@starci/eslint-canon-fe 9.10.0 → 9.11.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 9.11.0 - 2026-11-03
+
+- Changed: `modules/auth` holds the front-end transport rules like `modules/api`: no auth door file takes axios or `fetch`, and no file keeps module-level mutable state (the access token lives in the `@starci/auth` client); the stack concern `auth` names `@starci/auth`.
+
 ## 9.10.0
 
 - Added: `starci-fe/directive-first` (R369, `FE_DIRECTIVE_FIRST`) at error: a `"use client"` or `"use server"` directive is the first statement of its module; below an import it does nothing and `next build` refuses the file.

package/dist/fe-stack.d.ts

@@ -4,6 +4,11 @@ import { type Rules, type Recommended } from "./lib/rule.js";
  * No import (static, re-export, dynamic or `require`) of a package the fe-stack catalog forbids.
  */
 export declare const feStackImport: import("./lib/rule.js").Rule<"forbidden", []>;
+/**
+ * The SWR extension points belong to `@starci/next-data`: `pollingRestart` is the one middleware and `createViewerCache` the one
+ * binding of the viewer's cache, so an app that imports the `Middleware` or `ScopedMutator` type is writing a second one.
+ */
+export declare const swrExtensionFromPackage: import("./lib/rule.js").Rule<"own", []>;
 /** The rules this law contributes to the plugin. */
 export declare const rules: Rules;
 /** Every rule is an error: a second library for a concern is the defect, not a style. */

package/dist/fe-stack.js

@@ -59,9 +59,43 @@ export const feStackImport = defineRule({
         };
     },
 });
+/** The SWR types an app needs only to write its own middleware or to bind the writes of a viewer's cache by hand. */
+const PACKAGE_OWNED_SWR_TYPES = new Set(["Middleware", "ScopedMutator"]);
+/**
+ * The SWR extension points belong to `@starci/next-data`: `pollingRestart` is the one middleware and `createViewerCache` the one
+ * binding of the viewer's cache, so an app that imports the `Middleware` or `ScopedMutator` type is writing a second one.
+ */
+export const swrExtensionFromPackage = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "An app writes no SWR middleware and no cache binding of its own." },
+        schema: [],
+        messages: {
+            own: "`{{name}}` of `swr` is the type of an SWR extension the stack already ships. Use `pollingRestart`, `viewerSwrConfig` and `createViewerCache` of `@starci/next-data` (FE-DATA-SWR, FE-DATA-KEY) instead of writing a second one.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        return {
+            ImportDeclaration(node) {
+                if (node.source.value !== "swr")
+                    return;
+                for (const specifier of node.specifiers) {
+                    if (specifier.type !== "ImportSpecifier")
+                        continue;
+                    const name = specifier.imported.type === "Identifier" ? specifier.imported.name : String(specifier.imported.value);
+                    if (PACKAGE_OWNED_SWR_TYPES.has(name))
+                        context.report({ node: specifier, messageId: "own", data: { name } });
+                }
+            },
+        };
+    },
+});
 /** The rules this law contributes to the plugin. */
 export const rules = {
     "fe-stack-import": feStackImport,
+    "swr-extension-from-package": swrExtensionFromPackage,
 };
 /** Every rule is an error: a second library for a concern is the defect, not a style. */
 export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]));

package/dist/lib/scope.d.ts

@@ -39,14 +39,6 @@ export declare const isProductSource: (context: AnyContext) => boolean;
 export declare const isComponentFile: (context: AnyContext) => boolean;
 /** True when the given file (an absolute or repo-relative name, e.g. where an import resolves to) sits in a component layer of slot `fe.components` or `fe.package.ui`. */
 export declare const isComponentPath: (context: AnyContext, file: string) => boolean;
-/**
- * The one auth door of the session issuer's client: `modules/auth/auth-door.ts` (slot `fe.modules.auth`). It alone calls the app's
- * own back-end auth doors (login, signup, refresh, logout, password reset, resend verification) with the REST client, credentials
- * included; every other file of `modules/auth` and every other module stays outside the transport.
- */
-export declare const isAuthDoor: (context: AnyContext) => boolean;
-/** The in-memory access-token store of `modules/auth` (`modules/auth/token-store.ts`), the one module-level mutable state the auth client keeps. */
-export declare const isAuthTokenStore: (context: AnyContext) => boolean;
 /** The one place that may read the environment: slot `fe.modules.config`. */
 export declare const isConfigModule: (context: AnyContext) => boolean;
 /**

package/dist/lib/scope.js

@@ -48,16 +48,6 @@ export const isComponentPath = (context, file) => {
     const found = hfsOf(context).classify(file);
     return (found.slot === "fe.components" || found.slot === "fe.package.ui") && found.kind !== undefined;
 };
-/** The base name of the linted file. */
-const baseNameOf = (context) => (context.filename || context.getFilename()).split(/[\\/]/).at(-1) ?? "";
-/**
- * The one auth door of the session issuer's client: `modules/auth/auth-door.ts` (slot `fe.modules.auth`). It alone calls the app's
- * own back-end auth doors (login, signup, refresh, logout, password reset, resend verification) with the REST client, credentials
- * included; every other file of `modules/auth` and every other module stays outside the transport.
- */
-export const isAuthDoor = (context) => inSlot(context, "fe.modules.auth") && baseNameOf(context) === "auth-door.ts";
-/** The in-memory access-token store of `modules/auth` (`modules/auth/token-store.ts`), the one module-level mutable state the auth client keeps. */
-export const isAuthTokenStore = (context) => inSlot(context, "fe.modules.auth") && baseNameOf(context) === "token-store.ts";
 /** The one place that may read the environment: slot `fe.modules.config`. */
 export const isConfigModule = (context) => inSlot(context, "fe.modules.config");
 /**

package/dist/lib/why.d.ts

@@ -392,6 +392,11 @@ export declare const why: {
         en: string;
         fix: string;
     };
+    "swr-extension-from-package": {
+        code: string;
+        en: string;
+        fix: string;
+    };
     "fe-stack-import": {
         code: string;
         en: string;

package/dist/lib/why.js

@@ -392,6 +392,11 @@ export const why = {
         en: "`<file>` starts a recurring timer that reads the wall clock for live time labels.",
         fix: "Render Grammar RelativeTime with the target dateTime, locale and mode; its shared ticker owns live relative time and countdown updates.",
     },
+    "swr-extension-from-package": {
+        code: "FE_STACK_FORBIDDEN",
+        en: "`<file>` imports the `Middleware` or `ScopedMutator` type of `swr`, so it writes an SWR middleware or a cache binding the stack already ships.",
+        fix: "List `viewerSwrConfig` (it carries `pollingRestart`) in the app's SWRConfig and write through the `createViewerCache()` instance of `@starci/next-data`.",
+    },
     "fe-stack-import": {
         code: "FE_STACK_FORBIDDEN",
         en: "`<file>` imports `<what>`, a package or scoped package family the front-end stack forbids.",

package/dist/transport.d.ts

@@ -19,6 +19,7 @@
  * standing in for a status.
  */
 import { type Recommended, type Rules } from "./lib/rule.js";
+/** The HTTP methods of the REST client whose first argument is the request path. */
 /**
  * `fetch` is reached only in the API layer, each canonical transport library only in its home, and no other HTTP library exists.
  *
@@ -28,7 +29,7 @@ import { type Recommended, type Rules } from "./lib/rule.js";
  * `socket.io-client` only by `hooks/socketio/`. Native `WebSocket` is refused everywhere, including the API layer.
  * Every other file reaches the back end through an SWR hook over an operation.
  */
-export declare const fetchOnlyInApiClient: import("./lib/rule.js").Rule<"library" | "outside" | "channel" | "websocket" | "xhr" | "placed" | "authDoor", []>;
+export declare const fetchOnlyInApiClient: import("./lib/rule.js").Rule<"library" | "outside" | "channel" | "websocket" | "xhr" | "placed", []>;
 /** Every `fetch` of the API layer (a custom fetch handed to the Apollo http link, a raw call) carries an abort signal, so a hung backend cannot hang a reader. */
 export declare const clientFetchHasSignal: import("./lib/rule.js").Rule<"signal", []>;
 /** No module-level mutable state in the API layer: a token or locale in a `let` leaks across requests. */

package/dist/transport.js

@@ -23,7 +23,7 @@ import { isNode } from "./lib/ast.js";
 import { hfsOf } from "./lib/hfs.js";
 import { forbiddingConcern, packageNameOf } from "./lib/fe-stack.js";
 import { defineRule } from "./lib/rule.js";
-import { globalReferences, inSlot, isApiClient, isApiLayer, isApiRest, isAuthDoor, isAuthTokenStore, isOutcomeModule } from "./lib/scope.js";
+import { globalReferences, inSlot, isApiClient, isApiLayer, isApiRest, isOutcomeModule } from "./lib/scope.js";
 import { typed } from "./lib/types.js";
 /**
  * The canonical transport libraries and the one place each may be imported (fe-stack graphql, rest and realtime): Apollo in
@@ -31,7 +31,7 @@ import { typed } from "./lib/types.js";
  */
 const PLACED_TRANSPORTS = new Map([
     ["@apollo/client", { where: "the API layer (`modules/api`)", allowed: (context) => isApiLayer(context) }],
-    ["axios", { where: "the REST calls of the API layer (`modules/api/rest/`) and the auth door (`modules/auth/auth-door.ts`)", allowed: (context) => isApiRest(context) || isAuthDoor(context) }],
+    ["axios", { where: "the REST calls of the API layer (`modules/api/rest/`)", allowed: (context) => isApiRest(context) }],
     ["socket.io-client", { where: "`hooks/socketio/`", allowed: (context) => inSlot(context, "fe.hooks.socketio") }],
     ["graphql-ws", { where: "the Apollo clients of the API layer (`modules/api/graphql/clients/`, or the shared api package's `graphql/clients/`)", allowed: (context) => isApiClient(context) }],
 ]);
@@ -140,26 +140,6 @@ const transportUses = (context) => {
 };
 // -- FE-TRANSPORT-1 --------------------------------------------------------------------------------
 /** The HTTP methods of the REST client whose first argument is the request path. */
-const REST_METHODS = new Set(["get", "post", "put", "patch", "delete", "request"]);
-/** The static text of a path argument (a literal, or a template's fixed parts), or null when nothing about it is fixed. */
-const staticPath = (node) => {
-    if (node?.type === "Literal" && typeof node.value === "string")
-        return node.value;
-    if (node?.type === "TemplateLiteral")
-        return node.quasis.map((quasi) => quasi.value.cooked ?? "").join("<expression>");
-    return null;
-};
-/** A path segment `auth/`: the app's own back-end auth doors. */
-const AUTH_DOOR_PATH = /(?:^|\/)auth\//;
-/** In the auth door, a REST call whose path the rule can read must name an `/auth/` door; a fully dynamic path is left to review. */
-const judgeAuthDoorCall = (context, node) => {
-    if (node.callee.type !== "MemberExpression" || node.callee.computed || node.callee.property.type !== "Identifier" || !REST_METHODS.has(node.callee.property.name))
-        return;
-    const path = staticPath(node.arguments[0]);
-    if (path === null || AUTH_DOOR_PATH.test(path))
-        return;
-    context.report({ node, messageId: "authDoor", data: { call: `.${node.callee.property.name}()`, path } });
-};
 /**
  * `fetch` is reached only in the API layer, each canonical transport library only in its home, and no other HTTP library exists.
  *
@@ -180,13 +160,11 @@ export const fetchOnlyInApiClient = defineRule({
             library: "`{{name}}` is a second HTTP transport. The front end talks to its back end through Apollo (`modules/api/graphql`) and the axios REST calls (`modules/api/rest`); another library is another set of timeout, retry and error rules. Use an operation of `modules/api`.",
             placed: "`{{name}}` is imported outside {{where}}, the one place the front-end stack gives it. A component or hook that holds the transport itself skips the link chain (token, locale, retry, timeout) and the one result vocabulary. Call an operation of `modules/api` through its SWR hook (`hooks/swr/`), or listen through `hooks/socketio/`.",
             xhr: "`XMLHttpRequest` is a second transport. Use an operation of the API layer (`modules/api`).",
-            authDoor: "`{{call}}` calls `{{path}}` from the auth door. `modules/auth/auth-door.ts` calls only the app's own back-end auth doors (`/auth/...`: login, signup, refresh, logout, password reset, resend verification); every other REST call is `modules/api/rest/`.",
             websocket: "Native `WebSocket` is a second realtime transport. Use socket.io-client in `hooks/socketio/`, the front end's realtime owner.",
         },
     },
     create(context) {
         const layer = isApiLayer(context);
-        const authDoor = isAuthDoor(context);
         const library = (node, source) => {
             const name = packageNameOf(source);
             if (name === null || forbiddingConcern(source))
@@ -231,8 +209,6 @@ export const fetchOnlyInApiClient = defineRule({
                     library(node, node.source.value);
             },
             CallExpression(node) {
-                if (authDoor)
-                    judgeAuthDoorCall(context, node);
                 // `require("axios")` where `require` is the CommonJS global.
                 const [first] = node.arguments;
                 if (node.callee.type !== "Identifier" || node.callee.name !== "require" || first?.type !== "Literal")
@@ -290,14 +266,14 @@ const isTransportFile = (context) => isApiLayer(context) && !hfsOf(context).rela
 export const noSharedTransportState = defineRule({
     meta: {
         type: "problem",
-        docs: { description: "The API layer (`modules/api/**`) and `modules/auth` hold no module-level `let`/`var`, but the in-memory access-token store `modules/auth/token-store.ts`." },
+        docs: { description: "The API layer (`modules/api/**`) and `modules/auth` hold no module-level `let`/`var`." },
         schema: [],
         messages: {
             shared: "A module-level `{{kind}}` in the API layer. A token or locale kept there is shared by every request on the server and by every reader in one tab, so one reader's credential can answer another's request. Pass the credential as a parameter or read it from context.",
         },
     },
     create(context) {
-        if (!isTransportFile(context) && !(inSlot(context, "fe.modules.auth") && !isAuthTokenStore(context)))
+        if (!isTransportFile(context) && !inSlot(context, "fe.modules.auth"))
             return {};
         const check = (node) => {
             const declaration = node.type === "VariableDeclaration" ? node : node.type === "ExportNamedDeclaration" ? node.declaration : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.10.0",
+  "version": "9.11.0",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,36 +30,43 @@ pins:
     side: fe
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
+  '@starci/next-data':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/next-data/package.json
+    why: 'the SWR data helpers of every front end (fe-stack data, owner:next-data-package): pollingRestart, the viewer and tenant key helpers, viewerSwrConfig and the viewer cache; each operation hook stays in the app and the package holds no component.'
   '@starci/grammar':
-    version: 0.21.13
+    version: 0.21.14
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.12.0
+    version: 3.13.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.10.0
+    version: 9.11.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.13
+    version: 0.21.14
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.13
+    version: 0.21.14
     group: starci
     install: registry
     side: fe
@@ -85,7 +92,7 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.6.0
+    version: 2.6.1
     group: starci
     install: registry
     side: be
@@ -105,8 +112,22 @@ pins:
     side: be
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
+  '@starci/auth':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: both
+    source: packages/auth/package.json
+    why: 'the lite sign-in: the NestJS module (EdDSA access tokens with a multi-key JWKS, passwords, Google OAuth with state and PKCE, rotating refresh sessions, the sign-in budget, the refresh cookie), the front-end client and its React bindings, the door contracts and test doubles; the one importer of the identity libraries, reached by a back end only through integrations/passport; @starci/jest-preset compiles it as an ESM-only dependency.'
+  '@starci/object-storage':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: be
+    source: packages/object-storage/package.json
+    why: 'object storage of a back end: a NestJS module and the ObjectStorage port over S3-compatible storage (presigned PUT and GET that sign the content type and size, head, get, put, list, delete, bucket setup, size and content-type limits, coded errors), with @starci/object-storage/testing for its specs; the only importer of @aws-sdk/client-s3 and @aws-sdk/s3-request-presigner (R331).'
   '@starci/hfs':
-    version: 5.1.0
+    version: 5.2.0
     group: starci
     install: registry
     side: both
@@ -543,12 +564,12 @@ pins:
     version: 3.1150.0
     group: framework
     side: be
-    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
+    why: 'the S3 transport inside @starci/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces), which depends on it at exactly this version and which no app file imports; 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
   '@aws-sdk/s3-request-presigner':
     version: 3.1150.0
     group: framework
     side: be
-    why: 'signs the presigned PUT and GET of integrations/object-storage locally, the same release as client-s3.'
+    why: 'signs the presigned PUT and GET inside @starci/object-storage locally, the same release as client-s3; no app file imports it.'
   '@apollo/server':
     version: 5.5.1
     group: framework

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -37,17 +37,17 @@ concerns:
   - id: rest
     tier: core
     packages: [axios]
-    home: [fe.modules.api, fe.modules.auth]
+    home: [fe.modules.api]
     pattern: FE-API-REST
     forbids: [ky, superagent, node-fetch, cross-fetch, isomorphic-fetch]
-    why: modules/api/rest/<area>/*.ts for uploads and presigned URLs, and modules/auth/auth-door.ts for the app's own auth doors only; GraphQL carries every other call.
+    why: modules/api/rest/<area>/*.ts for uploads and presigned URLs, only; GraphQL carries every other call.
   - id: data
     tier: core
-    packages: [swr]
+    packages: [swr, '@starci/next-data']
     home: [fe.hooks.swr]
     pattern: FE-DATA-SWR
     forbids: ['@tanstack/react-query', react-query]
-    why: hooks/swr/api/{graphql,rest}/{queries,mutations}/use*Swr.ts wrap one operation each; components call hooks only.
+    why: hooks/swr/api/{graphql,rest}/{queries,mutations}/use*Swr.ts wrap one operation each; components call hooks only. The polling-restart middleware (pollingRestart), the key helpers, the viewer-keyed config and the viewer cache are @starci/next-data's (owner next-data-package); an app imports no Middleware or ScopedMutator type of swr and writes none of them.
   - id: toast
     tier: core
     packages: ['@heroui/react']
@@ -96,11 +96,11 @@ concerns:
       hand-written reader (read-event-stream.ts) and no second SSE library is installed.
   - id: auth
     tier: core
-    packages: []
+    packages: ['@starci/auth']
     home: [fe.modules.auth]
     pattern: FE-AUTH
-    forbids: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-js']
-    why: modules/auth is the session issuer's client (lite - auth-door.ts over the app's own back-end auth doors with the in-memory token store; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
+    forbids: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-js', jose, jwt-decode, next-auth, '@auth/core', keycloak-js, oidc-client-ts]
+    why: modules/auth is the session issuer's client (one @starci/auth client instance over the app's own back-end auth doors, the access token in its memory; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
   - id: i18n
     tier: core
     packages: [next-intl]

package/runtime/knowledge/hfs/slots.yaml

@@ -236,17 +236,20 @@ ruleParams:
       "node:https": [platform/http]
       http: [platform/http]
       https: [platform/http]
-      "@aws-sdk/client-s3": [integrations/object-storage]       # the ObjectStorage port: one S3 adapter for MinIO, S3 and Spaces (R331)
-      "@aws-sdk/s3-request-presigner": [integrations/object-storage]
-      minio: []                                          # storage goes through the S3 client of integrations/object-storage
+      "@aws-sdk/client-s3": []                           # the S3 client is a dependency of @starci/object-storage, imported by no app file (R331)
+      "@aws-sdk/s3-request-presigner": []
+      "@starci/object-storage": [integrations/object-storage]   # the ObjectStorage port: one S3 adapter for MinIO, S3 and Spaces (R331)
+      minio: []                                          # storage goes through @starci/object-storage
       "@supabase": []                                    # no Supabase client in a back end
-      "@nestjs/passport": [integrations/passport]        # the identity libraries (R328)
-      passport: [integrations/passport]
-      passport-google-oauth20: [integrations/passport]
-      passport-local: [integrations/passport]
-      "@nestjs/jwt": [integrations/passport]
-      jose: [integrations/passport]
-      bcryptjs: [integrations/passport]
+      "@nestjs/passport": []                             # the identity libraries are @starci/auth's dependencies, never an app's (R328)
+      passport: []
+      passport-google-oauth20: []
+      passport-local: []
+      "@nestjs/jwt": []
+      jose: []
+      bcryptjs: []
+      "@starci/auth": [integrations/passport]            # the lite sign-in package: its server entry is reached only through integrations/passport (R328)
+      "@starci/auth/testing": [integrations/passport]   # its test doubles, for the glue's specs
       bcrypt: []
       cache-manager: [integrations/cache, integrations/redis]
       "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability
@@ -1978,36 +1981,68 @@ slots:
     editions: [lite]
     exemplifiedBy:
       - packages/hfs/templates/be/skeleton-lite/src/modules/integrations/passport/
-    # The one owner of the lite identity libraries (ruleParams.be.infraOwners: @nestjs/passport, passport, passport-google-oauth20,
-    # passport-local, @nestjs/jwt, jose, bcryptjs): the Google OAuth 2.0 strategy (state and PKCE), the local email and password
-    # strategy (bcrypt), the app's own asymmetric access tokens and their JWKS, and the rotating refresh cookie. domain/identity
-    # verifies a token through this integration's verifier and builds the principal (contexts/code/be/api-auth.md).
+    # The glue of @starci/auth, the lite sign-in package (Google OAuth with state and PKCE, email and password, EdDSA access tokens with
+    # their JWKS, rotating refresh sessions): the one importer of the package (ruleParams.be.infraOwners), which owns the identity
+    # libraries (@nestjs/passport, passport, passport-google-oauth20, passport-local, @nestjs/jwt, jose, bcryptjs) that no app imports.
+    # It parses the typed options, builds the verifier and names the injectors; domain/identity verifies a token through the kit and
+    # builds the principal (contexts/code/be/api-auth.md).
     path: "src/modules/integrations/passport/"
     presence: required
     tracked: tracked
     tier: integrations
     owner: true
-    requires: [index.ts, passport.config.ts, passport.options.ts, passport.decorators.ts, passport.tokens.ts, passport.password.ts, passport.cookie.ts]   # Secrets, no defaults (R44); options and named injectors (R83); tokens and JWKS; bcrypt; the refresh cookie
-    allows: [index.ts, passport.config.ts, passport.options.ts, passport.decorators.ts, passport.tokens.ts, passport.password.ts, passport.cookie.ts, strategies/, errors/]
-    logic: [passport.tokens.ts, passport.password.ts, passport.cookie.ts]   # JWT sign and verify over the own JWKS, bcrypt, the refresh cookie: measured at 100 per file
+    requires: [index.ts, passport.config.ts, passport.options.ts, passport.decorators.ts, passport.kit.ts, passport.registration.ts]   # Secrets, no defaults (R44); options and named injectors (R83); the kit and the module over @starci/auth
+    allows: [index.ts, passport.config.ts, passport.options.ts, passport.decorators.ts, passport.kit.ts, passport.registration.ts, errors/]
+    logic: [passport.kit.ts]   # the verifier mapping over the package: measured at 100 per file
     tests: unit-beside
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER, BE_AUTH_PASSPORT_OWNER, BE_AUTH_JWT_OWN_JWKS, BE_AUTH_REFRESH_COOKIE]
     coverage: required
     since: 3.9.0
+  - id: be.identity.sign-in
+    since: 3.16.0
+    profiles: [be]
+    editions: [lite]
+    editionWhy: "lite signs people in with the package @starci/auth, so its sign-in glue is rendered, not written (owner ruling auth-package); full uses its identity provider."
+    # The identity capability's sign-in glue over @starci/auth: the entities of the session, attempt and user tables, the stores the package asks for (sessions, accounts, rate counter), the authenticator and the service the doors call, with their specs. `starci app sync` renders them; a hand edit is drift.
+    path: "{src/modules/domain/identity/account-directory.service.spec.ts,src/modules/domain/identity/account-directory.service.ts,src/modules/domain/identity/authenticator.service.spec.ts,src/modules/domain/identity/authenticator.service.ts,src/modules/domain/identity/persistence/entities/auth-identity.entity.ts,src/modules/domain/identity/persistence/entities/auth-user.entity.ts,src/modules/domain/identity/persistence/entities/identity-attempt.entity.ts,src/modules/domain/identity/persistence/entities/identity-refresh-token.entity.ts,src/modules/domain/identity/persistence/entities/identity-session.entity.ts,src/modules/domain/identity/persistence/entities/index.ts,src/modules/domain/identity/rate-counter.service.spec.ts,src/modules/domain/identity/rate-counter.service.ts,src/modules/domain/identity/session-store.service.spec.ts,src/modules/domain/identity/session-store.service.ts,src/modules/domain/identity/sign-in.service.spec.ts,src/modules/domain/identity/sign-in.service.ts,src/tests/fixtures/builders/identity.builder.ts}"
+    presence: optional
+    tracked: tracked
+    tier: inherit
+    tests: unit-beside
+    coverage: none
+    managedBy: auth-lite
+    managedOnly: true     # lists files sync renders; the slot owning the path judges them
+    rules: [HFS_MANAGED_FILE_DRIFT]
+  - id: be.feature.auth
+    since: 3.16.0
+    profiles: [be]
+    editions: [lite]
+    editionWhy: "lite signs people in with the package @starci/auth, so its sign-in glue is rendered, not written (owner ruling auth-package); full uses its identity provider."
+    # The auth feature: the REST doors under /auth (login, refresh, session, logout, Google start and callback, jwks) over IdentitySignInService, one command or query and handler per door.
+    path: "{src/features/api/auth/application/auth.contracts.ts,src/features/api/auth/application/get-jwks.handler.ts,src/features/api/auth/application/get-jwks.query.ts,src/features/api/auth/application/google-begin.command.ts,src/features/api/auth/application/google-begin.handler.ts,src/features/api/auth/application/google-complete.command.ts,src/features/api/auth/application/google-complete.handler.ts,src/features/api/auth/application/login.command.ts,src/features/api/auth/application/login.handler.ts,src/features/api/auth/application/logout.command.ts,src/features/api/auth/application/logout.handler.ts,src/features/api/auth/application/refresh.command.ts,src/features/api/auth/application/refresh.handler.ts,src/features/api/auth/application/session.command.ts,src/features/api/auth/application/session.handler.ts,src/features/api/auth/auth.module-definition.ts,src/features/api/auth/auth.module.ts,src/features/api/auth/auth.options.ts,src/features/api/auth/index.ts,src/features/api/auth/transport/http/auth-http.module-definition.ts,src/features/api/auth/transport/http/auth-http.module.ts,src/features/api/auth/transport/http/auth-http.options.ts,src/features/api/auth/transport/http/auth.controller.ts,src/features/api/auth/transport/http/dto/google-start.request.ts,src/features/api/auth/transport/http/dto/login.request.ts}"
+    presence: optional
+    tracked: tracked
+    tier: inherit
+    tests: none
+    coverage: none
+    managedBy: auth-lite
+    managedOnly: true     # lists files sync renders; the slot owning the path judges them
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: be.integrations.object-storage
     profiles: [be]
     exemplifiedBy:
       - packages/hfs/templates/be/skeleton-lite/src/modules/integrations/object-storage/
-    # The one owner of the S3 client (@aws-sdk/client-s3 and @aws-sdk/s3-request-presigner) over S3-compatible storage (MinIO in
-    # lite): the ObjectStorage port with presigned PUT and GET; no other module imports an S3 SDK or minio.
+    # The glue of @starci/object-storage, the owner of the S3 client (@aws-sdk/client-s3 and @aws-sdk/s3-request-presigner) over
+    # S3-compatible storage (MinIO in lite): this folder keeps the bucket, parses the settings and registers the module; no app
+    # file imports an S3 SDK or minio, and no other module imports the package.
     path: "src/modules/integrations/object-storage/"
     presence: optional
     litePresence: required
     tracked: tracked
     tier: integrations
     owner: true
-    requires: [index.ts, object-storage.config.ts, object-storage.options.ts, object-storage.decorators.ts, object-storage.client.ts]
-    allows: [index.ts, object-storage.module.ts, object-storage.module-definition.ts, object-storage.config.ts, object-storage.options.ts, object-storage.decorators.ts, object-storage.client.ts, errors/]
+    requires: [index.ts, object-storage.config.ts, object-storage.options.ts, object-storage.decorators.ts, object-storage.module-definition.ts, object-storage.module.ts]
+    allows: [index.ts, object-storage.config.ts, object-storage.options.ts, object-storage.decorators.ts, object-storage.module-definition.ts, object-storage.module.ts, errors/]
     tests: unit-beside
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER, BE_STORAGE_OWNER]
     coverage: required
@@ -2541,7 +2576,7 @@ slots:
     profiles: [fe]
     # The identity-provider client (fe-stack auth, FE-AUTH): the session, the access token the Apollo link attaches and the
     # sign-in/sign-out calls. It talks only to the app's own back-end auth doors and holds no credential: the refresh token lives in
-    # the back end's httpOnly cookie and the access token in memory (ruling:lite-self-hosted-postgres-passport-minio).
+    # the back end's httpOnly cookie and the access token in the memory of the one @starci/auth client (ruling:lite-self-hosted-postgres-passport-minio).
     path: "apps/<app>/src/modules/auth/"
     presence: optional
     tracked: tracked
@@ -2551,6 +2586,20 @@ slots:
     tests: none
     since: 3.0.0
     rules: [FE_STACK_FORBIDDEN]
+  - id: fe.modules.auth.client
+    since: 3.16.0
+    profiles: [fe]
+    editions: [lite]
+    editionWhy: "lite signs people in with the package @starci/auth, so its auth client is rendered, not written (owner ruling auth-package); full wires its identity provider."
+    # The AuthClient every edition shares, implemented by one @starci/auth/client instance over the app's own back-end auth doors.
+    path: "apps/web/src/modules/auth/client.ts"
+    presence: optional
+    tracked: tracked
+    tier: inherit
+    tests: none
+    managedBy: auth-lite
+    managedOnly: true     # lists files sync renders; the slot owning the path judges them
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: fe.modules.toast
     profiles: [fe]
     # Mutation feedback (fe-stack toast, FE-TOAST): the HeroUI toast wrapper, showGraphQLToast over a GraphQLResponse and the

package/runtime/scripts/hfs/architecture/identity.mjs

@@ -1,57 +1,17 @@
-// identity.mjs - the back-end identity machine. Under lite the one token verifier is be.integrations.passport: jose's jwtVerify
-// there checks the app's OWN key set (createLocalJWKSet over the keys it signs with, never createRemoteJWKSet), pins issuer,
-// audience and algorithms, and no file decodes a token unverified or reads authorization claims from a request body (R329).
-// In both editions every jwtVerify call holds the JWT policy (R260, jwtPolicyProblems).
+// identity.mjs - the back-end identity machine. Under lite the one token verifier is @starci/auth, composed by be.integrations.passport:
+// no app file calls jose's jwtVerify, decodes a token unverified or reads authorization claims from a request body (R329), and the
+// passport integration imports @starci/auth/server. In both editions every jwtVerify call holds the JWT policy (R260, jwtPolicyProblems).
 import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
-import { fromConfig, importedFrom, jwtPolicyProblems, reportAt, unwrap } from './jwt-ast.mjs';
+import { jwtPolicyProblems, reportAt, unwrap } from './jwt-ast.mjs';
 import { accessName } from '../../lib/ts-ast.mjs';
 const PASSPORT_SLOT = 'be.integrations.passport';
+const PACKAGE_ENTRY = '@starci/auth/server';
 const BE_JWT_VERIFIED = 'BE_AUTH_JWT_OWN_JWKS';
 /** The rule ids the back-end identity machine reports. */
 export const IDENTITY_RULE_IDS = Object.freeze(['BE_AUTH_JWT_OWN_JWKS', 'BE_JWT_ALG_PINNED']);
 const JWT_MODULES = new Set(['jose', 'jsonwebtoken', 'jwt-decode']);
 const CLAIM_NAMES = new Set(['role', 'roles', 'membership', 'memberships']);
-const objectLiteral = (kit, checker, node) => {
-    const current = unwrap(kit.ts, node);
-    if (!current)
-        return null;
-    if (kit.ts.isObjectLiteralExpression(current))
-        return current;
-    if (!kit.ts.isIdentifier(current))
-        return null;
-    for (const declaration of kit.declarationsOf(checker, current)) {
-        if (kit.ts.isVariableDeclaration(declaration) && declaration.initializer) {
-            const value = unwrap(kit.ts, declaration.initializer);
-            if (kit.ts.isObjectLiteralExpression(value))
-                return value;
-        }
-    }
-    return null;
-};
-const staticStrings = (kit, checker, node) => {
-    const current = unwrap(kit.ts, node);
-    if (kit.ts.isStringLiteralLike(current))
-        return [current.text];
-    if (kit.ts.isArrayLiteralExpression(current)) {
-        const literals = current.elements.filter((element) => kit.ts.isStringLiteralLike(element));
-        if (literals.length === current.elements.length)
-            return literals.map((element) => element.text);
-    }
-    const value = kit.stringValue(checker, current);
-    return value === null ? null : [value];
-};
-const jwksArgument = (kit, checker, node) => {
-    const current = unwrap(kit.ts, node);
-    if (!current)
-        return false;
-    if (kit.ts.isCallExpression(current))
-        return importedFrom(kit, checker, current.expression, new Set(['jose']), new Set(['createLocalJWKSet']));
-    if (!kit.ts.isIdentifier(current))
-        return false;
-    return kit.declarationsOf(checker, current).some((declaration) => kit.ts.isVariableDeclaration(declaration) && declaration.initializer
-        && jwksArgument(kit, checker, declaration.initializer));
-};
 const importedCall = (kit, checker, call) => {
     const direct = kit.importBinding(checker, call.expression);
     if (direct?.module === 'jwt-decode' && direct.name === 'default')
@@ -84,41 +44,16 @@ const fromRequestBody = (kit, checker, node, seen = new Set()) => {
     return kit.declarationsOf(checker, current).some(declaration => kit.ts.isVariableDeclaration(declaration) && declaration.initializer
         && fromRequestBody(kit, checker, declaration.initializer, seen));
 };
-function verifyJwtCall(kit, checker, file, node, counters, violations) {
-    counters.verifyCalls += 1;
-    if (file.slot !== PASSPORT_SLOT) {
-        reportAt(violations, kit, BE_JWT_VERIFIED, file, node, `jwtVerify is called outside ${PASSPORT_SLOT}; the integration is the one token verifier.`);
-        return true;
-    }
-    const options = objectLiteral(kit, checker, node.arguments[2]);
-    const property = (name) => options ? kit.propertyOf(options, name) : null;
-    const values = (name) => {
-        const entry = property(name);
-        return entry ? staticStrings(kit, checker, kit.valueOfProperty(entry)) : null;
-    };
-    const issuer = property('issuer');
-    const audience = values('audience');
-    const algorithms = values('algorithms');
-    // The audience is pinned by a literal or, as R260 accepts, by typed configuration (the skeleton's TokenOptions.audience).
-    const audienceEntry = property('audience');
-    const pinnedAudience = (audience !== null && audience.length > 0)
-        || (audienceEntry != null && fromConfig(kit.ts, checker, kit.valueOfProperty(audienceEntry)));
-    const good = jwksArgument(kit, checker, node.arguments[1]) && issuer != null && pinnedAudience
-        && algorithms !== null && algorithms.length > 0;
-    if (!good) {
-        reportAt(violations, kit, BE_JWT_VERIFIED, file, node, 'jwtVerify must check the app\'s own key set (createLocalJWKSet(...) over the keys integrations/passport signs with) and pin issuer, audience and a non-empty algorithms list; jwtVerify then enforces signature and exp.');
-    }
-    else
-        counters.verifiedCalls += 1;
-    return false;
-}
 function inspectJwtCall(kit, checker, file, node, counters, violations) {
     const binding = importedCall(kit, checker, node);
     if (binding && JWT_MODULES.has(binding.module) && ['decode', 'decodeJwt', 'jwtDecode'].includes(binding.name)) {
         reportAt(violations, kit, BE_JWT_VERIFIED, file, node, `${binding.module}.${binding.name} decodes a token without proving its signature; verify it through integrations/passport.`, { module: binding.module, method: binding.name });
     }
-    if (binding?.module === 'jose' && binding.name === 'jwtVerify')
-        return verifyJwtCall(kit, checker, file, node, counters, violations);
+    if (binding?.module === 'jose' && binding.name === 'jwtVerify') {
+        counters.verifyCalls += 1;
+        reportAt(violations, kit, BE_JWT_VERIFIED, file, node, 'jwtVerify is called in the app; @starci/auth verifies the own access tokens, reached through ' + PASSPORT_SLOT + '.');
+        return true;
+    }
     return false;
 }
 function inspectRequestClaims(kit, file, node, checker, violations) {
@@ -146,18 +81,18 @@ function checkOwnJwks(input) {
     const violations = [];
     const integrations = [...input.graph.files.values()].filter((file) => file.slot === PASSPORT_SLOT);
     if (!integrations.length)
-        return { violations, coverage: { status: 'not-applicable', integrationFiles: 0, verifiedCalls: 0 } };
-    const counters = { verifyCalls: 0, verifiedCalls: 0 };
+        return { violations, coverage: { status: 'not-applicable', integrationFiles: 0, verifyCalls: 0 } };
+    const counters = { verifyCalls: 0 };
     for (const file of input.graph.files.values()) {
         const checker = kit.checkerOf(file.sourceFile);
         kit.walk(file.sourceFile, (node) => inspectBackendNode(kit, checker, file, node, counters, violations));
     }
-    if (counters.verifyCalls === 0) {
-        const anchor = integrations.find((file) => path.posix.basename(file.rel).endsWith('.tokens.ts')) ?? integrations[0];
-        if (anchor)
-            reportAt(violations, kit, BE_JWT_VERIFIED, anchor, anchor.sourceFile, `${PASSPORT_SLOT} has no jose.jwtVerify call backed by createLocalJWKSet over the app's own keys.`);
-    }
-    return { violations, coverage: { status: 'checked', integrationFiles: integrations.length, verifyCalls: counters.verifyCalls, verifiedCalls: counters.verifiedCalls } };
+    const composes = integrations.some((file) => file.sourceFile.statements.some((statement) => kit.ts.isImportDeclaration(statement)
+        && kit.ts.isStringLiteral(statement.moduleSpecifier) && statement.moduleSpecifier.text === PACKAGE_ENTRY));
+    const anchor = integrations.find((file) => path.posix.basename(file.rel) === 'index.ts') ?? integrations[0];
+    if (!composes && anchor)
+        reportAt(violations, kit, BE_JWT_VERIFIED, anchor, anchor.sourceFile, PASSPORT_SLOT + ' does not import ' + PACKAGE_ENTRY + ', the one verifier of the own access tokens.');
+    return { violations, coverage: { status: 'checked', integrationFiles: integrations.length, verifyCalls: counters.verifyCalls, composesPackage: composes } };
 }
 /** R260 BE_JWT_ALG_PINNED: every jose jwtVerify call pins a literal secure algorithm list and a configured issuer, and binds the principal by a configured audience or the authenticated role. */
 export function checkJwtPolicy(input) {

package/runtime/scripts/hfs/architecture/transport-owner.mjs

@@ -17,8 +17,7 @@ import { propertyValue } from './function-spec-providers.mjs';
  *   - no file outside the client folder and the stream reader folder (`fe.transport.stream`, `modules/api/sse/clients/`) references the global `fetch`: a call, `globalThis.fetch`, `window.fetch`, or a
  *     reference passed as a value (`useSWR(key, fetch)`, `const send = fetch`), all of which a spelling-based rule misses; with no
  *     client at all every such reference is a finding that says the repository has no client;
- *   - axios is imported only by the api owner (modules/api, the api package) for its rest calls and by the auth door
- *     (modules/auth/auth-door.ts) for the app's own auth doors; every other HTTP library is a
+ *   - axios is imported only by the api owner (modules/api, the api package) for its rest calls; every other HTTP library is a
  *     second transport wherever it is imported, by static import, `import()` or `require()`;
  *   - an `ApolloClient` is constructed only inside the client folder;
  *   - every GraphQL operation (`graphql/queries/query-*.ts`, `graphql/mutations/mutation-*.ts`, `graphql/subscriptions/subscription-*.ts`) imports the client (or the api
@@ -105,17 +104,15 @@ function isApolloClientConstruction(ts, kit, checker, node) {
     const binding = kit.importBinding(checker, node.expression);
     return Boolean(binding?.name === 'ApolloClient' && binding.module.startsWith('@apollo/client'));
 }
-/** The one auth door of the session issuer's client (`modules/auth/auth-door.ts`, slot fe.modules.auth): it calls the app's own auth doors with axios. */
-const isAuthDoor = (file) => file.slot === 'fe.modules.auth' && path.posix.basename(file.rel) === 'auth-door.ts';
 function inspectLibraryImport({ ts, file, node, transport, report }) {
     const specifier = moduleSpecifierOf(ts, node);
     if (!specifier || !ts.isStringLiteralLike(specifier))
         return;
     const library = specifier.text.split('/')[0];
-    if (!HTTP_LIBRARIES.has(library) || (library === REST_LIBRARY && (API_OWNER_SLOTS.has(file.slot) || isAuthDoor(file))))
+    if (!HTTP_LIBRARIES.has(library) || (library === REST_LIBRARY && (API_OWNER_SLOTS.has(file.slot))))
         return;
     const where = library === REST_LIBRARY
-        ? 'axios belongs to the api owner (modules/api/rest, the api package) and the auth door (modules/auth/auth-door.ts) only: call their functions'
+        ? 'axios belongs to the api owner (modules/api/rest, the api package) only: call their functions'
         : `the transport is Apollo GraphQL (${transport}) with axios for the rest calls of modules/api/rest`;
     report(file, node, `${specifier.text} is a second HTTP transport in ${file.rel}; ${where}.`, { library: specifier.text });
 }

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -121,7 +121,7 @@ export const MANIFEST_KINDS = [APP_KIND, RUNTIME_KIND];
 export const manifestKind = (m) => (isPlainObject(m) && m.kind !== undefined ? m.kind : APP_KIND);
 const strList = (v) => stringList(v);
 
-const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'editionWhy', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'templateNa', 'exemplifiedBy', 'role', 'importedBy', 'logic'];
+const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'editionWhy', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'templateNa', 'exemplifiedBy', 'role', 'importedBy', 'logic', 'managedOnly'];
 /** The roles a file slot may play that a rule reads (`role`): the entity registry of persistence.md BE-PERSISTENCE-3 (architecture/entity-registry.mjs). */
 const SLOT_ROLES = ['entity-registry'];
 /** The fields a slot's `lite` overlay may hold: the same keys it would carry in the slot body, resolved under edition lite. */

package/runtime/scripts/hfs/slots.mjs

@@ -232,7 +232,7 @@ export function readRepoDeclaration(manifest, repoRoot) {
 function createScopeResolver(manifest, repo) {
     const profile = repo.profile;
     const edition = repo.edition ?? 'full';
-    const slots = manifest.slots.filter((s) => s.profiles.includes(profile) && slotInEdition(manifest, s, edition)).map((s) => effectiveSlot(s, profile, edition));
+    const slots = manifest.slots.filter((s) => s.managedOnly !== true && s.profiles.includes(profile) && slotInEdition(manifest, s, edition)).map((s) => effectiveSlot(s, profile, edition));
     const scope = { manifest, repo, profile, slots, byId: new Map(slots.map((s) => [s.id, s])), variants: slots.flatMap(variantsOf), appKind: new Map(repo.apps.map((a) => [a.name, a.kind])) };
     const classifyPath = (input) => classifyIn(scope, input);
     /** tracked | ignored | external for the slot owning `p`, or null when no slot owns it. */