@starci/eslint-canon-fe 8.2.13 → 8.2.15

package/runtime/knowledge/patterns/fe/folder.yaml

@@ -29,8 +29,11 @@ rules:
       `hfs.json` `sides.fe.apps` with kind `next` (slot `fe.app.next`; the scaffold writes `landing` and `app`) — and all
       product source lives under fe/apps/<app>/src. An fe/src/ does not exist. Each Next source root
       (fe/apps/<app>/src) uses app/ for framework adapters; features/{pages,layouts,overlays} for route-facing product
-      composition; components/{blocks,composites,branches,leaves} for product visuals; hooks/<domain> for React hooks;
-      and modules/<capability> for cohesive reusable technical and domain capabilities. Every app carries the required
+      composition; components/{blocks,composites,branches,leaves} for product visuals and components/providers for the
+      client providers the root layout mounts; hooks/ for React hooks (swr, rhf, zustand, socketio, effects, reuseables and
+      <domain>); redux/ for the app-wide store; and modules/<capability> for cohesive reusable technical and domain
+      capabilities (api, auth, toast, i18n, config, routes, brand, types, storage, superjson, dayjs, utils). Each concern's
+      library and home is knowledge/hfs/fe-stack.yaml. Every app carries the required
       module instances of slot `fe.modules` and one brand.css under modules/brand when it sets brand tokens
       (`fe.modules.brand`). No other empty role
       folder is required. Grammar remains a separate product-agnostic package. The only files that may sit directly in the
@@ -78,9 +81,10 @@ rules:
         when: "A routed authentication scenario"
         write: "fe/apps/<app>/src/features/pages/AuthenticationPage/index.tsx"
       - id: case-2
-        when: "A reusable API client, reader or session capability"
+        when: "A back-end call or the session"
         write: >
-          fe/apps/<app>/src/modules/api/ or fe/apps/<app>/src/modules/session/ with one explicit public index.ts entry
+          slot fe.modules.api (one file per query or mutation) or slot fe.modules.auth, each with one explicit public index.ts
+          entry
       - id: case-3
         when: "A reusable product visual without scenario ownership"
         write: "an owner folder of slot `fe.components` under the layer it belongs to — for example fe/apps/<app>/src/components/leaves/<Name>/index.tsx"
@@ -257,7 +261,7 @@ rules:
         when: "Global app files"
         write: >
           app/globals.css, app/global-error.tsx, app/[locale]/error.tsx, app/[locale]/not-found.tsx, app/sitemap.ts,
-          app/robots.ts, app/health/{live,ready}/route.ts
+          app/robots.ts, app/health/live/route.ts (the one route handler, FE-ROUTE)
     verification:
       automated:
         - FE_ERROR_BOUNDARY_MISSING
@@ -287,33 +291,35 @@ rules:
     relatedExamples: []
 
   - id: FE-FOLDER-4
-    title: Hooks are hooks; readers and transport live in modules
+    title: Hooks are hooks; operations and transport live in modules
     kind: mandatory
     hfsRules: [R56, R50, R49, R21, R26]
     requirement: |
-      hooks/<domain>/ holds React hooks (use*.ts, one hook per file) and exactly one <domain>.shared.ts for shared
-      non-hook helpers of that domain (key builders, token readers). A file in hooks/ that is not a hook and is not the shared
-      file is a finding. Server-side readers (fetch and map, no React) live in modules/api/<domain>/read-*.ts and are
-      wrapped in React cache() when several blocks call them in one request. Generic client plumbing, the Outcome type,
-      the generated wire types (from be/contracts/, through the root codegen) live in modules/api; environment reading lives in modules/config; every
-      href builder lives in modules/routes; locale routing lives in modules/i18n; colour values live in modules/brand.
+      hooks/ holds React hooks (use*.ts, one hook per file): hooks/swr (one SWR wrapper per modules/api operation, plus
+      SwrSideEffects.tsx), hooks/rhf (forms), hooks/zustand/<store> (a store and its hooks), hooks/socketio (sockets.ts,
+      SocketIoSideEffects.tsx, enums/, types/), hooks/effects (app-wide side effects), hooks/reuseables (generic hooks) and
+      hooks/<domain>/ with exactly one <domain>.shared.ts for shared non-hook helpers of that domain. A file in hooks/ that is
+      none of these is a finding. The Apollo clients and their links, one file per query and mutation, the GraphQLResponse
+      envelope, the generated wire types (from be/contracts/, through the root codegen) and the axios calls live in
+      modules/api; the session lives in modules/auth; mutation feedback in modules/toast; environment reading in
+      modules/config; every href builder in modules/routes; locale routing in modules/i18n; colour values in modules/brand.
       A helper name defined twice across hook files is a finding.
     rationale: |
       A rule that says what a hooks folder is also says where everything else goes, so nobody copies a helper sixteen
-      times or fills hooks/ with server fetch functions.
+      times or fills hooks/ with transport calls.
     cases:
       - id: case-1
-        when: "Authentication request lifecycle"
-        write: "fe/apps/<app>/src/hooks/authentication/useAuthentication.ts"
+        when: "A query the sales page reads"
+        write: "fe/apps/<app>/src/hooks/swr/api/graphql/queries/useQuerySalesSummarySwr.ts over modules/api/graphql/queries/query-sales-summary.ts"
       - id: case-2
         when: "A helper shared by the hooks of one domain"
         write: "fe/apps/<app>/src/hooks/sales/sales.shared.ts, for example useSalesAccessToken's token reader"
       - id: case-3
-        when: "A server read used by several blocks"
-        write: "fe/apps/<app>/src/modules/api/sales/read-sales-summary.ts, exported through modules/api/index.ts"
+        when: "A form"
+        write: "fe/apps/<app>/src/hooks/rhf/useSendHandoffForm.ts"
       - id: case-4
         when: "The API client"
-        write: "fe/apps/<app>/src/modules/api/client.ts and fe/apps/<app>/src/modules/api/outcome.ts"
+        write: "fe/apps/<app>/src/modules/api/graphql/clients/ (auth and no-auth Apollo clients, links/) and fe/apps/<app>/src/modules/api/graphql/types.ts"
       - id: case-5
         when: "Intrinsic custom helper"
         write: "fe/apps/<app>/src/hooks/ui/useAutoScroll.ts; direct useRef and useState calls may remain in their visual owner"

package/runtime/knowledge/sonar-gate.yaml

@@ -81,13 +81,17 @@ overall:
   cognitiveComplexity:
     rule: typescript:S3776
     via: overall.issues
-# Lite is the same quality policy without a test or coverage world. Readers select this block from hfs.json edition;
-# keeping both gates in this document makes every threshold data, never a branch-local restatement.
+# Lite is the same quality policy, coverage included: a lite back end keeps full's unit run and its 100 per file on the measured
+# logic files (owner ruling 2026-10-12, R212 case-1). Readers select this block from hfs.json edition; the gate keeps its own
+# name so a lite project's server gate stays a separate object, and every threshold below equals full's.
 lite:
   gate:
     name: starci-quality-lite
     newCodePeriod: {type: NUMBER_OF_DAYS, value: 30}
   newCode:
+    coverage:
+      metric: new_coverage
+      minPercent: 100
     ignoreBelowChangedLines: 20
     duplication:
       metric: new_duplicated_lines_density
@@ -109,6 +113,10 @@ lite:
     hotspots:
       metric: security_hotspots_reviewed
       minReviewedPercent: 100
+    coverage:
+      metric: coverage
+      minPercent: 100
+      perFile: true
     duplication:
       metric: duplicated_lines_density
       maxPercent: 3

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -266,3 +266,51 @@ removed:
     use: 'probeDraft reads only and returns verdict, draft and sends; a foreign draft receives no keys'
     since: 1.0.0-alpha.9
     match: '\b(?:draftProbe|probeDraft)\.(?:restore|restored|removed|after)\b'
+  - id: code-fe-db-result-typed
+    kind: code
+    name: FE_DB_RESULT_TYPED
+    use: 'the front end reads no data through Supabase (R217, auth only in fe.modules.auth); reads are GraphQL queries of modules/api wrapped by hooks/swr, typed by graphql-codegen (R52 FE_WIRE_GENERATED)'
+    since: 1.0.0-alpha.13
+  - id: code-fe-db-error-handled
+    kind: code
+    name: FE_DB_ERROR_HANDLED
+    use: 'a failure arrives as the GraphQLResponse envelope of modules/api/graphql/types.ts and is never collapsed into empty data (R51 FE_HTTP_STATUS_COLLAPSE)'
+    since: 1.0.0-alpha.13
+  - id: code-fe-auth-session-trust
+    kind: code
+    name: FE_AUTH_SESSION_TRUST
+    use: 'the front end runs no server code that trusts a session (R243 FE_SERVER_ACTION_FORBIDDEN); the back end verifies the access token against the JWKS (R219 BE_SUPABASE_JWT_VERIFIED)'
+    since: 1.0.0-alpha.13
+  - id: code-fe-db-write-shape
+    kind: code
+    name: FE_DB_WRITE_SHAPE
+    use: 'a write is a GraphQL mutation of modules/api wrapped by a useMutate<X>Swr hook and reported by modules/toast; Server Actions are refused (R243 FE_SERVER_ACTION_FORBIDDEN)'
+    since: 1.0.0-alpha.13
+  - id: slot-fe-modules-db
+    kind: vocabulary
+    name: fe.modules.db
+    use: 'the front end reads and writes through the back end GraphQL API in fe.modules.api, wrapped by hooks/swr; Supabase on the front end is fe.modules.auth only (owner ruling 2026-10-13)'
+    since: 1.0.0-alpha.13
+    match: '\bfe\.modules\.db\b'
+  - id: slot-fe-package-db
+    kind: vocabulary
+    name: fe.package.db
+    use: 'a shared front-end data client is fe.package.api (Apollo clients and the GraphQLResponse union); Supabase on the front end is fe.modules.auth only'
+    since: 1.0.0-alpha.13
+    match: '\bfe\.package\.db\b'
+  - id: slot-be-feature-realtime-supabase
+    kind: vocabulary
+    name: be.feature.realtime.supabase
+    use: 'both editions push through the socket.io gateway be.feature.realtime.websocket; lite runs it in the api process'
+    since: 1.0.0-alpha.13
+    match: '\bbe\.feature\.realtime\.supabase\b'
+  - id: slot-key-anonymous-actions
+    kind: vocabulary
+    name: anonymousActions
+    use: 'the front end holds no Server Action (R243 FE_SERVER_ACTION_FORBIDDEN), so no slot lists anonymous ones'
+    since: 1.0.0-alpha.13
+  - id: lint-heroicons-is-the-glyph-vendor
+    kind: vocabulary
+    name: heroicons-is-the-glyph-vendor
+    use: 'the eslint-fe rule is one-icon-set: the application icon set is @phosphor-icons/react (knowledge/hfs/fe-stack.yaml icons), imported only by the Icon leaf; the grammar Icon takes whatever glyph the app supplies'
+    since: 1.0.0-alpha.13

package/runtime/scripts/hfs/architecture/client-reaches-server.mjs

@@ -1,6 +1,5 @@
 import { builtinModules } from 'node:module';
 import { sourceLocation } from '../../lib/ts-ast.mjs';
-import { isServerActionModule } from './server-action.mjs';
 
 /**
  * R55 `client-reaches-server` (FE_CLIENT_REACHES_SERVER), the repository half of the eslint rule `client-no-server-import`,
@@ -58,7 +57,6 @@ const scanClientEntry = (entry, { ts, graph, runtime, violations }) => {
   const seen = new Map([[entry.rel, { chain: [entry.rel], first: null }]]);
   const queue = [entry.rel];
   for (const rel of queue) {
-    if (isServerActionModule(ts, graph.files.get(rel).sourceFile)) continue;
     const state = seen.get(rel);
     for (const hit of runtime.serverOf(rel)) {
       const at = state.first ?? sourceLocation(graph.files.get(rel).sourceFile, hit.node);

package/runtime/scripts/hfs/architecture/config.mjs

@@ -199,7 +199,8 @@ function inferredLayout(root, workspaces) {
     features: collect('src/features'),
     components: [...new Set(components)],
     hooks: collect('src/hooks'),
-    modules: collect('src/modules'),
+    // src/redux/ (fe.redux) is a modules-tier owner beside src/modules/ (owner ruling 2026-10-13, fe-stack state-global).
+    modules: [...collect('src/modules'), ...collect('src/redux')],
     transport: collect('src/modules/api'),
   };
 }
@@ -291,7 +292,7 @@ function derivedGrammar(root, packageRoot, workspaces, apps = []) {
     if (declaresGrammar(pkg)) consumerManifests.push(manifest);
   }
   if (!consumerManifests.length) return null;
-  return { package: GRAMMAR_PACKAGE, entry: `${GRAMMAR_PACKAGE}/common`, styleEntry: `${GRAMMAR_PACKAGE}/common.css`, styleSources, consumerManifests, peers: ['react', '@heroui/react'] };
+  return { package: GRAMMAR_PACKAGE, entry: `${GRAMMAR_PACKAGE}/common`, styleEntry: `${GRAMMAR_PACKAGE}/common.css`, styleSources, consumerManifests, peers: ['react', '@heroui/react', '@xyflow/react'] };
 }
 
 /**

package/runtime/scripts/hfs/architecture/dead-exports.mjs

@@ -8,7 +8,7 @@
  *                      so a file only a spec imports is dead, on purpose. Type-only imports reach a file.
  *
  * Owner = every graph.ownerRoots unit whose tier is not `app` and whose public entry file is in the graph (index.ts or
- * index.tsx, a package's src/index.ts). The `entries` its slot declares (slot data, e.g. fe.modules.db browser.ts) are further
+ * index.tsx, a package's src/index.ts). The `entries` its slot declares (slot data: a second public entry file of the owner) are further
  * public entries of the same owner, judged exactly like the entry. The exported names of an entry are its named exports, `export { a as b }`,
  * `export { x } from`, declarations with `export`, and `default` for `export default`. `export *` is refused by owners.mjs
  * and contributes no name here.
@@ -34,6 +34,7 @@ import fs from 'node:fs';
 import { canonical } from './config.mjs';
 import path from 'node:path';
 import { treeOf } from './required-files.mjs';
+import { globExpression } from '../../lib/glob.mjs';
 
 export const DEAD_EXPORT_RULE_IDS = ['HFS_UNUSED_EXPORT', 'HFS_UNUSED_FILE'];
 
@@ -59,7 +60,10 @@ export function entryOf(graph, config, key, owner) {
 /** The additional public entry files (repository-relative, in the graph) the slot manifest declares for the owner (slot field `entries`, on the slot that holds its entry file). */
 function extraEntries(graph, entry) {
   const found = graph.resolver.classifyPath(entry);
-  return (found.slot ? graph.resolver.slot(found.slot)?.entries ?? [] : []).map(name => `${found.root}/${name}`).filter(rel => graph.files.has(rel));
+  const names = found.slot ? graph.resolver.slot(found.slot)?.entries ?? [] : [];
+  // an entry holding `*` (one file per operation) names every graph file it matches
+  const matches = name => [...graph.files.keys()].filter(rel => globExpression(`${found.root}/${name}`).test(rel));
+  return names.flatMap(name => (name.includes('*') ? matches(name) : [`${found.root}/${name}`].filter(rel => graph.files.has(rel))));
 }
 
 const importBindings = (ts, declaration) => {

package/runtime/scripts/hfs/architecture/error-masked.mjs

@@ -33,13 +33,22 @@ const isGraphqlRegistration = (kit, checker, node) => kit.ts.isCallExpression(no
   && ['forRoot', 'forRootAsync'].includes(node.expression.name.text)
   && kit.isImportOf(checker, node.expression.expression, 'GraphQLModule', '@nestjs/graphql');
 
+/**
+ * The formatter a `formatError` value names: the value itself, or the callee of an arrow whose body only calls it (an arrow that
+ * binds the errors service, `(formatted, error) => formatGraphqlError(errors, formatted, error)`).
+ */
+function formatterOf(ts, value) {
+  if (value && ts.isArrowFunction(value) && ts.isCallExpression(value.body)) return value.body.expression;
+  return value;
+}
+
 function passesMaskedFormatError(kit, inErrors, checker, call) {
   const { ts } = kit;
   let masked = false;
   for (const argument of call.arguments) {
     kit.walk(argument, inner => {
       if ((ts.isPropertyAssignment(inner) || ts.isShorthandPropertyAssignment(inner)) && kit.propertyNameText(inner.name) === 'formatError'
-        && inErrors(checker, kit.valueOfProperty(inner))) masked = true;
+        && inErrors(checker, formatterOf(ts, kit.valueOfProperty(inner)))) masked = true;
     });
   }
   return masked;

package/runtime/scripts/hfs/architecture/frontend.mjs

@@ -8,7 +8,7 @@ import { checkWorldRenderBoundaries } from './frontend-world.mjs';
 import { checkGrammar } from './frontend-grammar.mjs';
 import { checkRoute } from './frontend-routing.mjs';
 const FEATURE_TIERS = new Set(['pages', 'layouts', 'overlays']);
-const COMPONENT_TIERS = new Set(['blocks', 'composites', 'branches', 'leaves']);
+const COMPONENT_TIERS = new Set(['blocks', 'composites', 'branches', 'leaves', 'providers']);
 
 function absolute(root, relative) {
   return path.resolve(root, ...relative.split('/'));
@@ -90,7 +90,7 @@ function checkFrontendSourceLayout(config, sourceFile, roots) {
   if (located.role === 'hooks') valid = located.relative.includes('/') || roleEntry(located.relative);
   return valid ? [] : [{ ruleId: 'FE_SOURCE_LAYOUT_INVALID', path: relativePath(config.root, sourceFile.fileName), line: 1, column: 1,
     message: ({ features: 'Frontend features contain only pages, layouts and overlays plus an optional root public entry.',
-      components: 'Frontend components contain only blocks, composites, branches and leaves plus an optional root public entry.',
+      components: 'Frontend components contain only blocks, composites, branches, leaves and providers plus an optional root public entry.',
       hooks: 'Every authored custom hook is grouped below a domain folder under hooks; only the root public entry may sit directly under hooks.' })[located.role] }];
 }
 
@@ -139,8 +139,15 @@ function reportExportedHooks(state) {
   }
 }
 
+/** True when the slot that owns this file names it as its `hooks` role (redux/hooks.ts, modules/toast/hooks.ts): the owner's own typed hooks. */
+function slotHooksRole(config, fileName) {
+  const found = config.hfs?.classifyPath?.(relativePath(config.root, fileName));
+  const role = found?.slot ? config.hfs.slot(found.slot)?.roles?.hooks : undefined;
+  return typeof role === 'string' && path.basename(fileName) === role;
+}
+
 function checkCustomHookLocations(config, context, sourceFile, roots) {
-  if (insideAny(roots.hooks, sourceFile.fileName)) return [];
+  if (insideAny(roots.hooks, sourceFile.fileName) || slotHooksRole(config, sourceFile.fileName)) return [];
   const { ts } = context;
   const state = { ts, config, sourceFile, checker: context.checkerFor(sourceFile.fileName), violations: [], seen: new Set() };
   visitHookDeclarations(state, sourceFile);

package/runtime/scripts/hfs/architecture/hfs.mjs

@@ -43,7 +43,8 @@ export const HFS_RULE_IDS = [
 
 const NON_NPM_ENTRIES = new Set(['pnpm-lock.yaml', 'pnpm-workspace.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb']);
 const HUSKY_HOOKS_PATH = /^\.husky(?:\/_)?\/?$/u;
-const BACKEND_SRC_CHILDREN = new Set(['features', 'modules', 'tests']);
+/** The folders of a back end's src/ the slot manifest knows (features, modules, tests, assets): read from the be slot paths, never listed here. */
+const backendSrcChildrenOf = resolver => new Set(resolver.slots().filter(slot => slot.profiles.includes('be')).flatMap(slot => braceVariants(slot.path)).map(variant => /^src\/([a-z][a-z-]*)\//.exec(variant)?.[1]).filter(Boolean));
 const moduleTiersOf = resolver => new Set(resolver.slots().filter(slot => slot.profiles.includes('be')).flatMap(slot => braceVariants(slot.path)).map(variant => /^src\/modules\/([a-z][a-z-]*)\//.exec(variant)?.[1]).filter(Boolean)); // the folders of src/modules/ the slot manifest knows (domain, platform, integrations, events, queues, projections)
 // Owner test layout 2026-09-30: unit `<name>.spec.ts`, integration, e2e and contract by folder and suffix; int-spec and harness-spec stay banned.
 const UNSUPPORTED_TEST_SUFFIX = /\.(?:int|harness)-spec\.[cm]?[jt]sx?$/u;
@@ -274,9 +275,11 @@ function checkApplications(state) {
 function checkBackendSourceLayout(state) {
   if (!state.backend) return;
   const { tree, resolver, finding } = state;
+  const srcChildren = backendSrcChildrenOf(resolver);
+  const srcList = [...srcChildren].sort(byCodeUnit).map(name => name + '/').join(', ');
   for (const child of tree.children('src').sort(byCodeUnit)) {
-    if (!BACKEND_SRC_CHILDREN.has(child))
-      finding('HFS_SRC_LAYOUT_INVALID', `src/${child}`, `Backend src/ holds only features/, modules/ and tests/; ${child} must move to its owner.`);
+    if (!srcChildren.has(child))
+      finding('HFS_SRC_LAYOUT_INVALID', `src/${child}`, `Backend src/ holds only ${srcList}; ${child} must move to its owner.`);
   }
   for (const tier of tree.children('src/modules').sort(byCodeUnit)) {
     if (!moduleTiersOf(resolver).has(tier))

package/runtime/scripts/hfs/architecture/index.mjs

@@ -48,6 +48,7 @@ import { checkFeSlotAllows, FE_SLOT_ALLOWS_RULE_IDS } from './fe-slot-allows.mjs
 import { checkI18nKeys, I18N_KEYS_RULE_IDS } from './i18n-keys.mjs';
 import { checkDocLanguage, DOC_LANGUAGE_RULE_IDS } from './doc-language.mjs';
 import { checkBackendSupabase, checkFrontendSupabase, BACKEND_SUPABASE_RULE_IDS, FRONTEND_SUPABASE_RULE_IDS } from './supabase.mjs';
+import { checkServerActions, SERVER_ACTION_RULE_IDS } from './server-action.mjs';
 import { LINT_CODES, onLintSurface } from './surface.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 
@@ -98,6 +99,7 @@ const FRONTEND_MACHINE = {
   feSlotAllows: [checkFeSlotAllows, FE_SLOT_ALLOWS_RULE_IDS],
   i18nKeys: [checkI18nKeys, I18N_KEYS_RULE_IDS],
   supabaseFrontend: [checkFrontendSupabase, FRONTEND_SUPABASE_RULE_IDS],
+  serverActions: [checkServerActions, SERVER_ACTION_RULE_IDS],
 };
 
 /** Errors the machine reports when a program cannot be built or an edge cannot be proven: it cannot judge, so it refuses. */

package/runtime/scripts/hfs/architecture/owners.mjs

@@ -2,17 +2,23 @@ import path from 'node:path';
 import { canonical, isInside } from './config.mjs';
 import { relativePath, workspaceExportSources } from './typescript.mjs';
 import { sourceLocation } from '../../lib/ts-ast.mjs';
-import { isServerActionModule } from './server-action.mjs';
+import { globExpression } from '../../lib/glob.mjs';
+import { posixPath } from '../../lib/path-key.mjs';
 
 function absolute(root, relative) {
   return canonical(path.resolve(root, ...relative.split('/')));
 }
 
-/** The extra public entries the slot manifest declares for the owner (slot field `entries`, on the slot that holds its entry file), as absolute paths. */
+/**
+ * The extra public entries the slot manifest declares for the owner (slot field `entries`, on the slot that holds its entry file):
+ * exact files as absolute paths, and the entries holding a `*` (one file per operation, `graphql/queries/query-*.ts`) as patterns.
+ */
 function slotEntries(config, owner) {
   const found = config.hfs?.classifyPath?.(owner.entry);
   const names = found?.slot ? config.hfs.slot(found.slot)?.entries ?? [] : [];
-  return names.map(name => absolute(config.root, `${found.root}/${name}`));
+  const exact = names.filter(name => !name.includes('*')).map(name => absolute(config.root, `${found.root}/${name}`));
+  const patterns = names.filter(name => name.includes('*')).map(name => globExpression(`${posixPath(absolute(config.root, found.root))}/${name}`));
+  return { exact, patterns };
 }
 
 /** The owner's public entries: its declared entry, the `entries` its slot declares, plus every source file its package.json `exports` maps when the owner is a workspace package. */
@@ -21,9 +27,10 @@ function ownerDeclarations(config, context) {
     const root = absolute(config.root, owner.root);
     const entry = absolute(config.root, owner.entry);
     const workspace = context.workspaces?.find(item => item.root === root);
-    const declared = slotEntries(config, owner);
+    const { exact: declared, patterns } = slotEntries(config, owner);
     const entries = new Set([entry, ...declared, ...(workspace ? workspaceExportSources(context.ts, workspace) : [])]);
-    return { ...owner, root, entry, entries, declared };
+    const isEntry = file => entries.has(file) || patterns.some(pattern => pattern.test(posixPath(file)));
+    return { ...owner, root, entry, entries, isEntry, declared };
   }).sort((a, b) => b.root.length - a.root.length);
 }
 
@@ -35,7 +42,7 @@ function reexportSteps(context, current) {
   return (context.edges.get(current.file) ?? []).filter(candidate => candidate.reexport).map(candidate => ({ file: candidate.to, chain: [...current.chain, candidate.to] }));
 }
 
-function privateOwnerChain(context, owners, actionEntries, edge) {
+function privateOwnerChain(context, owners, edge) {
   const sourceOwner = ownerOf(owners, edge.from);
   const queue = [{ file: edge.to, chain: [edge.from, edge.to] }];
   const visited = new Set();
@@ -44,7 +51,7 @@ function privateOwnerChain(context, owners, actionEntries, edge) {
     if (visited.has(current.file)) continue;
     visited.add(current.file);
     const owner = ownerOf(owners, current.file);
-    if (owner && sourceOwner?.id !== owner.id) return owner.entries.has(current.file) || actionEntries.has(current.file) ? null : { owner, chain: current.chain };
+    if (owner && sourceOwner?.id !== owner.id) return owner.isEntry(current.file) ? null : { owner, chain: current.chain };
     queue.push(...reexportSteps(context, current));
   }
   return null;
@@ -61,7 +68,7 @@ function arrangesSchema(config, from, to) {
     && resolver.classifyPath(relativePath(config.root, to)).slot === 'be.persistence';
 }
 
-function publicEntryViolations(config, context, owners, sourceFiles, actionEntries) {
+function publicEntryViolations(config, context, owners, sourceFiles) {
   const violations = [];
   for (const owner of owners) {
     const sourceFile = sourceFiles.get(owner.entry);
@@ -73,7 +80,6 @@ function publicEntryViolations(config, context, owners, sourceFiles, actionEntri
     const publicFiles = new Set([
       sourceFile,
       ...owner.declared.map(file => sourceFiles.get(file)).filter(Boolean),
-      ...[...actionEntries].filter(file => isInside(owner.root, file)).map(file => sourceFiles.get(file)).filter(Boolean),
     ]);
     for (const entryFile of publicFiles) {
       for (const statement of entryFile.statements) if (context.ts.isExportDeclaration(statement) && !statement.exportClause) {
@@ -90,12 +96,12 @@ function publicEntryViolations(config, context, owners, sourceFiles, actionEntri
   return violations;
 }
 
-function ownerImportViolations(config, context, owners, actionEntries) {
+function ownerImportViolations(config, context, owners) {
   const violations = [];
   for (const sourceFile of context.files) {
     const from = canonical(sourceFile.fileName);
     for (const edge of context.edges.get(from) ?? []) {
-      const bypass = privateOwnerChain(context, owners, actionEntries, edge);
+      const bypass = privateOwnerChain(context, owners, edge);
       if (!bypass) continue;
       if (arrangesSchema(config, from, bypass.chain.at(-1))) continue;
       violations.push({
@@ -119,11 +125,8 @@ export function checkOwners(config, context) {
   if (!config.owners?.length) return [];
   const owners = ownerDeclarations(config, context);
   const sourceFiles = new Map(context.files.map(file => [canonical(file.fileName), file]));
-  const actionEntries = new Set(config.kinds.includes('frontend')
-    ? [...sourceFiles].filter(([, file]) => isServerActionModule(context.ts, file)).map(([name]) => name)
-    : []);
   return [
-    ...publicEntryViolations(config, context, owners, sourceFiles, actionEntries),
-    ...ownerImportViolations(config, context, owners, actionEntries),
+    ...publicEntryViolations(config, context, owners, sourceFiles),
+    ...ownerImportViolations(config, context, owners),
   ];
 }

package/runtime/scripts/hfs/architecture/route-files-thin.mjs

@@ -24,6 +24,9 @@ const HOOK_ROUTES = new Set([...MOUNTING_ROUTES, 'page']);
 const HOOK_NAME = /^use[A-Z0-9]/u;
 const HOOKS_SLOT = 'fe.hooks';
 
+/** The client providers (fe.components.providers) wrap the mounted owner like a package shell; they are not a second owner. */
+const PROVIDERS_SLOT = 'fe.components.providers';
+const isFeatureOwner = target => target?.tier === 'feature' && target.slot !== PROVIDERS_SLOT;
 const isFunction = (ts, node) => ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node);
 const jsxOf = (ts, node) => ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node);
 
@@ -68,7 +71,7 @@ function reportRoute(violations, kit, file, stem, node, message, extra = {}) {
 function inspectMountingTag(tag, { graph, kit, ts, file, stem, checker, violations, state }) {
   if (ts.isIdentifier(tag) && /^[a-z]/u.test(tag.text)) {
     reportRoute(violations, kit, file, stem, tag, `<${tag.text}> is drawing in a ${stem} route file; a route file mounts one feature and draws nothing. Move the markup into the feature.`);
-  } else if (kit.declarationsOf(checker, ts.isPropertyAccessExpression(tag) ? tag.name : tag).some(declaration => graph.files.get(kit.graphPath(declaration) ?? '')?.tier === 'feature')) {
+  } else if (kit.declarationsOf(checker, ts.isPropertyAccessExpression(tag) ? tag.name : tag).some(declaration => isFeatureOwner(graph.files.get(kit.graphPath(declaration) ?? '')))) {
     state.owners += 1;
   }
 }

package/runtime/scripts/hfs/architecture/server-action.mjs

@@ -1,24 +1,79 @@
-/** The value of a directive-prologue statement, or null once the prologue has ended. */
-function directiveValue(ts, sourceFile, statement) {
-  const expressionStatement = ts?.isExpressionStatement
-    ? ts.isExpressionStatement(statement)
-    : Boolean(statement?.expression);
-  if (!expressionStatement) return null;
-  const expression = statement.expression;
-  if (ts?.isStringLiteral) return ts.isStringLiteral(expression) ? expression.text : null;
-  const raw = expression?.getText?.(sourceFile);
-  const quote = raw?.[0];
-  return typeof expression?.text === 'string' && (quote === "'" || quote === '"') && raw.at(-1) === quote
-    ? expression.text
-    : null;
+import { sourceLocation } from '../../lib/ts-ast.mjs';
+
+/**
+ * The front end serves no API (owner ruling 2026-10-13, both editions, every app): it calls the back end through Apollo GraphQL and
+ * axios in modules/api and never runs server code of its own.
+ *
+ *   - FE_SERVER_ACTION_FORBIDDEN: a `"use server"` directive anywhere in a front-end source file, in the file's directive prologue
+ *     (a Server Action module) or in the prologue of any function body (an inline Server Action), apps and packages alike;
+ *   - FE_ROUTE_HANDLER_FORBIDDEN: a route handler (`route.ts`, `route.js` and their module variants) under `apps/<app>/src/app/` other than the
+ *     liveness probe `health/live/route.ts` and the file the slot `fe.route.callback` owns (the Supabase auth code exchange).
+ *
+ * The check is provider-independent: it runs for every front-end repository.
+ */
+export const SERVER_ACTION_RULE_IDS = Object.freeze(['FE_SERVER_ACTION_FORBIDDEN', 'FE_ROUTE_HANDLER_FORBIDDEN']);
+
+const SERVER_ACTION = 'FE_SERVER_ACTION_FORBIDDEN';
+const ROUTE_HANDLER = 'FE_ROUTE_HANDLER_FORBIDDEN';
+const CALLBACK_SLOT = 'fe.route.callback';
+const ROUTE_FILE = /^apps\/([^/]+)\/src\/app\/(?:.+\/)?route\.[cm]?[jt]s$/u;
+
+/** The statement nodes of a directive prologue: the leading string-literal expression statements. */
+function prologue(ts, statements) {
+  const directives = [];
+  for (const statement of statements ?? []) {
+    if (!ts.isExpressionStatement(statement) || !ts.isStringLiteral(statement.expression)) break;
+    directives.push(statement);
+  }
+  return directives;
+}
+
+const useServerIn = (ts, statements) => prologue(ts, statements).find(statement => statement.expression.text === 'use server') ?? null;
+
+/** Every `"use server"` directive of one source file: the file-level one and each function-level one. */
+function serverDirectives(ts, sourceFile) {
+  const found = [];
+  const fileLevel = useServerIn(ts, sourceFile.statements);
+  if (fileLevel) found.push({ node: fileLevel, level: 'file' });
+  const visit = node => {
+    // a function with a block body: declaration, expression, arrow, method, constructor or accessor
+    if (ts.isFunctionLike(node) && node.body && ts.isBlock(node.body)) {
+      const inline = useServerIn(ts, node.body.statements);
+      if (inline) found.push({ node: inline, level: 'function' });
+    }
+    ts.forEachChild(node, visit);
+  };
+  ts.forEachChild(sourceFile, visit);
+  return found;
+}
+
+function serverActionViolations(ts, file) {
+  return serverDirectives(ts, file.sourceFile).map(({ node, level }) => ({
+    ruleId: SERVER_ACTION, path: file.rel, ...sourceLocation(file.sourceFile, node), level,
+    message: `${file.rel} declares a ${level}-level "use server" directive: the front end runs no Server Action. Call the back end through a modules/api GraphQL operation (or a rest call) from an SWR hook, and move the server work into a be feature.`,
+  }));
+}
+
+function routeHandlerViolation(file) {
+  const match = ROUTE_FILE.exec(file.rel);
+  if (!match) return null;
+  if (file.rel === `apps/${match[1]}/src/app/health/live/route.ts` || file.slot === CALLBACK_SLOT) return null;
+  return {
+    ruleId: ROUTE_HANDLER, path: file.rel, line: 1, column: 1,
+    message: `${file.rel} is a front-end route handler outside health/live/route.ts and the ${CALLBACK_SLOT} slot: the front end serves no API. Webhooks, cron, public APIs and third-party callbacks belong to be features; the browser reaches the back end through modules/api.`,
+  };
 }
 
-/** True when a TypeScript source file declares `"use server"` in its directive prologue. */
-export function isServerActionModule(ts, sourceFile) {
-  for (const statement of sourceFile?.statements ?? []) {
-    const value = directiveValue(ts, sourceFile, statement);
-    if (value === null) return false;
-    if (value === 'use server') return true;
+/** The FE machine check of both bans over every source file of the front-end program. */
+export function checkServerActions({ graph, context }) {
+  const ts = context.ts;
+  const violations = [];
+  let routes = 0;
+  for (const file of graph.files.values()) {
+    violations.push(...serverActionViolations(ts, file));
+    const route = routeHandlerViolation(file);
+    if (ROUTE_FILE.test(file.rel)) routes += 1;
+    if (route) violations.push(route);
   }
-  return false;
+  return { violations, coverage: { status: 'checked', files: graph.files.size, routes } };
 }

package/runtime/scripts/hfs/architecture/supabase-ast.mjs

@@ -34,7 +34,7 @@ const typeFromSupabase = (checker, node) => {
   return false;
 };
 
-export const signatureFromSupabase = (checker, call) => {
+const signatureFromSupabase = (checker, call) => {
   try { return declarationFromSupabase(checker.getResolvedSignature(call)?.declaration); } catch { return false; }
 };
 
@@ -45,7 +45,7 @@ export const unwrap = (ts, node) => {
   return current;
 };
 
-export const isSupabaseValue = (kit, checker, node) => {
+const isSupabaseValue = (kit, checker, node) => {
   const current = unwrap(kit.ts, node);
   if (!current) return false;
   if (importedFrom(kit, checker, current, SUPABASE_MODULES)) return true;