", "no-dangerous-html", "response-cookie-attributes", "require-export-jsdoc", "no-vietnamese-in-source",
+  "no-hardcoded-endpoint-fallback", "no-runtime-namespace", "list-item-has-key", "no-index-key", "no-inline-literal-prop-in-list", "prefer-arrow-export",
+  "handler-on-prefix", "no-native-form-control", "no-native-img", "image-has-size", "no-second-i18n-stack", "html-lang-from-locale", "no-null-suspense-fallback",
+  "no-native-anchor", "no-inline-parameter-type", "no-hand-rolled-polling", "status-text-uses-soft-foreground", "no-copy-in-call", "no-alert", "no-failure-collapse",
+  "outcome-kinds-exhaustive", "no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import",
+  "prefer-export-from", "no-unused-prop-types", "media-has-caption", "max-params",
+])
+
+/** The source of a plain front-end tree: its `src/`. */
+export const PLAIN_SOURCE_FILES = Object.freeze(["src/**/*.{ts,tsx}"])
+
+/**
+ * The flat config of a TypeScript front-end tree that is no HFS app: the same fences as an app (typed linting, no inline directive, every rule at
+ * `error`) over the rules that need no slot view. It takes the root of the tree and nothing else.
+ *
+ * @param {object} input - Attachment options.
+ * @param {string} input.root - The absolute directory holding the tree's `tsconfig.json` and `src/`.
+ * @param {object} input.plugin - The canon plugin.
+ * @param {Record<string, unknown>} input.hooks - The React Hooks rules at error.
+ * @param {object} input.reactHooks - The React Hooks plugin.
+ * @param {object} input.tsPlugin - The typescript-eslint plugin.
+ * @param {{ sonarjs: object, unicorn: object }} input.sonar - The plugins of the Sonar way rules.
+ * @returns {Array<object>} The flat config: one ignore block, one typed source block and the Sonar way block.
+ */
+export const buildPlainSourceConfig = ({ root, plugin, hooks, reactHooks, tsPlugin, sonar, canon = true }) => {
+  if (typeof root !== "string" || root === "") throw new Error("starciPlainSourceConfig needs { root } - the directory of the tree's tsconfig.json and src/")
+  const canonRules = canon ? Object.fromEntries(SLOT_FREE_RULES.map((name) => [`starci-fe/${name}`, "error"])) : {}
+  const missing = SLOT_FREE_RULES.filter((name) => !(name in plugin.rules))
+  if (missing.length > 0) throw new Error(`starciPlainSourceConfig lists rules the canon plugin does not publish: ${missing.join(", ")}`)
+  return [
+    { ignores: [...IGNORED] },
+    {
+      files: [...PLAIN_SOURCE_FILES],
+      languageOptions: {
+        parser: tsParser,
+        ecmaVersion: "latest",
+        sourceType: "module",
+        parserOptions: { projectService: true, tsconfigRootDir: root, ecmaFeatures: { jsx: true } },
+      },
+      linterOptions: { ...linterOptions },
+      plugins: { "starci-fe": plugin, "react-hooks": reactHooks, "@typescript-eslint": tsPlugin },
+      rules: { ...canonRules, ...hooks, ...BORROWED },
+    },
+    { files: [...PLAIN_SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs: sonar.sonarjs, unicorn: sonar.unicorn }, rules: sonarWayRules(sonar.sonarjs, "fe").rules },
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.4.29",
+  "version": "8.4.30",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.30
+    version: 3.4.31
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.29
+    version: 8.4.30
     group: starci
     install: registry
     side: fe
@@ -50,40 +50,40 @@ pins:
     source: packages/stylelint/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.5
+    version: 2.0.7
     group: starci
     install: registry
     side: both
     source: packages/tsconfig/package.json
   '@starci/prettier-config':
-    version: 1.0.3
+    version: 1.0.4
     group: starci
     install: registry
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.3.4
+    version: 2.3.5
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
     why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
-    version: 1.2.2
+    version: 1.2.3
     group: starci
     install: registry
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.23
+    version: 1.7.24
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.23
+    version: 4.7.24
     group: starci
     install: registry
     side: both
@@ -465,7 +465,7 @@ pins:
     version: 13.4.5
     group: framework
     side: be
-    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13. Stays on 13.x for alpha.18: the npm-audit advisory fixed by 14.0.3 (semver major) is a documented accepted exception, upgrade deferred to alpha.19 (owner ruling graphql-13-advisory-accepted-until-a19, 2026-10-16).'
+    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the full-app resolution on 2026-10-13. Stays on 13.x for alpha.18: the npm-audit advisory fixed by 14.0.3 (semver major) is a documented accepted exception, upgrade deferred to alpha.19 (owner ruling graphql-13-advisory-accepted-until-a19, 2026-10-16).'
   '@graphql-tools/utils':
     version: 12.1.0
     group: framework
@@ -475,12 +475,12 @@ pins:
     version: 13.4.5
     group: framework
     side: be
-    why: 'the Apollo driver of @nestjs/graphql; the ecommerce-app resolution on 2026-10-13. Stays on 13.x with @nestjs/graphql (accepted advisory, major deferred to alpha.19).'
+    why: 'the Apollo driver of @nestjs/graphql; the full-app resolution on 2026-10-13. Stays on 13.x with @nestjs/graphql (accepted advisory, major deferred to alpha.19).'
   '@apollo/server':
     version: 5.5.1
     group: framework
     side: be
-    why: 'the Apollo server behind @nestjs/apollo; the ecommerce-app resolution on 2026-10-13.'
+    why: 'the Apollo server behind @nestjs/apollo; the full-app resolution on 2026-10-13.'
   '@nestjs/websockets':
     version: 11.2.5
     group: framework

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.4.0
+version: 3.5.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -39,6 +39,8 @@ versioning:
 # when the file key is absent; .starcistacks owns custody. Capability <capability>.config.ts roles stay unchanged.
 # 3.3.0 is a minor (alpha.16): it ADDS the optional app.ci-stack-deploy slot, the managed workflow of the starci app stack verbs.
 # 3.4.0 is a minor (alpha.25): it ADDS the opt-in be.contract.mcp-tools slot, the committed MCP tool-catalog snapshot of an app.
+# 3.5.0 is a minor (alpha.27): it ADDS the opt-in app.browser-config slot, the managed browser/tsconfig.json that type-checks the browser
+# journey (enabled with app.browser by `browser: true`).
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -617,6 +619,23 @@ slots:
     tests: none
     requires: [playwright.config.ts, journeys/]
     allows: [playwright.config.ts, stack.mjs, "journeys/*.ts"]
+  - id: app.browser-config
+    since: 3.5.0
+    profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): browser journeys belong to full; lite proves app boot through R272 wiring."
+    # The program that type-checks the browser journey: Playwright only transpiles the config and the journeys, so without it nothing
+    # type-checks them and the op gate finds no tsconfig.json owning a changed journey (GATE_TSC_CONFIG_MISSING). It is managed (rendered
+    # by starci app sync from templates/app/browser-config, extending @starci/tsconfig/e2e.json), never authored, and enabled with
+    # app.browser by `browser: true` in hfs.json.
+    path: browser/tsconfig.json
+    presence: opt-in
+    litePresence: forbidden
+    goesTo: "the full edition: a lite app has no browser journey to type-check"
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: browser-config
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.github-meta
     since: 3.1.0
     profiles: [app]

package/runtime/knowledge/sonar-gate.yaml

@@ -8,7 +8,7 @@ purpose: |
   conditions and selects it for the project, and (2) judges an op's slice - the lines it changed - against
   the same numbers. Code-writing ops cannot settle done while the slice is red
   (scripts/kernel/sonar-settle.mjs). Changing a number here changes every repository on the next scan.
-  The gate has two parts: `newCode` (the recent work: coverage, duplication, blocker/critical issues, hotspots) and
+  The gate has two parts: `newCode` (the recent work: coverage, duplication, issues of every severity, hotspots) and
   `overall` (the whole code: coverage, no imported HFS, ESLint or stylelint finding, no bug, code smell or
   vulnerability, every hotspot reviewed, no duplicated-lines excess, no cognitive-complexity issue). The one Sonar
   mechanism of the HFS canon is packages/hfs/README.md section "Sonar".
@@ -26,15 +26,15 @@ newCode:
   coverage:
     metric: new_coverage
     minPercent: 100
-  # SonarQube's ignoreSmallChanges: fewer changed lines than this are not held to duplication.
-  ignoreBelowChangedLines: 20
+  # SonarQube's ignoreSmallChanges floor: 0, so a change of any size is held to duplication.
+  ignoreBelowChangedLines: 0
   duplication:
     metric: new_duplicated_lines_density
     maxPercent: 3
   issues:
-    # An open issue of these severities on a changed line fails the slice; lesser ones are listed, never blocking.
-    blockingSeverities: [BLOCKER, CRITICAL]
-    metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations}
+    # An open issue of any severity on a changed line fails the slice: there is no lesser severity that is only listed.
+    blockingSeverities: [BLOCKER, CRITICAL, MAJOR, MINOR, INFO]
+    metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations, MAJOR: new_major_violations, MINOR: new_minor_violations, INFO: new_info_violations}
     max: 0
   hotspots:
     metric: new_security_hotspots_reviewed
@@ -92,13 +92,13 @@ lite:
     coverage:
       metric: new_coverage
       minPercent: 100
-    ignoreBelowChangedLines: 20
+    ignoreBelowChangedLines: 0
     duplication:
       metric: new_duplicated_lines_density
       maxPercent: 3
     issues:
-      blockingSeverities: [BLOCKER, CRITICAL]
-      metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations}
+      blockingSeverities: [BLOCKER, CRITICAL, MAJOR, MINOR, INFO]
+      metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations, MAJOR: new_major_violations, MINOR: new_minor_violations, INFO: new_info_violations}
       max: 0
     hotspots:
       metric: new_security_hotspots_reviewed
@@ -139,9 +139,9 @@ reasoning: |
   lives there, the feature tier is thin (R203) and proven by integration and e2e, and the front end has no unit tests.
   duplication 3: the Sonar way value; the worst project today is 2.1, so 3 rejects a real copy-paste block and
   passes ordinary work.
-  blocker/critical 0: the two severities that are defects, not style. main carries old debt of both kinds
-  (one product repository carries 3 blocker and 137 critical), so the SLICE verdict reads only changed lines and never main's backlog;
-  major and lower are reported on the summary and never fail a slice.
+  issues 0 at every severity (blocker, critical, major, minor, info), owner ruling 2026-10-22 (no loosening): a lesser severity is not a
+  lesser finding. The SLICE verdict reads only changed lines and never main's backlog; the overall condition holds the whole project.
+  A change of any size is held to duplication (ignoreBelowChangedLines 0).
   overall issues 0 and overall duplication 3: the server gate is also the owner's definition of done for the HFS canon:
   a repository that carries any open ESLint, stylelint or HFS finding is not green, whatever the age of the line. The
   op slice keeps judging changed lines (an op cannot fix a repository's whole backlog); the dashboard and CI show the

package/runtime/packages/hfs/templates/app/package-scripts/package.json

@@ -5,7 +5,6 @@
 {{> app/package-scripts/core.json}}
     "typecheck:tests": "tsc -p be/src/tests/tsconfig.json",
     "test": "cd be && jest --selectProjects unit --coverage",
-    "test:affected": "cd be && jest --selectProjects unit --passWithNoTests",
     "test:integration": "npm run typecheck:tests && cd be && jest --selectProjects integration",
     "test:e2e": "npm run typecheck:tests && cd be && jest --selectProjects e2e",
     "test:contract": "npm run typecheck:tests && cd be && jest --selectProjects contract",

package/runtime/scripts/hfs/architecture/automatic-gates.mjs

@@ -10,7 +10,7 @@ const E2E_COMMAND = new RegExp([
   String.raw`src\/tests\/(?:world|integration|e2e|contract)\b|`,
   String.raw`jest[^\n|&;]*(?:e2e|integration|contract)`,
 ].join(''), 'u');
-const UNIT_RUN_SCRIPTS = ['test', 'test:unit', 'test:ci', 'test:affected', 'test:coverage', 'test:cov'];
+const UNIT_RUN_SCRIPTS = ['test', 'test:unit', 'test:ci', 'test:coverage', 'test:cov'];
 
 const runsE2e = text => E2E_COMMAND.test(String(text).replace(/--ignore-pattern[= ]+(?:"[^"]*"|'[^']*'|\S+)/gu, ''));
 const withoutComments = text => text.split('\n').filter(line => !/^\s*#/u.test(line)).join('\n');

package/runtime/scripts/hfs/slots.mjs

@@ -153,9 +153,10 @@ export function resolveRepoDeclaration(manifest, declaration, { file = HFS_DECLA
     edition,
     side: null,
     profile: APP_SCOPE,
-    // The root declares no app or connection of its own (each side does); its one opt-in slot is the browser journey (`browser: true`).
+    // The root declares no app or connection of its own (each side does); its opt-in slots are the browser journey and the managed
+    // tsconfig.json that type-checks it, both switched on by `browser: true`.
     apps: Object.freeze([]),
-    optionalSlots: Object.freeze(declaration.browser === true ? ['app.browser'] : []),
+    optionalSlots: Object.freeze(declaration.browser === true ? ['app.browser', 'app.browser-config'] : []),
     connections: Object.freeze([]),
     providers,
     reads: Object.freeze([]),

package/runtime/scripts/lib/sonar-way.mjs

@@ -2,7 +2,8 @@
 // the one mapping both lint canons (@starci/eslint-canon-be and -fe) publish, so `starci app lint` in the op loop refuses what the scan would
 // raise while the code is written. The base is eslint-plugin-sonarjs's recommended config, SonarSource's own port of Sonar way (each rule's
 // docs url names its S-id); its rules the canons already publish in another form stay with that owner (SONAR_WAY_OWNED), and the Sonar way
-// rules SonarSource builds on other ESLint rules are SONAR_WAY_EXTRA. Every rule is `error`. A unit or end-to-end spec is outside the scan,
+// rules SonarSource builds on other ESLint rules are SONAR_WAY_EXTRA. Every rule is `error`; no rule is left to the server because its port
+// disagrees with it (a port that disagrees is fixed in the source it reports, never switched off). A unit or end-to-end spec is outside the scan,
 // so outside these rules: the canons give this block the ignores of sonar-syntax-rules.mjs OUTSIDE_THE_SCAN_FILES. The runtime's own
 // `sonar-rules` gate reads the two limits below.
 
@@ -11,31 +12,36 @@ export const COGNITIVE_COMPLEXITY_LIMIT = 15;
 export const MAX_PARAMETERS = 7;
 
 /**
- * sonarjs rules of Sonar way the local lint does not run: another canon owner reports the same Sonar id, or the port does not match what the
- * server reports on the same source and is left to the server. Parity is measured, not assumed: a product scan with 0 issues on the server
- * (Sonar way, 2026-10-21) while these ports reported 130 findings on it; a rule that cannot match the server is not a lint error.
+ * sonarjs rules of Sonar way the local lint does not run under their sonarjs name because another owner enforces the same Sonar id at error:
+ * a canon syntax rule, a borrowed typescript-eslint rule or the TypeScript compiler. Each owner is asserted in packages/eslint/be/sonar-way.spec.mjs and packages/eslint/fe/config.spec.mjs.
  */
 const SONAR_WAY_OWNED = Object.freeze({
   'sonarjs/no-nested-conditional': 'S3358, the canon syntax rule no-nested-conditional',
   'sonarjs/unused-import': 'S1128, the canon syntax rule no-unused-import',
   'sonarjs/void-use': 'S3735, the canon syntax rule no-void-operator',
   'sonarjs/deprecation': 'S1874, the borrowed @typescript-eslint/no-deprecated',
-  'sonarjs/no-unused-vars': 'S1481, the TypeScript compiler (noUnusedLocals in @starci/tsconfig); the port also reports a rest-sibling omit the server accepts',
-  'sonarjs/different-types-comparison': 'S3403, the server: the port reads control-flow-narrowed types (`x !== null` after an aliased guard) the server does not report',
-  'sonarjs/function-return-type': 'S3800, the server: the port reports nullable and union returns the server accepts',
-  'sonarjs/argument-type': 'S3782, the server: the port reports optional arguments the server accepts',
+  'sonarjs/no-unused-vars': 'S1481, the TypeScript compiler (noUnusedLocals and noUnusedParameters in @starci/tsconfig)',
+});
+
+/**
+ * Sonar way rules with no ESLint form that applies to the module format of a side. S7785 prefers top-level await, which a CommonJS output
+ * (the back end: `module: nodenext` without `type: module`) cannot contain; the front end is ESM and runs the rule.
+ */
+export const SONAR_WAY_NOT_APPLICABLE = Object.freeze({
+  be: Object.freeze({ S7785: 'top-level await does not exist in the CommonJS output of a back end' }),
+  fe: Object.freeze({}),
 });
 
 /**
  * The Sonar way rules SonarSource implements on an ESLint rule outside eslint-plugin-sonarjs: `{ sonar, rule, options? }`. The canon syntax
  * rules carry S107 (`max-params`, which spares the constructor of an injectable class as the server does) and S4084 (`media-has-caption`,
- * front end). Left out: S7785 (top-level await; an app's TypeScript compiles to CommonJS, `module: nodenext` without `type: module`) and
- * S6582 (typescript-eslint's optional-chain rule reports guards whose optional chain would change the value's type, which the server accepts).
+ * front end); S6582 is typescript-eslint's `prefer-optional-chain`, which needs the type information the canons' typed block provides.
  */
 export const SONAR_WAY_EXTRA = Object.freeze([
   { sonar: 'S3863', rule: 'no-duplicate-imports', options: [{ allowSeparateTypeImports: true }] },
+  { sonar: 'S6582', rule: '@typescript-eslint/prefer-optional-chain' },
   { sonar: 'S4138', rule: 'unicorn/no-for-loop' },
-  { sonar: 'S7721', rule: 'unicorn/consistent-function-scoping', options: [{ checkArrowFunctions: false }] },
+  { sonar: 'S7721', rule: 'unicorn/consistent-function-scoping' },
   { sonar: 'S7732', rule: 'unicorn/no-instanceof-builtins' },
   { sonar: 'S7740', rule: 'unicorn/no-this-assignment' },
   { sonar: 'S7744', rule: 'unicorn/no-useless-fallback-in-spread' },
@@ -50,14 +56,20 @@ export const SONAR_WAY_EXTRA = Object.freeze([
   { sonar: 'S7784', rule: 'unicorn/prefer-structured-clone' },
 ]);
 
+/** The ESM-only Sonar way rules: S7785 prefers top-level await (see SONAR_WAY_NOT_APPLICABLE). */
+const SONAR_WAY_ESM = Object.freeze([{ sonar: 'S7785', rule: 'unicorn/prefer-top-level-await' }]);
+
 /** The Sonar id a sonarjs rule documents (its docs url ends in `#/rspec/S<id>/javascript`), or null. */
 const sonarIdOf = (rule) => /\/rspec\/#\/rspec\/(S\d+)\//u.exec(rule?.meta?.docs?.url ?? '')?.[1] ?? null;
 
 /**
  * The Sonar way rules, `{ rules, mapped }`: `rules` the flat-config rule levels (sonarjs' recommended rules at error minus the owned ones,
- * with S3776's limit, then SONAR_WAY_EXTRA), `mapped` every `{ sonar, rule }` row.
+ * with S3776's limit, then SONAR_WAY_EXTRA, then the ESM-only rules unless `side` is `be`), `mapped` every `{ sonar, rule }` row.
+ *
+ * @param {object} sonarjs - The eslint-plugin-sonarjs plugin.
+ * @param {'be' | 'fe'} [side] - The side the rules lint; the back end compiles to CommonJS.
  */
-export function sonarWayRules(sonarjs) {
+export function sonarWayRules(sonarjs, side = 'fe') {
   const mapped = [];
   const rules = {};
   for (const [name, setting] of Object.entries(sonarjs.configs.recommended.rules)) {
@@ -67,7 +79,7 @@ export function sonarWayRules(sonarjs) {
     rules[name] = ['error', ...options];
     mapped.push({ sonar: sonarIdOf(sonarjs.rules[name.slice('sonarjs/'.length)]), rule: name });
   }
-  for (const entry of SONAR_WAY_EXTRA) {
+  for (const entry of [...SONAR_WAY_EXTRA, ...SONAR_WAY_ESM.filter(row => !SONAR_WAY_NOT_APPLICABLE[side][row.sonar])]) {
     rules[entry.rule] = ['error', ...(entry.options ?? [])];
     mapped.push({ sonar: entry.sonar, rule: entry.rule });
   }