@starci/eslint-grammar-offset-pop 0.12.4 → 0.12.6

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.12.6 - 2026-10-26
+
+- Changed: versioned with Grammar 0.12.6; depends on the exact StarCi family lint 0.12.6; the bundled runtime copies follow the new sources. No rule changes.
+
+## 0.12.5 - 2026-10-26
+
+- Changed: versioned with Grammar 0.12.5; depends on the exact StarCi family lint 0.12.5; the bundled canon pins follow the new package pins. No rule changes.
+
 ## 0.12.4 - 2026-10-26
 
 - Changed: versioned with Grammar 0.12.4; no rule changes beyond the version pin of the exact StarCi family lint dependency.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-grammar-offset-pop",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "description": "Offset Pop Grammar lint: the inherited Common component contract over its own visual family.",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "typescript": ">=5.9"
   },
   "dependencies": {
-    "@starci/eslint-grammar-starci": "0.12.4"
+    "@starci/eslint-grammar-starci": "0.12.6"
   },
   "devDependencies": {
     "@typescript-eslint/parser": "8.71.0",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -23,42 +23,42 @@ pins:
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
-    version: 0.12.4
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.45
+    version: 3.4.47
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.0
+    version: 9.1.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.4
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.4
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.0.12
+    version: 2.0.13
     group: starci
     install: registry
     side: fe
@@ -91,14 +91,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.36
+    version: 1.7.39
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.36
+    version: 4.7.39
     group: starci
     install: registry
     side: both
@@ -299,6 +299,11 @@ pins:
     group: ui
     side: fe
     why: 'Grammar FlowGraph imports React Flow from @xyflow/react; every Grammar consumer declares this required peer at the version used by the Grammar package.'
+  react-aria-components:
+    version: 1.21.1
+    group: ui
+    side: fe
+    why: 'Grammar imports React Aria Components directly (Sidebar, Field); every Grammar consumer declares this required peer at the version HeroUI resolves.'
   '@heroui/react':
     version: 3.2.6
     group: ui

package/runtime/knowledge/hfs/slots.yaml

@@ -43,7 +43,7 @@ versioning:
 # journey (enabled with app.browser by `browser: true`).
 # 3.6.0 is a minor (alpha.30): it ADDS the opt-in be.feature.realtime.sse slot, the server-sent-events door of the realtime kind (owner decision
 # 2026-10-24: lite may serve SSE, and SSE is the default door for one-way push), and lets fe.modules.api hold the SSE stream operations (sse/).
-# 3.7.0 is a minor (alpha.31): it ADDS the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
+# 3.7.0 is a minor (alpha.31): it ADDS the optional app.scripts.integration slot (scripts/integration/*.mjs, the product test-support scripts that only the integration harness runs) and the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
 # transport client layer), and lets fe.hooks.swr hold the SWR subscription hooks (api/sse/subscriptions/useSubscribe<X>Swr.ts, one useSWRSubscription per stream operation).
 
 # Field meaning, per slot.
@@ -727,6 +727,24 @@ slots:
     rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, edition: lite}
+  - id: app.scripts.integration
+    since: 3.7.0
+    profiles: [app]
+    editionWhy: "Lite and full share the slot: a product's integration proof that needs a throwaway, unmigrated database has the same need in both editions, and lite's generic scripts path is closed to anything but codegen and delivery tooling."
+    # Product test-support scripts, run only by the integration harness (the integration suites call them; no package script, workflow, hook
+    # or deploy step does). A proof that must create a throwaway database that no migration has touched and run DDL on it keeps that work here,
+    # because the back-end lint refuses runtime DDL and raw query text in test sources. The folder is `integration`, not `test`:
+    # R252's script scan skips test folders, and a support script that creates databases must stay inside it. A spec or test is not a script
+    # (BE_SPEC_PLACEMENT), a check or lint source has no place (HFS_REPO_LOCAL_CHECK), and a script that reaches a host other than the private
+    # test stack is refused by its own connection guard, which the integration spec of the product proves.
+    path: "scripts/integration/*.mjs"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, editions: [lite, full]}
   - id: app.sides
     since: 3.1.0
     profiles: [app]