@starci/eslint-canon-fe 9.9.11 → 9.9.12

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 9.9.12
+
+- Changed: Carry the bundled runtime of @starci/hfs 5.0.8 (the rule texts name `app check`, the read-set helper of the rule memo) and its canon pins; the comments name `app check` for the removed lint verb.
+
 ## 9.9.11
 
 - Changed: Recognize declared module hook roles through real hook-call provenance.

package/README.md

@@ -48,7 +48,7 @@ columns inside a joined card, where `PaneGrid` owns both (`FE_HAND_BUILT_PANES`)
 The spacing law (R350) leaves every distance to Grammar: `no-spacing-utility` refuses a padding, margin, gap
 or space utility (`p-*`, `px-*`, `m*-*`, `gap-*`, `space-*`, arbitrary values and variants included) in an app class
 string, where a role prop names the relation instead (`Stack`/`Cluster` `gap`, `Grid` `kind`, `PaneSection`, `Page`;
-`FE_SPACING_UTILITY`). It runs in the counting cohort (`COUNTING` of `src/lib/config.ts`): `starci app lint` reports
+`FE_SPACING_UTILITY`). It runs in the counting cohort (`COUNTING` of `src/lib/config.ts`): `starci app check --gate lint` reports
 and counts every finding at warn and fails on none, while `starci app codemod spacing-roles` migrates the app.
 
 The [button intent law](docs/button-intent.md) (CTA-6) requires every app Button and IconButton to

package/dist/index.js

@@ -311,6 +311,6 @@ for (const addition of A14_CONTRIBUTIONS) {
     Object.assign(rules, addition.rules);
     Object.assign(recommended, addition.recommended);
 }
-// The result cache of `starci app lint` (contexts/project/check-cache.md) reads these two declarations of the installed canon.
+// The result cache of `starci app check --gate lint` (contexts/project/check-cache.md) reads these two declarations of the installed canon.
 export { crossFileInputs } from "./lib/cross-file-inputs.js";
 export { projectGraph } from "./project-graph.js";

package/dist/lib/config.d.ts

@@ -29,7 +29,7 @@ export declare const IGNORED: readonly string[];
 export declare const BORROWED: Readonly<Record<string, "error">>;
 /**
  * The counting cohort: a rule the owner ruled to ship at `warn` for one release while a codemod moves apps onto the API
- * it asks for, each with the HFS rule id it enforces. `starci app lint` reports and counts its findings and never fails
+ * it asks for, each with the HFS rule id it enforces. `starci app check --gate lint` reports and counts its findings and never fails
  * on them; the next cohort moves the rule to error and deletes its entry. No other rule may be below error.
  */
 export declare const COUNTING: Readonly<Record<string, {

package/dist/lib/config.js

@@ -42,7 +42,7 @@ export const BORROWED = Object.freeze({
 const levelOf = (setting) => (Array.isArray(setting) ? setting[0] : setting);
 /**
  * The counting cohort: a rule the owner ruled to ship at `warn` for one release while a codemod moves apps onto the API
- * it asks for, each with the HFS rule id it enforces. `starci app lint` reports and counts its findings and never fails
+ * it asks for, each with the HFS rule id it enforces. `starci app check --gate lint` reports and counts its findings and never fails
  * on them; the next cohort moves the rule to error and deletes its entry. No other rule may be below error.
  */
 export const COUNTING = Object.freeze({

package/dist/lib/cross-file-inputs.d.ts

@@ -1,7 +1,7 @@
 /**
  * The files a rule of this canon reads that ESLint's own import graph does not carry.
  *
- * The result cache of `starci app lint` (contexts/project/check-cache.md, ESLint) re-lints a file when it or a file it reaches through imports
+ * The result cache of `starci app check --gate lint` (contexts/project/check-cache.md, ESLint) re-lints a file when it or a file it reaches through imports
  * changed. A rule that reads another file by path, with `fs` (a sibling, a directory listing, a manifest, a module file it follows by hand),
  * has an input the import graph cannot see, so the rule declares it here and the cache dirties the files that depend on it:
  *

package/dist/lib/cross-file-inputs.js

@@ -1,7 +1,7 @@
 /**
  * The files a rule of this canon reads that ESLint's own import graph does not carry.
  *
- * The result cache of `starci app lint` (contexts/project/check-cache.md, ESLint) re-lints a file when it or a file it reaches through imports
+ * The result cache of `starci app check --gate lint` (contexts/project/check-cache.md, ESLint) re-lints a file when it or a file it reaches through imports
  * changed. A rule that reads another file by path, with `fs` (a sibling, a directory listing, a manifest, a module file it follows by hand),
  * has an input the import graph cannot see, so the rule declares it here and the cache dirties the files that depend on it:
  *

package/dist/project-graph.d.ts

@@ -19,7 +19,7 @@ export interface ProjectGraphSnapshot {
 /**
  * The findings every project-graph rule of this canon reports, per file, from one fresh build of the side's graph.
  *
- * The result cache of `starci app lint` calls this once for a side whose files changed and compares each file's findings with the recorded
+ * The result cache of `starci app check --gate lint` calls this once for a side whose files changed and compares each file's findings with the recorded
  * ones: a file whose graph findings differ is linted again by ESLint itself, so ESLint stays the only emitter of each message. It is the very
  * graph the rules read (same machine, same manifest, same filter), never a second judge.
  *

package/dist/project-graph.js

@@ -21,7 +21,7 @@ export const recommended = Object.fromEntries(mine.map((e) => [`starci-fe/${e.id
 /**
  * The findings every project-graph rule of this canon reports, per file, from one fresh build of the side's graph.
  *
- * The result cache of `starci app lint` calls this once for a side whose files changed and compares each file's findings with the recorded
+ * The result cache of `starci app check --gate lint` calls this once for a side whose files changed and compares each file's findings with the recorded
  * ones: a file whose graph findings differ is linted again by ESLint itself, so ESLint stays the only emitter of each message. It is the very
  * graph the rules read (same machine, same manifest, same filter), never a second judge.
  *

package/docs/surface-rules.md

@@ -4,7 +4,7 @@ Law module: `surface-rules.mjs`. HFS rule: R318. Canon: ANATOMY-2 and PADDING-0.
 
 ## `starci-fe/no-app-surface-paint`
 
-Finding code: `FE_GRAMMAR_LAYOUT_ONLY`. App classes carry layout. A raw `bg-surface` utility paints a surface and is refused, including conditional classes, class builders, responsive variants, important modifiers and opacity suffixes. Compose a painted Grammar surface such as `SurfaceCard`. Static props spreads keep the same obligations. Typed app lint follows imported colocated class declarations as well as local constants.
+Finding code: `FE_GRAMMAR_LAYOUT_ONLY`. App classes carry layout. A raw `bg-surface` utility paints a surface and is refused, including conditional classes, class builders, responsive variants, important modifiers and opacity suffixes. Compose a painted Grammar surface such as `SurfaceCard`. Static props spreads keep the same obligations. The typed lint of an app follows imported colocated class declarations as well as local constants.
 
 ## `starci-fe/no-list-panel-padding`
 
@@ -26,7 +26,7 @@ const Panel = () => <div className="px-4"><SurfaceCard><ListBox inset="panel" la
 
 ## `starci-fe/no-hand-built-panes`
 
-Finding code: `FE_HAND_BUILT_PANES`. A multi-pane frame is a `PaneGrid` of `Pane`s, which draws the dividers between panes, sizes the columns and collapses a side pane below medium. A vertical `Divider` used as a column seam is a pane frame drawn by hand: a vertical `Divider` (or the plain wrapper element that holds only it) standing among plain column elements (`div`, `aside`, `Region`) of a flex row, or a vertical `Divider` anywhere inside a `SurfaceCard composition="joined"`; and a joined card that holds a plain flex row of two or more columns as one of its own children. `joined` stacks bands divided by horizontal separators. A short vertical separator between controls of a toolbar, a `flex-col` stack, and a row whose classes cannot be read in the file are not judged. Typed app lint follows imported colocated class declarations.
+Finding code: `FE_HAND_BUILT_PANES`. A multi-pane frame is a `PaneGrid` of `Pane`s, which draws the dividers between panes, sizes the columns and collapses a side pane below medium. A vertical `Divider` used as a column seam is a pane frame drawn by hand: a vertical `Divider` (or the plain wrapper element that holds only it) standing among plain column elements (`div`, `aside`, `Region`) of a flex row, or a vertical `Divider` anywhere inside a `SurfaceCard composition="joined"`; and a joined card that holds a plain flex row of two or more columns as one of its own children. `joined` stacks bands divided by horizontal separators. A short vertical separator between controls of a toolbar, a `flex-col` stack, and a row whose classes cannot be read in the file are not judged. The typed lint of an app follows imported colocated class declarations.
 
 Invalid:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.9.11",
+  "version": "9.9.12",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,42 +31,42 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.21.11
+    version: 0.21.12
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.11.18
+    version: 3.11.19
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.9.11
+    version: 9.9.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.11
+    version: 0.21.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.11
+    version: 0.21.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.5.0
+    version: 2.5.1
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 5.0.7
+    version: 5.0.8
     group: starci
     install: registry
     side: both

package/runtime/knowledge/sonar-gate.yaml

@@ -40,11 +40,11 @@ newCode:
     metric: new_security_hotspots_reviewed
     minReviewedPercent: 100
     unreviewedMax: 0
-# The whole code, not only the new code. Every finding of the HFS canon reaches Sonar through ONE entry, `starci app lint`
+# The whole code, not only the new code. Every finding of the HFS canon reaches Sonar through ONE entry, `starci app check --gate lint --out`
 # (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry). CI runs it per side with --side and --out,
 # then merges rules by id and joins issues into ONE file, reports/lint.sonar.json, named by sonar.externalIssuesReportPaths; the gate holds the open-issue count of
 # the whole project at zero. The file carries three engines:
-#   starci-hfs   the repository findings of `starci app check` (managed files, tree, pins, CI, contracts; the rule id is the finding code)
+#   starci-hfs   the repository findings of the gates a run selects (managed files, tree, pins, CI, contracts; the rule id is the finding code)
 #   eslint       ESLint's json over the repository (the BE and FE canon plugins alike, per-file and project-graph rules)
 #   stylelint    stylelint's json over the style glob (front ends)
 # The engines share ONE placement rule (a finding on a file Sonar does not index is filed on the first source file); Sonar's own

package/runtime/scripts/hfs/rules/read.mjs

@@ -3,8 +3,21 @@ import fs from 'node:fs';
 import path from 'node:path';
 /** Files above this size are not read by a tree check (a tracked binary or a generated dump is no source of these laws). */
 const MAX_READ_BYTES = 1024 * 1024;
+let sink = null;
+/** Runs `run` with every `readText` / `readJson` it makes reported to `onRead` (before the read), and returns its value. */
+export function recordReads(onRead, run) {
+    const before = sink;
+    sink = onRead;
+    try {
+        return run();
+    }
+    finally {
+        sink = before;
+    }
+}
 /** The text of `rel` under `repoRoot`, or null when it is absent, unreadable, over MAX_READ_BYTES or binary. */
 export function readText(repoRoot, rel) {
+    sink?.(repoRoot, rel);
     try {
         const target = path.join(repoRoot, rel);
         if (fs.statSync(target).size > MAX_READ_BYTES)

package/runtime/scripts/lib/sonar-syntax-rules.mjs

@@ -1,6 +1,6 @@
 // sonar-syntax-rules.mjs - the ESLint rules that keep a TypeScript app clear of the smells SonarCloud flagged in the example apps, judged on
 // the syntax tree alone (no type information, no dependency). Both lint canons (@starci/eslint-canon-be and -fe) publish them from their
-// bundled runtime copy under the names below, so a product inherits them and `starci app lint` refuses the finding before the scan sees it.
+// bundled runtime copy under the names below, so a product inherits them and `starci app check --gate lint` refuses the finding before the scan sees it.
 // Each message names the Sonar rule it stands for, and a rule judges the files the example scans judge: a unit or end-to-end spec is outside the
 // scan (`sonar.exclusions`), so it is outside these rules. The rules that need the type checker (S1874, S6551, S7503) are borrowed from
 // typescript-eslint by the canon factories; the one that needs a regex ambiguity analysis (S8786) runs in the runtime's own `sonar-rules` check.

package/runtime/scripts/lib/sonar-way.mjs

@@ -1,5 +1,5 @@
 // sonar-way.mjs - the Sonar way TypeScript profile (the default quality profile sonar.starci.org and SonarCloud apply) as ESLint rules:
-// the one mapping both lint canons (@starci/eslint-canon-be and -fe) publish, so `starci app lint` in the op loop refuses what the scan would
+// the one mapping both lint canons (@starci/eslint-canon-be and -fe) publish, so `starci app check --gate lint` in the op loop refuses what the scan would
 // raise while the code is written. The base is eslint-plugin-sonarjs's recommended config, SonarSource's own port of Sonar way (each rule's
 // docs url names its S-id); its rules the canons already publish in another form stay with that owner (SONAR_WAY_OWNED), and the Sonar way
 // rules SonarSource builds on other ESLint rules are SONAR_WAY_EXTRA. Every rule is `error`; no rule is left to the server because its port