@starci/eslint-canon-fe 8.2.18 → 8.4.0

package/lib/pure-owner-helper.mjs

@@ -0,0 +1,148 @@
+/**
+ * The owner exports an auth callback may use besides the exchange (R287 `FE_CALLBACK_SHAPE`, owner ruling `auth-callback-pure-helpers`,
+ * 2026-10-17 "Theo y tro"): a PURE helper of the app's `modules/routes` or `modules/auth` that computes the redirect target or validates
+ * `next`, and a static route table. Both are found by TypeScript symbol resolution to the declaration, never by the spelling of the name.
+ *
+ * A pure helper is a synchronous function that returns text (or null), holds no `await` or `yield`, reaches no I/O global (network, storage,
+ * DOM, `process`, `require`, `console`) and calls only locals, language built-ins and other pure helpers of `modules/routes` or
+ * `modules/auth` (followed through barrels). `modules/config` is the environment owner: a call to its readers is a configuration read, not I/O.
+ * Anything else it imports, a library value included, makes it impure.
+ */
+import ts from "typescript"
+import { reaching } from "./own-hook-origin.mjs"
+import { programFor } from "./program-for.mjs"
+import { resolveImport } from "./scope.mjs"
+
+/** Globals that reach the network, storage, the page, the process or the console. */
+const IO_GLOBALS = new Set(["fetch", "XMLHttpRequest", "WebSocket", "EventSource", "Request", "navigator", "localStorage", "sessionStorage", "indexedDB", "document", "window", "self", "globalThis", "process", "require", "console", "setTimeout", "setInterval", "queueMicrotask", "Worker", "BroadcastChannel"])
+
+const OWNER_FILE = /\/modules\/(?:routes|auth)(?:\/|\.tsx?$)/
+const CONFIG_FILE = /\/modules\/config(?:\/|\.tsx?$)/
+const EXTENSIONS = ["", ".ts", ".tsx", "/index.ts", "/index.tsx"]
+
+const normal = (file) => file.fileName.replaceAll("\\", "/")
+
+/** The module file an import specifier names, or null when none exists on disk. */
+const moduleFile = (context, source) => {
+  const target = resolveImport(context, source)
+  if (target === null) return null
+  return EXTENSIONS.map((extension) => `${target}${extension}`).find((candidate) => ts.sys.fileExists(candidate)) ?? null
+}
+
+/** The declaration an export of the module resolves to, after barrels and re-exports. */
+const exportedDeclaration = (context, source, name) => {
+  const file = moduleFile(context, source)
+  if (file === null) return null
+  const program = reaching(programFor(context), context.filename, file)
+  const checker = program.getTypeChecker()
+  const sourceFile = program.getSourceFile(file)
+  const moduleSymbol = sourceFile && checker.getSymbolAtLocation(sourceFile)
+  const exported = moduleSymbol && checker.getExportsOfModule(moduleSymbol).find((symbol) => symbol.name === name)
+  if (!exported) return null
+  const symbol = exported.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(exported) : exported
+  return { checker, declaration: symbol.declarations?.[0] ?? null }
+}
+
+/** Strip `as`, `satisfies` and parentheses. */
+const bare = (node) => {
+  let current = node
+  while (current && (ts.isAsExpression(current) || ts.isSatisfiesExpression(current) || ts.isParenthesizedExpression(current))) current = current.expression
+  return current
+}
+
+/** The function-like node of a function declaration or of a variable initialised with an arrow or function expression. */
+const functionOf = (declaration) => {
+  if (ts.isFunctionDeclaration(declaration)) return declaration
+  const init = ts.isVariableDeclaration(declaration) ? bare(declaration.initializer) : null
+  return init && (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) ? init : null
+}
+
+const isInside = (node, root) => node.getSourceFile() === root.getSourceFile() && node.pos >= root.pos && node.end <= root.end
+
+/** Whether an identifier names a declaration, a property or a member rather than referring to a binding. */
+const isNameOnly = (node) => {
+  const parent = node.parent
+  if (ts.isPropertyAccessExpression(parent)) return parent.name === node
+  if (ts.isPropertyAssignment(parent) || ts.isMethodDeclaration(parent) || ts.isPropertySignature(parent)) return parent.name === node
+  return (ts.isParameter(parent) || ts.isVariableDeclaration(parent) || ts.isFunctionDeclaration(parent) || ts.isBindingElement(parent)) && parent.name === node
+}
+
+/** A declaration of another file: an owner helper is followed, the environment owner is a leaf, everything else is impure. */
+const foreignPure = (env, declaration, root) => {
+  const file = normal(declaration.getSourceFile())
+  if (CONFIG_FILE.test(file)) return true
+  if (!OWNER_FILE.test(file) || declaration.getSourceFile().isDeclarationFile) return false
+  return declarationPure(env, declaration, root)
+}
+
+/** A global of the language or of the lib files is pure unless it reaches I/O. */
+const globalPure = (symbol) => !IO_GLOBALS.has(symbol.getName())
+
+/** Whether one identifier reference stays inside the pure surface. */
+const referencePure = (env, node, root) => {
+  const symbol = env.checker.getSymbolAtLocation(node)
+  if (!symbol) return node.text === "undefined"
+  const target = symbol.flags & ts.SymbolFlags.Alias ? env.checker.getAliasedSymbol(symbol) : symbol
+  const declarations = target.declarations ?? []
+  if (declarations.length === 0) return node.text === "undefined"
+  return declarations.every((declaration) => {
+    const file = declaration.getSourceFile()
+    if (isInside(declaration, root)) return true
+    if (!ts.isExternalModule(file)) return globalPure(target)
+    return foreignPure(env, declaration, root)
+  })
+}
+
+/** Walk a node: no await or yield, no impure reference; type positions are not behaviour. */
+const nodePure = (env, node, root) => {
+  if (ts.isAwaitExpression(node) || ts.isYieldExpression(node)) return false
+  if (ts.isTypeNode(node) && !ts.isExpressionWithTypeArguments(node)) return true
+  if (ts.isIdentifier(node) && !isNameOnly(node) && !referencePure(env, node, root)) return false
+  return ts.forEachChild(node, (child) => (nodePure(env, child, root) ? undefined : true)) !== true
+}
+
+/** A declaration is pure when its function (or its constant initialiser) is. */
+function declarationPure(env, declaration, root) {
+  if (env.seen.has(declaration)) return true
+  env.seen.add(declaration)
+  const fn = functionOf(declaration)
+  if (fn) return !fn.asteriskToken && !fn.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) && (fn.body ? nodePure(env, fn.body, fn) : false)
+  if (ts.isVariableDeclaration(declaration) && declaration.initializer) return nodePure(env, declaration.initializer, declaration.initializer)
+  return false
+}
+
+/** Whether a function's declared or inferred return type is text, null or undefined. */
+const returnsText = (checker, declaration) => {
+  const signature = checker.getSignaturesOfType(checker.getTypeAtLocation(declaration), ts.SignatureKind.Call)[0]
+  if (!signature) return false
+  const type = checker.getReturnTypeOfSignature(signature)
+  const parts = type.isUnion() ? type.types : [type]
+  return parts.every((part) => part.flags & (ts.TypeFlags.StringLike | ts.TypeFlags.Null | ts.TypeFlags.Undefined))
+}
+
+/** A static table: a constant object whose leaves are string literals or plain templates. */
+const isStaticTable = (node) => {
+  const value = bare(node)
+  if (!value) return false
+  if (ts.isStringLiteralLike(value)) return true
+  if (ts.isObjectLiteralExpression(value)) return value.properties.every((property) => ts.isPropertyAssignment(property) && isStaticTable(property.initializer))
+  return false
+}
+
+/**
+ * What an import of the callback's owner modules is: `"pure"` (a pure text-returning helper), `"routes"` (a static route table) or null.
+ *
+ * @param {object} context - The ESLint rule context.
+ * @param {string} source - The import specifier.
+ * @param {string} name - The imported name.
+ * @returns {"pure" | "routes" | null} The kind.
+ */
+export function ownerExportKind(context, source, name) {
+  const found = exportedDeclaration(context, source, name)
+  if (!found?.declaration) return null
+  const { checker, declaration } = found
+  if (ts.isVariableDeclaration(declaration) && !functionOf(declaration)) return declaration.parent.flags & ts.NodeFlags.Const && isStaticTable(declaration.initializer) ? "routes" : null
+  const fn = functionOf(declaration)
+  const env = { checker, seen: new Set() }
+  return fn && returnsText(checker, fn) && declarationPure(env, declaration, fn) ? "pure" : null
+}

package/lib/redux-hook-origin.mjs

@@ -0,0 +1,44 @@
+/** Resolve typed Redux hook factories by their import provenance, never by a local use* name. */
+import ts from "typescript"
+import { programFor } from "./program-for.mjs"
+
+const REDUX_HOOKS = new Set(["useSelector", "useDispatch", "useStore"])
+
+function reduxImport(declaration) {
+  if (!ts.isImportSpecifier(declaration) || declaration.isTypeOnly) return false
+  const clause = declaration.parent.parent
+  return !clause.isTypeOnly && clause.parent.moduleSpecifier.text === "react-redux"
+    && REDUX_HOOKS.has((declaration.propertyName ?? declaration.name).text)
+}
+
+function typedFactory(checker, declaration) {
+  if (!ts.isVariableDeclaration(declaration) || !(declaration.parent.flags & ts.NodeFlags.Const)) return false
+  const call = declaration.initializer
+  if (!call || !ts.isCallExpression(call) || call.arguments.length !== 0) return false
+  const member = call.expression
+  return ts.isPropertyAccessExpression(member) && member.name.text === "withTypes"
+    && reduxBinding(checker, member.expression)
+}
+
+function reduxBinding(checker, node) {
+  const symbol = checker.getSymbolAtLocation(node)
+  return (symbol?.declarations ?? []).some(reduxImport)
+}
+
+/** A relative/barrel import must resolve to a const initialized by a real Redux hook's withTypes(). */
+export function importedReduxHook(context, definition) {
+  const specifier = definition.node
+  if (specifier.type !== "ImportSpecifier" || definition.parent.importKind === "type" || specifier.importKind === "type") return false
+  const source = String(definition.parent.source.value)
+  const name = specifier.imported.name ?? specifier.imported.value
+  if (source === "react-redux") return REDUX_HOOKS.has(name)
+  const program = programFor(context)
+  const target = ts.resolveModuleName(source, context.filename, program.getCompilerOptions(), ts.sys).resolvedModule
+  const file = target && program.getSourceFile(target.resolvedFileName)
+  const checker = program.getTypeChecker()
+  const moduleSymbol = file && checker.getSymbolAtLocation(file)
+  const exported = moduleSymbol && checker.getExportsOfModule(moduleSymbol).find(symbol => symbol.name === name)
+  if (!exported) return false
+  const symbol = exported.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(exported) : exported
+  return (symbol.declarations ?? []).some(declaration => typedFactory(checker, declaration))
+}

package/next-conventions.mjs

@@ -12,12 +12,13 @@
  */
 
 import { attribute, attributeValue, calleeName, leadingTextOf, stringOf } from "./lib/ast.mjs"
+import { variableOf } from "./lib/bindings.mjs"
 import { forbiddingConcern } from "./lib/fe-stack.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
-import { baseName, classOf, fileOf, inSlot, roleOfFile, slotOfFile, stem } from "./lib/scope.mjs"
+import { baseName, classOf, fileOf, inSlot, roleOfFile, slotOfFile } from "./lib/scope.mjs"
 
 /** Another i18n stack: a second place that decides which language a reader sees (one the fe-stack catalog forbids by name is fe-stack-import's finding). */
-const OTHER_I18N = /^(?:react-i18next|i18next|next-i18next|react-intl|next-translate|@lingui\/.+|typesafe-i18n|rosetta)(?:\/.*)?$/
+const OTHER_I18N = /^(?:react-i18next|i18next|next-i18next|react-intl|next-translate|typesafe-i18n|rosetta)(?:\/.*)?$|^@lingui\/.+$/
 
 // -- FE-NEXT-1 -------------------------------------------------------------------------------------
 
@@ -137,21 +138,23 @@ export const htmlLangFromLocale = {
 
 // -- FE-NEXT-5 -------------------------------------------------------------------------------------
 
-/** The names a module exports, from declarations and specifiers. */
-const exportedNames = (program) => {
-  const names = new Set()
-  for (const statement of program.body) {
-    if (statement.type !== "ExportNamedDeclaration") continue
-    const declaration = statement.declaration
-    if (declaration && declaration.id) names.add(declaration.id.name)
-    if (declaration && declaration.type === "VariableDeclaration") {
-      for (const entry of declaration.declarations) if (entry.id.type === "Identifier") names.add(entry.id.name)
+/** The names one named-export statement introduces. */
+const statementExportNames = (statement) => {
+  if (statement.type !== "ExportNamedDeclaration") return []
+  const declaration = statement.declaration
+  const names = (statement.specifiers ?? []).map((specifier) => specifier.exported.name)
+  if (declaration?.id) names.push(declaration.id.name)
+  if (declaration?.type === "VariableDeclaration") {
+    for (const entry of declaration.declarations) {
+      if (entry.id.type === "Identifier") names.push(entry.id.name)
     }
-    for (const specifier of statement.specifiers ?? []) names.add(specifier.exported.name)
   }
   return names
 }
 
+/** The names a module exports, from declarations and specifiers. */
+const exportedNames = (program) => new Set(program.body.flatMap(statementExportNames))
+
 /** Every page names itself: `metadata` or `generateMetadata`. */
 export const pageExportsMetadata = {
   meta: {
@@ -338,34 +341,34 @@ const STACK_FACTORIES = new Map([
   ["next-intl/middleware", new Set(["default"])],
 ])
 
-/** The variable a name binds to, walking up from the scope of a node. */
-const bindingOf = (context, identifier) => {
-  let scope = (context.sourceCode ?? context.getSourceCode()).getScope(identifier)
-  while (scope) {
-    const variable = scope.set.get(identifier.name)
-    if (variable) return variable.defs[0] ?? null
-    scope = scope.upper
-  }
+/** The public name selected by a named or default import. */
+const importedName = (specifier) => {
+  if (specifier.type === "ImportSpecifier") return specifier.imported.name ?? specifier.imported.value
+  if (specifier.type === "ImportDefaultSpecifier") return "default"
   return null
 }
 
+/** The known next-intl factory selected from an import. */
+const stackFactory = (definition, exported) => {
+  const source = String(definition.parent.source.value)
+  if (!STACK_FACTORIES.get(source)?.has(exported)) return null
+  return { source, name: exported === "default" ? "createMiddleware" : exported }
+}
+
+/** A factory called through a namespace import, else null. */
+const namespaceFactory = (context, callee) => {
+  if (callee.type !== "MemberExpression" || callee.computed || callee.object.type !== "Identifier" || callee.property.type !== "Identifier") return null
+  const definition = variableOf(context, callee.object)?.defs[0] ?? null
+  if (definition?.type !== "ImportBinding" || definition.node.type !== "ImportNamespaceSpecifier") return null
+  return stackFactory(definition, callee.property.name)
+}
+
 /** The name a stack factory has where the call reads it: "defineRouting" (next-intl/routing), else null. */
 const stackFactoryOf = (context, callee) => {
-  if (callee.type === "Identifier") {
-    const definition = bindingOf(context, callee)
-    if (definition?.type !== "ImportBinding") return null
-    const source = String(definition.parent.source.value)
-    const specifier = definition.node
-    const exported = specifier.type === "ImportSpecifier" ? specifier.imported.name ?? specifier.imported.value : specifier.type === "ImportDefaultSpecifier" ? "default" : null
-    return exported !== null && STACK_FACTORIES.get(source)?.has(exported) ? { source, name: exported === "default" ? "createMiddleware" : exported } : null
-  }
-  if (callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.property.type === "Identifier") {
-    const definition = bindingOf(context, callee.object)
-    if (definition?.type !== "ImportBinding" || definition.node.type !== "ImportNamespaceSpecifier") return null
-    const source = String(definition.parent.source.value)
-    return STACK_FACTORIES.get(source)?.has(callee.property.name) ? { source, name: callee.property.name } : null
-  }
-  return null
+  if (callee.type !== "Identifier") return namespaceFactory(context, callee)
+  const definition = variableOf(context, callee)?.defs[0] ?? null
+  if (definition?.type !== "ImportBinding") return null
+  return stackFactory(definition, importedName(definition.node))
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.2.18",
+  "version": "8.4.0",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.2.19
+    version: 3.4.0
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.2.18
+    version: 8.4.0
     group: starci
     install: registry
     side: fe
@@ -62,28 +62,28 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.2.7
+    version: 2.3.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
     why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
-    version: 1.2.1
+    version: 1.2.2
     group: starci
     install: registry
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.2.17
+    version: 1.4.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.2.17
+    version: 4.4.0
     group: starci
     install: registry
     side: both
@@ -180,7 +180,7 @@ pins:
     side: be
   # --- framework
   next:
-    version: 16.1.6
+    version: 16.4.2
     group: framework
     side: fe
   react:
@@ -206,7 +206,7 @@ pins:
     group: framework
     side: be
   '@nestjs/platform-express':
-    version: 11.2.5
+    version: 11.2.7
     group: framework
     side: be
   '@nestjs/testing':
@@ -316,7 +316,7 @@ pins:
     side: fe
     why: 'the codegen preset of the front-end wire types (fe-stack codegen); the latest registry version on 2026-10-13.'
   'axios':
-    version: 1.15.2
+    version: 1.20.0
     group: framework
     side: fe
     why: 'the REST client of the front end for uploads, presigned URLs and auth endpoints (fe-stack rest); version read from the starci-academy package-lock on 2026-10-13.'
@@ -465,12 +465,12 @@ pins:
     version: 13.4.5
     group: framework
     side: be
-    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13.'
+    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13. Stays on 13.x for alpha.18: the npm-audit advisory fixed by 14.0.3 (semver major) is a documented accepted exception, upgrade deferred to alpha.19 (owner ruling graphql-13-advisory-accepted-until-a19, 2026-10-16).'
   '@nestjs/apollo':
     version: 13.4.5
     group: framework
     side: be
-    why: 'the Apollo driver of @nestjs/graphql; the ecommerce-app resolution on 2026-10-13.'
+    why: 'the Apollo driver of @nestjs/graphql; the ecommerce-app resolution on 2026-10-13. Stays on 13.x with @nestjs/graphql (accepted advisory, major deferred to alpha.19).'
   '@apollo/server':
     version: 5.5.1
     group: framework

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -1,6 +1,6 @@
 schema: starci/fe-stack@1
 purpose: >-
-  The front-end stack of every app, lite and full alike (owner ruling 2026-10-13, R212 case-2): for each common front-end concern the
+  The front-end stack of every app, lite and full alike (owner ruling 2026-10-13, R212 case-2 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4): for each common front-end concern the
   ONE canonical library, its HFS home (slot ids of knowledge/hfs/slots.yaml), the pattern id that teaches it
   (knowledge/patterns/fe/*.yaml) and the alternatives a front end never depends on or imports. Versions live in
   knowledge/hfs/canon-pins.yaml only. `tier: core` packages are installed by every scaffold; `opt` packages are added when a feature
@@ -219,3 +219,24 @@ concerns:
     pattern: FE-LINT
     forbids: []
     why: the canon lint and format configuration.
+  - id: auth-supabase
+    tier: opt
+    packages: ['@supabase/supabase-js', '@supabase/ssr']
+    home: [fe.modules.auth]
+    pattern: FE-AUTH
+    forbids: []
+    why: the lite auth provider client and PKCE server cookie adapter, confined to modules/auth; data still goes through the back end.
+  - id: framework-support
+    tier: opt
+    packages: [server-only, rxjs]
+    home: [fe.source-root-pinned]
+    pattern: FE-ROUTE
+    forbids: []
+    why: the Next server boundary marker and Apollo peer support used by canonical workspaces.
+  - id: tool-support
+    tier: opt
+    packages: ['@types/node', '@types/react', '@types/react-dom', '@starci/tsconfig', '@starci/stylelint-canon', '@tailwindcss/postcss', postcss-value-parser, stylelint, eslint-plugin-react-hooks]
+    home: [fe.tool-config]
+    pattern: FE-LINT
+    forbids: []
+    why: the compiler, CSS and lint support packages of the canonical front-end configs.