@starci/hfs 4.11.16 → 4.11.17

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 4.11.17 - 2026-10-30
+
+- Fixed: `stemOfEvent` (the event class file name of R151) maps underscores to dashes as well as dots, matching eslint-canon-be's `event-consumer-shape` and the kebab case of `source-suffix`.
+- Fixed: `starci app emit`'s write pass (outDir is the app root) no longer calls `appHasDbTypes`/`writeDbTypes`, whose module (`emit/db-types.mjs`) left with the lite Supabase types in 4.10.0: every write pass aborted after `events.json` and wrote no `schema.graphql` or `openapi.json`. `emitContracts` answers `{ written, skipped, standIns }`; spec: the write pass in `src/input-bounds-emit.spec.mjs`.
+- Changed: the bundled canon pins name ai-router 0.4.0 (mounted keys), hfs 4.11.17, eslint-canon-be 3.8.16, eslint-canon-fe 9.5.18 and the Grammar family 0.15.29. No rule or template changed.
+
 ## 4.11.16 - 2026-10-30
 
 - Fixed: the back-end skeleton's `OriginGuard` (`platform/http-security`, BE-AUTH-5) requires an actual allowed `Origin` header on a cookie-bearing mutation (`POST`, `PUT`, `PATCH`, `DELETE` with a `Cookie` header) and on a door or handler marked with the new `RequireOrigin()` (`http-security.decorators.ts`, metadata `REQUIRE_ORIGIN_KEY`), which covers the start of a cookie-authenticated flow before the first cookie exists. A missing, empty, opaque (`null`) or foreign `Origin` is refused with `HTTP_SECURITY_ORIGIN_REJECTED` (403), and an allowed `Referer` no longer stands in for it there; `ServerToServer` does not exempt such a request. Safe methods, and mutations without a cookie on unmarked doors, keep their rules (Referer fallback when Origin is absent, the `ServerToServer` exemption). Spec `origin.guard.spec.ts`: class and handler markers, the first sign-in, cookie-bearing requests and the preserved admission paths, split into describe groups within the function budget.

package/emit/contracts.mjs

@@ -27,7 +27,6 @@ import { fileURLToPath } from 'node:url';
 import { emitEvents, eventServices, eventsSnapshotPath } from './events.mjs';
 import { openapiPath } from './operations.mjs';
 import { readEnv } from '../runtime/scripts/lib/env.mjs';
-import { createSlotResolver, loadSlotManifest, locateDeclaration, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 
 /** The stderr prefix of a dependency the worker could not load and stood in for. */
 const STAND_IN = 'stand-in ';
@@ -75,37 +74,16 @@ function emitApp(repoRoot, app) {
   return { graphql: graphql.text, openapi: operations.text, standIns: [...graphql.lines, ...operations.lines] };
 }
 
-/**
- * The app-scope slot view of the repository `repoRoot` belongs to: `{ appRoot, resolver }`, or null when no app declaration
- * resolves there (a bare folder is not an app and emits no types). `repoRoot` is the be side folder, so `locateDeclaration`
- * answers the app root above it.
- */
-function appDbScope(repoRoot) {
-  try {
-    const { appRoot } = locateDeclaration(repoRoot);
-    const manifest = loadSlotManifest();
-    return { appRoot, resolver: createSlotResolver(manifest, readRepoDeclaration(manifest, appRoot)) };
-  } catch {
-    return null;
-  }
-}
-
 /**
  * Writes the snapshots of every api app: `contracts/<app>/schema.graphql` when it serves GraphQL and `contracts/<app>/openapi.json`
- * when it has an operation table. Answers `{ written: [paths], skipped: [apps], standIns: { app: [lines] }, types }`, `skipped`
+ * when it has an operation table. Answers `{ written: [paths], skipped: [apps], standIns: { app: [lines] } }`, `skipped`
  * being the apps with neither. `declaration` is the parsed hfs.json. `outDir` (absolute) redirects the snapshots to another
  * root, keeping their relative paths.
- *
- * On the real write pass (`outDir` is `repoRoot`) the app's database types are written too when the slot `app.db.types`
- * is enabled: `resolver` is the app-scope slot view (built from the declaration at the app root when not passed), `appRoot`
- * overrides where the types land, and `run` is the command runner `writeDbTypes` spawns `psql` with. `types` in the answer
- * is `writeDbTypes`'s `{ path, changed }`, or null for an app without the slot or a redirected pass.
  */
-export function emitContracts({ repoRoot, declaration, outDir = repoRoot, resolver, appRoot, run } = {}) {
+export function emitContracts({ repoRoot, declaration, outDir = repoRoot } = {}) {
   const written = [];
   const skipped = [];
   const standIns = {};
-  let types = null;
   for (const app of apiApps(declaration)) {
     const emitted = emitApp(repoRoot, app);
     if (emitted.graphql === null && emitted.openapi === null) {
@@ -130,12 +108,5 @@ export function emitContracts({ repoRoot, declaration, outDir = repoRoot, resolv
     fs.writeFileSync(target, events);
     written.push(relative);
   }
-  // The generated Database types are an app-level artifact of the write pass only: a redirected outDir is the R23 check
-  // mode, and L09 judges drift on the same emitted text through the injected emitTypes (emit/db-types.mjs dbTypesEmitter).
-  if (outDir === repoRoot) {
-    const scope = resolver === undefined ? appDbScope(repoRoot) : { appRoot: locateDeclaration(repoRoot).appRoot, resolver };
-    const target = appRoot ?? scope?.appRoot;
-    if (target !== null && target !== undefined && scope?.resolver != null && appHasDbTypes(scope.resolver)) types = writeDbTypes({ root: target, run });
-  }
-  return { written, skipped, standIns, types };
+  return { written, skipped, standIns };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.11.16",
+  "version": "4.11.17",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.28
+    version: 0.15.29
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.8.15
+    version: 3.8.16
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.17
+    version: 9.5.18
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.28
+    version: 0.15.29
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.28
+    version: 0.15.29
     group: starci
     install: registry
     side: fe
@@ -99,14 +99,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. A fake declared https (defineHttpFake) serves TLS with the run''s ephemeral in-memory fake CA and publishes its PEM as w.fake.<name>.ca for the app''s own client to trust; verification is never turned off. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/ai-router':
-    version: 0.3.0
+    version: 0.4.0
     group: starci
     install: registry
     side: be
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.11.16
+    version: 4.11.17
     group: starci
     install: registry
     side: both

package/runtime/scripts/hfs/rules/event-bus.mjs

@@ -28,8 +28,9 @@ const TEST_CALLEES = new Set(['it', 'test']);
 /** The TypeScript compiler of the app (else of the runtime), or null. */
 const typescriptFor = (repoRoot) => loadTypescript(repoRoot, HERE);
 
-/** The event-bus pattern file name of an event name: dots become dashes (`order.placed` -> `order-placed`). */
-export const stemOfEvent = (name) => name.replaceAll('.', '-');
+/** The event-bus pattern file name of an event name: dots and underscores become dashes (`order.placed` -> `order-placed`,
+ * `installation_changed` -> `installation-changed`), the kebab case source-suffix gives every file. */
+export const stemOfEvent = (name) => name.replaceAll(/[._]/gu, '-');
 
 /** The initializer of a `static` property member with an identifier name, parentheses and `as` casts stripped, else null. */
 function staticMemberValue(ts, member) {