@starci/hfs 4.7.24 → 4.7.26

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 4.7.26 - 2026-10-23
+- Changed: the bundled canon pins select @starci/cli 1.7.26, @starci/eslint-canon-be 3.4.33 and @starci/eslint-canon-fe 8.4.32.
+
+## 4.7.25 - 2026-10-23
+- Fixed: with fe packages, the managed `lint` and `lint:fix` scripts build them first (`turbo run build --filter=./fe/packages/*`, turbo.json already declares lint dependsOn ^build): the typed front-end canon of @starci/eslint-canon-fe 8.4.30 read a fresh full scaffold's i18n package as unresolved types (`no-unsafe-*`), so `starci app lint` was red on a new app.
+- Fixed: the skeleton specs cover the express-adapter guard of the edge security and the GraphQL error mapper without locations or path, so a fresh scaffold's unit run holds per-file 100; the skeleton templates and the Supabase auth partial are prettier-formatted (`HFS_FORMAT` was red on a fresh lite scaffold).
+- Changed: the bundled canon pins select @starci/cli 1.7.25, @starci/eslint-canon-be 3.4.32 and @starci/eslint-canon-fe 8.4.31.
+
 ## 4.7.24 - 2026-10-23
 - Fixed: `starci app release push` counts no skipped conclusion as passing (owner ruling 2026-10-22: a skip is a loosening): a green candidate run with a skipped job is red, and the failing-jobs report lists skipped jobs and steps. The candidate grace is 45 minutes and the bounded wait 150 minutes from the push; a queued run is listed, so GitHub's queue never counts against the grace. Specs: `src/candidate-ci.spec.mjs`.
 - Fixed: the local release gate always runs `db-stop` once `db-start` ran (`teardownOf`): a red database row no longer leaves the lite app's local Supabase running. Specs: `src/no-loosening-ci.spec.mjs`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.24",
+  "version": "4.7.26",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.31
+    version: 3.4.33
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.30
+    version: 8.4.32
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.24
+    version: 1.7.26
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.24
+    version: 4.7.26
     group: starci
     install: registry
     side: both

package/sync/index.mjs

@@ -345,7 +345,8 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     buildFe: 'npm run codegen --silent && turbo run build --filter=./fe/apps/*',
     // The be side with its tsc; every fe workspace with its own typecheck script through turbo (the packages are built first: ^build).
     typecheck: 'npm run codegen --silent && tsc -p be/tsconfig.json && turbo run typecheck',
-    lintPrefix: 'npm run codegen --silent && ',
+    // The typed lint reads the types the fe packages declare (their dist, turbo.json: lint dependsOn ^build), so the packages are built first.
+    lintPrefix: packages ? 'npm run codegen --silent && turbo run build --filter=./fe/packages/* && ' : 'npm run codegen --silent && ',
     nodeMajor: String(NODE_MAJOR),
     sonarKey: sonarKey ?? app.project,
     sonarHostLine: sonarHostLine(quality.sonar),

package/templates/be/platform/errors-graphql/graphql-error.mapper.spec.ts

@@ -49,4 +49,19 @@ describe("formatGraphqlError", () => {
         })
         expect(errors.describe).toHaveBeenCalledWith(cause)
     })
+
+    it("leaves out the locations and path a formatted error does not carry", () => {
+        const subject = formatGraphqlError
+        const errors = mock<ErrorsService>()
+        errors.describe.mockReturnValue({ code: "ERRORS_INTERNAL", kind: "internal", status: 500, params: {} })
+
+        expect(subject(errors, { message: "raw" }, new GraphQLError("GRAPHQL_PARSE_FAILED"))).toEqual({
+            message: "raw",
+            extensions: { kind: "invalid" },
+        })
+        expect(subject(errors, { message: "raw" }, new Error("boom"))).toEqual({
+            message: "ERRORS_INTERNAL",
+            extensions: { code: "ERRORS_INTERNAL", kind: "internal", params: {} },
+        })
+    })
 })

package/templates/be/platform/graphql/localize-errors.mapper.spec.ts

@@ -65,17 +65,20 @@ describe("localizeError", () => {
         expect(errors.text).toHaveBeenCalledWith("ITEM_NOT_FOUND", { id: "i-1", retries: 2 }, "en")
     })
 
-    it.each([undefined, null, ["i-1"], "i-1", 42, false])("interpolates no params when extensions.params is %p", (params) => {
-        const errors = mock<ErrorsService>()
-        errors.text.mockReturnValue("The item was not found")
-        const error: GraphQLFormattedError = {
-            message: "ITEM_NOT_FOUND",
-            extensions: { code: "ITEM_NOT_FOUND", params },
-        }
-
-        expect(localizeError(errors, "en", error).message).toBe("The item was not found")
-        expect(errors.text).toHaveBeenCalledWith("ITEM_NOT_FOUND", {}, "en")
-    })
+    it.each([undefined, null, ["i-1"], "i-1", 42, false])(
+        "interpolates no params when extensions.params is %p",
+        (params) => {
+            const errors = mock<ErrorsService>()
+            errors.text.mockReturnValue("The item was not found")
+            const error: GraphQLFormattedError = {
+                message: "ITEM_NOT_FOUND",
+                extensions: { code: "ITEM_NOT_FOUND", params },
+            }
+
+            expect(localizeError(errors, "en", error).message).toBe("The item was not found")
+            expect(errors.text).toHaveBeenCalledWith("ITEM_NOT_FOUND", {}, "en")
+        },
+    )
 })
 
 describe("localizeErrorsPlugin", () => {

package/templates/be/skeleton/src/modules/platform/http-security/edge-security.service.spec.ts

@@ -58,7 +58,9 @@ describe("HTTP edge origin validation", () => {
     it("rejects an empty allowlist and HTTP origins without development permission", async () => {
         const edge = await buildEdge()
         expect(() => edge.validateAllowedOrigins([], false)).toThrow("HTTP_SECURITY_REQUEST_INVALID")
-        expect(() => edge.validateAllowedOrigins(["http://web.example"], false)).toThrow("HTTP_SECURITY_REQUEST_INVALID")
+        expect(() => edge.validateAllowedOrigins(["http://web.example"], false)).toThrow(
+            "HTTP_SECURITY_REQUEST_INVALID",
+        )
     })
 })
 
@@ -120,3 +122,35 @@ describe("HTTP edge installation", () => {
         },
     )
 })
+
+describe("HTTP edge adapter", () => {
+    it.each([null, 1, {}, { disable: jest.fn() }])(
+        "refuses an HTTP adapter whose instance %p is no express application",
+        async (instance) => {
+            const edge = await buildEdge()
+            const { app } = appWithServer()
+            const adapter = mock<ReturnType<INestApplication["getHttpAdapter"]>>()
+            adapter.getInstance.mockReturnValue(instance)
+            app.getHttpAdapter.mockReturnValue(adapter)
+            expect(() => edge.applyHttpSecurity(app, options, { trustProxy: 1 })).toThrow(
+                "HTTP_SECURITY_REQUEST_INVALID",
+            )
+            expect(app.enableCors).not.toHaveBeenCalled()
+        },
+    )
+
+    it("accepts an express application that is a function or a plain object", async () => {
+        const edge = await buildEdge()
+        const callable = Object.assign(() => undefined, { disable: jest.fn(), set: jest.fn() })
+        const plain = { disable: jest.fn(), set: jest.fn() }
+        for (const server of [callable, plain]) {
+            const { app } = appWithServer()
+            const adapter = mock<ReturnType<INestApplication["getHttpAdapter"]>>()
+            adapter.getInstance.mockReturnValue(server)
+            app.getHttpAdapter.mockReturnValue(adapter)
+            edge.applyHttpSecurity(app, options, { trustProxy: 1 })
+            expect(server.disable).toHaveBeenCalledWith("x-powered-by")
+            expect(server.set).toHaveBeenCalledWith("trust proxy", 1)
+        }
+    })
+})

package/templates/be/skeleton/src/modules/platform/http-security/edge-security.service.ts

@@ -11,7 +11,8 @@ const isExpressApplication = (value: unknown): value is Express =>
 
 const expressOf = (app: INestApplication): Express => {
     const instance: unknown = app.getHttpAdapter().getInstance()
-    if (!isExpressApplication(instance)) throw new HttpSecurityError({ code: HttpSecurityErrorCode.RequestInvalid, params: { fields: "HTTP_ADAPTER" } })
+    if (!isExpressApplication(instance))
+        throw new HttpSecurityError({ code: HttpSecurityErrorCode.RequestInvalid, params: { fields: "HTTP_ADAPTER" } })
     return instance
 }
 

package/templates/be/skeleton/src/modules/platform/primitives/outcome.mapper.spec.ts

@@ -64,7 +64,11 @@ describe("outcome mappers", () => {
         it("turns a refusal into the capability error with its parameters", () => {
             const outcome = subject.refused<CapabilityErrorCode>("CAPABILITY_REFUSED", { resource: "value-1" })
 
-            expect(thrownBy(() => subject.unwrapOutcome(outcome, CapabilityError))).toMatchObject({ name: "CapabilityError", code: "CAPABILITY_REFUSED", params: { resource: "value-1" } })
+            expect(thrownBy(() => subject.unwrapOutcome(outcome, CapabilityError))).toMatchObject({
+                name: "CapabilityError",
+                code: "CAPABILITY_REFUSED",
+                params: { resource: "value-1" },
+            })
         })
     })
 })

package/templates/be/skeleton-lite/src/modules/platform/database/database.module.ts

@@ -10,7 +10,8 @@ import { PRIMARY_CONNECTION } from "./primary.connection"
 import { DATABASE_PROBE, PRIMARY_ENTITY_MANAGER } from "./primary.decorators"
 
 /** The `schema` option of a connection, left out when the connection names none. */
-const schemaOption = (schema: string | undefined): Partial<Record<"schema", string>> => (schema === undefined ? {} : { schema })
+const schemaOption = (schema: string | undefined): Partial<Record<"schema", string>> =>
+    schema === undefined ? {} : { schema }
 
 /** The token each declared connection provides its shared EntityManager under. */
 type EntityManagerToken = typeof PRIMARY_ENTITY_MANAGER

package/templates/fe/auth/supabase-client.ts.tpl

@@ -4,7 +4,11 @@ const sessionOf = (session: Session | null): AuthSession | undefined =>
         : { userId: session.user.id, ...(session.user.email === undefined ? {} : { email: session.user.email }) }
 
 /** A Supabase Auth error as the provider reports it: its HTTP status, its code and its message. */
-type ProviderError = { readonly status: number | undefined; readonly code: string | undefined; readonly message: string }
+type ProviderError = {
+    readonly status: number | undefined
+    readonly code: string | undefined
+    readonly message: string
+}
 
 /** The failure kind of a Supabase Auth error: refused credentials, rejected input, or the provider unavailable. */
 const kindOf = (status: number | undefined): string => {

package/templates/fe/skeleton/apps/landing/src/modules/i18n/index.ts

@@ -1,7 +1,4 @@
 import { createAppI18n } from "@{{project}}/i18n"
 
 /** The landing's i18n: the product's one next-intl stack (the i18n package), with this app's own catalogs under `messages/`. */
-export const landingI18n = createAppI18n(
-    "landing",
-    (locale) => import(`./messages/${locale}.json`),
-)
+export const landingI18n = createAppI18n("landing", (locale) => import(`./messages/${locale}.json`))

package/templates/fe/skeleton-lite/apps/__app__/src/modules/auth/client.ts

@@ -10,7 +10,8 @@ let authentication: SupabaseClient["auth"] | undefined
  * redirect's code is exchanged by `detectSessionInUrl`, no route handler). It never calls `.from()`, `.rpc()` or storage:
  * data goes through modules/api to the back end, which verifies the access token.
  */
-const authOf = (): SupabaseClient["auth"] => (authentication ??= createClient(supabaseUrl(), supabaseAnonKey(), {
+const authOf = (): SupabaseClient["auth"] =>
+    (authentication ??= createClient(supabaseUrl(), supabaseAnonKey(), {
         auth: { flowType: "pkce", detectSessionInUrl: true, persistSession: true, autoRefreshToken: true },
     }).auth)