@starci/eslint-canon-fe 9.4.0 → 9.4.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 9.4.2 - 2026-10-28
+
+- Changed: the bundled canon pins follow release E (Grammar family 0.15.2, hfs 4.9.3, canon-fe 9.4.2, canon-be 3.6.2, ai-router 0.3.0) and pin no `starci-harness`: an app's CLI is the version of the CLI that runs @starci/hfs. No rule changed.
+
+## 9.4.1 - 2026-10-28
+
+- Fixed: `server-module-marks-server-only` exempts every route-tier file (`fe.route`, `fe.source-root-pinned` and the opt-in `fe.route.callback`), so the auth callback route is no longer told to carry the marker route files need not.
+- Changed: the bundled runtime's `repo-identity.mjs` names a repository by its origin remote (hfs 4.9.2); the fixture copy of the callback route template exports an arrow `GET`.
+- Changed: the bundled canon pins follow release D (Grammar family 0.15.1, hfs 4.9.2, canon-fe 9.4.1, canon-be 3.6.1, starci-harness 1.1.0-alpha.2), so an app installs the released versions without pin drift.
+
 ## 9.4.0 - 2026-10-28
 
 - Changed: the package is TypeScript. `src/**/*.ts` (rules, the shared `lib/` readers and every spec) is strict and builds to `dist/` with the `@starci/tsconfig` `package-esm` preset; `main`, `types` and `exports` point at `dist`, keeping `@starci/eslint-canon-fe/lib/*.mjs` (also `lib/*.js`). The fixture tester is `fixtures/typed/tester.ts`. The bundled runtime is read through the package import `#runtime/*`, typed by `src/types/runtime` until the runtime is built from `@starci/hfs`. Rules are typed against typescript-eslint's rule module; `@typescript-eslint/utils` joins the dependencies. No rule changed behaviour in the conversion.

package/dist/client-boundary.js

@@ -132,8 +132,6 @@ export const clientNoServerImport = defineRule({
     },
 });
 // -- FE-CLIENT-2b ----------------------------------------------------------------------------------
-/** The slots whose files are Next route files: server components by construction, so the framework decides, not a marker. */
-const ROUTE_FILE_SLOTS = new Set(["fe.route", "fe.source-root-pinned"]);
 /** True when a statement is `import "server-only"`: an import with no bindings from the marker package. */
 const isMarkerStatement = (statement) => statement?.type === "ImportDeclaration" && statement.specifiers.length === 0 && statement.source.value === "server-only";
 /** True when a TypeScript source file opens with `import "server-only"`. */
@@ -174,8 +172,9 @@ export const serverModuleMarksServerOnly = defineRule({
         },
     },
     create(context) {
-        const slot = slotOfFile(context);
-        if (!slot || ROUTE_FILE_SLOTS.has(slot))
+        // A route-tier file (the routes, the auth callback, the pinned source-root files) is a Next route file: a server component
+        // by construction, so the framework decides, not a marker.
+        if (!slotOfFile(context) || tierOfFile(context) === "route")
             return {};
         // A block or a page is a server or client COMPONENT, not a server module: whether client code reaches the server through it is
         // the machine's multi-hop question (FE_CLIENT_REACHES_SERVER). The marker belongs to the modules that hold server work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.4.0",
+  "version": "9.4.2",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -1,7 +1,8 @@
 schema: starci/canon-pins@1
 purpose: >-
   The exact version of every shared dependency in the StarCi family, including package-owned runtime dependencies. One version per dependency for the whole
-  family. Raising a version is a change to this file first (with the package bump when it is a @starci package),
+  family. The command line itself is not pinned here: an app's starci-harness is the version of the CLI that runs @starci/hfs to
+  judge or scaffold it (scripts/hfs/canon-pins.mjs), since that CLI depends on this package exactly. Raising a version is a change to this file first (with the package bump when it is a @starci package),
   then the repositories' own upgrade lane (each sets the exact version and reinstalls; nothing else installs a @starci package). Read on 2026-09-29 from the packages under
   .claude/packages and from the installed node_modules of the six product repositories; where they disagreed the
   newest version installed in more than one repository won, and the runtime's own version won for @starci packages.
@@ -30,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.0
+    version: 0.15.2
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.6.0
+    version: 3.6.2
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.4.0
+    version: 9.4.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.0
+    version: 0.15.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.0
+    version: 0.15.2
     group: starci
     install: registry
     side: fe
@@ -98,21 +99,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/ai-router':
-    version: 0.2.1
+    version: 0.3.0
     group: starci
     install: registry
     side: be
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
-  'starci-harness':
-    version: 1.1.0-alpha.1
-    group: starci
-    install: registry
-    side: both
-    source: cli/package.json
-    why: 'the one StarCi command line (bins starci and starci-harness): a product repository installs it for starci app, which it runs in-process through its exact @starci/hfs dependency, and its codegen loads starci-harness/input-bounds.'
   '@starci/hfs':
-    version: 4.9.1
+    version: 4.9.3
     group: starci
     install: registry
     side: both

package/runtime/scripts/hfs/repo-identity.mjs

@@ -42,13 +42,13 @@ function askGit(root) {
 }
 
 /**
- * The product repository name: the main checkout's folder name (so a worktree and its main checkout agree), else the
- * origin remote's name, else package.json name outside Git, else the folder name. A folder inside a larger repository
- * (a nested product, an example) is named by its own folder.
+ * The product repository name: the origin remote's repository name (one name for every clone and worktree, whatever
+ * folder holds it), else the main checkout's folder name (so a worktree and its main checkout agree), else package.json
+ * name outside Git, else the folder name. A folder inside a larger repository (a nested product, an example) is named by
+ * its own folder.
  */
 export function repositoryName(root) {
   const { inWorkTree, repositoryRoot, home } = identityOf(root);
-  if (home) return path.basename(home);
   if (repositoryRoot) {
     try {
       const remote = trimTrailingSlashes(git(gitRemote, root, ['get-url', 'origin'])).replace(GIT_SUFFIX, '');
@@ -56,6 +56,7 @@ export function repositoryName(root) {
       if (name) return name;
     } catch { /* No origin remote. */ }
   }
+  if (home) return path.basename(home);
   if (inWorkTree && !repositoryRoot) return path.basename(root);
   try {
     const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));