@starci/eslint-canon-fe 8.4.40 → 8.4.41

package/lib/app-shell-visible.mjs

@@ -0,0 +1,92 @@
+/** Traverse only the visible bar composition and its local React owners. */
+import { functionOf, variableOf } from "./bindings.mjs"
+import { grammarName, propOf, resolveLocal } from "./app-shell.mjs"
+
+const BAR_SLOTS = {
+  WorkspaceShell: ["header", "compactHeader"],
+  TopBar: ["brand", "navigation", "actions"],
+  NavigationFeatureNav: ["identity", "navigation", "actions", "compactNavigationTrigger"],
+  DropdownMenu: ["trigger"],
+  Popover: ["trigger"],
+  Drawer: ["trigger"],
+}
+
+/** Visible JSX composition only: menu, popover and drawer bodies are outside the navbar band. */
+export const visitVisible = (context, expression, visit, seen = new Set(), branch = () => "both", ancestors = []) => {
+  const node = resolveLocal(context, expression)
+  if (!node || seen.has(node)) return
+  const visited = new Set(seen).add(node)
+  const next = (child) => visitVisible(context, child, visit, visited, branch, ancestors)
+  switch (node.type) {
+    case "JSXExpressionContainer": next(node.expression); break
+    case "JSXFragment": for (const child of node.children) next(child); break
+    case "ConditionalExpression": visitConditional(node, next, branch); break
+    case "LogicalExpression": visitLogical(context, node, next, branch); break
+    case "ArrayExpression": for (const item of node.elements) next(item); break
+    case "JSXElement": visitElement(context, node, visit, visited, branch, ancestors); break
+  }
+}
+
+const visitConditional = (node, next, branch) => {
+  const choice = branch(node)
+  if (choice !== "alternate") next(node.consequent)
+  if (choice !== "consequent") next(node.alternate)
+}
+
+const visitLogical = (context, node, next, branch) => {
+  const left = resolveLocal(context, node.left)
+  const known = left?.type === "Literal"
+  let right = node.operator === "&&" ? Boolean(left?.value) : !left?.value
+  if (node.operator === "??") right = left?.value === null
+  if (!known) {
+    const choice = branch(node)
+    if (choice === "both") { next(node.left); next(node.right); return }
+    right = choice === "consequent"
+  }
+  next(right ? node.right : node.left)
+}
+
+const visitElement = (context, node, visit, seen, branch, ancestors) => {
+  const opening = node.openingElement
+  const name = grammarName(context, opening)
+  if (visit(opening, name, ancestors) === false) return
+  const inside = [...ancestors, opening]
+  const next = (child) => visitVisible(context, child, visit, seen, branch, inside)
+  if (name === null && opening.name.type === "JSXIdentifier") {
+    const fn = functionOf(context, resolveLocal(context, opening.name)) ?? variableOf(context, opening.name)?.defs.find((definition) => definition.type === "FunctionName")?.node
+    if (fn) visitFunction(context, fn, visit, seen, branch, inside)
+  }
+  const slots = BAR_SLOTS[name]
+  if (slots) for (const slot of slots) next(propOf(context, opening, slot).value)
+  if (["DropdownMenu", "Popover", "Drawer"].includes(name)) return
+  for (const child of node.children) next(child)
+}
+
+/** Visit a rendered owner's returns with the same branch, overlay and local-binding semantics as inline JSX. */
+export const visitFunction = (context, fn, visit, seen, branch, ancestors) => {
+  if (fn.body.type !== "BlockStatement") return visitVisible(context, fn.body, visit, seen, branch, ancestors)
+  visitStatements(context, fn.body.body, visit, seen, branch, ancestors)
+}
+
+const visitStatements = (context, statements, visit, seen, branch, ancestors) => {
+  for (const statement of statements) {
+    if (statement.type === "ReturnStatement") {
+      visitVisible(context, statement.argument, visit, seen, branch, ancestors)
+      return true
+    }
+    if (statement.type === "BlockStatement" && visitStatements(context, statement.body, visit, seen, branch, ancestors)) return true
+    if (statement.type === "IfStatement") {
+      if (visitIf(context, statement, visit, seen, branch, ancestors)) return true
+    }
+  }
+  return false
+}
+
+const visitIf = (context, statement, visit, seen, branch, ancestors) => {
+  const condition = resolveLocal(context, statement.test)
+  let choice = branch(statement)
+  if (condition?.type === "Literal") choice = condition.value ? "consequent" : "alternate"
+  const consequent = choice !== "alternate" && visitStatements(context, [statement.consequent], visit, seen, branch, ancestors)
+  const alternate = choice !== "consequent" && statement.alternate && visitStatements(context, [statement.alternate], visit, seen, branch, ancestors)
+  return choice === "consequent" && consequent || choice === "alternate" && alternate || consequent && alternate
+}

package/lib/app-shell.mjs

@@ -0,0 +1,148 @@
+/** Static readers for the visible Grammar app-bar composition, including local JSX owners. */
+import { attributeValue, stringOf } from "./ast.mjs"
+import { functionOf, importOf, unwrap, variableOf } from "./bindings.mjs"
+
+const GRAMMAR_SOURCE = /^@starci\/grammar(?:\/|$)/
+/** Grammar controls whose visible hit target belongs to the navbar band's size contract. */
+const BAR_CONTROLS = new Set(["Button", "IconButton", "Switch", "AvatarButton", "PlainPressable", "IdentityLockup", "SearchField", "Input", "TextField", "Select", "TextAction"])
+const BAR_WRAPPERS = new Set(["GrammarRoot", "WorkspaceShell", "TopBar", "NavigationFeatureNav", "Region", "PageContainer", "NavLandmark", "Form", "Fieldset", "Field", "ButtonGroup", "DropdownMenu", "Popover", "Drawer", "Tooltip"])
+const ACTION_PROPS = ["onPress", "onClick", "onAction", "onValueChange", "onSelectionChange", "onSelectedChange", "onChange", "onInputChange"]
+const INTERACTION_PROPS = new Set(["label", "value", "defaultValue", "selectedKey", "selectedKeys", "selectionMode", "href", ...ACTION_PROPS])
+
+/** Bar policy also counts labelled/value/selection/action field owners, so an extra control cannot vanish from the cluster. */
+export const isBarControl = (context, opening, name) => {
+  if (BAR_CONTROLS.has(name)) return true
+  if (!name || !/^[A-Z]/.test(name) || BAR_WRAPPERS.has(name)) return false
+  if (opening.attributes.some((entry) => entry.type === "JSXAttribute" && INTERACTION_PROPS.has(entry.name.name))) return true
+  return [...INTERACTION_PROPS].some((prop) => propOf(context, opening, prop).value !== null)
+}
+/** A literal or constant's initializer, without type-only wrappers. */
+export const resolveLocal = (context, expression, seen = new Set()) => {
+  const node = unwrap(expression)
+  if (node?.type === "MemberExpression") return resolveMember(context, node, seen)
+  if (node?.type === "CallExpression") return resolveCall(context, node, seen)
+  if (!["Identifier", "JSXIdentifier"].includes(node?.type) || seen.has(node)) return node
+  const definition = variableOf(context, node)?.defs.find((entry) => entry.type === "Variable")
+  if (!definition || definition.parent?.kind !== "const") return node
+  seen.add(node)
+  return resolveLocal(context, initializerOf(definition.node, node), seen)
+}
+
+const resolveCall = (context, node, seen) => {
+  if (seen.has(node)) return node
+  seen.add(node)
+  const fn = functionOf(context, resolveLocal(context, node.callee, seen))
+  if (!fn) return node
+  if (fn.body.type !== "BlockStatement") return resolveLocal(context, fn.body, seen)
+  if (fn.body.body.some((statement) => !["VariableDeclaration", "ReturnStatement"].includes(statement.type))) return node
+  const returned = fn.body.body.find((statement) => statement.type === "ReturnStatement")
+  return returned ? resolveLocal(context, returned.argument, seen) : node
+}
+
+const resolveMember = (context, node, seen) => {
+  const key = node.computed ? stringOf(node.property) : node.property.name
+  if (!key) return node
+  const property = objectValue(context, node.object, key, seen)
+  return property.known && property.value !== null ? resolveLocal(context, property.value, seen) : node
+}
+
+const initializerOf = (declaration, node) => {
+  if (declaration.id.type === "ObjectPattern") {
+    const property = declaration.id.properties.find((entry) => entry.type === "Property" && entry.value.name === node.name)
+    if (!property) return node
+    return { type: "MemberExpression", object: declaration.init, property: property.key, computed: property.computed }
+  }
+  return declaration.init
+}
+
+/** The imported Grammar component's name; aliases and namespace imports keep their identity. */
+export const grammarName = (context, opening) => {
+  const name = opening.name
+  if (name.type === "JSXIdentifier") {
+    const canonical = expressionName(context, name)
+    if (canonical) return canonical
+    return variableOf(context, name)?.defs.length ? null : name.name
+  }
+  if (name.type !== "JSXMemberExpression" || name.object.type !== "JSXIdentifier") return null
+  return expressionName(context, { type: "MemberExpression", object: name.object, property: name.property, computed: false })
+}
+
+const expressionName = (context, expression) => {
+  const resolved = resolveLocal(context, expression)
+  if (resolved?.type === "MemberExpression") {
+    return namespaceName(context, resolved.object, resolved.computed ? stringOf(resolved.property) : resolved.property.name)
+  }
+  if (!["Identifier", "JSXIdentifier"].includes(resolved?.type)) return null
+  const imported = importOf(context, resolved)
+  return imported && GRAMMAR_SOURCE.test(imported.source) ? imported.imported : null
+}
+
+const namespaceName = (context, expression, property) => {
+  const object = resolveLocal(context, expression)
+  if (!["Identifier", "JSXIdentifier"].includes(object?.type)) return null
+  const imported = importOf(context, object)
+  return imported && GRAMMAR_SOURCE.test(imported.source) ? property : null
+}
+
+const objectValue = (context, expression, name, seen = new Set()) => {
+  const node = resolveLocal(context, expression)
+  if (node?.type === "ConditionalExpression") return conditionalObjectValue(context, node, name, seen)
+  if (node?.type !== "ObjectExpression" || seen.has(node)) return { known: false, value: null }
+  seen.add(node)
+  let result = { known: true, value: null }
+  for (const property of node.properties) {
+    if (property.type === "SpreadElement") {
+      const spread = objectValue(context, property.argument, name, seen)
+      if (!spread.known || spread.value !== null) result = spread
+    } else if (!property.computed && (property.key.name ?? property.key.value) === name) {
+      result = { known: true, value: property.value }
+    }
+  }
+  return result
+}
+
+const conditionalObjectValue = (context, node, name, seen) => {
+  if (seen.has(node)) return { known: false, value: null }
+  const visited = new Set(seen).add(node)
+  const values = [node.consequent, node.alternate].map((branch) => objectValue(context, branch, name, new Set(visited)))
+  return { known: values.every((value) => value.known && value.value === null), value: null }
+}
+
+/** The effective prop, respecting JSX spread order; unknown later spreads cannot prove a value. */
+export const propOf = (context, opening, name) => {
+  let result = { known: true, value: null }
+  for (const entry of opening.attributes) {
+    if (entry.type === "JSXSpreadAttribute") {
+      const spread = objectValue(context, entry.argument, name)
+      if (!spread.known || spread.value !== null) result = spread
+    } else if (entry.name.name === name) result = { known: true, value: attributeValue(entry), present: true }
+  }
+  return result
+}
+
+/** A statically proven string prop, or null for missing/unknown values. */
+export const textProp = (context, opening, name) => {
+  const prop = propOf(context, opening, name)
+  return prop.known ? stringOf(resolveLocal(context, prop.value)) : null
+}
+
+/** The source spelling is semantic evidence for an icon or action whose translated label is dynamic. */
+export const semanticText = (context, opening) => {
+  const values = ["source", "icon", "label", "aria-label", "id", ...ACTION_PROPS].map((name) => {
+    const prop = propOf(context, opening, name)
+    return prop.value ? context.sourceCode.getText(prop.value) : ""
+  })
+  return values.join(" ")
+}
+
+/** The right-cluster role and the Grammar kind that must draw it. */
+export const clusterRole = (context, opening, name) => {
+  if (name === "Switch") return "theme"
+  if (name === "AvatarButton") return "account"
+  const text = semanticText(context, opening)
+  if (/language|locale|translate/i.test(text)) return "language"
+  if (/notification|bell/i.test(text)) return "notifications"
+  if (/account|avatar|profile/i.test(text)) return "account"
+  if (/theme|darkmode|color.?mode/i.test(text)) return "theme"
+  return null
+}

package/lib/why.mjs

@@ -29,6 +29,31 @@ export const why = {
     en: "`<file>` adds horizontal wrapper padding to a Grammar list or its section caption, stacking the content inset.",
     fix: "Remove the wrapper padding and use ListBox inset=\"panel\" so headers, captions and rows share the panel content edge.",
   },
+  "app-shell-frame": {
+    code: "FE_APP_SHELL_FRAME",
+    en: "The app frame must use Grammar WorkspaceShell with its fixed viewport.",
+    fix: "Compose WorkspaceShell viewport=\"fixed\" and supply its header, navigation and primary slots.",
+  },
+  "no-shell-bottom-tabs": {
+    code: "FE_APP_SHELL_BOTTOM_TABS",
+    en: "Bottom tab navigation replaces the required mobile sidebar drawer.",
+    fix: "Use WorkspaceShell navigationDrawer and Sidebar presentation=\"drawer\".",
+  },
+  "navbar-control-size": {
+    code: "FE_NAVBAR_CONTROL_SIZE",
+    en: "A navbar control does not use Grammar's shared control height.",
+    fix: "Set size=\"control\" on every visible bar control.",
+  },
+  "navbar-cluster": {
+    code: "FE_NAVBAR_CLUSTER",
+    en: "Navbar action component kinds or order differ from the app-shell canon.",
+    fix: "Compose Language IconButton, theme Switch, notification IconButton and account AvatarButton in that order.",
+  },
+  "no-navbar-create": {
+    code: "FE_NAVBAR_CREATE",
+    en: "A create action is composed into the global navbar.",
+    fix: "Move the create action to the page that owns it.",
+  },
   "no-env-outside-config": {
     code: "FE_ENV_OWNER",
     en: "`<file>` reads an environment variable. Only `modules/config` may read env.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.4.40",
+  "version": "8.4.41",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -23,7 +23,7 @@ pins:
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-canon-fe (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
-    version: 0.12.0
+    version: 0.12.1
     group: starci
     install: registry
     side: fe
@@ -37,7 +37,7 @@ pins:
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.40
+    version: 8.4.41
     group: starci
     install: registry
     side: fe

package/runtime/knowledge/hfs/slots.yaml

@@ -251,8 +251,8 @@ ruleParams:
       socket.io: [platform/realtime]
       graphql-subscriptions: [platform/realtime]
       graphql-ws: [platform/realtime]
-      "@socket.io/postgres-adapter": [platform/realtime]   # the stateless socket.io adapter of a scaled lite back end
-      "@socket.io/redis-adapter": [platform/realtime]      # the sharded socket.io adapter of a scaled full back end
+      "@socket.io/postgres-adapter": [platform/realtime]   # the stateless socket.io adapter of a scaled lite back end without Redis
+      "@socket.io/redis-adapter": [platform/realtime]      # the sharded socket.io adapter of a scaled back end on the declared Redis
       pg: [platform/realtime]                              # the LISTEN connection of the Postgres hub; every other query goes through TypeORM
     # R87 BE_CQRS_SHAPE no-event-bus: the in-process event vocabulary the rule refuses. `imports` maps a module
     # specifier to the member names that are an in-process event; `[]` flags the package itself (its emitter packages
@@ -371,11 +371,11 @@ ruleParams:
     # ruling:R212/case-10 (R212 HFS_BACKING_UNDECLARED / HFS_BACKING_UNUSED, R276 STACKS_LITE_SELFHOSTED_DB): THE backing services a back
     # end may declare in hfs.json sides.be.backing. `clients` are the libraries that consume the service: one of them as a dependency
     # is its consumer, and under lite none of them may be a dependency while the service is undeclared. `patterns` are the declared
-    # patterns that need the service. `images` are the image repositories (the last path segment) a lite stack runs it from; an
-    # undeclared one is refused there.
+    # patterns that need the service. `images` are the image repositories (the last path segment) a stack runs it from.
+    # `editions` limits admission: owner:lite-vector-is-pgvector keeps vector search on Supabase pgvector in lite.
     backing:
       redis: {clients: [bullmq, "@nestjs/bullmq", bull, "@nestjs/bull", ioredis, redis, "@keyv/redis", cache-manager-redis-yet, cache-manager-ioredis-yet, "@socket.io/redis-adapter"], patterns: [queue, fenced-job], images: [redis, redis-stack, redis-stack-server]}
-      qdrant: {clients: ["@qdrant/js-client-rest", "@qdrant/qdrant-js"], patterns: [], images: [qdrant]}
+      qdrant: {clients: ["@qdrant/js-client-rest", "@qdrant/qdrant-js"], patterns: [], images: [qdrant], editions: [full]}
     # Edition lite (ruleParams(manifest, 'be', 'lite') merges these keys over the base; a map merges one level deep): the schema
     # authority is the Supabase migration tree (supabase/migrations/*.sql, forward-only), so a lite back end holds no TypeORM
     # migration or entity under be/ (R34/R35 read schemaAuthority; be.persistence's lite overlay allows neither). The unit roles,
@@ -389,6 +389,8 @@ ruleParams:
       schemaAuthority: supabase
       infraOwners:
         kafkajs: []
+        "@qdrant/js-client-rest": []
+        "@qdrant/qdrant-js": []
 
 slots:
 
@@ -764,7 +766,7 @@ slots:
   - id: app.starcistacks
     since: 3.1.0
     profiles: [app]
-    editionWhy: "owner:lite-production-swarm: lite requires declared docker-swarm production with Supabase backing; full also admits Compose development, Kubernetes and Terraform."
+    editionWhy: "owner:lite-production-swarm: lite requires declared docker-swarm production with Supabase backing; owner:dev-docker-prod-swarm keeps dependencies in Docker Linux containers in dev and the app and dependencies on Swarm in prod except hosted Supabase."
     exemplifiedBy:
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/, edition: lite}

package/runtime/modules/goal/source-phrases.yaml

@@ -0,0 +1,95 @@
+# ============================================================================
+# modules/goal/source-phrases.yaml
+#
+# The Vietnamese phrase lists runtime source matches against owner or product
+# text (scripts/lib/source-phrases.mjs). This is DATA for matchers, never
+# owner-visible messages - those live in modules/i18n/messages/ (i18n.mjs).
+# Each list holds the Vietnamese alternatives one matcher adds to its English
+# pattern (a regex fragment when the source pattern used regex syntax, a plain
+# word otherwise); the consumer is named above each group. The leaf keys are
+# declared Vietnamese fields (scripts/lib/language.mjs DECLARED_VIETNAMESE_FIELDS),
+# like the signal phrase lists of archetypes.yaml.
+# ============================================================================
+
+schema: starci/module-goal-source-phrases@1
+
+phrases:
+
+  # packages/eslint/fe/lib/app-shell-create.mjs - localized labels of create actions prohibited in the navbar.
+  appShell:
+    product: ['Tạo mới', 'tao moi']
+
+  # scripts/agent/bias.mjs extractRoutingBias - the routing markers an owner
+  # prompt types before a pool alias. Regex alternatives; syllables join with \s*.
+  bias:
+    prefer: ['ưu\s*tiên', 'uu\s*tien', 'u-u\s*tien', prefer]
+    avoid: ['không\s*dùng', 'khong\s*dung', 'tránh', 'tranh', avoid, 'don''t\s+use']
+    only: ['chỉ\s*dùng', 'chi\s*dung', 'only\s+use', only]
+
+  # scripts/checks/check-guidance-commands.mjs excusedBy - a negation or a
+  # refusal verb, in either language, excuses a refused command in guidance.
+  guidance:
+    negation: ['không', 'đừng', 'cấm', 'tránh']
+    refused: ['bị chặn', 'bị từ chối']
+
+  # scripts/kernel/ask-server.mjs drawReplyDecision - a Telegram reply made only
+  # of accept words (plus optionally "golden") accepts a drawing. accept is a
+  # word list; golden holds regex alternatives.
+  drawReply:
+    accept: ['duyệt', 'đồng', 'ý', 'chấp', 'nhận', 'được', 'đẹp', 'rồi', 'nhé', 'nha', 'ừ']
+    golden: ['(?:đặt làm |làm )?(?:mẫu|ảnh|hình) chuẩn', 'làm mẫu']
+
+  # scripts/kernel/progress-rca.mjs causesOf - the blocker/report phrases of
+  # each failure cause, whichever language the report was written in.
+  rca:
+    missingPaths: ['không tồn tại', 'vắng mặt', '0 tệp', 'quét 0']
+    grantTooNarrow: ['ngoài owned', 'ngoài allowlist', 'ngoài grant', 'ngoài own']
+    toolTimeout: ['30 giây', 'ngắt sau']
+    testGap: ['kiểm thử hồi quy']
+    checkerUnavailable: ['không khả dụng']
+
+  # scripts/supervisor/owed.mjs - notes addressed to the supervisor, conditions
+  # only the owner can meet, and the label heuristics.
+  owed:
+    supervisorVerbs: ['cho', 'cần', 'chờ', 'đợi', 'phản hồi(?: của)?', 'hỏi']
+    ownerWord: ['chủ sở hữu']
+    orWord: ['hoặc']
+    beyondAuthority: ['ngoài thẩm quyền']
+    ownerOnly: ['bàn giao', 'mật khẩu', 'thanh toán']
+    workerDied: ['không nộp report']
+    contractConflict: ['mâu thuẫn']
+    decision: ['ủy quyền', 'uỷ quyền', '\bquyết\b']
+
+  # scripts/work/draw-feedback.mjs - the owner-note classification words
+  # (GOLDEN_WORDS, product-direction, grammar, knowledge).
+  drawNote:
+    golden: ['mẫu chuẩn', 'ảnh chuẩn', 'hình chuẩn']
+    product: ['luôn', 'không bao giờ', 'mọi', 'tất cả', 'từ nay', 'màu', 'thương hiệu', 'phông', 'chữ', 'khoảng cách', 'bo góc', 'đổ bóng', 'biểu tượng']
+    grammar: ['thành phần mới', 'biến thể', 'thiếu thành phần', 'không có thành phần']
+    knowledge: ['kiến thức', 'quy tắc chung', 'nguyên tắc chung']
+
+  # scripts/work/draw/draw-quality.mjs - internal-copy jargon, actor and
+  # success words a render source's visible copy may carry in either language.
+  drawCopy:
+    sourceLabel: ['nguồn']
+    internalVocabulary: ['nguồn hiện tại', 'hệ thống lõi']
+    actor: ['người dùng', 'chủ']
+    success: ['đã cài', 'đang hoạt động', 'sẵn sàng', 'đã xác nhận', 'thành công']
+
+  # scripts/work/ui-archetype.mjs archetypeOf - surface title/intent words in
+  # either language that derive an archetype when ui.archetype is absent.
+  uiArchetype:
+    wizard: ['thiết lập', 'các bước']
+    form: ['chỉnh sửa', 'tạo mới', 'cài đặt', 'đăng nhập']
+    dashboard: ['tổng quan', 'trang chủ']
+
+  # scripts/work/grammar-proposal.mjs MD_FIELDS - the section markers of a
+  # markdown grammar proposal in either language.
+  proposal:
+    gap: ['không có', 'thiếu']
+    anatomy: ['giải phẫu']
+
+  # scripts/lib/redact.mjs - the verification-code label a secret value may sit
+  # behind (regex alternative; a separator between syllables is [ _-]?).
+  redact:
+    otpLabel: ['mã[ _-]?(?:otp|xác[ _-]?(?:thực|minh))']

package/runtime/scripts/hfs/architecture/typescript.mjs

@@ -311,7 +311,7 @@ const packageIndexSource = workspace => {
 };
 
 /** The source entry a workspace import resolves to without a build: its export targets mapped back to source, `src/index.ts` for the package root. */
-function workspaceSourceEntry(ts, workspace, specifier) {
+export function workspaceSourceEntry(ts, workspace, specifier) {
   if (!workspace.workspace || !workspace.name || !sameOrUnder(specifier, workspace.name)) return null;
   const isRoot = specifier === workspace.name;
   const candidates = isRoot && !workspace.exports ? manifestEntryTargets(workspace.manifest) : exportCandidates(workspace, specifier);

package/runtime/scripts/hfs/declaration-slots.mjs

@@ -2,6 +2,7 @@
 // (a slot with `appKind`) and by declared pattern (a slot with `pattern: <name>` is enabled by `sides.<side>.patterns: [<name>]`, one
 // mechanism for pattern slots). A cross-cutting pattern can instead be owned by the side's canonical proof scenario catalog.
 // slots.mjs asks this file to judge a side's lists and to say whether a slot is enabled for a repository.
+import { judgedInEdition } from './edition-slots.mjs';
 
 /** The problems of a side's `optionalSlots` and `patterns` against the manifest. */
 export function optionalSlotProblems(manifest, side, s) {
@@ -24,11 +25,12 @@ export function optionalSlotProblems(manifest, side, s) {
   return bad;
 }
 
-/** The problems of a side's `backing` list: every name is a backing service of ruleParams.be.backing (ruling:R212/case-10). */
-export function backingProblems(manifest, side, s) {
-  const services = Object.keys(manifest.ruleParams?.be?.backing ?? {});
+/** The problems of a side's `backing` list: every name is admitted by ruleParams.be.backing in this edition. */
+export function backingProblems(manifest, side, s, edition = 'full') {
+  const services = Object.entries(manifest.ruleParams?.be?.backing ?? {})
+    .filter(([, entry]) => judgedInEdition(entry, edition)).map(([name]) => name);
   return (s.backing ?? []).filter((name) => !services.includes(name))
-    .map((name) => `sides.${side}.backing names ${name}, which is not one of ruleParams.be.backing (${services.join(', ')})`);
+    .map((name) => `sides.${side}.backing names ${name}, which is not admitted in edition ${edition} by ruleParams.be.backing (${services.join(', ')})`);
 }
 
 /** The problems of the shape of a side's `patterns` list (a unique list of pattern names). */

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -6,13 +6,15 @@ import { paramNamesOk } from './param-names.mjs';
 import { kindParamProblems, scenarioProblem } from './declaration-slots.mjs';
 import { NAME, namedMapValid, PACKAGE_NAME, roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
 import { byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
+import { ruleEditionProblems } from './edition-slots.mjs';
 
 const PROFILES = ['be', 'fe'];
 const BE_OWN = ['infraOwners', 'eventBus', 'specDoubles', 'paramNames', 'suffixes', 'bannedSuffixes', 'contractShape', 'unitRoles', 'logicRoles', 'valueRoles', 'thinRoles', 'patternScenarios', 'kindPatterns', 'addKinds', 'backing'];
-const backingEntryOk = (entry) => isPlainObject(entry) && Object.keys(entry).sort(byCodeUnit).join() === 'clients,images,patterns'
+const backingEntryOk = (entry) => isPlainObject(entry) && Object.keys(entry).every((key) => ['clients', 'images', 'patterns', 'editions'].includes(key))
   && nonemptyUniqueList(entry.clients, (name) => PACKAGE_NAME.test(String(name)))
   && Array.isArray(entry.patterns) && entry.patterns.every((name) => NAME.test(String(name))) && new Set(entry.patterns).size === entry.patterns.length
-  && nonemptyUniqueList(entry.images, (name) => PACKAGE_NAME.test(String(name)));
+  && nonemptyUniqueList(entry.images, (name) => PACKAGE_NAME.test(String(name)))
+  && ruleEditionProblems(entry, 'backing service').length === 0;
 const FORM_NAMES = new Set(['call', 'new', 'curried', 'object', 'primitive', 'array']);
 const blockOk = (v) => isPlainObject(v) && Number.isInteger(v.lines) && v.lines >= 2 && Number.isInteger(v.tokens) && v.tokens >= 1 && Object.keys(v).length === 2;
 const fileLinesOk = (v) => isPlainObject(v) && Number.isInteger(v.soft) && v.soft >= 1 && typeof v.hardGrowth === 'boolean' && Object.keys(v).length === 2;
@@ -51,7 +53,7 @@ function beSpecificProblems(be, manifest) {
   const eventBus = be.eventBus;
   if (!isPlainObject(eventBus) || Object.keys(eventBus).sort(byCodeUnit).join() !== 'classes,imports' || !memberMap(eventBus.imports, true) || !memberMap(eventBus.classes, false)) bad.push('ruleParams.be.eventBus must be {imports: {<module>: [unique PascalCase members]}, classes: {<module>: [non-empty unique PascalCase classes]}}');
   if (!paramNamesOk(be.paramNames)) bad.push('ruleParams.be.paramNames must be a non-empty list of unique {type | typeSuffix, names, nameSuffix?} entries');
-  if (!namedMapValid(be.backing, backingEntryOk)) bad.push('ruleParams.be.backing must map a backing service name to {clients: [unique package names], patterns: [unique pattern names], images: [unique image repositories]}');
+  if (!namedMapValid(be.backing, backingEntryOk)) bad.push('ruleParams.be.backing must map a backing service name to {clients: [unique package names], patterns: [unique pattern names], images: [unique image repositories], editions?: [unique known editions]}');
   if (!roleList(be.suffixes)) bad.push('ruleParams.be.suffixes must be a non-empty list of unique kebab-case role suffixes');
   if (!roleList(be.bannedSuffixes)) bad.push('ruleParams.be.bannedSuffixes must be a non-empty list of unique kebab-case suffixes');
   else if (roleList(be.suffixes) && be.suffixes.some((x) => be.bannedSuffixes.includes(x))) bad.push('ruleParams.be.suffixes and bannedSuffixes must be disjoint');

package/runtime/scripts/hfs/slot-side-problems.mjs

@@ -19,9 +19,9 @@ function requiredAppKindProblems(manifest, side, declaration) {
 }
 
 /** Problems for one side declaration, preserving the manifest's checks and their order. */
-export function sideProblems(manifest, side, declaration) {
+export function sideProblems(manifest, side, declaration, edition = 'full') {
   const bad = sideAppKindProblems(manifest, side, declaration.apps);
-  bad.push(...optionalSlotProblems(manifest, side, declaration), ...backingProblems(manifest, side, declaration));
+  bad.push(...optionalSlotProblems(manifest, side, declaration), ...backingProblems(manifest, side, declaration, edition));
   for (const read of declaration.reads ?? []) if (!manifest.sides[side].reads.includes(read)) bad.push(`sides.${side}.reads names ${read}; ${side} may read only ${manifest.sides[side].reads.join(', ') || 'nothing of the other side'}`);
   bad.push(...requiredAppKindProblems(manifest, side, declaration));
   return bad;

package/runtime/scripts/hfs/slots.mjs

@@ -140,7 +140,7 @@ export function resolveRepoDeclaration(manifest, declaration, { file = HFS_DECLA
   if (declaration.kind === RUNTIME_KIND) return runtimeDeclaration(manifest, declaration, file, side);
   const { edition, known, valid } = declarationEdition(manifest, declaration);
   if (!valid) fail('HFS_EDITION_INVALID', `hfs.json edition is ${JSON.stringify(declaration.edition)}; the editions this manifest knows are ${known.join(', ')} (absent means full)`, { file, edition: declaration.edition });
-  const bad = PROFILES.flatMap((name) => sideProblems(manifest, name, declaration.sides[name]));
+  const bad = PROFILES.flatMap((name) => sideProblems(manifest, name, declaration.sides[name], edition));
   if (bad.length) declarationInvalid(bad, file);
   if (side !== null && !PROFILES.includes(side)) fail('HFS_DECLARATION_INVALID', `${side} is not a side of an app (be, fe)`, { file, side });
   // A provider declared on any connection enables the provider slots of every profile (a fe side declares none): each view carries the union.

package/runtime/scripts/lib/secret-patterns.mjs

@@ -56,6 +56,45 @@ const ASSIGNED_UNQUOTED = new RegExp(
   SECRET_NAME + String.raw`(?!['"\`]|env\()([A-Za-z0-9_+=-]{12,})(?![A-Za-z0-9_+=.(\[-])`,
 );
 
+const SQL_ROLE_HEAD = /^\s*(?:CREATE|ALTER)\s+(?:ROLE|USER)\b/i;
+const SQL_STATEMENT = /[^;\r\n]+/g;
+const SQL_PASSWORD_WORD = /\bPASSWORD\s+/gi;
+const PSQL_PASSWORD_REFERENCE = /:(?:'[A-Za-z_]\w*'|"[A-Za-z_]\w*")/y;
+const SQL_PASSWORD_QUOTED = /'([^'\r\n]{12,})'/y;
+const ASSIGNED_PLACEHOLDER = /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i;
+const SQL_PASSWORD_RULE = { name: 'assigned-secret' };
+
+/** Read only password tokens in role statements; sticky value readers never retry at later character positions. */
+function sqlPasswordParts(file, text) {
+  const references = [], literals = [];
+  if (!/\.(?:sql|sh)(?:\.tpl)?$/i.test(file ?? '')) return { references, literals };
+  for (const statement of text.matchAll(SQL_STATEMENT)) {
+    if (!SQL_ROLE_HEAD.test(statement[0])) continue;
+    for (const keyword of statement[0].matchAll(SQL_PASSWORD_WORD)) {
+      const start = statement.index + keyword.index + keyword[0].length;
+      PSQL_PASSWORD_REFERENCE.lastIndex = start;
+      SQL_PASSWORD_QUOTED.lastIndex = start;
+      const reference = PSQL_PASSWORD_REFERENCE.exec(text);
+      const literal = SQL_PASSWORD_QUOTED.exec(text);
+      if (reference) references.push([start, start + reference[0].length]);
+      if (literal) literals.push(literal[1]);
+    }
+  }
+  return { references, literals };
+}
+
+/** Psql variable references retain their positions while the assignment heuristic sees no literal value there. */
+function maskedReferences(text, references) {
+  const parts = [];
+  let cursor = 0;
+  for (const [start, end] of references) {
+    parts.push(text.slice(cursor, start), ' '.repeat(end - start));
+    cursor = end;
+  }
+  parts.push(text.slice(cursor));
+  return parts.join('');
+}
+
 const NAME_WORD = (word, tail) => new RegExp(`^${NAME_REST}${SEGMENT_BEFORE}(?:${word})${tail}`);
 const SECRET_NAME_TEST = NAME_WORD(SECRET_WORD, String.raw`(?:[_\-.]|[A-Z]|[^A-Za-z0-9_$]|$)`);
 const BENIGN_TAIL_TEST = NAME_WORD(BENIGN_WORD, '$');
@@ -84,27 +123,37 @@ export const SECRET_PATTERNS = [
   // A spec file's keyword-assigned values are test inputs (a spec's sign-in
   // form password and a mocked accessToken once refused a push): the heuristic skips spec files too.
   // A SCREAMING_SNAKE quoted value in source is a public code (an enum member whose value is an upper-case code), not a credential.
-  { name: 'assigned-secret', re: ASSIGNED_QUOTED, sourceCode: /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/, placeholder: /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i,
+  { name: 'assigned-secret', re: ASSIGNED_QUOTED, sourceCode: /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/, placeholder: ASSIGNED_PLACEHOLDER,
     skipFile: /\.(?:spec|test|e2e-spec)\.[cm]?[jt]sx?$/ },
   // An unquoted value in TypeScript or JavaScript source is an identifier or a type (`token: InjectionToken`,
   // `MODULE_OPTIONS_TOKEN: DATABASE_OPTIONS_TOKEN`), never a literal; the unquoted form is the dotenv, compose and toml shape.
-  { name: 'assigned-secret', re: ASSIGNED_UNQUOTED, placeholder: /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i,
+  { name: 'assigned-secret', re: ASSIGNED_UNQUOTED, placeholder: ASSIGNED_PLACEHOLDER,
     skipFile: /\.(?:spec|test|e2e-spec)\.[cm]?[jt]sx?$|\.[cm]?[jt]sx?$/ },
 ];
 
 
-/** The names of the patterns one line of `file` matches (never the value). A stand-in value and a spec file's keyword assignment are no hit. */
-export function secretHits(file, text) {
-  const names = [];
+/** Matched pattern metadata stays private; callers receive pattern names, never credential values. */
+function matchingSecretPatterns(file, text) {
+  const matches = [];
+  const sql = sqlPasswordParts(file, text);
+  const assignments = maskedReferences(text, sql.references);
   for (const rule of SECRET_PATTERNS) {
     if (rule.skipFile?.test(file ?? '')) continue;
-    const hit = rule.re.exec(text);
-    if (hit && rule.sourceCode?.test(hit[1] ?? '') && /\.[cm]?[jt]sx?$/.test(file ?? '')) continue;
-    if (hit && !rule.placeholder?.test(hit[1] ?? '')) names.push(rule.name);
+    const hit = rule.re.exec(rule.name === 'assigned-secret' ? assignments : text);
+    if (hit && !rule.placeholder?.test(hit[1] ?? '')) matches.push({ rule, value: hit[1] ?? '' });
   }
-  return names;
+  for (const value of sql.literals) if (!ASSIGNED_PLACEHOLDER.test(value)) matches.push({ rule: SQL_PASSWORD_RULE, value });
+  return matches;
 }
 
+/** The strict secret-shape judgement used by Work custody, including uppercase keyword-assigned credentials. */
+export const secretPatternHits = (file, text) => matchingSecretPatterns(file, text).map(({ rule }) => rule.name);
+
+/** The source judgement also admits public SCREAMING_SNAKE codes; every provider shape remains refused. */
+export const secretHits = (file, text) => matchingSecretPatterns(file, text)
+  .filter(({ rule, value }) => !(rule.sourceCode?.test(value) && /\.[cm]?[jt]sx?$/.test(file ?? '')))
+  .map(({ rule }) => rule.name);
+
 const BADGE_BEGIN = '<!-- >>> starci app sync (managed block; do not edit) >>> -->';
 const BADGE_END = '<!-- <<< starci app sync <<< -->';