@starci/hfs 4.16.2 → 4.16.3

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 4.16.3 - 2026-11-01
+
+- Changed: the bundled canon pins name hfs 4.16.3, @starci/grammar 0.20.0, eslint-canon-be 3.11.4, eslint-canon-fe 9.8.3 and eslint-grammar-core and eslint-grammar-offset-pop 0.20.0 (RELEASE_VERSION_NOT_BUMPED: 4.16.2 is on npm).
+
 ## 4.16.2 - 2026-10-31
 
 - Fixed: R248 `ENV_DUPLICATE` judges app env only. The operator's SSH member (`deploy.remote.sealed`) and the CI member `vps-ci` are separate identities by design (ruling ci-transport-one-home) and never reach an app container, so the SSH group keys (`SSH_GROUP`, now exported from `secret-standard`) held by exactly those two members of one environment are no duplicate; an app key in two members, or an SSH group key in any third member, stays red.
@@ -7,7 +11,7 @@
 - Added: the ssh gate operation `identity-restore <recipient>` (stdin: the identity; writes only the fixed server identity path, once, for the matching recipient), so the restore workflow is admitted when the CI key is forced through `starci-ssh-gate`; `CI_MEMBER` moves to `sealed-member`.
 - Fixed: R259 `DB_MIGRATION_DESTRUCTIVE` leaves out `SET NOT NULL` and a type change on a column (or table) the same migration created earlier, which touches no existing data, and an entity references a table only by the name its `@Entity`/`@Table` decorator spells: a column property of the same word (`queue`) is no reference to a dropped table `queue`; an entity that spells no name keeps the identifier match.
 - Fixed: `HFS_SCHEDULE_UNDECLARED` judges unparsable SQL only when it calls `cron.schedule`, `cron.unschedule`, `cron.schedule_in_database` or `cron.alter_job`; a statement of another dialect (MySQL session setup) schedules nothing.
-- Changed: the bundled canon pins name hfs 4.16.2, @starci/grammar 0.19.1, eslint-canon-be 3.11.3, eslint-canon-fe 9.8.2 and eslint-grammar-core and eslint-grammar-offset-pop 0.19.1.
+- Changed: the bundled canon pins name hfs 4.16.2, @starci/grammar 0.20.0, eslint-canon-be 3.11.4, eslint-canon-fe 9.8.3 and eslint-grammar-core and eslint-grammar-offset-pop 0.20.0.
 
 ## 4.16.1 - 2026-10-31
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.16.2",
+  "version": "4.16.3",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.19.1
+    version: 0.20.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.11.3
+    version: 3.11.4
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.8.2
+    version: 9.8.3
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.19.1
+    version: 0.20.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.19.1
+    version: 0.20.0
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.16.2
+    version: 4.16.3
     group: starci
     install: registry
     side: both