@starci/eslint-canon-fe 9.5.23 → 9.6.2

package/runtime/knowledge/hfs/slots.yaml

@@ -51,7 +51,7 @@ versioning:
 # 3.10.0 is a minor (2026-10-29): it ADDS the lite be.platform.database.entities slot, the entity registry (slot fields role and importedBy), so the
 # tier matrix and the public-entry rules admit exactly its <c>Entities imports and its deep importers (persistence.md BE-PERSISTENCE-3).
 # 3.11.0 (ruling:lite-official-postgres-image, 2026-10-29) is, like 3.9.0, a change for lite only: it ADDS the managed app.db.image slot
-# (db/Dockerfile, written by `starci app sync --write`), narrows ruleParams.db.extensions to the extensions that image carries, and gives
+# (db/Dockerfile, written by `starci app sync --execute`), narrows ruleParams.db.extensions to the extensions that image carries, and gives
 # @nestjs/schedule and cron one owner, platform/jobs (R335).
 # 3.13.0 (rulings lite-pgmq-bus-bullmq-jobs and lite-db-image-in-stacks, 2026-10-29) is a change for lite only: ruleParams.db.extensions
 # admits pgmq, the event bus, ruleParams.db.queueOutbox is retired with the pg_cron half of R258, the lite event-bus functions replace
@@ -940,7 +940,7 @@ slots:
 
   # ----- app root: the database of a lite app (ruling:lite-self-hosted-postgres-passport-minio): a self-hosted PostgreSQL in the app's
   # stack (the `db` service, built from the managed .starcistacks/images/db/Dockerfile: the official postgres image plus pgvector and pgmq, ruling:lite-db-image-in-stacks), migrated by
-  # `starci app db migrate --url-env <NAME>`. A full app keeps its TypeORM migrations under be/ and has no such folder.
+  # `starci app db migrate --db-url-env <NAME>`. A full app keeps its TypeORM migrations under be/ and has no such folder.
   - id: app.db
     profiles: [app]
     editions: [lite]

package/runtime/knowledge/sonar-gate.yaml

@@ -41,7 +41,7 @@ newCode:
     minReviewedPercent: 100
     unreviewedMax: 0
 # The whole code, not only the new code. Every finding of the HFS canon reaches Sonar through ONE entry, `starci app lint`
-# (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry). CI runs it per side with --side and --sonar,
+# (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry). CI runs it per side with --side and --out,
 # then merges rules by id and joins issues into ONE file, reports/lint.sonar.json, named by sonar.externalIssuesReportPaths; the gate holds the open-issue count of
 # the whole project at zero. The file carries three engines:
 #   starci-hfs   the repository findings of `starci app check` (managed files, tree, pins, CI, contracts; the rule id is the finding code)

package/runtime/packages/hfs/templates/app/package-scripts/package.json

@@ -8,7 +8,7 @@
     "test:integration": "npm run typecheck:tests && cd be && jest --selectProjects integration",
     "test:e2e": "npm run typecheck:tests && cd be && jest --selectProjects e2e",
     "test:contract": "npm run typecheck:tests && cd be && jest --selectProjects contract",
-    "test:stack": "starci app stack",
+    "test:world": "starci app world up",
 {{supabaseScripts}}
     "contract:emit": "starci app emit"
   }

package/runtime/scripts/api/git/cat-file.mjs

@@ -1,5 +1,4 @@
 // cat-file.mjs — `git cat-file <args>`: the type, size or content of repository objects (-e, -p, --batch).
 import { runGit } from './lib.mjs';
-
 /** The spawn result {status, stdout, stderr, error} of `git cat-file ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
 export const catFile = (args = [], options = {}) => runGit(['cat-file', ...args], options);

package/runtime/scripts/api/git/config-get.mjs

@@ -1,10 +1,9 @@
 // config-get.mjs — `git config [--local] --get <key>`: one configuration value of a checkout (empty when unset).
 import { gitRunner } from './lib.mjs';
-
 /**
  * {ok, stdout, stderr}; `local` reads the repository's own config only; `env` replaces the process env (a caller drops
  * git's repository-local variables). git: the caller's runner or null.
  */
 export function configGet(cwd, key, { local = false, env = undefined, git = null } = {}) {
-  return gitRunner(git)(['config', ...(local ? ['--local'] : []), '--get', key], env ? { cwd, env } : { cwd });
+    return gitRunner(git)(['config', ...(local ? ['--local'] : []), '--get', key], env ? { cwd, env } : { cwd });
 }

package/runtime/scripts/api/git/diff.mjs

@@ -1,5 +1,4 @@
 // diff.mjs — `git diff <args>`: the changes between commits, the index and the working tree.
 import { runGit } from './lib.mjs';
-
 /** The spawn result {status, stdout, stderr, error} of `git diff ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
 export const diff = (args = [], options = {}) => runGit(['diff', ...args], options);

package/runtime/scripts/api/git/lib.mjs

@@ -13,7 +13,6 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { withoutGitLocalEnv } from '../../lib/git.mjs';
 import { withTempEnv } from '../../../engine/temp-root.mjs';
-
 /**
  * Spawn `file` (the git binary) once with `args`: utf8 text, a hidden window, never a shell.
  * Options pass through last, so cwd, timeout, input, env or maxBuffer land as given. encoding:'buffer'
@@ -21,46 +20,46 @@ import { withTempEnv } from '../../../engine/temp-root.mjs';
  * ERR_UNKNOWN_ENCODING, so it reaches spawnSync as encoding:null (Buffer output either way).
  */
 const gitSpawn = (file, args, options = {}) => {
-  assertMutationFence({ kind: 'git-effect', args });
-  const spawn = { encoding: 'utf8', windowsHide: true, ...options };
-  if (spawn.encoding === 'buffer') spawn.encoding = null;
-  // tempChildEnv copies the env (node adds NODE_V8_COVERAGE to the env object it is given: a frozen caller env must not throw under coverage) and points TEMP/TMP/TMPDIR at the temp root
-  return spawnSync(file, args, withTempEnv(spawn));
+    assertMutationFence({ kind: 'git-effect', args });
+    const spawn = { encoding: 'utf8', windowsHide: true, ...options };
+    if (spawn.encoding === 'buffer')
+        spawn.encoding = null;
+    // tempChildEnv copies the env (node adds NODE_V8_COVERAGE to the env object it is given: a frozen caller env must not throw under coverage) and points TEMP/TMP/TMPDIR at the temp root
+    // reason: encoding:null (the former 'buffer') returns Buffers; callers of that mode read the result as raw bytes
+    const spawnOptions = withTempEnv(spawn);
+    return spawnSync(file, args, spawnOptions);
 };
-
 /**
  * `git args` in `cwd`, or `git -C dir args` when `dir` is given. `git` overrides the binary; `config` ({key: value})
  * prefixes one `-c key=value` per entry (core.quotepath=off, a committer identity). Scoped calls discard ambient
  * hook repository variables; an explicit env remains authoritative, including an intentional temporary index.
  */
-export const runGit = (args, { cwd = null, dir = null, git = 'git', config = null, ...options } = {}) =>
-  gitSpawn(git, [...(dir ? ['-C', dir] : []), ...Object.entries(config ?? {}).flatMap(([key, value]) => ['-c', `${key}=${value}`]), ...args], {
+export const runGit = (args, { cwd = null, dir = null, git = 'git', config = null, ...options } = {}) => gitSpawn(git, [...(dir ? ['-C', dir] : []), ...Object.entries(config ?? {}).flatMap(([key, value]) => ['-c', `${key}=${value}`]), ...args], {
     ...(cwd ? { cwd } : {}), ...options,
     ...((cwd || dir) && options.env === undefined ? { env: withoutGitLocalEnv(process.env) } : {}),
-  });
-
+});
 /**
  * A caller's git runner folded to (args, opts) -> {ok, stdout, stderr}. `git`: the caller's runner (args, {cwd}) ->
  * {ok|status, stdout|out, stderr|err} (a spec's fake); null: runGit with a 5-minute timeout and a 64 MB buffer.
  */
 export const gitRunner = (git = null) => (args, opts = {}) => {
-  const r = git ? git(args, opts) : runGit(args, { timeout: 300_000, maxBuffer: 64 * 1024 * 1024, ...opts });
-  return { ok: r?.ok ?? (!r?.error && r?.status === 0), stdout: String(r?.stdout ?? r?.out ?? '').trim(), stderr: String(r?.stderr ?? r?.err ?? r?.error?.message ?? r?.error ?? '').trim() };
+    const r = git ? git(args, opts) : runGit(args, { timeout: 300_000, maxBuffer: 64 * 1024 * 1024, ...opts });
+    return { ok: r?.ok ?? (!r?.error && r?.status === 0), stdout: String(r?.stdout ?? r?.out ?? '').trim(), stderr: String(r?.stderr ?? r?.err ?? (typeof r?.error === 'object' ? r.error?.message : undefined) ?? r?.error ?? '').trim() };
 };
-
 let cachedGit;
 const gitPathOf = ({ env, platform, home, exists }) => {
-  const p = platform === 'win32' ? path.win32 : path.posix;
-  const pathKey = Object.keys(env).find((name) => name.toLowerCase() === 'path');
-  const shim = p.join(home, '.starci', 'bin');
-  const same = (a, b) => (platform === 'win32' ? p.resolve(a).toLowerCase() === p.resolve(b).toLowerCase() : p.resolve(a) === p.resolve(b));
-  const binary = platform === 'win32' ? 'git.exe' : 'git';
-  for (const raw of String(pathKey ? env[pathKey] : '').split(platform === 'win32' ? ';' : ':')) {
-    const dir = raw.replace(/^"(.*)"$/, '$1');
-    const file = dir && p.isAbsolute(dir) && !same(dir, shim) ? p.join(dir, binary) : null;
-    if (file && exists(file)) return file;
-  }
-  return null;
+    const p = platform === 'win32' ? path.win32 : path.posix;
+    const pathKey = Object.keys(env).find((name) => name.toLowerCase() === 'path');
+    const shim = p.join(home, '.starci', 'bin');
+    const same = (a, b) => (platform === 'win32' ? p.resolve(a).toLowerCase() === p.resolve(b).toLowerCase() : p.resolve(a) === p.resolve(b));
+    const binary = platform === 'win32' ? 'git.exe' : 'git';
+    for (const raw of String(pathKey ? env[pathKey] : '').split(platform === 'win32' ? ';' : ':')) {
+        const dir = raw.replace(/^"(.*)"$/, '$1');
+        const file = dir && p.isAbsolute(dir) && !same(dir, shim) ? p.join(dir, binary) : null;
+        if (file && exists(file))
+            return file;
+    }
+    return null;
 };
 /**
  * The absolute path of the real git binary, or null: the first PATH directory holding git (git.exe on Windows) that is not
@@ -69,12 +68,13 @@ const gitPathOf = ({ env, platform, home, exists }) => {
  * platform, home, exists) are for a spec and bypass the cache.
  */
 export const gitExecutable = (options = null) => {
-  if (!options && cachedGit !== undefined) return cachedGit;
-  const { env = process.env, platform = process.platform, home = os.homedir(), exists = (file) => fs.statSync(file, { throwIfNoEntry: false })?.isFile() === true } = options ?? {};
-  const found = gitPathOf({ env, platform, home, exists });
-  if (!options) cachedGit = found;
-  return found;
+    if (!options && cachedGit !== undefined)
+        return cachedGit;
+    const { env = process.env, platform = process.platform, home = os.homedir(), exists = (file) => fs.statSync(file, { throwIfNoEntry: false })?.isFile() === true } = options ?? {};
+    const found = gitPathOf({ env, platform, home, exists });
+    if (!options)
+        cachedGit = found;
+    return found;
 };
-
 /** The output ceiling of the whole-diff and `cat-file --batch` calls batch (a release diff is tens of megabytes). */
-const BATCH_MAX_BUFFER = 1024 * 1024 * 1024;
+export const BATCH_MAX_BUFFER = 1024 * 1024 * 1024;

package/runtime/scripts/api/git/ls-files.mjs

@@ -1,6 +1,5 @@
 // ls-files.mjs — `git ls-files <args>`: the paths the index tracks (--cached), or the untracked / deleted / ignored ones
 // the flags ask for (-z keeps any file name intact).
 import { runGit } from './lib.mjs';
-
 /** The spawn result {status, stdout, stderr, error} of `git ls-files ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
 export const lsFiles = (args = [], options = {}) => runGit(['ls-files', ...args], options);

package/runtime/scripts/api/git/ls-tree.mjs

@@ -1,5 +1,4 @@
 // ls-tree.mjs — `git ls-tree <args>`: the entries of a tree object.
 import { runGit } from './lib.mjs';
-
 /** The spawn result {status, stdout, stderr, error} of `git ls-tree ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
 export const lsTree = (args = [], options = {}) => runGit(['ls-tree', ...args], options);

package/runtime/scripts/api/git/merge-base.mjs

@@ -1,9 +1,8 @@
 // merge-base.mjs — `git merge-base <a> <b>`: the best common ancestor of two commits. Whether one commit is in another
 // is is-ancestor.mjs.
 import { gitRunner } from './lib.mjs';
-
 /** The best common ancestor of commits `a` and `b` (a sha), or null when they share none or a ref does not resolve. */
 export const mergeBase = (cwd, a, b, { git = null } = {}) => {
-  const r = gitRunner(git)(['merge-base', a, b], { cwd });
-  return r.ok && r.stdout ? r.stdout : null;
+    const r = gitRunner(git)(['merge-base', a, b], { cwd });
+    return r.ok && r.stdout ? r.stdout : null;
 };

package/runtime/scripts/api/git/remote.mjs

@@ -1,5 +1,4 @@
 // remote.mjs — `git remote <args>`: the configured remotes (get-url <name>).
 import { runGit } from './lib.mjs';
-
 /** The spawn result {status, stdout, stderr, error} of `git remote ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
 export const remote = (args = [], options = {}) => runGit(['remote', ...args], options);

package/runtime/scripts/api/git/rev-parse-query.mjs

@@ -1,5 +1,4 @@
 // rev-parse-query.mjs — `git rev-parse <args>`: one rev-parse query (--show-toplevel, --git-common-dir, --git-path, a ref): the text it prints.
 import { runGit } from './lib.mjs';
-
 /** The spawn result {status, stdout, stderr, error} of `git rev-parse ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
 export const revParseQuery = (args = [], options = {}) => runGit(['rev-parse', ...args], options);

package/runtime/scripts/api/git/show.mjs

@@ -1,6 +1,5 @@
 // show.mjs — `git show <args>`: an object of a repository - a file at a revision (`<rev>:<path>`), or a commit's
 // header and message (-s --format=...).
 import { runGit } from './lib.mjs';
-
 /** The spawn result {status, stdout, stderr, error} of `git show ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
 export const show = (args = [], options = {}) => runGit(['show', ...args], options);

package/runtime/scripts/hfs/allows.mjs

@@ -1,7 +1,6 @@
 import path from 'node:path';
 import { braceVariants, globExpression } from '../lib/glob.mjs';
 import { declaredLogicOf } from './manifest-shape.mjs';
-
 /**
  * What a slot's `requires`, `allows` and `forbids` entries (knowledge/hfs/slots.yaml) say about a file, read through the
  * resolver of scripts/hfs/slots.mjs. The machine checks that judge "this folder holds only what its slot allows"
@@ -14,65 +13,65 @@ import { declaredLogicOf } from './manifest-shape.mjs';
  */
 const VAR = /<([A-Za-z][A-Za-z0-9-]*)>/g;
 const SPEC = /\.spec\.ts$/;
-
 /**
  * Whether `relative` is the unit spec `<stem>.spec.ts` of a measured file beside it that the slot names: a file the slot declares in
  * `logic`, or a `requires`/`allows` file of a logic role (ruleParams.be.logicRoles), in a slot whose coverage is required and whose tests
  * are unit-beside. The slot admits that spec without listing it, as unit-test-colocated (R47) accepts it.
  */
 function isMeasuredSpec(resolver, classified, slot, relative, named) {
-  if (!SPEC.test(relative) || slot.coverage !== 'required' || slot.tests !== 'unit-beside') return false;
-  const subject = relative.replace(SPEC, '.ts');
-  if (declaredLogicOf(slot).includes(subject)) return true;
-  const role = /\.([a-z0-9-]+)\.ts$/.exec(subject)?.[1];
-  // An app resolver keeps no rule parameters of its own: a path on a side reads that side's.
-  const params = classified.side ? resolver.sides?.[classified.side]?.ruleParams() : resolver.ruleParams?.();
-  return (params?.logicRoles ?? []).includes(role) && named.some(matcher => matcher.expression.test(subject));
+    if (!SPEC.test(relative) || slot.coverage !== 'required' || slot.tests !== 'unit-beside')
+        return false;
+    const subject = relative.replace(SPEC, '.ts');
+    if (declaredLogicOf(slot).includes(subject))
+        return true;
+    const role = /\.([a-z0-9-]+)\.ts$/.exec(subject)?.[1];
+    // An app resolver keeps no rule parameters of its own: a path on a side reads that side's.
+    const params = classified.side ? resolver.sides?.[classified.side]?.ruleParams() : resolver.ruleParams?.();
+    return (params?.logicRoles ?? []).includes(role) && named.some((matcher) => matcher.expression.test(subject));
 }
-
 function matchersOf(entries, bindings) {
-  return (entries ?? []).flatMap(entry => {
-    const directory = entry.endsWith('/');
-    const body = directory ? entry.slice(0, -1) : entry;
-    const filled = body.replace(VAR, (whole, name) => bindings[name] ?? '*');
-    return braceVariants(filled).map(variant => ({ entry, directory, expression: globExpression(directory ? `${variant}/**` : variant) }));
-  });
+    return (entries ?? []).flatMap((entry) => {
+        const directory = entry.endsWith('/');
+        const body = directory ? entry.slice(0, -1) : entry;
+        const filled = body.replace(VAR, (_whole, name) => bindings[name] ?? '*');
+        return braceVariants(filled).map((variant) => ({ entry, directory, expression: globExpression(directory ? `${variant}/**` : variant) }));
+    });
 }
-
 /** The path of `file` below the instance root of the slot that owns it. */
 export function relativeToRoot(file, root) {
-  return root && file.startsWith(`${root}/`) ? file.slice(root.length + 1) : path.posix.basename(file);
+    return root && file.startsWith(`${root}/`) ? file.slice(root.length + 1) : path.posix.basename(file);
 }
-
 /**
  * Whether the slot that owns `file` names it in `requires` or `allows` (and does not forbid it); null when no enabled slot
  * owns it. Unlike allowsFile it judges a slot that lists only `requires` too, so a folder closed by its slot (an app's
  * src/) is read from the slot and never from a check's own list.
  */
 export function slotAdmitsFile(resolver, file) {
-  const classified = resolver.classifyPath(file);
-  if (classified.status === 'no-slot' || classified.status === 'ambiguous' || !classified.slot) return null;
-  const slot = resolver.slot(classified.slot);
-  const relative = relativeToRoot(classified.path, classified.root);
-  const named = matchersOf([...(slot.requires ?? []), ...(slot.allows ?? [])], classified.bindings);
-  const hit = named.some(matcher => matcher.expression.test(relative)) || isMeasuredSpec(resolver, classified, slot, relative, named);
-  const forbidden = matchersOf(slot.forbids, classified.bindings).some(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
-  return hit && !forbidden;
+    const classified = resolver.classifyPath(file);
+    if (classified.status === 'no-slot' || classified.status === 'ambiguous' || !classified.slot)
+        return null;
+    const slot = resolver.slot(classified.slot);
+    const relative = relativeToRoot(classified.path, classified.root);
+    const named = matchersOf([...(slot.requires ?? []), ...(slot.allows ?? [])], classified.bindings);
+    const hit = named.some(matcher => matcher.expression.test(relative)) || isMeasuredSpec(resolver, classified, slot, relative, named);
+    const forbidden = matchersOf(slot.forbids, classified.bindings).some(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
+    return hit && !forbidden;
 }
-
 /**
  * {slot, root, relative, allowed, entry?, forbiddenBy?} for a repository-relative file, or null when no enabled slot owns
  * it or the slot names no `allows`. `allowed` is true when the relative path matches a `requires` or `allows` entry.
  */
 export function allowsFile(resolver, file) {
-  const classified = resolver.classifyPath(file);
-  if (classified.status === 'no-slot' || classified.status === 'ambiguous' || !classified.slot) return null;
-  const slot = resolver.slot(classified.slot);
-  if (!slot?.allows?.length) return null;
-  const relative = relativeToRoot(classified.path, classified.root);
-  const named = matchersOf([...(slot.requires ?? []), ...slot.allows], classified.bindings);
-  const hit = named.find(matcher => matcher.expression.test(relative));
-  const spec = !hit && isMeasuredSpec(resolver, classified, slot, relative, named);
-  const forbidden = matchersOf(slot.forbids, classified.bindings).find(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
-  return { slot: slot.id, root: classified.root, relative, allowed: (Boolean(hit) || spec) && !forbidden, entry: hit?.entry, forbiddenBy: forbidden?.entry, allows: slot.allows };
+    const classified = resolver.classifyPath(file);
+    if (classified.status === 'no-slot' || classified.status === 'ambiguous' || !classified.slot)
+        return null;
+    const slot = resolver.slot(classified.slot);
+    if (!slot?.allows?.length)
+        return null;
+    const relative = relativeToRoot(classified.path, classified.root);
+    const named = matchersOf([...(slot.requires ?? []), ...slot.allows], classified.bindings);
+    const hit = named.find(matcher => matcher.expression.test(relative));
+    const spec = !hit && isMeasuredSpec(resolver, classified, slot, relative, named);
+    const forbidden = matchersOf(slot.forbids, classified.bindings).find(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
+    return { slot: slot.id, root: classified.root, relative, allowed: (Boolean(hit) || spec) && !forbidden, entry: hit?.entry, forbiddenBy: forbidden?.entry, allows: slot.allows };
 }