@starci/eslint-canon-fe 9.4.0 → 9.4.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 9.4.1 - 2026-10-28
+
+- Fixed: `server-module-marks-server-only` exempts every route-tier file (`fe.route`, `fe.source-root-pinned` and the opt-in `fe.route.callback`), so the auth callback route is no longer told to carry the marker route files need not.
+- Changed: the bundled runtime's `repo-identity.mjs` names a repository by its origin remote (hfs 4.9.2); the fixture copy of the callback route template exports an arrow `GET`.
+- Changed: the bundled canon pins follow release D (Grammar family 0.15.1, hfs 4.9.2, canon-fe 9.4.1, canon-be 3.6.1, starci-harness 1.1.0-alpha.2), so an app installs the released versions without pin drift.
+
 ## 9.4.0 - 2026-10-28
 
 - Changed: the package is TypeScript. `src/**/*.ts` (rules, the shared `lib/` readers and every spec) is strict and builds to `dist/` with the `@starci/tsconfig` `package-esm` preset; `main`, `types` and `exports` point at `dist`, keeping `@starci/eslint-canon-fe/lib/*.mjs` (also `lib/*.js`). The fixture tester is `fixtures/typed/tester.ts`. The bundled runtime is read through the package import `#runtime/*`, typed by `src/types/runtime` until the runtime is built from `@starci/hfs`. Rules are typed against typescript-eslint's rule module; `@typescript-eslint/utils` joins the dependencies. No rule changed behaviour in the conversion.

package/dist/client-boundary.js

@@ -132,8 +132,6 @@ export const clientNoServerImport = defineRule({
     },
 });
 // -- FE-CLIENT-2b ----------------------------------------------------------------------------------
-/** The slots whose files are Next route files: server components by construction, so the framework decides, not a marker. */
-const ROUTE_FILE_SLOTS = new Set(["fe.route", "fe.source-root-pinned"]);
 /** True when a statement is `import "server-only"`: an import with no bindings from the marker package. */
 const isMarkerStatement = (statement) => statement?.type === "ImportDeclaration" && statement.specifiers.length === 0 && statement.source.value === "server-only";
 /** True when a TypeScript source file opens with `import "server-only"`. */
@@ -174,8 +172,9 @@ export const serverModuleMarksServerOnly = defineRule({
         },
     },
     create(context) {
-        const slot = slotOfFile(context);
-        if (!slot || ROUTE_FILE_SLOTS.has(slot))
+        // A route-tier file (the routes, the auth callback, the pinned source-root files) is a Next route file: a server component
+        // by construction, so the framework decides, not a marker.
+        if (!slotOfFile(context) || tierOfFile(context) === "route")
             return {};
         // A block or a page is a server or client COMPONENT, not a server module: whether client code reaches the server through it is
         // the machine's multi-hop question (FE_CLIENT_REACHES_SERVER). The marker belongs to the modules that hold server work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.4.0",
+  "version": "9.4.1",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,35 +30,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.0
+    version: 0.15.1
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.6.0
+    version: 3.6.1
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.4.0
+    version: 9.4.1
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.0
+    version: 0.15.1
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.0
+    version: 0.15.1
     group: starci
     install: registry
     side: fe
@@ -105,14 +105,14 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   'starci-harness':
-    version: 1.1.0-alpha.1
+    version: 1.1.0-alpha.2
     group: starci
     install: registry
     side: both
     source: cli/package.json
     why: 'the one StarCi command line (bins starci and starci-harness): a product repository installs it for starci app, which it runs in-process through its exact @starci/hfs dependency, and its codegen loads starci-harness/input-bounds.'
   '@starci/hfs':
-    version: 4.9.1
+    version: 4.9.2
     group: starci
     install: registry
     side: both

package/runtime/scripts/hfs/repo-identity.mjs

@@ -42,13 +42,13 @@ function askGit(root) {
 }
 
 /**
- * The product repository name: the main checkout's folder name (so a worktree and its main checkout agree), else the
- * origin remote's name, else package.json name outside Git, else the folder name. A folder inside a larger repository
- * (a nested product, an example) is named by its own folder.
+ * The product repository name: the origin remote's repository name (one name for every clone and worktree, whatever
+ * folder holds it), else the main checkout's folder name (so a worktree and its main checkout agree), else package.json
+ * name outside Git, else the folder name. A folder inside a larger repository (a nested product, an example) is named by
+ * its own folder.
  */
 export function repositoryName(root) {
   const { inWorkTree, repositoryRoot, home } = identityOf(root);
-  if (home) return path.basename(home);
   if (repositoryRoot) {
     try {
       const remote = trimTrailingSlashes(git(gitRemote, root, ['get-url', 'origin'])).replace(GIT_SUFFIX, '');
@@ -56,6 +56,7 @@ export function repositoryName(root) {
       if (name) return name;
     } catch { /* No origin remote. */ }
   }
+  if (home) return path.basename(home);
   if (inWorkTree && !repositoryRoot) return path.basename(root);
   try {
     const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));