@starci/eslint-canon-fe 8.3.0 → 8.4.1

package/next-conventions.mjs

@@ -12,12 +12,13 @@
  */
 
 import { attribute, attributeValue, calleeName, leadingTextOf, stringOf } from "./lib/ast.mjs"
+import { variableOf } from "./lib/bindings.mjs"
 import { forbiddingConcern } from "./lib/fe-stack.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
-import { baseName, classOf, fileOf, inSlot, roleOfFile, slotOfFile, stem } from "./lib/scope.mjs"
+import { baseName, classOf, fileOf, inSlot, roleOfFile, slotOfFile } from "./lib/scope.mjs"
 
 /** Another i18n stack: a second place that decides which language a reader sees (one the fe-stack catalog forbids by name is fe-stack-import's finding). */
-const OTHER_I18N = /^(?:react-i18next|i18next|next-i18next|react-intl|next-translate|@lingui\/.+|typesafe-i18n|rosetta)(?:\/.*)?$/
+const OTHER_I18N = /^(?:react-i18next|i18next|next-i18next|react-intl|next-translate|typesafe-i18n|rosetta)(?:\/.*)?$|^@lingui\/.+$/
 
 // -- FE-NEXT-1 -------------------------------------------------------------------------------------
 
@@ -137,21 +138,23 @@ export const htmlLangFromLocale = {
 
 // -- FE-NEXT-5 -------------------------------------------------------------------------------------
 
-/** The names a module exports, from declarations and specifiers. */
-const exportedNames = (program) => {
-  const names = new Set()
-  for (const statement of program.body) {
-    if (statement.type !== "ExportNamedDeclaration") continue
-    const declaration = statement.declaration
-    if (declaration && declaration.id) names.add(declaration.id.name)
-    if (declaration && declaration.type === "VariableDeclaration") {
-      for (const entry of declaration.declarations) if (entry.id.type === "Identifier") names.add(entry.id.name)
+/** The names one named-export statement introduces. */
+const statementExportNames = (statement) => {
+  if (statement.type !== "ExportNamedDeclaration") return []
+  const declaration = statement.declaration
+  const names = (statement.specifiers ?? []).map((specifier) => specifier.exported.name)
+  if (declaration?.id) names.push(declaration.id.name)
+  if (declaration?.type === "VariableDeclaration") {
+    for (const entry of declaration.declarations) {
+      if (entry.id.type === "Identifier") names.push(entry.id.name)
     }
-    for (const specifier of statement.specifiers ?? []) names.add(specifier.exported.name)
   }
   return names
 }
 
+/** The names a module exports, from declarations and specifiers. */
+const exportedNames = (program) => new Set(program.body.flatMap(statementExportNames))
+
 /** Every page names itself: `metadata` or `generateMetadata`. */
 export const pageExportsMetadata = {
   meta: {
@@ -338,34 +341,34 @@ const STACK_FACTORIES = new Map([
   ["next-intl/middleware", new Set(["default"])],
 ])
 
-/** The variable a name binds to, walking up from the scope of a node. */
-const bindingOf = (context, identifier) => {
-  let scope = (context.sourceCode ?? context.getSourceCode()).getScope(identifier)
-  while (scope) {
-    const variable = scope.set.get(identifier.name)
-    if (variable) return variable.defs[0] ?? null
-    scope = scope.upper
-  }
+/** The public name selected by a named or default import. */
+const importedName = (specifier) => {
+  if (specifier.type === "ImportSpecifier") return specifier.imported.name ?? specifier.imported.value
+  if (specifier.type === "ImportDefaultSpecifier") return "default"
   return null
 }
 
+/** The known next-intl factory selected from an import. */
+const stackFactory = (definition, exported) => {
+  const source = String(definition.parent.source.value)
+  if (!STACK_FACTORIES.get(source)?.has(exported)) return null
+  return { source, name: exported === "default" ? "createMiddleware" : exported }
+}
+
+/** A factory called through a namespace import, else null. */
+const namespaceFactory = (context, callee) => {
+  if (callee.type !== "MemberExpression" || callee.computed || callee.object.type !== "Identifier" || callee.property.type !== "Identifier") return null
+  const definition = variableOf(context, callee.object)?.defs[0] ?? null
+  if (definition?.type !== "ImportBinding" || definition.node.type !== "ImportNamespaceSpecifier") return null
+  return stackFactory(definition, callee.property.name)
+}
+
 /** The name a stack factory has where the call reads it: "defineRouting" (next-intl/routing), else null. */
 const stackFactoryOf = (context, callee) => {
-  if (callee.type === "Identifier") {
-    const definition = bindingOf(context, callee)
-    if (definition?.type !== "ImportBinding") return null
-    const source = String(definition.parent.source.value)
-    const specifier = definition.node
-    const exported = specifier.type === "ImportSpecifier" ? specifier.imported.name ?? specifier.imported.value : specifier.type === "ImportDefaultSpecifier" ? "default" : null
-    return exported !== null && STACK_FACTORIES.get(source)?.has(exported) ? { source, name: exported === "default" ? "createMiddleware" : exported } : null
-  }
-  if (callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.property.type === "Identifier") {
-    const definition = bindingOf(context, callee.object)
-    if (definition?.type !== "ImportBinding" || definition.node.type !== "ImportNamespaceSpecifier") return null
-    const source = String(definition.parent.source.value)
-    return STACK_FACTORIES.get(source)?.has(callee.property.name) ? { source, name: callee.property.name } : null
-  }
-  return null
+  if (callee.type !== "Identifier") return namespaceFactory(context, callee)
+  const definition = variableOf(context, callee)?.defs[0] ?? null
+  if (definition?.type !== "ImportBinding") return null
+  return stackFactory(definition, importedName(definition.node))
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.3.0",
+  "version": "8.4.1",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/config.example.yaml

@@ -185,10 +185,11 @@ sonar: {organization: null}
 #   minFreeRamPct  free-RAM percentage below which no new heavy op starts
 # set them only in the gitignored config.yaml copy, e.g.
 #   resources: {minFreeDiskGb: 5, minFreeDiskPct: 1, minFreeRamPct: 10}
-# release — where the full test suite of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
-#   suite: local   the shipped default: `starci release cut` runs the root suite and the Linux parity container before it pushes, and the pre-push gate asks for their green rows
-#   suite: ci      the owner's recorded choice (2026-10-09): no local full suite and no Linux container; the GitHub ci workflow runs the suite (with coverage, Codecov, SonarCloud) AFTER the push.
-#                  The cut still runs npm run check, npm run test:packages, the specs affected by the release, the live Orca smokes and the example apps; the record lists the root suite as
-#                  delegated, never green. A release can reach GitHub and its tag before the suite has run; a red CI is fixed forward with the next pre-release (starci release ci-status).
-# "none" is refused: the suite does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
+# release - where the Linux parity of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
+#   suite: local   the shipped default: `starci release cut` runs the root rows (npm run test:packages, npm run test:e2e, npm run check) and the Linux parity container before it pushes,
+#                  and the pre-push gate asks for the green root rows
+#   suite: ci      the owner's recorded choice (2026-10-09): no local Linux container; the GitHub ci workflow runs the Linux parity (and SonarCloud) AFTER the push.
+#                  The cut still runs the same root rows and the example apps; the record lists linux-parity as delegated, never green.
+#                  A release can reach GitHub and its tag before the Linux parity has run; a red CI is fixed forward with the next pre-release (starci release ci-status).
+# "none" is refused: the Linux parity does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
 release: {suite: local}

package/runtime/engine/config.mjs

@@ -9,7 +9,7 @@ import {validateSonar} from './sonar-config.mjs';
 import {validateRelease,RELEASE_KEYS} from './release-config.mjs';
 import {validateOrca,ORCA_KEYS} from './orca-config.mjs';
 import {validateResources,RESOURCE_KEYS} from './resources-config.mjs';
-import {ENV_NAME,secretEnv,connectorSecret} from './secrets.mjs';
+import { ENV_NAME, connectorSecret } from './secrets.mjs';
 import {byCodeUnit} from './by-code-unit.mjs';
 import {EFFORT_LEVELS,MODELS_KEYS,validateModelsBlock,refuseRemovedKeys,shippedTiers} from './model-config.mjs';
 const knownNames=names=>[...names].sort(byCodeUnit).join(', ');
@@ -162,8 +162,6 @@ function validateConnectors(connectors){
   if(connectors.cloudflare!==undefined)validateCloudflareConnector(connectors.cloudflare);
   if(connectors.telegram!==undefined)validateTelegramConnector(connectors.telegram);
 }
-/** Load connector credentials from the explicitly verified runtime main; never print the returned environment. */
-export function connectorEnv(config,env=process.env,verifiedRuntimeRoot=undefined){return secretEnv(verifiedRuntimeRoot,env);}
 /**
  * The normalized `connectors` block: defaults filled in, the secrets' PRESENCE (booleans, never values),
  * whether each connector is ready to run, and the owner-facing warnings the security posture earns.
@@ -243,8 +241,8 @@ export function uatSettings(config=loadConfig()){
 const GRANT=/^([a-z0-9][a-z0-9.-]*)=(\d+)@([a-z]+(?:\+[a-z]+)*)$/;
 /** One grant string `<pool>=<slots>@<role>+<role>` as {pool, slots, roles}, or null when it is not that shape. */
 /** The closed set of top-level config.yaml blocks: the validator accepts these and refuses every other key. */
-export const CONFIG_BLOCKS=Object.freeze(['language','model','effort','models','allocation','kernel','budgets','supervisor','parallel','delegation','connectors','asks','uat','specs','reconciler','debugLoop','orca','roots','resources','sonar','release','launchTrust','retention']);
-export function parseAllocationGrant(text){
+const CONFIG_BLOCKS=Object.freeze(['language','model','effort','models','allocation','kernel','budgets','supervisor','parallel','delegation','connectors','asks','uat','specs','reconciler','debugLoop','orca','roots','resources','sonar','release','launchTrust','retention']);
+function parseAllocationGrant(text){
   const m=typeof text==='string'?GRANT.exec(text.trim()):null;
   return m?{pool:m[1],slots:Number(m[2]),roles:m[3].split('+')}:null;
 }
@@ -327,7 +325,7 @@ const validateEarlyConfigBlocks=(config)=>{
   if(config?.orca!==undefined){validateOrca(config.orca);} if(config?.roots!==undefined){validateRoots(config.roots);} if(config?.resources!==undefined){validateResources(config.resources);} if(config?.sonar!==undefined){validateSonar(config.sonar);} if(config?.release!==undefined){validateRelease(config.release);}
 };
 const validateConfigBlocks=(config,knownProviders,runtimes,profile)=>{
-  // specs (owner 2026-09-28): {harness?, unit?, e2e?} booleans - each family a boolean; absent = its default (SPEC_DEFAULTS: harness off, unit on, e2e off; specsSettings).
+  // specs (owner 2026-09-28): {unit?, e2e?} booleans - each family a boolean; absent = its default (SPEC_DEFAULTS: unit on, e2e off; specsSettings).
   if(config?.specs!==undefined&&config.specs!==null&&(!plain(config.specs)||Object.keys(config.specs).some(key=>!CONFIG_KEY_TREE.specs.includes(key)||typeof config.specs[key]!=='boolean')))throw new Error(`Invalid config.yaml: specs must be {${SPEC_FAMILIES.map(k=>k+'?: boolean').join(', ')}}, or null.`);
   // reconciler (scripts/reconciler/state.mjs reconcilerConfig): {enabled?: boolean, profile?: operational|observe, controllers?: {<name>: {mode: off|shadow|active}}}, or null.
   if(config?.reconciler!==undefined&&config.reconciler!==null){validateReconcilerBlock(config.reconciler);} if(config?.allocation!==undefined){validateAllocationBlock(config.allocation,runtimes);}
@@ -356,8 +354,8 @@ export function configuredAllocationPolicy(config=loadConfig()){
     :null;
   return {grants,source:allocation?'allocation':'default'};
 }
-/** The variable that confines the owner's `config.yaml` to a directory tree: set, an owner file is read only from under that directory (tests/setup/isolated-temp.mjs points it at a spec's own temp root). */
-export const OWNER_CONFIG_WITHIN_ENV='STARCI_OWNER_CONFIG_WITHIN';
+/** The variable that confines the owner's `config.yaml` to a directory tree: set, an owner file is read only from under that directory (e2e/setup/isolated-temp.mjs points it at a spec's own temp root). */
+const OWNER_CONFIG_WITHIN_ENV='STARCI_OWNER_CONFIG_WITHIN';
 const foldPath=p=>process.platform==='win32'?path.resolve(p).toLowerCase():path.resolve(p);
 /**
  * Whether the owner's `config.yaml` under `root` is visible to this process. Unconfined (the variable unset) every owner file is visible; confined, only the files under the named
@@ -398,31 +396,25 @@ export function inspectOwnerConfig(root=configRoot){
 }
 /**
  * The owner's spec switches (config.yaml root `specs`, owner 2026-09-28; defaults set 2026-09-29, none needs a config block):
- *   harness - .claude's own specs. Default false = touching-only: harness work writes and runs the specs of new or changed code
- *             and the land gate runs only the specs touching the landed files (`land.mjs --specs touching`, its default);
- *             the whole suite never runs in a land - `--specs all` is refused unless this is true. The full suite runs in
- *             the owner-approved /starci release flow (scripts/supervisor/release-cut.mjs), which needs no key. true = `--specs all` may run;
  *   unit    - product unit specs in workflows. Default on: a code-writing op writes/updates the unit specs of the source it
  *             adds or changes and runs only those; the full unit suite is unit.verify's or the approved /starci release flow's. false = the ops'
  *             policy.specsToggle deferral path (scripts/route/spec-deferral.mjs);
  *   e2e     - product e2e in workflows. Default OFF: e2e runs only when the goal or the owner explicitly asks (set true,
  *             or `starci kernel run-deferred-tests`); e2e.verify then runs the FULL e2e suite.
- * An absent, null or unreadable owner file reads as the defaults: harness off, unit on, e2e off.
+ * An absent, null or unreadable owner file reads as the defaults: unit on, e2e off. The runtime itself has no specs (owner ruling no-runtime-specs), so there is no switch for them.
  */
-const SPEC_FAMILIES=Object.freeze(['harness','unit','e2e']);
+const SPEC_FAMILIES=Object.freeze(['unit','e2e']);
 const SEAT_KEYS=Object.freeze(['agent','model','effort']);
 /** The keys each config block accepts directly under it (the validators read these lists; docs/config-format.md and the example are checked against them). Blocks whose keys are open or deeper than this are not listed. */
-export const CONFIG_KEY_TREE=Object.freeze({
+const CONFIG_KEY_TREE=Object.freeze({
   models:MODELS_KEYS,allocation:Object.freeze(['grants']),kernel:SEAT_KEYS,budgets:Object.freeze(['maxOps']),parallel:Object.freeze(['gear']),
   supervisor:Object.freeze(['mode','pollIntervalMs','repos','stallMinutes','kernel','workers','landGate','frozenMinutes']),
   delegation:Object.freeze(['asks','until','excludes','note']),asks:Object.freeze(['autoAcceptRecommended','excludes']),uat:Object.freeze(['maxConcurrent']),
   specs:SPEC_FAMILIES,reconciler:Object.freeze(['enabled','profile','controllers']),debugLoop:Object.freeze(['interval','worktreeLimit']),
   orca:ORCA_KEYS,roots:ROOT_KEYS,resources:RESOURCE_KEYS,release:RELEASE_KEYS,
 });
-export const SPEC_DEFAULTS=Object.freeze({harness:false,unit:true,e2e:false});
+export const SPEC_DEFAULTS=Object.freeze({unit:true,e2e:false});
 export function specsSettings(config){const specs=plain(config?.specs)?config.specs:{};return Object.fromEntries(SPEC_FAMILIES.map(key=>[key,typeof specs[key]==='boolean'?specs[key]:SPEC_DEFAULTS[key]]));}
-/** specs.harness of the owner file under `root` (tolerant read: inspectOwnerConfig): true only when the owner opted in to `--specs all`. */
-export function harnessSpecsEnabled(root=configRoot){return specsSettings(inspectOwnerConfig(root).config).harness;}
 /**
  * config.yaml `debugLoop` (skills/starci, scripts/debug/digest): {interval?, worktreeLimit?}, each optional.
  *   interval       <n>s | <n>m | <n>h — the cadence of the chat /loop that runs `starci debug digest`.

package/runtime/engine/removed-vocabulary.mjs

@@ -12,8 +12,6 @@ function loaded(){
   return cache.doc;
 }
 
-/** The kinds a removed spelling has. */
-export const removedKinds=()=>loaded().kinds;
 
 /** modules/kernel/removed-vocabulary.yaml: the one list of spellings the runtime refuses, each with its replacement and the release that removed it. */
 export const removedVocabulary=()=>loaded().removed;

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.3.1
+    version: 3.4.1
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.3.0
+    version: 8.4.1
     group: starci
     install: registry
     side: fe
@@ -62,28 +62,28 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.2.7
+    version: 2.3.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
     why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
-    version: 1.2.1
+    version: 1.2.2
     group: starci
     install: registry
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.3.0
+    version: 1.4.1
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.3.0
+    version: 4.4.1
     group: starci
     install: registry
     side: both
@@ -180,7 +180,7 @@ pins:
     side: be
   # --- framework
   next:
-    version: 16.1.6
+    version: 16.4.2
     group: framework
     side: fe
   react:
@@ -206,7 +206,7 @@ pins:
     group: framework
     side: be
   '@nestjs/platform-express':
-    version: 11.2.5
+    version: 11.2.7
     group: framework
     side: be
   '@nestjs/testing':
@@ -316,7 +316,7 @@ pins:
     side: fe
     why: 'the codegen preset of the front-end wire types (fe-stack codegen); the latest registry version on 2026-10-13.'
   'axios':
-    version: 1.15.2
+    version: 1.20.0
     group: framework
     side: fe
     why: 'the REST client of the front end for uploads, presigned URLs and auth endpoints (fe-stack rest); version read from the starci-academy package-lock on 2026-10-13.'
@@ -465,12 +465,12 @@ pins:
     version: 13.4.5
     group: framework
     side: be
-    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13.'
+    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13. Stays on 13.x for alpha.18: the npm-audit advisory fixed by 14.0.3 (semver major) is a documented accepted exception, upgrade deferred to alpha.19 (owner ruling graphql-13-advisory-accepted-until-a19, 2026-10-16).'
   '@nestjs/apollo':
     version: 13.4.5
     group: framework
     side: be
-    why: 'the Apollo driver of @nestjs/graphql; the ecommerce-app resolution on 2026-10-13.'
+    why: 'the Apollo driver of @nestjs/graphql; the ecommerce-app resolution on 2026-10-13. Stays on 13.x with @nestjs/graphql (accepted advisory, major deferred to alpha.19).'
   '@apollo/server':
     version: 5.5.1
     group: framework

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -1,6 +1,6 @@
 schema: starci/fe-stack@1
 purpose: >-
-  The front-end stack of every app, lite and full alike (owner ruling 2026-10-13, R212 case-2): for each common front-end concern the
+  The front-end stack of every app, lite and full alike (owner ruling 2026-10-13, R212 case-2 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4): for each common front-end concern the
   ONE canonical library, its HFS home (slot ids of knowledge/hfs/slots.yaml), the pattern id that teaches it
   (knowledge/patterns/fe/*.yaml) and the alternatives a front end never depends on or imports. Versions live in
   knowledge/hfs/canon-pins.yaml only. `tier: core` packages are installed by every scaffold; `opt` packages are added when a feature
@@ -219,3 +219,24 @@ concerns:
     pattern: FE-LINT
     forbids: []
     why: the canon lint and format configuration.
+  - id: auth-supabase
+    tier: opt
+    packages: ['@supabase/supabase-js', '@supabase/ssr']
+    home: [fe.modules.auth]
+    pattern: FE-AUTH
+    forbids: []
+    why: the lite auth provider client and PKCE server cookie adapter, confined to modules/auth; data still goes through the back end.
+  - id: framework-support
+    tier: opt
+    packages: [server-only, rxjs]
+    home: [fe.source-root-pinned]
+    pattern: FE-ROUTE
+    forbids: []
+    why: the Next server boundary marker and Apollo peer support used by canonical workspaces.
+  - id: tool-support
+    tier: opt
+    packages: ['@types/node', '@types/react', '@types/react-dom', '@starci/tsconfig', '@starci/stylelint-canon', '@tailwindcss/postcss', postcss-value-parser, stylelint, eslint-plugin-react-hooks]
+    home: [fe.tool-config]
+    pattern: FE-LINT
+    forbids: []
+    why: the compiler, CSS and lint support packages of the canonical front-end configs.