@starci/eslint-canon-fe 9.11.0 → 9.12.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 9.12.1 - 2026-11-03
+
+- Changed: the runtime copies carry the canon pins of `@starci/auth` 0.2.1, `@starci/auth-oidc` 0.1.1, the Grammar family 0.21.16 and `@starci/hfs` 5.4.0.
+
+## 9.12.0 - 2026-11-03
+
+- Changed: the runtime copies carry R368's acceptance of the module-definition helpers, the module-per-transport confinement of the helpers and the `@starci/nest-kit` and `@starci/next-i18n` pins; `i18n-stack-in-one-module` refuses every product-source call of a next-intl layer builder (the stack is `@starci/next-i18n`'s).
+- Added: `starciFePackagesConfig`, `loadPackagesHfs` and `scopeToPackages`: the rules of the front end over `packages/<pkg>/src/workbench/**` and `src/public/**` of the root workspace packages, over the package view of the app root, for the managed root `eslint.config.mjs`; the workbench contract stays with the back-end canon and the project-graph rules with the side folders.
+- Changed: the runtime copy of the slot manifest carries the slots `app.packages`, `app.module-registry` and `app.packages-lint`.
+
 ## 9.11.0 - 2026-11-03
 
 - Changed: `modules/auth` holds the front-end transport rules like `modules/api`: no auth door file takes axios or `fetch`, and no file keeps module-level mutable state (the access token lives in the `@starci/auth` client); the stack concern `auth` names `@starci/auth`.

package/dist/index.d.ts

@@ -43,7 +43,8 @@ export declare const rules: Record<string, Rule>;
 export declare const recommended: Record<string, "error" | "warn">;
 /** Flat-config options that make inline directives ineffective rather than merely forbidden. */
 export { linterOptions } from "./lib/config.js";
-export { loadHfs } from "./lib/hfs.js";
+export { loadHfs, loadPackagesHfs } from "./lib/hfs.js";
+export { scopeToPackages } from "./lib/config.js";
 /**
  * The Vietnamese why of each rule that carries a catalogue code: `{ code, vi, fixVi }`.
  *
@@ -81,6 +82,18 @@ export declare const reactHooksRules: (reactHooks: unknown) => Record<string, "e
 export declare const starciFeConfig: ({ hfs }?: {
     readonly hfs?: unknown;
 }) => Linter.Config[];
+/**
+ * The flat config of the front-end subpaths of an app's root workspace packages (`packages/<pkg>/src/workbench/**` and `src/public/**`), for the
+ * managed root `eslint.config.mjs`: `starciFePackagesConfig({ hfs: loadPackagesHfs(import.meta.url) })`, composed with the Grammar family's
+ * `...PackagesConfig`. The very rules of `starciFeConfig` over the package view, but the project-graph rules, which judge the import graph of a
+ * side folder that a package is not part of.
+ *
+ * @param input - The package view of the app root.
+ * @returns The flat config.
+ */
+export declare const starciFePackagesConfig: ({ hfs }?: {
+    readonly hfs?: unknown;
+}) => Linter.Config[];
 /**
  * The flat config of a TypeScript front-end tree that is no HFS app (a runtime package, the harness UI):
  * `export default starciPlainSourceConfig({ root: import.meta.dirname })`. It lints the tree's `src/` with types, with the inline-directive fence, the

package/dist/index.js

@@ -49,7 +49,7 @@ import { recommended as typeSafetyRecommended, rules as typeSafetyRules } from "
 import { recommended as projectGraphRecommended, rules as projectGraphRules } from "./project-graph.js";
 import { recommended as sonarParityRecommended, rules as sonarParityRules } from "./sonar-parity.js";
 import { recommended as spacingRecommended, rules as spacingRules } from "./spacing.js";
-import { buildFeConfig, buildPlainSourceConfig, COUNTING } from "./lib/config.js";
+import { buildFeConfig, buildPlainSourceConfig, COUNTING, scopeToPackages } from "./lib/config.js";
 import { why } from "./lib/why.js";
 import { recommended as uiRulingsRecommended, rules as uiRulingsRules } from "./ui-rulings.js";
 /** Each law's contribution, kept separate so a duplicate name is detectable rather than silent. */
@@ -134,7 +134,8 @@ export const rules = Object.fromEntries(CONTRIBUTIONS.flatMap((entry) => Object.
 export const recommended = Object.fromEntries(CONTRIBUTIONS.flatMap((entry) => Object.entries(entry.recommended)));
 /** Flat-config options that make inline directives ineffective rather than merely forbidden. */
 export { linterOptions } from "./lib/config.js";
-export { loadHfs } from "./lib/hfs.js";
+export { loadHfs, loadPackagesHfs } from "./lib/hfs.js";
+export { scopeToPackages } from "./lib/config.js";
 /**
  * The Vietnamese why of each rule that carries a catalogue code: `{ code, vi, fixVi }`.
  *
@@ -246,6 +247,21 @@ export const starciFeConfig = ({ hfs } = {}) => {
         source: { ...recommended, ...reactHooksRules(reactHooks) },
     });
 };
+/**
+ * The flat config of the front-end subpaths of an app's root workspace packages (`packages/<pkg>/src/workbench/**` and `src/public/**`), for the
+ * managed root `eslint.config.mjs`: `starciFePackagesConfig({ hfs: loadPackagesHfs(import.meta.url) })`, composed with the Grammar family's
+ * `...PackagesConfig`. The very rules of `starciFeConfig` over the package view, but the project-graph rules, which judge the import graph of a
+ * side folder that a package is not part of.
+ *
+ * @param input - The package view of the app root.
+ * @returns The flat config.
+ */
+export const starciFePackagesConfig = ({ hfs } = {}) => {
+    const reactHooks = loadReactHooks();
+    const graph = new Set(Object.keys(projectGraphRecommended));
+    const source = { ...Object.fromEntries(Object.entries(recommended).filter(([name]) => !graph.has(name))), ...reactHooksRules(reactHooks) };
+    return scopeToPackages(buildFeConfig({ hfs, plugin, reactHooks, tsPlugin: loadTsPlugin(), sonar: loadSonarPlugins(), source }));
+};
 /**
  * The flat config of a TypeScript front-end tree that is no HFS app (a runtime package, the harness UI):
  * `export default starciPlainSourceConfig({ root: import.meta.dirname })`. It lints the tree's `src/` with types, with the inline-directive fence, the

package/dist/lib/config.d.ts

@@ -88,3 +88,16 @@ export declare const buildPlainSourceConfig: ({ root, plugin, hooks, reactHooks,
     readonly sonar: SonarPlugins;
     readonly canon?: boolean;
 }) => Linter.Config[];
+/** The front-end subpaths of a root workspace package: its workbench (drawn with Grammar) and its public face; the React-free workbench contract stays back end. */
+export declare const PACKAGE_SOURCE_FILES: readonly string[];
+/** What a package folder never lints: installed packages, build output, generated wire types. */
+export declare const PACKAGE_IGNORED: readonly string[];
+/**
+ * A front-end flat config (the canon's or a Grammar family's) narrowed to the front-end subpaths of the root workspace packages of an app:
+ * the very rules of the fe side, over `packages/<pkg>/src/workbench/**` and `src/public/**` of the app root, the workbench contract left to the
+ * back-end canon. The global ignore block becomes the package one. The config is read, never changed.
+ *
+ * @param config - The flat config of a front end built over the package view.
+ * @returns The same blocks with `files` narrowed to the package subpaths.
+ */
+export declare const scopeToPackages: (config: readonly Linter.Config[]) => Linter.Config[];

package/dist/lib/config.js

@@ -148,3 +148,21 @@ export const buildPlainSourceConfig = ({ root, plugin, hooks, reactHooks, tsPlug
         { files: [...PLAIN_SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs: sonar.sonarjs, unicorn: sonar.unicorn }, rules: sonarWayRules(sonar.sonarjs, "fe").rules },
     ];
 };
+/** The front-end subpaths of a root workspace package: its workbench (drawn with Grammar) and its public face; the React-free workbench contract stays back end. */
+export const PACKAGE_SOURCE_FILES = Object.freeze(["packages/*/src/workbench/**/*.{ts,tsx}", "packages/*/src/public/**/*.{ts,tsx}"]);
+const PACKAGE_CONTRACT = Object.freeze(["packages/*/src/workbench/contract/**"]);
+/** What a package folder never lints: installed packages, build output, generated wire types. */
+export const PACKAGE_IGNORED = Object.freeze(["**/node_modules/**", "**/.next/**", "**/dist/**", "**/coverage/**", "**/__generated__/**"]);
+/**
+ * A front-end flat config (the canon's or a Grammar family's) narrowed to the front-end subpaths of the root workspace packages of an app:
+ * the very rules of the fe side, over `packages/<pkg>/src/workbench/**` and `src/public/**` of the app root, the workbench contract left to the
+ * back-end canon. The global ignore block becomes the package one. The config is read, never changed.
+ *
+ * @param config - The flat config of a front end built over the package view.
+ * @returns The same blocks with `files` narrowed to the package subpaths.
+ */
+export const scopeToPackages = (config) => config.map((block) => {
+    if (block.files === undefined)
+        return { ...block, ignores: [...PACKAGE_IGNORED] };
+    return { ...block, files: [...PACKAGE_SOURCE_FILES], ignores: [...(block.ignores ?? []), ...PACKAGE_CONTRACT] };
+});

package/dist/lib/hfs.d.ts

@@ -16,6 +16,22 @@ export declare const loadHfs: (configUrl: string | URL) => HfsView;
  * @returns The frozen HFS view.
  */
 export declare const hfsFromDeclaration: (declaration: unknown, repoRoot: string) => HfsView;
+/**
+ * The HFS view of the root workspace packages of an app, judged by the laws of the fe side: the managed root `eslint.config.mjs`
+ * (`packages/*` of the app root) calls this. Paths are the app's own; a package file is of the tier `package`.
+ *
+ * @param configUrl - `import.meta.url` of the app root's `eslint.config.mjs`.
+ * @returns The frozen HFS view (profile fe over the paths of the app root).
+ */
+export declare const loadPackagesHfs: (configUrl: string | URL) => HfsView;
+/**
+ * The HFS view of the root packages of an in-memory app declaration, for rule tests.
+ *
+ * @param declaration - An app `hfs.json` object.
+ * @param repoRoot - The absolute app root the linted filenames live under.
+ * @returns The frozen HFS view.
+ */
+export declare const packagesHfsFromDeclaration: (declaration: unknown, repoRoot: string) => HfsView;
 /** True for a value that carries the view's resolver (`slotOf`), the test the canon has always made of `settings.starci.hfs`. */
 export declare const isHfsView: (value: unknown) => value is HfsView;
 /**

package/dist/lib/hfs.js

@@ -13,7 +13,7 @@
  */
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { declaredHfsView, openHfsView } from "#runtime/scripts/hfs/view.mjs";
+import { declaredHfsView, declaredPackagesHfsView, openHfsView, openPackagesHfsView } from "#runtime/scripts/hfs/view.mjs";
 import { RUNTIME_ROOT } from "./package-root.js";
 const RUNTIME = RUNTIME_ROOT;
 /**
@@ -31,6 +31,22 @@ export const loadHfs = (configUrl) => openHfsView({ runtimeRoot: RUNTIME, repoRo
  * @returns The frozen HFS view.
  */
 export const hfsFromDeclaration = (declaration, repoRoot) => declaredHfsView({ runtimeRoot: RUNTIME, declaration, repoRoot, side: "fe" });
+/**
+ * The HFS view of the root workspace packages of an app, judged by the laws of the fe side: the managed root `eslint.config.mjs`
+ * (`packages/*` of the app root) calls this. Paths are the app's own; a package file is of the tier `package`.
+ *
+ * @param configUrl - `import.meta.url` of the app root's `eslint.config.mjs`.
+ * @returns The frozen HFS view (profile fe over the paths of the app root).
+ */
+export const loadPackagesHfs = (configUrl) => openPackagesHfsView({ runtimeRoot: RUNTIME, repoRoot: dirname(fileURLToPath(configUrl)), side: "fe" });
+/**
+ * The HFS view of the root packages of an in-memory app declaration, for rule tests.
+ *
+ * @param declaration - An app `hfs.json` object.
+ * @param repoRoot - The absolute app root the linted filenames live under.
+ * @returns The frozen HFS view.
+ */
+export const packagesHfsFromDeclaration = (declaration, repoRoot) => declaredPackagesHfsView({ runtimeRoot: RUNTIME, declaration, repoRoot, side: "fe" });
 /** True for a value that carries the view's resolver (`slotOf`), the test the canon has always made of `settings.starci.hfs`. */
 export const isHfsView = (value) => typeof value === "object" && value !== null && "slotOf" in value && typeof value.slotOf === "function";
 /** The `starci.hfs` entry of a settings object, read without trusting its shape. */

package/dist/lib/why.js

@@ -384,8 +384,8 @@ export const why = {
     },
     "i18n-stack-in-one-module": {
         code: "FE_I18N_PLACEMENT",
-        en: "`<file>` builds a layer of the next-intl stack itself (`defineRouting`, `createNavigation`, `getRequestConfig`, `createMiddleware`). The stack is written once for the whole repo.",
-        fix: "Use the shared i18n factory; a single app keeps routing/request config in modules/i18n and navigation in modules/routes. The proxy imports routing without navigation.",
+        en: "`<file>` builds a layer of the next-intl stack itself (`defineRouting`, `createNavigation`, `getRequestConfig`, `createMiddleware`). The stack is written once, in `@starci/next-i18n`.",
+        fix: "Describe the languages with `defineI18n` and call `createProxy`, `createI18nNavigation`, `createRequestConfig` and `createReadLocaleSegment` of `@starci/next-i18n`; the proxy imports no navigation.",
     },
     "no-app-relative-clock": {
         code: "FE_SIZE_AND_STATE_BUDGET",

package/dist/next-conventions.d.ts

@@ -30,13 +30,13 @@ export declare const noNativeAnchor: import("./lib/rule.js").Rule<"internal" | "
 /** No route written by hand outside `modules/routes`. */
 export declare const noHardcodedRoute: import("./lib/rule.js").Rule<"route", []>;
 /**
- * The next-intl stack is written once per repository.
+ * The next-intl stack is written once, in `@starci/next-i18n`.
  *
  * `defineRouting` (`next-intl/routing`), `createNavigation` (`next-intl/navigation`), `getRequestConfig` (`next-intl/server`) and
  * `createMiddleware` (`next-intl/middleware`), resolved by the import that binds the called name (a renamed import or a namespace
- * member counts), have one owner. A shared i18n package owns its stack. In a one-app repository, routing and request
- * config belong to modules/i18n while createNavigation belongs to modules/routes. The proxy imports routing without
- * evaluating navigation: next-intl's navigation module selects React runtime exports unavailable in the proxy.
+ * member counts), are called by that package and by no product source: an app describes its languages with `defineI18n` and builds
+ * the proxy, the navigation, the request config and the layout's locale read with the package's factories. The proxy imports the
+ * routing without evaluating navigation: next-intl's navigation module selects React runtime exports unavailable in the proxy.
  *
  * It does not replace `no-second-i18n-stack`: that rule refuses another i18n LIBRARY at its import, this one refuses a second copy of
  * next-intl's own stack. Different evidence, different remedy.

package/dist/next-conventions.js

@@ -374,13 +374,13 @@ const stackFactoryOf = (context, callee) => {
     return stackFactory(definition, importedName(definition.node));
 };
 /**
- * The next-intl stack is written once per repository.
+ * The next-intl stack is written once, in `@starci/next-i18n`.
  *
  * `defineRouting` (`next-intl/routing`), `createNavigation` (`next-intl/navigation`), `getRequestConfig` (`next-intl/server`) and
  * `createMiddleware` (`next-intl/middleware`), resolved by the import that binds the called name (a renamed import or a namespace
- * member counts), have one owner. A shared i18n package owns its stack. In a one-app repository, routing and request
- * config belong to modules/i18n while createNavigation belongs to modules/routes. The proxy imports routing without
- * evaluating navigation: next-intl's navigation module selects React runtime exports unavailable in the proxy.
+ * member counts), are called by that package and by no product source: an app describes its languages with `defineI18n` and builds
+ * the proxy, the navigation, the request config and the layout's locale read with the package's factories. The proxy imports the
+ * routing without evaluating navigation: next-intl's navigation module selects React runtime exports unavailable in the proxy.
  *
  * It does not replace `no-second-i18n-stack`: that rule refuses another i18n LIBRARY at its import, this one refuses a second copy of
  * next-intl's own stack. Different evidence, different remedy.
@@ -388,20 +388,15 @@ const stackFactoryOf = (context, callee) => {
 export const i18nStackInOneModule = defineRule({
     meta: {
         type: "problem",
-        docs: { description: "A shared i18n package owns the stack; one app keeps routing/request config in i18n and navigation in routes, with a routing-only proxy entry." },
+        docs: { description: "The next-intl stack is built by @starci/next-i18n; an app calls its factories and never next-intl's own, and its proxy never evaluates the navigation." },
         schema: [],
         messages: {
-            stack: "`{{name}}` builds the next-intl stack outside its owner. Keep {{where}} and import the owned result through its public entry.",
-            proxyNavigation: "The proxy imports navigation runtime through {{source}}. Import routing from the i18n public entry, or use the shared package's routing-only proxy export; the proxy must not evaluate the routes/navigation barrel.",
+            stack: "`{{name}}` builds the next-intl stack in the app. Describe the languages with `defineI18n` and build the proxy, the navigation, the request config and the locale read of the layout with `createProxy`, `createI18nNavigation`, `createRequestConfig` and `createReadLocaleSegment` of `@starci/next-i18n` (FE-I18N-1).",
+            proxyNavigation: "The proxy imports navigation runtime through {{source}}. Build the proxy with `createProxy` of `@starci/next-i18n/proxy` over the i18n description; the proxy must not evaluate the routes/navigation barrel.",
         },
     },
     create(context) {
-        const hfs = hfsOf(context);
-        const slot = slotOfFile(context);
-        const single = hfs.apps.length === 1;
-        const proxy = single && slot === "fe.source-root-pinned" && roleOfFile(context) === "proxy";
-        const proxyFile = slot === "fe.source-root-pinned" && roleOfFile(context) === "proxy";
-        const where = single ? "routing/request config in modules/i18n and navigation in modules/routes" : "the stack in the shared i18n package that every app calls";
+        const proxyFile = slotOfFile(context) === "fe.source-root-pinned" && roleOfFile(context) === "proxy";
         const safeProxyImport = (node) => {
             if (!proxyFile || !node.source || (node.type === "ImportDeclaration" ? node.importKind === "type" : node.exportKind === "type"))
                 return;
@@ -419,18 +414,8 @@ export const i18nStackInOneModule = defineRule({
             ExportAllDeclaration: safeProxyImport,
             CallExpression(node) {
                 const factory = stackFactoryOf(context, node.callee);
-                // In a one-app repository the proxy (role `proxy`) mounts the locale middleware built from the one routing; a shared repository
-                // builds it in the i18n package and the proxy re-exports it.
-                if (factory?.name === "createMiddleware" && proxy)
-                    return;
-                if (slot === "fe.package.i18n")
-                    return;
-                if (single && factory?.name === "createNavigation" && slot === "fe.modules.routes")
-                    return;
-                if (single && factory?.name !== "createNavigation" && slot === "fe.modules.i18n")
-                    return;
                 if (factory)
-                    context.report({ node, messageId: "stack", data: { name: factory.name, where } });
+                    context.report({ node, messageId: "stack", data: { name: factory.name } });
             },
         };
     },

package/docs/next-conventions.md

@@ -207,9 +207,7 @@ router.push(routes.newWorkspace())
 
 ## `starci-fe/i18n-stack-in-one-module`
 
-The shared i18n package owns a multi-app stack. A single app keeps routing/request config in `modules/i18n` and navigation in the `modules/routes` public entry.
-
-`defineRouting` and `getRequestConfig` remain in the i18n owner. `createNavigation` belongs to a shared `fe.package.i18n` owner or the single app's `fe.modules.routes` owner. A single app's proxy mounts locale middleware using the routing-only public i18n entry. A shared package exposes its routing-only proxy entry as a declared package export. The proxy does not import `next-intl/navigation` or the app's routes/navigation barrel. Named import aliases and namespace imports keep their factory identity.
+The next-intl stack is built by `@starci/next-i18n`, never by a product source. `defineRouting`, `createNavigation`, `getRequestConfig` and `createMiddleware` are called by no file of an app or of a shared package, wherever it sits. An app states its languages with `defineI18n` and builds the proxy, the navigation, the request config and the layout's locale read with `createProxy`, `createI18nNavigation`, `createRequestConfig` and `createReadLocaleSegment`. The proxy does not import `next-intl/navigation` or the app's routes/navigation barrel. Named import aliases and namespace imports keep their factory identity.
 
 **Invalid** (`apps/web/src/modules/i18n/request.ts`, a repository with two apps)
 
@@ -218,15 +216,17 @@ import { getRequestConfig } from "next-intl/server"
 export default getRequestConfig(async () => ({ locale: "vi", messages: {} }))
 ```
 
-**Valid** (`apps/web/src/modules/i18n/index.ts`)
+**Valid** (`apps/web/src/modules/i18n/request.ts`)
 
 ```ts
-import { createAppI18n } from "@acme/i18n"
-export const i18n = createAppI18n({ locales: ["vi"] })
+import { createRequestConfig } from "@starci/next-i18n/request"
+import { i18n } from "./routing"
+
+export default createRequestConfig(i18n, { app: "web", loadMessages: (locale) => import(`./messages/${locale}.json`) })
 ```
 
 **Finding code:** `FE_I18N_PLACEMENT`
 
-**Why:** `<file>` builds a layer of the next-intl stack itself (`defineRouting`, `createNavigation`, `getRequestConfig`, `createMiddleware`). The stack may be written only once per repo.
+**Why:** `<file>` builds a layer of the next-intl stack itself (`defineRouting`, `createNavigation`, `getRequestConfig`, `createMiddleware`). The stack is written once, in `@starci/next-i18n`.
 
-**Fix:** Use the shared i18n factory, or keep routing/request configuration in the single app's i18n module and navigation in its public routes entry. Keep navigation imports out of the proxy.
+**Fix:** Describe the languages with `defineI18n` and call `createProxy`, `createI18nNavigation`, `createRequestConfig` and `createReadLocaleSegment` of `@starci/next-i18n`. Keep navigation imports out of the proxy.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.11.0",
+  "version": "9.12.1",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/bundle.json

@@ -101,6 +101,7 @@
     "scripts/hfs/architecture/render-graph.mjs",
     "scripts/hfs/architecture/render-prop-across-server.mjs",
     "scripts/hfs/architecture/required-files.mjs",
+    "scripts/hfs/architecture/root-packages.mjs",
     "scripts/hfs/architecture/route-files-thin.mjs",
     "scripts/hfs/architecture/schema-owner.mjs",
     "scripts/hfs/architecture/server-action.mjs",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -38,42 +38,49 @@ pins:
     source: packages/next-data/package.json
     why: 'the SWR data helpers of every front end (fe-stack data, owner:next-data-package): pollingRestart, the viewer and tenant key helpers, viewerSwrConfig and the viewer cache; each operation hook stays in the app and the package holds no component.'
   '@starci/grammar':
-    version: 0.21.14
+    version: 0.21.16
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
+  '@starci/next-i18n':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/next-i18n/package.json
+    why: 'the next-intl stack of every front end (fe-stack i18n, owner:next-i18n-package): defineI18n over the locales of the app, the locale-negotiating proxy, the locale-aware navigation, the request config that loads the catalogs of the app and the locale read of the [locale] layout; the app keeps its message catalogs and writes none of the stack.'
   '@starci/eslint-canon-be':
-    version: 3.13.0
+    version: 3.14.1
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.11.0
+    version: 9.12.1
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.14
+    version: 0.21.16
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.14
+    version: 0.21.16
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.5.1
+    version: 2.6.0
     group: starci
     install: registry
     side: fe
@@ -92,7 +99,7 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.6.1
+    version: 2.6.2
     group: starci
     install: registry
     side: be
@@ -112,13 +119,27 @@ pins:
     side: be
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
-  '@starci/auth':
+  '@starci/nest-kit':
     version: 0.1.0
     group: starci
     install: registry
+    side: be
+    source: packages/nest-kit/package.json
+    why: 'the module definition of every back-end module: defineConfigurableModule and defineCapabilityModule return the module base class, the options token and the options types with their types stated, so a <x>.module-definition.ts is one call that the lint on stated export types (R368) and the duplicate-code check (R21) both accept; @starci/jest-preset compiles it as an ESM-only dependency.'
+  '@starci/auth':
+    version: 0.2.1
+    group: starci
+    install: registry
     side: both
     source: packages/auth/package.json
     why: 'the lite sign-in: the NestJS module (EdDSA access tokens with a multi-key JWKS, passwords, Google OAuth with state and PKCE, rotating refresh sessions, the sign-in budget, the refresh cookie), the front-end client and its React bindings, the door contracts and test doubles; the one importer of the identity libraries, reached by a back end only through integrations/passport; @starci/jest-preset compiles it as an ESM-only dependency.'
+  '@starci/auth-oidc':
+    version: 0.1.1
+    group: starci
+    install: registry
+    side: both
+    source: packages/auth-oidc/package.json
+    why: 'the full sign-in: the OIDC client of the identity provider (Keycloak) behind the PrincipalVerifier of @starci/auth, so guards do not change between editions: the NestJS module (issuer discovery, the JWKS with caching and rotation, algorithm-pinned token checks, role mapping, the authorization code flow with PKCE and nonce), the front-end client (PKCE redirect, one shared refresh, tokens in memory) and the fake issuer for tests; the one importer of jose in a full app, reached by a back end only through integrations/keycloak; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/object-storage':
     version: 0.1.0
     group: starci
@@ -126,8 +147,15 @@ pins:
     side: be
     source: packages/object-storage/package.json
     why: 'object storage of a back end: a NestJS module and the ObjectStorage port over S3-compatible storage (presigned PUT and GET that sign the content type and size, head, get, put, list, delete, bucket setup, size and content-type limits, coded errors), with @starci/object-storage/testing for its specs; the only importer of @aws-sdk/client-s3 and @aws-sdk/s3-request-presigner (R331).'
+  '@starci/mail':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: be
+    source: packages/mail/package.json
+    why: 'outgoing mail of a back end: a NestJS module and the Mailer port over SMTP (connect, greeting, socket and total timeouts, STARTTLS required by default, recipient, message and attachment checks, a shared SMTP target policy, coded errors, typed escaping render helpers returning { subject, text, html }), with @starci/mail/testing for its specs; the only importer of nodemailer (R90).'
   '@starci/hfs':
-    version: 5.2.0
+    version: 5.4.0
     group: starci
     install: registry
     side: both
@@ -570,6 +598,11 @@ pins:
     group: framework
     side: be
     why: 'signs the presigned PUT and GET inside @starci/object-storage locally, the same release as client-s3; no app file imports it.'
+  nodemailer:
+    version: 10.1.7
+    group: framework
+    side: be
+    why: 'the SMTP client inside @starci/mail, which depends on it at exactly this version and which no app file imports; 10.1.7 is the release of 2026-10-18, chosen over newer ones that had not aged two weeks.'
   '@apollo/server':
     version: 5.5.1
     group: framework
@@ -670,7 +703,7 @@ pins:
     version: 6.2.12
     group: framework
     side: be
-    why: signs the app's own ES256 access tokens and verifies them against its own key set (createLocalJWKSet) in integrations/passport.
+    why: signs the app's own access tokens and verifies them against its own key set inside @starci/auth, and verifies the identity provider's tokens against its JWKS inside @starci/auth-oidc; no app file imports it.
   class-transformer:
     version: 0.5.1
     group: framework

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -96,18 +96,18 @@ concerns:
       hand-written reader (read-event-stream.ts) and no second SSE library is installed.
   - id: auth
     tier: core
-    packages: ['@starci/auth']
+    packages: ['@starci/auth', '@starci/auth-oidc']
     home: [fe.modules.auth]
     pattern: FE-AUTH
     forbids: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-js', jose, jwt-decode, next-auth, '@auth/core', keycloak-js, oidc-client-ts]
     why: modules/auth is the session issuer's client (one @starci/auth client instance over the app's own back-end auth doors, the access token in its memory; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
   - id: i18n
     tier: core
-    packages: [next-intl]
+    packages: [next-intl, '@starci/next-i18n']
     home: [fe.modules.i18n]
     pattern: FE-I18N
     forbids: [i18next, react-i18next, next-i18next, react-intl, '@lingui/react']
-    why: useTranslations for copy and the next-intl formatter for numbers, fixed dates and currency; FE-DATE owns live time display.
+    why: useTranslations for copy and the next-intl formatter for numbers, fixed dates and currency; FE-DATE owns live time display. The routing, the proxy, the navigation, the request config and the locale read of the layout are @starci/next-i18n's (owner next-i18n-package); an app calls no defineRouting, createNavigation, getRequestConfig or createMiddleware.
   - id: ui
     tier: core
     packages: ['@heroui/react', '@heroui/styles', tailwindcss, '@starci/grammar', react-aria-components]

package/runtime/knowledge/hfs/slots.yaml

@@ -240,6 +240,8 @@ ruleParams:
       "@aws-sdk/s3-request-presigner": []
       "@starci/object-storage": [integrations/object-storage]   # the ObjectStorage port: one S3 adapter for MinIO, S3 and Spaces (R331)
       minio: []                                          # storage goes through @starci/object-storage
+      nodemailer: []                                     # the SMTP client is a dependency of @starci/mail alone; no app file imports it
+      "@starci/mail": [integrations/mail]                # outgoing mail: the Mailer port, parsed and registered by its one glue
       "@supabase": []                                    # no Supabase client in a back end
       "@nestjs/passport": []                             # the identity libraries are @starci/auth's dependencies, never an app's (R328)
       passport: []
@@ -248,8 +250,15 @@ ruleParams:
       "@nestjs/jwt": []
       jose: []
       bcryptjs: []
+      jsonwebtoken: []                                   # no other JWT or OIDC client library in a back end: the tokens of an identity provider are verified by @starci/auth-oidc (R328)
+      jwks-rsa: []
+      jwt-decode: []
+      passport-jwt: []
+      openid-client: []
       "@starci/auth": [integrations/passport]            # the lite sign-in package: its server entry is reached only through integrations/passport (R328)
       "@starci/auth/testing": [integrations/passport]   # its test doubles, for the glue's specs
+      "@starci/auth-oidc": [integrations/keycloak]       # the full sign-in package (jose is its dependency, imported by no app file): its server entry is reached only through integrations/keycloak (R328)
+      "@starci/auth-oidc/testing": [integrations/keycloak]   # its fake issuer, for the glue's specs
       bcrypt: []
       cache-manager: [integrations/cache, integrations/redis]
       "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability
@@ -463,6 +472,14 @@ ruleParams:
       - {name: public.event_bus_bury, reason: "platform/event-bus (add webhook, lite): the move of an exhausted or malformed message to its consumer's dead-letter queue"}
       - {name: public.event_bus_dead_letters, reason: "platform/event-bus (add webhook, lite): the operator read of a consumer's dead-letter queue"}
       - {name: public.event_bus_requeue, reason: "platform/event-bus (add webhook, lite): the operator requeue of one dead letter"}
+      - {name: public.be_auth_user_by_email, reason: "domain/identity (lite sign-in): the account of an exact sign-in address with its bcrypt hash, through the account-doors definer of the baseline"}
+      - {name: public.be_auth_user_by_id, reason: "domain/identity (lite sign-in): the standing of one account by id (a refresh), through the account-doors definer"}
+      - {name: public.be_auth_user_by_google, reason: "domain/identity (lite sign-in): the account a Google subject is linked to, through the account-doors definer"}
+      - {name: public.be_auth_create_user, reason: "domain/identity (lite sign-in): the account a first Google sign-in creates, through the account-doors definer"}
+      - {name: public.be_auth_link_google, reason: "domain/identity (lite sign-in): the link of a Google subject to an account, through the account-doors definer"}
+      - {name: public.be_auth_touch_user, reason: "domain/identity (lite sign-in): the sign-in record of an account and its profile keys, through the account-doors definer"}
+      - {name: public.be_auth_confirm_user, reason: "domain/identity (lite sign-in): the confirmation stamp of a mailbox whose link was spent, through the account-doors definer"}
+      - {name: public.be_auth_set_password, reason: "domain/identity (lite sign-in): the new password hash of a spent reset link (and the mailbox it proved), through the account-doors definer"}
     # R334 (lite): the only `.query(` outside platform/database's composer and the test world is the pass-through of a file listed here
     # (or in hfs.json sides.be.sqlPassThrough), whose SQL text is not the app's own. Paths are relative to the side folder.
     sqlPassThrough:
@@ -590,13 +607,24 @@ slots:
   - id: app.tool-config-local
     since: 3.1.0
     profiles: [app]
-    path: "{tsconfig.json,.eslintrc,.eslintrc.*,.eslintignore,eslint.config.*,.stylelintrc,.stylelintrc.*,.stylelintignore,stylelint.config.*,.prettierrc.*,prettier.config.*,jest.config.*,lint-staged.config.*,.lintstagedrc*}"
+    path: "{tsconfig.json,.eslintrc,.eslintrc.*,.eslintignore,eslint.config.js,eslint.config.cjs,eslint.config.ts,eslint.config.mts,eslint.config.cts,.stylelintrc,.stylelintrc.*,.stylelintignore,stylelint.config.*,.prettierrc.*,prettier.config.*,jest.config.*,lint-staged.config.*,.lintstagedrc*}"
     presence: forbidden
     tracked: external
     tier: none
     tests: none
-    goesTo: "nowhere at the app root: each side holds exactly its managed tool configuration (be.tool-config, fe.tool-config) and the root only the formatter (app.format-config)"
+    goesTo: "nowhere at the app root: each side holds exactly its managed tool configuration (be.tool-config, fe.tool-config) and the root only the formatter (app.format-config) and the eslint config of its root packages (app.packages-lint)"
     rules: [HFS_TOOL_CONFIG_LOCAL]
+  - id: app.packages-lint
+    since: 3.17.0
+    profiles: [app]
+    # The one eslint config at the app root: `starci app sync` renders it when the app has root workspace packages (app.packages), and it lints their
+    # source by subpath (the back-end canon, the front-end canon and the Grammar family each over their own subpaths). No other tool config lives here.
+    path: eslint.config.mjs
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.quality-config
     since: 3.1.0
     profiles: [app]
@@ -828,6 +856,31 @@ slots:
     rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, editions: [lite, full]}
+  - id: app.packages
+    since: 3.17.0
+    profiles: [app]
+    editionWhy: Lite and full share the slot; a product's agent SDK and its agent modules are workspace packages in both.
+    # A workspace package of the app ROOT (packages/agent-sdk, packages/module-<name>): first-party source that both sides import through its
+    # package entry points and never past them (ARCH_INTERNAL_IMPORT_OUTSIDE), linted by the root eslint config by subpath.
+    path: "packages/{agent-sdk,module-<name>}/"
+    presence: optional
+    tracked: tracked
+    tier: none
+    requires: [package.json, tsconfig.json, src/index.ts]
+    tests: unit-beside
+    rules: [HFS_UNUSED_EXPORT]
+  - id: app.module-registry
+    since: 3.17.0
+    profiles: [app]
+    editionWhy: Lite and full share the slot; the registry lists the module packages of the app.
+    path: packages/modules/
+    presence: optional
+    tracked: tracked
+    tier: none
+    requires: [package.json, src/index.ts]
+    allows: [package.json, tsconfig.json, tsconfig.build.json, src/index.ts, src/template/index.ts, src/manifest/index.ts]
+    tests: none
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.sides
     since: 3.1.0
     profiles: [app]
@@ -2003,8 +2056,8 @@ slots:
     profiles: [be]
     editions: [lite]
     editionWhy: "lite signs people in with the package @starci/auth, so its sign-in glue is rendered, not written (owner ruling auth-package); full uses its identity provider."
-    # The identity capability's sign-in glue over @starci/auth: the entities of the session, attempt and user tables, the stores the package asks for (sessions, accounts, rate counter), the authenticator and the service the doors call, with their specs. `starci app sync` renders them; a hand edit is drift.
-    path: "{src/modules/domain/identity/account-directory.service.spec.ts,src/modules/domain/identity/account-directory.service.ts,src/modules/domain/identity/authenticator.service.spec.ts,src/modules/domain/identity/authenticator.service.ts,src/modules/domain/identity/persistence/entities/auth-identity.entity.ts,src/modules/domain/identity/persistence/entities/auth-user.entity.ts,src/modules/domain/identity/persistence/entities/identity-attempt.entity.ts,src/modules/domain/identity/persistence/entities/identity-refresh-token.entity.ts,src/modules/domain/identity/persistence/entities/identity-session.entity.ts,src/modules/domain/identity/persistence/entities/index.ts,src/modules/domain/identity/rate-counter.service.spec.ts,src/modules/domain/identity/rate-counter.service.ts,src/modules/domain/identity/session-store.service.spec.ts,src/modules/domain/identity/session-store.service.ts,src/modules/domain/identity/sign-in.service.spec.ts,src/modules/domain/identity/sign-in.service.ts,src/tests/fixtures/builders/identity.builder.ts}"
+    # The identity capability's sign-in glue over @starci/auth: the entities of the session, attempt, refresh-token and email-token tables, the account doors over auth.users and auth.identities, the stores the package asks for (sessions, accounts, rate counter), the authenticator and the service the doors call, with their specs. `starci app sync` renders them; a hand edit is drift.
+    path: "{src/modules/domain/identity/account-directory.service.spec.ts,src/modules/domain/identity/account-directory.service.ts,src/modules/domain/identity/authenticator.service.spec.ts,src/modules/domain/identity/authenticator.service.ts,src/modules/domain/identity/identity-email.log-events.ts,src/modules/domain/identity/identity-email.service.spec.ts,src/modules/domain/identity/identity-email.service.ts,src/modules/domain/identity/identity-sign-in.log-events.ts,src/modules/domain/identity/persistence/account-doors.port.ts,src/modules/domain/identity/persistence/entities/identity-attempt.entity.ts,src/modules/domain/identity/persistence/entities/identity-email-token.entity.ts,src/modules/domain/identity/persistence/entities/identity-refresh-token.entity.ts,src/modules/domain/identity/persistence/entities/identity-session.entity.ts,src/modules/domain/identity/persistence/entities/index.ts,src/modules/domain/identity/rate-counter.service.spec.ts,src/modules/domain/identity/rate-counter.service.ts,src/modules/domain/identity/session-store.service.spec.ts,src/modules/domain/identity/session-store.service.ts,src/modules/domain/identity/sign-in.service.spec.ts,src/modules/domain/identity/sign-in.service.ts,src/tests/fixtures/builders/identity.builder.ts}"
     presence: optional
     tracked: tracked
     tier: inherit
@@ -2019,7 +2072,7 @@ slots:
     editions: [lite]
     editionWhy: "lite signs people in with the package @starci/auth, so its sign-in glue is rendered, not written (owner ruling auth-package); full uses its identity provider."
     # The auth feature: the REST doors under /auth (login, refresh, session, logout, Google start and callback, jwks) over IdentitySignInService, one command or query and handler per door.
-    path: "{src/features/api/auth/application/auth.contracts.ts,src/features/api/auth/application/get-jwks.handler.ts,src/features/api/auth/application/get-jwks.query.ts,src/features/api/auth/application/google-begin.command.ts,src/features/api/auth/application/google-begin.handler.ts,src/features/api/auth/application/google-complete.command.ts,src/features/api/auth/application/google-complete.handler.ts,src/features/api/auth/application/login.command.ts,src/features/api/auth/application/login.handler.ts,src/features/api/auth/application/logout.command.ts,src/features/api/auth/application/logout.handler.ts,src/features/api/auth/application/refresh.command.ts,src/features/api/auth/application/refresh.handler.ts,src/features/api/auth/application/session.command.ts,src/features/api/auth/application/session.handler.ts,src/features/api/auth/auth.module-definition.ts,src/features/api/auth/auth.module.ts,src/features/api/auth/auth.options.ts,src/features/api/auth/index.ts,src/features/api/auth/transport/http/auth-http.module-definition.ts,src/features/api/auth/transport/http/auth-http.module.ts,src/features/api/auth/transport/http/auth-http.options.ts,src/features/api/auth/transport/http/auth.controller.ts,src/features/api/auth/transport/http/dto/google-start.request.ts,src/features/api/auth/transport/http/dto/login.request.ts}"
+    path: "{src/features/api/auth/application/auth.contracts.ts,src/features/api/auth/application/confirm.command.ts,src/features/api/auth/application/confirm.handler.ts,src/features/api/auth/application/forgot.command.ts,src/features/api/auth/application/forgot.handler.ts,src/features/api/auth/application/get-jwks.handler.ts,src/features/api/auth/application/get-jwks.query.ts,src/features/api/auth/application/google-begin.command.ts,src/features/api/auth/application/google-begin.handler.ts,src/features/api/auth/application/google-complete.command.ts,src/features/api/auth/application/google-complete.handler.ts,src/features/api/auth/application/login.command.ts,src/features/api/auth/application/login.handler.ts,src/features/api/auth/application/logout.command.ts,src/features/api/auth/application/logout.handler.ts,src/features/api/auth/application/refresh.command.ts,src/features/api/auth/application/refresh.handler.ts,src/features/api/auth/application/resend.command.ts,src/features/api/auth/application/resend.handler.ts,src/features/api/auth/application/reset.command.ts,src/features/api/auth/application/reset.handler.ts,src/features/api/auth/application/session.command.ts,src/features/api/auth/application/session.handler.ts,src/features/api/auth/application/signup.command.ts,src/features/api/auth/application/signup.handler.ts,src/features/api/auth/auth.module-definition.ts,src/features/api/auth/auth.module.ts,src/features/api/auth/auth.options.ts,src/features/api/auth/index.ts,src/features/api/auth/transport/http/auth-http.module-definition.ts,src/features/api/auth/transport/http/auth-http.module.ts,src/features/api/auth/transport/http/auth-http.options.ts,src/features/api/auth/transport/http/auth.controller.ts,src/features/api/auth/transport/http/dto/forgot.request.ts,src/features/api/auth/transport/http/dto/google-start.request.ts,src/features/api/auth/transport/http/dto/login.request.ts,src/features/api/auth/transport/http/dto/resend.request.ts,src/features/api/auth/transport/http/dto/reset.request.ts,src/features/api/auth/transport/http/dto/signup.request.ts,src/features/api/auth/transport/http/dto/token.request.ts}"
     presence: optional
     tracked: tracked
     tier: inherit
@@ -2028,6 +2081,25 @@ slots:
     managedBy: auth-lite
     managedOnly: true     # lists files sync renders; the slot owning the path judges them
     rules: [HFS_MANAGED_FILE_DRIFT]
+  - id: be.integrations.mail
+    profiles: [be]
+    editions: [lite]
+    exemplifiedBy:
+      - packages/hfs/templates/be/skeleton-lite/src/modules/integrations/mail/
+    # The glue of @starci/mail, the owner of the SMTP client (nodemailer): this folder parses the settings (the server, the sender and the
+    # link lifetimes of the confirmation and reset mails), registers the module and names the injectors; no app file imports nodemailer,
+    # and no other module imports the package. The words and layout of each mail belong to the domain that sends it.
+    path: "src/modules/integrations/mail/"
+    presence: required
+    tracked: tracked
+    tier: integrations
+    owner: true
+    requires: [index.ts, mail.config.ts, mail.options.ts, mail.decorators.ts, mail.module-definition.ts, mail.module.ts]
+    allows: [index.ts, mail.config.ts, mail.options.ts, mail.decorators.ts, mail.module-definition.ts, mail.module.ts, errors/]
+    tests: unit-beside
+    rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER]
+    coverage: required
+    since: 5.3.0
   - id: be.integrations.object-storage
     profiles: [be]
     exemplifiedBy:
@@ -2047,6 +2119,25 @@ slots:
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER, BE_STORAGE_OWNER]
     coverage: required
     since: 3.9.0
+  - id: be.integrations.keycloak
+    profiles: [be]
+    editions: [full]
+    # The glue of @starci/auth-oidc, the OIDC client of the full edition's identity provider (Keycloak): discovery, the provider's JWKS,
+    # algorithm-pinned token checks and the authorization code flow with PKCE and nonce behind the PrincipalVerifier of @starci/auth.
+    # This folder parses the typed options, hands the package the app's bounded HTTP client and clock, and names the injectors;
+    # no app file imports jose, and no other module imports the package (ruleParams.be.infraOwners).
+    path: "src/modules/integrations/keycloak/"
+    presence: optional
+    tracked: tracked
+    tier: integrations
+    owner: true
+    requires: [index.ts, keycloak.config.ts, keycloak.options.ts, keycloak.decorators.ts, keycloak.registration.ts]
+    allows: [index.ts, keycloak.config.ts, keycloak.options.ts, keycloak.decorators.ts, keycloak.registration.ts, errors/, messages/]
+    tests: unit-beside
+    rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER, BE_AUTH_PASSPORT_OWNER, BE_INTEGRATION_SPEC_MISSING]
+    coverage: required
+    since: 3.17.0
+
 
   # ----- BE: tests (owner test layout 2026-09-30). Unit specs are <name>.service.spec.ts beside their service and nothing else; everything else
   # lives under src/tests/, one folder per kind, and the folder and the file suffix always agree (a file whose suffix does
@@ -2520,9 +2611,9 @@ slots:
     presence: required
     tracked: tracked
     tier: foundation
-    # The app's routing, request config and catalogs, or its adapter to the shared i18n factory. A single app
-    # owns createNavigation in fe.modules.routes, keeping this public entry safe for its proxy. Shared stacks
-    # belong to fe.package.i18n and expose a routing-only proxy entry separately from navigation.
+    # The app's description of its languages (defineI18n of @starci/next-i18n), its request config and catalogs, or its adapter to the
+    # shared i18n workspace package. A single app builds its navigation (createI18nNavigation) in fe.modules.routes, keeping this
+    # public entry safe for its proxy. A description shared by several apps belongs to fe.package.i18n.
     requires: [index.ts]
     tests: none
     rules: [FE_I18N_PLACEMENT, FE_I18N_CATALOG]
@@ -2592,7 +2683,7 @@ slots:
     editions: [lite]
     editionWhy: "lite signs people in with the package @starci/auth, so its auth client is rendered, not written (owner ruling auth-package); full wires its identity provider."
     # The AuthClient every edition shares, implemented by one @starci/auth/client instance over the app's own back-end auth doors.
-    path: "apps/web/src/modules/auth/client.ts"
+    path: "apps/web/src/modules/auth/{client.ts,email-doors.ts,index.ts}"
     presence: optional
     tracked: tracked
     tier: inherit
@@ -2674,7 +2765,7 @@ slots:
     owner: true
     requires: [package.json, src/index.ts, tsconfig.json]
     tests: none
-    why: the next-intl stack (routing, navigation, request config) written once, exported as the createAppI18n factory every app calls
+    why: the product's languages (defineI18n of @starci/next-i18n) written once and composed into the createAppI18n factory every app calls; the next-intl stack itself is the package's
     rules: [FE_I18N_PLACEMENT, FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
 
 # Checks that read this manifest (all ship from .claude; none keeps its own path list)

package/runtime/scripts/hfs/architecture/config.mjs

@@ -3,7 +3,8 @@ import path from 'node:path';
 import { slash } from '../../lib/path-key.mjs';
 import { readJsonFile as readJson } from '../../lib/json.mjs';
 import { isInside } from '../../lib/walk.mjs';
-import { openHfs } from '../slots.mjs';
+import { createSlotResolver, openHfs, readRepoDeclaration } from '../slots.mjs';
+import { ROOT_PACKAGE_SLOTS, rootPackageRecord, rootWorkspaceDirectories } from './root-packages.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 import { grammarContractFor } from '../../lib/grammar-lint.mjs';
 /** A file's identity: its resolved real path, or the resolved path when it does not exist. */
@@ -182,6 +183,28 @@ function workspaceDirectories(root, { packageRoot: appPackageRoot = root, side =
     }
     return [...directories].sort(byCodeUnit);
 }
+/**
+ * The workspace packages of the app root that no side owns: the `workspaces` patterns of the app's one package.json that do not start
+ * with a side folder (`packages/*`), and the directories the slots `app.packages` and `app.module-registry` place under `packages/`
+ * even when the manifest forgot to list them. A side imports them as first-party packages (through their entry points), never as
+ * "outside the side". A side of the app is judged here; the app root itself already counts them among its workspaces.
+ */
+function rootPackageRecords(root, packageRoot, side, opened) {
+    if (side === null)
+        return [];
+    const candidates = new Set(rootWorkspaceDirectories(packageRoot));
+    if (opened.manifest && existingDirectory(packageRoot, 'packages')) {
+        const resolver = createSlotResolver(opened.manifest, readRepoDeclaration(opened.manifest, packageRoot));
+        const container = path.join(packageRoot, 'packages');
+        for (const entry of fs.readdirSync(container, { withFileTypes: true }).filter(item => item.isDirectory())) {
+            const slot = resolver.classifyPath(`packages/${entry.name}`).slot;
+            if (slot !== undefined && ROOT_PACKAGE_SLOTS.has(slot))
+                candidates.add(path.join(container, entry.name));
+        }
+    }
+    return [...candidates].sort(byCodeUnit).filter(candidate => !isInside(root, candidate))
+        .flatMap(candidate => rootPackageRecord(packageRoot, candidate, canonical) ?? []);
+}
 function discoveredProjects(root, workspaces) {
     const projects = [];
     if (fs.existsSync(path.join(root, 'tsconfig.json')))
@@ -373,6 +396,7 @@ export function loadArchitectureConfig(repositoryRoot, { hfs } = {}) {
         kinds,
         projects,
         workspaces,
+        rootPackages: rootPackageRecords(root, packageRoot, side, opened),
         apps: apps.map(app => ({ name: app.name, kind: app.kind })),
         hfs: opened,
         owners: derivedOwners(root, opened),

package/runtime/scripts/hfs/architecture/module-per-transport.mjs

@@ -11,7 +11,7 @@ import { trimTrailingSlashes } from '../trailing-slashes.mjs';
  *
  *   - a `*.module.ts` file below a transport folder other than `<f>-<protocol>.module.ts`, a `*.module-definition.ts` that is
  *     not the sibling of the application module or of the transport module of its own folder, and an `@Module` class (or a
- *     `ConfigurableModuleBuilder`/`ConfigurableModuleClass` use) in a feature file that is neither the application module, the
+ *     `ConfigurableModuleBuilder`/`ConfigurableModuleClass` use or a `defineConfigurableModule`/`defineCapabilityModule` call of `@starci/nest-kit`) in a feature file that is neither the application module, the
  *     transport module of its own folder nor that module's definition are refused;
  *   - apps import only transport modules, of the kinds their app kind allows: the `composedBy` list of each transport slot
  *     in knowledge/hfs/slots.yaml (api: graphql, http, websocket; worker: schedule, message). An app root (app.module.ts
@@ -99,6 +99,8 @@ function reportModuleClassLocation(file, name, place, composedModuleOf, report)
     if (file.rel !== own)
         report(file, name, `${name.text} is a Nest module declared in ${file.rel}; a feature declares exactly its application module (${place.feature}.module.ts) and one module per transport folder (${place.feature}-<protocol>.module.ts), never a module per operation.`, { feature: place.feature });
 }
+/** The module-definition helpers of @starci/nest-kit: each builds the definition of one module, like `ConfigurableModuleBuilder`. */
+const DEFINITION_HELPERS = ['defineConfigurableModule', 'defineCapabilityModule'];
 function reportConfigurableModuleUses(file, checker, kit, ts, place, env) {
     const own = ownModuleOf(place, file.rel, env.composedModuleOf);
     const isDefinition = file.rel === definitionOf(own);
@@ -106,6 +108,9 @@ function reportConfigurableModuleUses(file, checker, kit, ts, place, env) {
         if (ts.isNewExpression(node) && kit.isImportOf(checker, node.expression, 'ConfigurableModuleBuilder', '@nestjs/common') && !isDefinition) {
             env.report(file, node, `ConfigurableModuleBuilder builds the module definition of one module; in feature ${place.feature} it is written only in ${path.posix.basename(definitionOf(own))}, beside ${path.posix.basename(own)}.`, { feature: place.feature });
         }
+        else if (ts.isCallExpression(node) && !isDefinition && DEFINITION_HELPERS.some(name => kit.isImportOf(checker, node.expression, name, '@starci/nest-kit'))) {
+            env.report(file, node, `${node.expression.getText(file.sourceFile)} builds the module definition of one module; in feature ${place.feature} it is written only in ${path.posix.basename(definitionOf(own))}, beside ${path.posix.basename(own)}.`, { feature: place.feature });
+        }
         else if (ts.isHeritageClause(node) && file.rel !== own) {
             for (const type of node.types)
                 if (kit.isImportOf(checker, type.expression, 'ConfigurableModuleClass', '@nestjs/common')) {

package/runtime/scripts/hfs/architecture/root-packages.mjs

@@ -0,0 +1,78 @@
+// root-packages.mjs - the workspace packages of an app ROOT (packages/agent-sdk, packages/module-<name>, the managed packages/modules).
+// They lie outside both side folders and belong to no side; both sides import them by package name, through their package entry points
+// (the `exports` of the manifest), so the import graph reads them as first-party packages and the back-end canon never reads them as
+// a third-party library. The app root's one package.json lists them in `workspaces`; the patterns that start with a side folder
+// (`fe/apps/*`) are that side's own workspaces and are not read here.
+import fs from 'node:fs';
+import path from 'node:path';
+import { readJsonFile as readJson } from '../../lib/json.mjs';
+import { byCodeUnit } from '../../lib/list.mjs';
+import { isInside } from '../../lib/walk.mjs';
+import { slash } from '../../lib/path-key.mjs';
+/** The slots whose directories at the app root are first-party packages of the app (agent SDK, module packages, the managed registry). */
+export const ROOT_PACKAGE_SLOTS = new Set(['app.packages', 'app.module-registry']);
+const SIDE_PREFIX = /^(?:be|fe)\//;
+/** A workspace pattern this reader expands (a literal path, or `*` as a whole segment); the others are judged by the workspace rules. */
+const expandablePattern = (written) => !path.isAbsolute(written) && written.split('/').every(segment => segment !== '..' && (!segment.includes('*') || segment === '*'));
+function expandSegment(base, segment) {
+    if (segment !== '*')
+        return [path.join(base, segment)];
+    if (!fs.existsSync(base) || !fs.lstatSync(base).isDirectory())
+        return [];
+    return fs.readdirSync(base, { withFileTypes: true }).filter(item => item.isDirectory()).sort((a, b) => byCodeUnit(a.name, b.name)).map(item => path.join(base, item.name));
+}
+/** A package folder with a regular package.json (a link is not one). */
+export function packageDirectory(absolute) {
+    try {
+        if (!fs.lstatSync(absolute).isDirectory())
+            return false;
+        const manifest = fs.lstatSync(path.join(absolute, 'package.json'));
+        return manifest.isFile() && !manifest.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/** The folders the `workspaces` of the app root's package.json name that no side owns, as absolute paths in code-unit order. */
+export function rootWorkspaceDirectories(packageRoot) {
+    const manifest = readJson(path.join(packageRoot, 'package.json'));
+    const declared = manifest?.workspaces;
+    const patterns = Array.isArray(declared) ? declared : declared?.packages;
+    const found = new Set();
+    for (const pattern of Array.isArray(patterns) ? patterns : []) {
+        if (typeof pattern !== 'string' || !pattern.trim())
+            continue;
+        const written = slash(pattern.trim()).replace(/^\.\//, '');
+        if (SIDE_PREFIX.test(written) || !expandablePattern(written))
+            continue;
+        let bases = [packageRoot];
+        for (const segment of written.split('/'))
+            bases = bases.flatMap(base => expandSegment(base, segment));
+        for (const base of bases)
+            found.add(path.resolve(base));
+    }
+    return [...found].sort(byCodeUnit);
+}
+/**
+ * The record of one package folder of the app root, or null when it is no named package inside the app root.
+ * `canonical` is the file-identity function of the caller (the real path), so a record agrees with the files the graph reads.
+ */
+export function rootPackageRecord(packageRoot, directory, canonical) {
+    if (!packageDirectory(directory) || !isInside(packageRoot, directory))
+        return null;
+    const manifest = readJson(path.join(directory, 'package.json'));
+    const name = manifest?.['name'];
+    if (manifest === null || typeof name !== 'string' || !name)
+        return null;
+    return { root: canonical(directory), relative: slash(path.relative(packageRoot, directory)), name, exports: manifest['exports'], manifest, workspace: true, app: false };
+}
+/** The names of the workspace packages of the app root: what the back-end canon must not read as third-party libraries. */
+export function rootPackageNames(packageRoot) {
+    const names = new Set();
+    for (const directory of rootWorkspaceDirectories(packageRoot)) {
+        const record = rootPackageRecord(packageRoot, directory, (file) => file);
+        if (record !== null)
+            names.add(record.name);
+    }
+    return names;
+}

package/runtime/scripts/hfs/architecture/type-context.mjs

@@ -241,8 +241,38 @@ function appendEdge(from, sourceFile, project, owningWorkspace, reference, actua
             errors.push(helpers.boundaryViolation(config.root, edge, owningWorkspace, targetWorkspace, 'ARCH_PACKAGE_EXPORT_BYPASS', 'Cross-package imports must use the target package name and a declared package export.'));
     }
 }
+/**
+ * An import of one of the app's root workspace packages (`@scope/agent-sdk`, `@scope/agent-sdk/workbench`). The package lies outside the side
+ * folder, yet it is first-party source both sides may import: through its package entry points (the `exports` of its manifest) and never past
+ * them. An entry point is no import that leaves the side and adds no edge (the package is not part of this side's graph; the package's own
+ * lint judges its files); a path into the package's source is refused. Returns true when the reference was settled here.
+ */
+function rootPackageReference(sourceFile, project, reference, state) {
+    const { config, errors, helpers, host, ts } = state;
+    if (!config.rootPackages?.length)
+        return false;
+    const item = helpers.rootPackageOf(config, reference.specifier);
+    if (item === null)
+        return false;
+    if (!helpers.rootPackageEntryDeclared(item, reference.specifier)) {
+        errors.push({
+            ruleId: 'ARCH_INTERNAL_IMPORT_OUTSIDE',
+            project: project.relative,
+            path: helpers.relativePath(config.root, sourceFile.fileName),
+            ...helpers.sourceLocation(sourceFile, reference.node),
+            specifier: reference.specifier,
+            message: `Internal import ${reference.specifier} reaches into the package ${item.name} past its package entry points; import ${helpers.rootPackageEntries(item).join(', ')} instead.`,
+        });
+        return true;
+    }
+    // An entry point that a path alias sends outside the package is no entry point: the ordinary boundary judges it.
+    const resolved = helpers.resolveTypeScriptModule(ts, reference.specifier, sourceFile.fileName, project.options, host, resolutionCache(state, project));
+    return resolved === undefined || helpers.isInside(item.root, helpers.canonical(resolved));
+}
 function processReference(from, sourceFile, project, owningWorkspace, reference, state) {
     const { config, ts, workspaceNames, workspaces, host, errors, helpers } = state;
+    if (rootPackageReference(sourceFile, project, reference, state))
+        return;
     // A workspace package is read at its source, never at its build: the same import resolves whether or not dist exists.
     const workspaceTarget = workspaces.filter(item => item.root !== helpers.canonical(config.root)).map(item => helpers.workspaceSourceEntry(ts, item, reference.specifier)).find(Boolean);
     const resolvedName = workspaceTarget ?? helpers.resolveTypeScriptModule(ts, reference.specifier, sourceFile.fileName, project.options, host, resolutionCache(state, project));

package/runtime/scripts/hfs/architecture/typescript.mjs

@@ -385,6 +385,26 @@ function packageExported(ts, workspace, specifier, actualTarget) {
         return expected === canonical(actualTarget) || sourceOfTarget(ts, workspace, target) === canonical(actualTarget);
     });
 }
+/** The root workspace package of the app (`packages/agent-sdk`) a specifier names, its name or a subpath of it; the longest name when several match. */
+export function rootPackageOf(config, specifier) {
+    let found = null;
+    for (const item of config.rootPackages ?? [])
+        if (sameOrUnder(specifier, item.name) && (found === null || item.name.length > found.name.length))
+            found = item;
+    return found;
+}
+/** Whether a specifier into a root package names one of its entry points: a subpath its `exports` declare, or its root through `exports`, `main`/`types` or `src/index`. A path into its source is not an entry point. */
+export function rootPackageEntryDeclared(item, specifier) {
+    if (exportCandidates(item, specifier).length > 0)
+        return true;
+    return specifier === item.name && !item.exports && (manifestEntryTargets(item.manifest).length > 0 || packageIndexSource(item) !== null);
+}
+/** The subpaths a root package declares for import (`.` first), for the message of a refused deep import. */
+export function rootPackageEntries(item) {
+    const declaration = item.exports;
+    const keys = declaration && typeof declaration === 'object' && !Array.isArray(declaration) ? Object.keys(declaration).filter(key => key.startsWith('.')) : ['.'];
+    return (keys.length ? keys : ['.']).map(key => (key === '.' ? item.name : `${item.name}${key.slice(1)}`));
+}
 function boundaryViolation(root, edge, fromWorkspace, toWorkspace, ruleId, message) {
     return {
         ruleId,
@@ -413,7 +433,7 @@ function typeScriptContext(config, loaded, paths) {
         canonical, compilerError, isInside, slash, readTypeScriptProject, typeScriptProjectReferencePath,
         sameOrUnder, createTypeScriptProgram, isProductionSource, sourceLocation, workspaceMetadata, workspaceOf,
         pathAliasMatches, moduleReferences, workspaceSourceEntry, resolveTypeScriptModule, crossesSide, assetExtension: ASSET_EXTENSION,
-        relativePath, packageExported, boundaryViolation,
+        relativePath, packageExported, boundaryViolation, rootPackageOf, rootPackageEntryDeclared, rootPackageEntries,
     });
 }
 export function relativePath(root, fileName) {

package/runtime/scripts/hfs/explicit-surface-rule.mjs

@@ -6,7 +6,7 @@ const HINTS = {
     'parameter type': 'Give the parameter a type: `(value: Input)`.',
     'property type': 'Give the property a type: `name: Result = ...`.',
     'accessor type': 'Give the accessor a type: `get name(): Result` (a setter takes it from its parameter).',
-    'destructured export': 'A destructuring pattern cannot carry a type per name: export each name as its own variable with a type, `export const name: Type = source.name`.',
+    'destructured export': 'A destructuring pattern cannot carry a type per name: export each name as its own variable with a type, `export const name: Type = source.name`; a module definition is `export const { ConfigurableModuleClass, OPTIONS_TYPE } = defineCapabilityModule<XOptions>()` (or `defineConfigurableModule`) of @starci/nest-kit, which states the types (`starci app codemod module-definition` writes it).',
     'exported value': 'Declare the type (an interface or a type alias) and annotate the export with it: `export const name: Shape = ...`.',
 };
 /** The `--isolatedDeclarations` flag name TypeScript ends its reasons with says nothing to the reader. */

package/runtime/scripts/hfs/view.mjs

@@ -5,6 +5,7 @@
 import path from 'node:path';
 import { allowsFile } from './allows.mjs';
 import { openHfs } from './slots.mjs';
+import { ROOT_PACKAGE_SLOTS } from './architecture/root-packages.mjs';
 const posix = (p) => String(p).replaceAll('\\', '/');
 const isAbsoluteAny = (text) => path.isAbsolute(text) || /^[A-Za-z]:\//.test(text);
 /**
@@ -69,3 +70,70 @@ export const openHfsView = ({ runtimeRoot, repoRoot }) => hfsView(openHfs({ root
  * @returns {object} The frozen view.
  */
 export const declaredHfsView = ({ runtimeRoot, declaration, repoRoot, side }) => hfsView(openHfs({ root: runtimeRoot, declaration, side }), repoRoot);
+/**
+ * The view of the root workspace packages of an app (`packages/<pkg>/src/**`, slots app.packages and app.module-registry), as the lint of one
+ * side sees them: the rule parameters, the apps and the Grammar of `side` (a package is judged by the laws of the side whose subpath a file
+ * sits in), and the paths of the APP ROOT (`repoRoot` is the app root, not a side folder). The slots answer for the root paths; a file of a
+ * package is of the tier `package` and has no owner: the owner laws (one `index.ts` per owner root) are the module folders', a package's public
+ * surface being the `exports` of its manifest.
+ *
+ * @param {object} opened - The result of `openHfs` for the app root (profile app, both sides resolved).
+ * @param {string} repoRoot - The absolute app root.
+ * @param {string} side - `be` or `fe`: the side whose laws the file is judged by.
+ * @returns {object} The frozen view: the profile of the side over the paths of the app root.
+ */
+function packagesView(opened, repoRoot, side) {
+    const scope = opened.sides?.[side];
+    const sideRepo = opened.repo.sides?.[side];
+    if (scope === undefined || sideRepo === undefined)
+        throw new Error('the view of the root packages needs the declaration of an app with both sides');
+    const rel = (file) => {
+        const text = posix(file);
+        return isAbsoluteAny(text) ? posix(path.relative(repoRoot, file)) : text.replace(/^\.\//, '');
+    };
+    const cache = new Map();
+    const classify = (file) => {
+        const key = rel(file);
+        if (!cache.has(key))
+            cache.set(key, opened.classifyPath(key));
+        return cache.get(key);
+    };
+    const packageOf = (file) => {
+        const slot = classify(file).slot;
+        const relative = rel(file);
+        return slot !== undefined && ROOT_PACKAGE_SLOTS.has(slot) ? relative.split('/').slice(0, 2).join('/') : null;
+    };
+    return Object.freeze({
+        repoRoot,
+        profile: side,
+        side,
+        edition: opened.repo.edition ?? 'full',
+        ...(sideRepo.grammar === undefined ? {} : { grammar: sideRepo.grammar }),
+        apps: sideRepo.apps,
+        connections: sideRepo.connections,
+        patterns: Object.freeze([...(sideRepo.patterns ?? [])]),
+        ruleParams: scope.ruleParams(),
+        relative: rel,
+        classify,
+        slotOf: (file) => classify(file).slot ?? null,
+        tierOf: (file) => (packageOf(file) === null ? null : 'package'),
+        // A package is no owner of the module laws (one index.ts at the owner root): its public surface is the `exports` of its manifest, so no file of it has an owner.
+        ownerOf: () => null,
+        allows: (file) => allowsFile(opened, rel(file)),
+        slot: (id) => opened.slot(id),
+    });
+}
+/**
+ * The view of the root packages of the app at `repoRoot` (the app root, where the root `eslint.config.mjs` lives), for the laws of `side`.
+ *
+ * @param {{ runtimeRoot: string, repoRoot: string, side: string }} input - Where the manifest copy lives, the app root, and the side whose laws apply.
+ * @returns {object} The frozen view.
+ */
+export const openPackagesHfsView = ({ runtimeRoot, repoRoot, side }) => packagesView(openHfs({ root: runtimeRoot, repoRoot }), repoRoot, side);
+/**
+ * The view of the root packages of an in-memory app declaration (rule tests): no file is read except the manifest.
+ *
+ * @param {{ runtimeRoot: string, declaration: object, repoRoot: string, side: string }} input - Manifest root, the app hfs.json object, the app root and the side.
+ * @returns {object} The frozen view.
+ */
+export const declaredPackagesHfsView = ({ runtimeRoot, declaration, repoRoot, side }) => packagesView(openHfs({ root: runtimeRoot, declaration }), repoRoot, side);

package/runtime/scripts/lib/declaration-surface.mjs

@@ -55,6 +55,52 @@ function returnsOnlyJsx(ts, source, start) {
     ts.forEachChild(fn.body, visit);
     return only;
 }
+/** The package whose module-definition helpers return a type they state in their own declaration (R368 accepts a destructured export of their call). */
+export const STATED_SURFACE_PACKAGE = '@starci/nest-kit';
+/** The helpers of that package: each is called with the options type as a type argument and returns the explicitly typed definition. */
+export const STATED_SURFACE_HELPERS = new Set(['defineConfigurableModule', 'defineCapabilityModule']);
+/** The local names under which `source` imports a stated-surface helper from its package (`import { defineConfigurableModule as define }` gives `define`). */
+function statedHelperNames(ts, source) {
+    const names = new Set();
+    for (const statement of source.statements) {
+        if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier) || statement.moduleSpecifier.text !== STATED_SURFACE_PACKAGE)
+            continue;
+        const bindings = statement.importClause?.namedBindings;
+        if (bindings === undefined || !ts.isNamedImports(bindings))
+            continue;
+        for (const element of bindings.elements)
+            if (STATED_SURFACE_HELPERS.has((element.propertyName ?? element.name).text))
+                names.add(element.name.text);
+    }
+    return names;
+}
+/**
+ * Whether the destructured export the diagnostic at `start` points at is `export const { A, B } = helper<Options>()` for a stated-surface helper:
+ * each name has the type the helper's declaration gives it, written there, so the file states its surface by naming the helper and the options
+ * type, exactly as `export const A: Host["A"] = built.A` states it through `Host`.
+ */
+function statesSurfaceThroughHelper(ts, source, start) {
+    const helpers = statedHelperNames(ts, source);
+    if (helpers.size === 0)
+        return null;
+    let innermost = source;
+    const descend = (node) => {
+        if (start < node.getFullStart() || start >= node.end)
+            return;
+        innermost = node;
+        ts.forEachChild(node, descend);
+    };
+    ts.forEachChild(source, descend);
+    for (let node = innermost; node !== undefined && node !== source; node = node.parent) {
+        if (!ts.isVariableDeclaration(node))
+            continue;
+        const call = node.initializer;
+        const stated = ts.isObjectBindingPattern(node.name) && call !== undefined && ts.isCallExpression(call) && ts.isIdentifier(call.expression) && helpers.has(call.expression.text)
+            && (call.typeArguments?.length ?? 0) > 0 && node.name.elements.every((element) => ts.isIdentifier(element.name) && element.dotDotDotToken === undefined);
+        return stated && call !== undefined ? call.getText(source) : null;
+    }
+    return null;
+}
 /** What to annotate for each isolated-declaration diagnostic code; any other code asks for the exported value's type. */
 const ANNOTATE = new Map([
     [9007, 'return type'], [9008, 'return type'], [9009, 'accessor type'], [9010, 'variable type'], [9011, 'parameter type'], [9012, 'property type'],
@@ -98,7 +144,14 @@ export function declarationSurface(ts, file, text, module) {
         return { outputText: declared.outputText, problems: [] };
     const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, file.endsWith('x') ? ts.ScriptKind.TSX : ts.ScriptKind.TS);
     const problems = [];
+    // The emit writes `any` for a destructured export; the call that states its type joins the digest, so a change of the options type reaches the importers.
+    const stated = new Set();
     for (const diagnostic of diagnostics) {
+        const call = diagnostic.code === 9019 && diagnostic.start !== undefined ? statesSurfaceThroughHelper(ts, source, diagnostic.start) : null;
+        if (call !== null) {
+            stated.add(call);
+            continue;
+        }
         const exempt = (diagnostic.code === 9007 || diagnostic.code === 9008) && diagnostic.start !== undefined && returnsOnlyJsx(ts, source, diagnostic.start);
         if (exempt)
             continue;
@@ -108,5 +161,6 @@ export function declarationSurface(ts, file, text, module) {
             reason: ts.flattenDiagnosticMessageText(diagnostic.messageText, '\n').split('\n')[0] ?? '',
         });
     }
-    return { outputText: declared.outputText, problems };
+    const outputText = stated.size === 0 ? declared.outputText : `${declared.outputText}${[...stated].sort().map((call) => `// stated by ${call}\n`).join('')}`;
+    return { outputText, problems };
 }