@starci/hfs 4.7.36 → 4.7.37

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 4.7.37 - 2026-10-26
+- Fixed: the scaffold SiteShell declares viewport=flow so Grammar lint reads it as site chrome, the hygiene sync follows the scaffold end-to-end fixes, and the scaffold json-logger spec expects the logger field order.
+
 ## 4.7.36 - 2026-10-26
 - Changed: the bundled canon pins select @starci/eslint-canon-be 3.4.45, @starci/eslint-canon-fe 9.1.0, the Grammar lint families 0.12.4 and @starci/grammar 0.12.4.
 - Added: the five R319 button-intent finding codes are catalogued and proven, and the `app codemod button-intent` migration is bundled.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.36",
+  "version": "4.7.37",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -91,14 +91,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.36
+    version: 1.7.37
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.36
+    version: 4.7.37
     group: starci
     install: registry
     side: both

package/sync/hygiene.mjs

@@ -58,7 +58,7 @@ export function hygieneFindings(files, ignored) {
     if (file.startsWith(WORK) && ignored.has(file)) {
       findings.push({ file, code: 'HFS_WORK_AGENT_DATA', message: 'is agent output, which .starciwork/.gitignore refuses; keep it in the scratchpad or the blob store' });
     }
-    if (file.startsWith(STACKS) && !file.endsWith('.enc') && !file.endsWith('.env.example')) {
+    if (file.startsWith(STACKS) && !file.endsWith('.enc') && !file.endsWith('.env.example') && !file.endsWith('/secrets/.gitkeep')) {
       if (file.includes('/secrets/')) findings.push({ file, code: 'HFS_PLAINTEXT_SECRET', message: 'sits under secrets/ but is not sealed; only <slug>.enc may be tracked' });
       else if (PLAINTEXT_NAME.test(file)) findings.push({ file, code: 'HFS_PLAINTEXT_SECRET', message: 'is a plaintext secret; seal it to .starcistacks/<env>/secrets/<slug>.enc' });
     }

package/templates/be/skeleton/src/modules/platform/logging/json-logger.service.spec.ts

@@ -167,8 +167,8 @@ describe("JsonLogger outside a correlation scope", () => {
         logger.warn("cart.slow")
 
         expect(written.map((entry) => entry.line)).toEqual([
-            `${JSON.stringify({ level: "info", event: "cart.opened", time: "2026-05-06T07:08:09.000Z", correlationId: "00000000-0000-4000-8000-000000000001" })}\n`,
-            `${JSON.stringify({ level: "warn", event: "cart.slow", time: "2026-05-06T07:08:09.000Z", correlationId: "00000000-0000-4000-8000-000000000001" })}\n`,
+            `${JSON.stringify({ correlationId: "00000000-0000-4000-8000-000000000001", level: "info", event: "cart.opened", time: "2026-05-06T07:08:09.000Z" })}\n`,
+            `${JSON.stringify({ correlationId: "00000000-0000-4000-8000-000000000001", level: "warn", event: "cart.slow", time: "2026-05-06T07:08:09.000Z" })}\n`,
         ])
     })
 })

package/templates/fe/common/site-shell.tsx.partial

@@ -1,6 +1,7 @@
 export const SiteShell = (props: SiteShellProps) => (
     <GrammarRoot className={siteShellClassNames.frame}>
         <WorkspaceShell
+            viewport="flow"
             primaryLabel={props.brand}
             header={<TopBar brand={<TextAction href={props.homeHref}>{props.brand}</TextAction>} />}
             primary={<PageContainer measure="reading">{props.children}</PageContainer>}