@starci/eslint-canon-fe 9.8.1 → 9.8.3

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 9.8.3 - 2026-11-01
+
+- Changed: the bundled canon pins name @starci/grammar 0.20.0, eslint-grammar-core and eslint-grammar-offset-pop 0.20.0, eslint-canon-be 3.11.4, eslint-canon-fe 9.8.3, stylelint-canon 2.4.0 and hfs 4.16.3 (RELEASE_VERSION_NOT_BUMPED: 9.8.2 is on npm).
+
+## 9.8.2 - 2026-11-01
+
+- Changed: the bundled canon pins name @starci/grammar 0.19.1, eslint-grammar-core and eslint-grammar-offset-pop 0.19.1, eslint-canon-be 3.11.3, eslint-canon-fe 9.8.2, stylelint-canon 2.4.0 and hfs 4.16.2 (RELEASE_VERSION_NOT_BUMPED: the previous versions are on npm).
+- Changed: the bundled hfs `database-migrations` follows hfs 4.16.2 (an alter of a column the migration added is not destructive; an entity names its table by its decorator).
+
 ## 9.8.1 - 2026-10-31
 
 - Changed: the bundled canon pins name @starci/grammar, eslint-grammar-core and eslint-grammar-offset-pop 0.19.0, eslint-canon-be 3.11.2, eslint-canon-fe 9.8.1, stylelint-canon 2.4.0 and hfs 4.16.1 (RELEASE_VERSION_NOT_BUMPED: 9.8.0 is on npm).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.8.1",
+  "version": "9.8.3",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.19.0
+    version: 0.20.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.11.2
+    version: 3.11.4
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.8.1
+    version: 9.8.3
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.19.0
+    version: 0.20.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.19.0
+    version: 0.20.0
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.16.1
+    version: 4.16.3
     group: starci
     install: registry
     side: both

package/runtime/scripts/hfs/rules/database-migrations.mjs

@@ -369,7 +369,7 @@ function columnAlterObject(tokens, index, table, line) {
         && sqlWord(tokens[at + 2 + Number(sqlWord(tokens[at + 1], 'column'))], 'set') && sqlWord(tokens[at + 3 + Number(sqlWord(tokens[at + 1], 'column'))], 'default'));
     if (!type && !(notNull && !defaultSet))
         return null;
-    return { name: `${table.name}.${column.name}`, leaf: column.leaf, table: table.leaf, kind: 'column', line };
+    return { name: `${table.name}.${column.name}`, leaf: column.leaf, table: table.leaf, kind: 'column', alters: true, line };
 }
 function alteredColumn(table, column, line) {
     return { name: `${table.name}.${column.name}`, leaf: column.leaf, table: table.leaf, kind: 'column', line };
@@ -467,11 +467,32 @@ function globalConstraintNames(statement) {
     }
     return names;
 }
+const ENTITY_DECORATORS = new Set(['Entity', 'Table', 'ViewEntity']);
+/** Adds the table names a class decorator `@Entity(...)`, `@Table(...)` or `@ViewEntity(...)` spells to `tables`; true when such a decorator spells none. */
+function noteEntityTables(ts, decorator, tables) {
+    const call = decorator.expression;
+    const callee = ts.isCallExpression(call) ? call.expression : call;
+    if (!ts.isIdentifier(callee) || !ENTITY_DECORATORS.has(callee.text))
+        return false;
+    const before = tables.size;
+    const collect = (node) => {
+        if (ts.isStringLiteralLike(node))
+            for (const part of [node.text, node.text.split('.').at(-1)])
+                tables.add(part);
+        ts.forEachChild(node, collect);
+    };
+    if (ts.isCallExpression(call))
+        for (const argument of call.arguments)
+            collect(argument);
+    return tables.size === before;
+}
 function sourceNameScopes(ts, text, file) {
     const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
     const checker = lexicalChecker(ts, source);
     const scopes = [];
     const entityNames = /\.entity\.[cm]?tsx?$/.test(file) ? new Set() : null;
+    const entityTables = new Set();
+    let implicitTable = false;
     const addSql = (sql) => {
         for (const statement of databaseSqlStatements(databaseSqlTokens(sql))) {
             const names = new Set(statement.filter((token) => sqlName(token) !== null).map((token) => token.v));
@@ -490,10 +511,15 @@ function sourceNameScopes(ts, text, file) {
             addSql(sql);
         if (entityNames && ts.isIdentifier(node))
             entityNames.add(node.text);
+        if (entityNames && ts.isDecorator(node))
+            implicitTable = noteEntityTables(ts, node, entityTables) || implicitTable;
         ts.forEachChild(node, visit);
     };
     visit(source);
-    return entityNames ? [{ names: entityNames, constraints: entityNames, globalConstraints: new Set() }] : scopes;
+    // An entity names its table by the string of its @Entity/@Table decorator; a column property of the same word (`queue`) is no table reference.
+    // An entity that names none (or has no such decorator) keeps the conservative identifier match.
+    const tables = entityTables.size > 0 && !implicitTable ? entityTables : undefined;
+    return entityNames ? [{ names: entityNames, tables, constraints: entityNames, globalConstraints: new Set() }] : scopes;
 }
 /**
  * Whether a be/src source references a destroyed object. A column (`<schema>.<table>.<column>`) is referenced only by a source that
@@ -501,9 +527,10 @@ function sourceNameScopes(ts, text, file) {
  * SQL constraints require explicit constraint names, while entities retain their table/decorator association.
  * Other object kinds match their leaf name conservatively.
  */
-const referencesObject = (scopes, object) => scopes.some(({ names, constraints, globalConstraints }) => (object.kind === 'constraint' && globalConstraints.has(object.leaf))
-    || ((object.kind === 'constraint' ? constraints : names).has(object.leaf)
-        && (!['column', 'constraint'].includes(object.kind) || !object.table || names.has(object.table))));
+const referencesObject = (scopes, object) => scopes.some(({ names, tables, constraints, globalConstraints }) => (object.kind === 'constraint' && globalConstraints.has(object.leaf))
+    || (object.kind === 'table' && tables !== undefined ? tables.has(object.leaf)
+        : (object.kind === 'constraint' ? constraints : names).has(object.leaf)
+            && (!['column', 'constraint'].includes(object.kind) || !object.table || (tables ?? names).has(object.table))));
 function destructiveObjectFinding(file, object, contract, references) {
     const reference = references.find(({ scopes }) => referencesObject(scopes, object));
     if (contract && !reference)
@@ -512,10 +539,50 @@ function destructiveObjectFinding(file, object, contract, references) {
         : 'use a *_contract_* migration after the application stops using this object';
     return found(DB_MIGRATION_DESTRUCTIVE, file, `${file}:${object.line} destructively changes ${object.name}; ${reason}`, { line: object.line, object: object.name, ...(reference ? { reference: reference.file } : {}) });
 }
+/** The `<table leaf>.<column leaf>` keys an ALTER TABLE ... ADD COLUMN statement adds, and `<table leaf>.*` for a CREATE TABLE. */
+function addedColumns(statement) {
+    const added = [];
+    for (let index = 0; index < statement.length - 1; index += 1) {
+        if (sqlWord(statement[index], 'create')) {
+            const at = skipWords(statement, index + 1, ['temp', 'temporary', 'unlogged']);
+            const created = sqlWord(statement[at], 'table') ? nameAt(statement, skipWords(statement, at + 1, ['if', 'not', 'exists'])) : null;
+            if (created)
+                added.push(`${created.leaf}.*`);
+        }
+        if (!(sqlWord(statement[index], 'alter') && sqlWord(statement[index + 1], 'table')))
+            continue;
+        const table = nameAt(statement, skipWords(statement, index + 2, ['if', 'exists', 'only']));
+        if (!table)
+            continue;
+        const body = statement.slice(table.next);
+        body.forEach((token, at) => {
+            if (!sqlWord(token, 'add'))
+                return;
+            const start = skipWords(body, at + 1, ['column', 'if', 'not', 'exists']);
+            if (['constraint', 'primary', 'foreign', 'unique', 'check', 'exclude'].some((word) => sqlWord(body[start], word)))
+                return;
+            const column = nameAt(body, start);
+            if (column)
+                added.push(`${table.leaf}.${column.leaf}`);
+        });
+    }
+    return added;
+}
+/** An ALTER of a column (SET NOT NULL, TYPE) the same migration added earlier changes no existing data: it is not destructive. */
+const alterOfNewColumn = (object, added) => object.alters === true && (added.has(`${object.table}.${object.leaf}`) || added.has(`${object.table}.*`));
+/** The destructive objects of one migration's SQL, in order, leaving out the alters of columns and tables the migration created itself. */
+function migrationDestructiveObjects(text) {
+    const added = new Set();
+    return databaseSqlStatements(databaseExecutableTokens(text)).flatMap((statement) => {
+        for (const key of addedColumns(statement))
+            added.add(key);
+        return destructiveObjects(statement).filter((object) => !alterOfNewColumn(object, added));
+    });
+}
 function destructiveFileFindings(file, text, references) {
     const contract = /_contract_[a-z0-9]+(?:[-_][a-z0-9]+)*\.sql$/.test(file);
     const seen = new Set();
-    const objects = databaseSqlStatements(databaseExecutableTokens(text)).flatMap(destructiveObjects);
+    const objects = migrationDestructiveObjects(text);
     return objects.flatMap((object) => {
         const key = `${object.line}:${object.kind}:${object.name}`;
         if (seen.has(key))
@@ -564,7 +631,7 @@ export async function contractReleaseFindings({ repoRoot, migrations, git }) {
         const text = readText(repoRoot, file);
         if (text === null)
             return [];
-        return databaseSqlStatements(databaseExecutableTokens(text)).flatMap(destructiveObjects).flatMap((object) => {
+        return migrationDestructiveObjects(text).flatMap((object) => {
             const reference = references.find(({ scopes }) => referencesObject(scopes, object));
             return reference ? [found(DB_MIGRATION_DESTRUCTIVE, file, `${file}:${object.line} destroys ${object.name}, which the previous release ${release} still references in ${reference.file}; the contract migration runs right after the accept while that release is the rollback target: ship the code change in one release and this contract migration in the next`, { line: object.line, object: object.name, release, reference: reference.file })] : [];
         });