@starci/eslint-canon-fe 9.4.9 → 9.5.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 9.5.0 - 2026-10-29
+
+- Changed: `modules/auth` is the session issuer's client. `fetch-only-in-api-client` admits axios in `modules/auth/auth-door.ts` and refuses a door call whose readable path names no `/auth/` door; `no-shared-transport-state` judges `modules/auth` and admits only `modules/auth/token-store.ts`; the machine `transport-owner` admits the auth door. `fe-stack-import` no longer carves Supabase into `modules/auth`: the fe-stack catalog forbids `@supabase/supabase-js`, `@supabase/ssr` and `@supabase/auth-js` everywhere and lists `fe.modules.auth` as a home of axios.
+- Removed: `callback-shape` (R287 `FE_CALLBACK_SHAPE`) with the `fe.route.callback` slot: the OAuth callback is a back-end door.
+- Changed: the bundled slot manifest 3.9.0 replaces the lite `app.supabase*` slots with `app.db` (`db/migrations`, `db/migrations/archive`, `db/seed.sql`, the managed `db/bootstrap.sql`), `be.integrations.supabase` with `be.integrations.passport` and `be.integrations.object-storage`, removes `fe.route.callback`, sets lite `schemaAuthority: sql`, gives lite TypeORM entities in `be.persistence`, adds `ruleParams.be.dbFunctions`, and moves the S3 SDKs to `integrations/object-storage` and the identity libraries to `integrations/passport` in `infraOwners` (`@supabase/*`, `minio` and `bcrypt` nowhere); the bundled rule catalog retires R216, R217, R219, R254 and R287 and adds R328-R334; the bundled canon pins name hfs 4.10.0, eslint-canon-be 3.7.0, eslint-canon-fe 9.5.0 and the Grammar family 0.15.11, pin `@nestjs/passport` 11.0.5 (CommonJS on the Nest 11 line), `passport` 0.7.0, `passport-google-oauth20` 2.0.0, `passport-local` 1.0.0, `bcryptjs` 3.0.3 and their types (tokens are signed and verified with `jose`; `@nestjs/jwt` stays allowed in `integrations/passport` but unpinned), and drop `@supabase/ssr`, `@supabase/supabase-js` and the `supabase` CLI.
+
+
 ## 9.4.9 - 2026-10-29
 
 - Changed: the bundled slot manifest gives the model libraries their owners in `ruleParams.be.infraOwners` (`@starci/ai-router` to `integrations/ai-gateway`, `@langchain/*` to `integrations/ai`; `openai`, `langchain`, `@langchain/langgraph`, `@langchain/community` and the provider SDKs nowhere) and lists R326 and R327 on `be.integrations`; the bundled canon pins name hfs 4.9.11, eslint-canon-be 3.6.8, eslint-canon-fe 9.4.9, the Grammar family 0.15.10 (grammar, eslint-grammar-core, eslint-grammar-offset-pop), and pin `@langchain/core` 1.3.1 and `@langchain/openai` 1.8.0. No rule changed.

package/dist/fe-stack.d.ts

@@ -1,9 +1,9 @@
 import { type Rules, type Recommended } from "./lib/rule.js";
+/** The package scope only the identity-provider client may import. */
 /**
- * No import (static, re-export, dynamic or `require`) of a package the fe-stack catalog forbids, and no `@supabase/*` outside
- * `modules/auth`. Type-only imports count: a type import still makes the package a dependency of the front end.
+ * No import (static, re-export, dynamic or `require`) of a package the fe-stack catalog forbids.
  */
-export declare const feStackImport: import("./lib/rule.js").Rule<"forbidden" | "supabase", []>;
+export declare const feStackImport: import("./lib/rule.js").Rule<"forbidden", []>;
 /** The rules this law contributes to the plugin. */
 export declare const rules: Rules;
 /** Every rule is an error: a second library for a concern is the defect, not a style. */

package/dist/fe-stack.js

@@ -1,26 +1,22 @@
 import { defineRule } from "./lib/rule.js";
 import { forbiddingConcern, packageNameOf } from "./lib/fe-stack.js";
-import { globalReferences, inSlot, isProductSource } from "./lib/scope.js";
+import { globalReferences, isProductSource } from "./lib/scope.js";
 /** The package scope only the identity-provider client may import. */
-const SUPABASE_SCOPE = "@supabase/";
 /**
- * No import (static, re-export, dynamic or `require`) of a package the fe-stack catalog forbids, and no `@supabase/*` outside
- * `modules/auth`. Type-only imports count: a type import still makes the package a dependency of the front end.
+ * No import (static, re-export, dynamic or `require`) of a package the fe-stack catalog forbids.
  */
 export const feStackImport = defineRule({
     meta: {
         type: "problem",
-        docs: { description: "A front end imports no library the fe-stack catalog forbids, and `@supabase/*` only in `modules/auth`." },
+        docs: { description: "A front end imports no library the fe-stack catalog forbids." },
         schema: [],
         messages: {
             forbidden: "`{{name}}` is a forbidden alternative for the {{concern}} concern of the front-end stack. The stack has one library per concern, the same in every app and both editions: use {{canonical}} ({{pattern}}). {{why}}",
-            supabase: "`{{name}}` is imported outside `modules/auth`. Supabase on the front end is the auth client only, held by `modules/auth` (the session, the access token the Apollo link attaches, sign-in and sign-out); data is read and written through the GraphQL operations of `modules/api`, never through Supabase from the browser.",
         },
     },
     create(context) {
         if (!isProductSource(context))
             return {};
-        const authOwner = inSlot(context, "fe.modules.auth");
         const judge = (node, source) => {
             const name = packageNameOf(source);
             if (name === null || name === undefined)
@@ -32,8 +28,6 @@ export const feStackImport = defineRule({
                 context.report({ node, messageId: "forbidden", data: { name, concern: concern.id, canonical, pattern: concern.pattern ?? "", why: concern.why ?? "" } });
                 return;
             }
-            if (name.startsWith(SUPABASE_SCOPE) && !authOwner)
-                context.report({ node, messageId: "supabase", data: { name } });
         };
         return {
             ImportDeclaration(node) {

package/dist/index.js

@@ -274,10 +274,8 @@ Object.assign(recommended, functionBudgetRecommended);
 // source-only catalog discovery can find them. The appended registration gives each module
 // ownership of those same rule instances without declaring either rule twice.
 import { recommended as swrFamilyRecommended, rules as swrFamilyRules } from "./swr-family.js";
-import { recommended as callbackShapeRecommended, rules as callbackShapeRules } from "./callback-shape.js";
 const A14_CONTRIBUTIONS = [
     { law: "swr-family", rules: swrFamilyRules, recommended: swrFamilyRecommended },
-    { law: "callback-shape", rules: callbackShapeRules, recommended: callbackShapeRecommended },
 ];
 for (const addition of A14_CONTRIBUTIONS) {
     const names = new Set(Object.keys(addition.rules));

package/dist/lib/scope.d.ts

@@ -39,6 +39,14 @@ export declare const isProductSource: (context: AnyContext) => boolean;
 export declare const isComponentFile: (context: AnyContext) => boolean;
 /** True when the given file (an absolute or repo-relative name, e.g. where an import resolves to) sits in a component layer of slot `fe.components` or `fe.package.ui`. */
 export declare const isComponentPath: (context: AnyContext, file: string) => boolean;
+/**
+ * The one auth door of the session issuer's client: `modules/auth/auth-door.ts` (slot `fe.modules.auth`). It alone calls the app's
+ * own back-end auth doors (login, signup, refresh, logout, password reset, resend verification) with the REST client, credentials
+ * included; every other file of `modules/auth` and every other module stays outside the transport.
+ */
+export declare const isAuthDoor: (context: AnyContext) => boolean;
+/** The in-memory access-token store of `modules/auth` (`modules/auth/token-store.ts`), the one module-level mutable state the auth client keeps. */
+export declare const isAuthTokenStore: (context: AnyContext) => boolean;
 /** The one place that may read the environment: slot `fe.modules.config`. */
 export declare const isConfigModule: (context: AnyContext) => boolean;
 /**

package/dist/lib/scope.js

@@ -48,6 +48,16 @@ export const isComponentPath = (context, file) => {
     const found = hfsOf(context).classify(file);
     return (found.slot === "fe.components" || found.slot === "fe.package.ui") && found.kind !== undefined;
 };
+/** The base name of the linted file. */
+const baseNameOf = (context) => (context.filename || context.getFilename()).split(/[\\/]/).at(-1) ?? "";
+/**
+ * The one auth door of the session issuer's client: `modules/auth/auth-door.ts` (slot `fe.modules.auth`). It alone calls the app's
+ * own back-end auth doors (login, signup, refresh, logout, password reset, resend verification) with the REST client, credentials
+ * included; every other file of `modules/auth` and every other module stays outside the transport.
+ */
+export const isAuthDoor = (context) => inSlot(context, "fe.modules.auth") && baseNameOf(context) === "auth-door.ts";
+/** The in-memory access-token store of `modules/auth` (`modules/auth/token-store.ts`), the one module-level mutable state the auth client keeps. */
+export const isAuthTokenStore = (context) => inSlot(context, "fe.modules.auth") && baseNameOf(context) === "token-store.ts";
 /** The one place that may read the environment: slot `fe.modules.config`. */
 export const isConfigModule = (context) => inSlot(context, "fe.modules.config");
 /**

package/dist/lib/why.js

@@ -339,8 +339,8 @@ export const why = {
     },
     "fe-stack-import": {
         code: "FE_STACK_FORBIDDEN",
-        en: "`<file>` imports `<what>`, a package or scoped package family the front-end stack forbids, or a Supabase package outside `modules/auth`.",
-        fix: "Use the concern's canonical library from `knowledge/hfs/fe-stack.yaml` (the message names it). For @dicebear/*, pass the identity id as seed on Grammar Avatar, AvatarButton or AvatarGroup members. Supabase on the front end is the auth client in `modules/auth` only, data goes through `modules/api`.",
+        en: "`<file>` imports `<what>`, a package or scoped package family the front-end stack forbids.",
+        fix: "Use the concern's canonical library from `knowledge/hfs/fe-stack.yaml` (the message names it). For @dicebear/*, pass the identity id as seed on Grammar Avatar, AvatarButton or AvatarGroup members.",
     },
     "file-size-growth": {
         code: "HFS_SIZE_GROWTH",

package/dist/shape-slot.d.ts

@@ -6,13 +6,13 @@ export declare const noDataStatusProp: import("./lib/rule.js").Rule<"status" | "
 /** A region that reads data hands its Base a DataSlot, and the Base renders it through SlotView. */
 export declare const regionReadsThroughSlot: import("./lib/rule.js").Rule<"slot" | "view", []>;
 /** A branch keeps only interaction state; a leaf holds no hook. */
-export declare const branchIntrinsicState: import("./lib/rule.js").Rule<"hooks" | "data" | "fetch" | "leaf", []>;
+export declare const branchIntrinsicState: import("./lib/rule.js").Rule<"hooks" | "data" | "leaf" | "fetch", []>;
 /** The rules this law contributes to the plugin. */
 export declare const rules: {
     "exhaustive-shape-switch": import("./lib/rule.js").Rule<"missing" | "hidden", []>;
     "no-data-status-prop": import("./lib/rule.js").Rule<"status" | "leaf", []>;
     "region-reads-through-slot": import("./lib/rule.js").Rule<"slot" | "view", []>;
-    "branch-intrinsic-state": import("./lib/rule.js").Rule<"hooks" | "data" | "fetch" | "leaf", []>;
+    "branch-intrinsic-state": import("./lib/rule.js").Rule<"hooks" | "data" | "leaf" | "fetch", []>;
 };
 /** Every FE canon rule is an error; existing debt is fixed before adoption. */
 export declare const recommended: Recommended;

package/dist/transport.d.ts

@@ -28,7 +28,7 @@ import { type Recommended, type Rules } from "./lib/rule.js";
  * `socket.io-client` only by `hooks/socketio/`. Native `WebSocket` is refused everywhere, including the API layer.
  * Every other file reaches the back end through an SWR hook over an operation.
  */
-export declare const fetchOnlyInApiClient: import("./lib/rule.js").Rule<"library" | "outside" | "channel" | "websocket" | "xhr" | "placed", []>;
+export declare const fetchOnlyInApiClient: import("./lib/rule.js").Rule<"library" | "outside" | "channel" | "websocket" | "xhr" | "placed" | "authDoor", []>;
 /** Every `fetch` of the API layer (a custom fetch handed to the Apollo http link, a raw call) carries an abort signal, so a hung backend cannot hang a reader. */
 export declare const clientFetchHasSignal: import("./lib/rule.js").Rule<"signal", []>;
 /** No module-level mutable state in the API layer: a token or locale in a `let` leaks across requests. */

package/dist/transport.js

@@ -19,12 +19,11 @@
  * standing in for a status.
  */
 import ts from "typescript";
-import { rules as callbackShapeRules } from "./callback-shape.js";
 import { isNode } from "./lib/ast.js";
 import { hfsOf } from "./lib/hfs.js";
 import { forbiddingConcern, packageNameOf } from "./lib/fe-stack.js";
 import { defineRule } from "./lib/rule.js";
-import { globalReferences, inSlot, isApiClient, isApiLayer, isApiRest, isOutcomeModule } from "./lib/scope.js";
+import { globalReferences, inSlot, isApiClient, isApiLayer, isApiRest, isAuthDoor, isAuthTokenStore, isOutcomeModule } from "./lib/scope.js";
 import { typed } from "./lib/types.js";
 /**
  * The canonical transport libraries and the one place each may be imported (fe-stack graphql, rest and realtime): Apollo in
@@ -32,7 +31,7 @@ import { typed } from "./lib/types.js";
  */
 const PLACED_TRANSPORTS = new Map([
     ["@apollo/client", { where: "the API layer (`modules/api`)", allowed: (context) => isApiLayer(context) }],
-    ["axios", { where: "the REST calls of the API layer (`modules/api/rest/`)", allowed: (context) => isApiRest(context) }],
+    ["axios", { where: "the REST calls of the API layer (`modules/api/rest/`) and the auth door (`modules/auth/auth-door.ts`)", allowed: (context) => isApiRest(context) || isAuthDoor(context) }],
     ["socket.io-client", { where: "`hooks/socketio/`", allowed: (context) => inSlot(context, "fe.hooks.socketio") }],
     ["graphql-ws", { where: "the Apollo clients of the API layer (`modules/api/graphql/clients/`, or the shared api package's `graphql/clients/`)", allowed: (context) => isApiClient(context) }],
 ]);
@@ -140,6 +139,27 @@ const transportUses = (context) => {
     return uses;
 };
 // -- FE-TRANSPORT-1 --------------------------------------------------------------------------------
+/** The HTTP methods of the REST client whose first argument is the request path. */
+const REST_METHODS = new Set(["get", "post", "put", "patch", "delete", "request"]);
+/** The static text of a path argument (a literal, or a template's fixed parts), or null when nothing about it is fixed. */
+const staticPath = (node) => {
+    if (node?.type === "Literal" && typeof node.value === "string")
+        return node.value;
+    if (node?.type === "TemplateLiteral")
+        return node.quasis.map((quasi) => quasi.value.cooked ?? "").join("<expression>");
+    return null;
+};
+/** A path segment `auth/`: the app's own back-end auth doors. */
+const AUTH_DOOR_PATH = /(?:^|\/)auth\//;
+/** In the auth door, a REST call whose path the rule can read must name an `/auth/` door; a fully dynamic path is left to review. */
+const judgeAuthDoorCall = (context, node) => {
+    if (node.callee.type !== "MemberExpression" || node.callee.computed || node.callee.property.type !== "Identifier" || !REST_METHODS.has(node.callee.property.name))
+        return;
+    const path = staticPath(node.arguments[0]);
+    if (path === null || AUTH_DOOR_PATH.test(path))
+        return;
+    context.report({ node, messageId: "authDoor", data: { call: `.${node.callee.property.name}()`, path } });
+};
 /**
  * `fetch` is reached only in the API layer, each canonical transport library only in its home, and no other HTTP library exists.
  *
@@ -160,11 +180,13 @@ export const fetchOnlyInApiClient = defineRule({
             library: "`{{name}}` is a second HTTP transport. The front end talks to its back end through Apollo (`modules/api/graphql`) and the axios REST calls (`modules/api/rest`); another library is another set of timeout, retry and error rules. Use an operation of `modules/api`.",
             placed: "`{{name}}` is imported outside {{where}}, the one place the front-end stack gives it. A component or hook that holds the transport itself skips the link chain (token, locale, retry, timeout) and the one result vocabulary. Call an operation of `modules/api` through its SWR hook (`hooks/swr/`), or listen through `hooks/socketio/`.",
             xhr: "`XMLHttpRequest` is a second transport. Use an operation of the API layer (`modules/api`).",
+            authDoor: "`{{call}}` calls `{{path}}` from the auth door. `modules/auth/auth-door.ts` calls only the app's own back-end auth doors (`/auth/...`: login, signup, refresh, logout, password reset, resend verification); every other REST call is `modules/api/rest/`.",
             websocket: "Native `WebSocket` is a second realtime transport. Use socket.io-client in `hooks/socketio/`, the front end's realtime owner.",
         },
     },
     create(context) {
         const layer = isApiLayer(context);
+        const authDoor = isAuthDoor(context);
         const library = (node, source) => {
             const name = packageNameOf(source);
             if (name === null || forbiddingConcern(source))
@@ -209,6 +231,8 @@ export const fetchOnlyInApiClient = defineRule({
                     library(node, node.source.value);
             },
             CallExpression(node) {
+                if (authDoor)
+                    judgeAuthDoorCall(context, node);
                 // `require("axios")` where `require` is the CommonJS global.
                 const [first] = node.arguments;
                 if (node.callee.type !== "Identifier" || node.callee.name !== "require" || first?.type !== "Literal")
@@ -266,14 +290,14 @@ const isTransportFile = (context) => isApiLayer(context) && !hfsOf(context).rela
 export const noSharedTransportState = defineRule({
     meta: {
         type: "problem",
-        docs: { description: "The API layer (`modules/api/**`) holds no module-level `let`/`var`." },
+        docs: { description: "The API layer (`modules/api/**`) and `modules/auth` hold no module-level `let`/`var`, but the in-memory access-token store `modules/auth/token-store.ts`." },
         schema: [],
         messages: {
             shared: "A module-level `{{kind}}` in the API layer. A token or locale kept there is shared by every request on the server and by every reader in one tab, so one reader's credential can answer another's request. Pass the credential as a parameter or read it from context.",
         },
     },
     create(context) {
-        if (!isTransportFile(context))
+        if (!isTransportFile(context) && !(inSlot(context, "fe.modules.auth") && !isAuthTokenStore(context)))
             return {};
         const check = (node) => {
             const declaration = node.type === "VariableDeclaration" ? node : node.type === "ExportNamedDeclaration" ? node.declaration : undefined;
@@ -878,8 +902,6 @@ export const rules = {
     "no-hand-typed-wire": noHandTypedWire,
     "outcome-kinds-exhaustive": outcomeKindsExhaustive,
     "one-outcome-union": oneOutcomeUnion,
-    // Forward the callback enforcer for the catalog's source-only CONTRIBUTIONS discovery.
-    ...callbackShapeRules,
 };
 /** Every rule is an error: a second transport or a status collapse is the defect, not a style. */
 export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.4.9",
+  "version": "9.5.0",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.10
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.6.8
+    version: 3.7.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.4.9
+    version: 9.5.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.10
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.10
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
@@ -85,12 +85,12 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.4.1
+    version: 2.5.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
-    why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+    why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeQueryBuilder, queueQueryBuilders, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
     version: 1.2.3
     group: starci
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.9.11
+    version: 4.10.0
     group: starci
     install: registry
     side: both
@@ -543,7 +543,7 @@ pins:
     version: 3.1150.0
     group: framework
     side: be
-    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces, Supabase Storage); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
+    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
   '@aws-sdk/s3-request-presigner':
     version: 3.1150.0
     group: framework
@@ -594,27 +594,47 @@ pins:
     group: framework
     side: be
     why: 'the Express 5 integration @nestjs/apollo loads at boot (R111 nestjs-apollo-express5, knowledge/hfs/peer-integrations.yaml); every api app that serves GraphQL installs it; the latest registry version on 2026-10-13.'
-  # --- Supabase lite
-  '@supabase/ssr':
-    version: 0.12.7
+  # --- lite identity (integrations/passport, ruling lite-self-hosted-postgres-passport-minio)
+  '@nestjs/passport':
+    version: 11.0.5
     group: framework
-    side: fe
-    why: the one server/browser client factory for a lite Next app; exact version registry-checked for the lite scaffold.
-  '@supabase/supabase-js':
-    version: 2.117.2
+    side: be
+    why: 'PassportStrategy of integrations/passport; 11.0.5 is CommonJS on the Nest 11 line (12.0.0 is ESM-only and breaks Nest 11 jest under the CommonJS transform of @starci/jest-preset), as nivo-lite runs it.'
+  passport:
+    version: 0.7.0
     group: framework
-    side: both
-    why: the generated Database-typed client used by the FE data owner and the BE Auth/Storage integration.
+    side: be
+    why: the strategy runtime under @nestjs/passport (its peer range ^0.5 || ^0.6 || ^0.7).
+  passport-google-oauth20:
+    version: 2.0.0
+    group: framework
+    side: be
+    why: Google OAuth 2.0 (authorization code with state and PKCE) of integrations/passport.
+  passport-local:
+    version: 1.0.0
+    group: framework
+    side: be
+    why: the email and password strategy of integrations/passport.
+  bcryptjs:
+    version: 3.0.3
+    group: framework
+    side: be
+    why: 'bcrypt in pure JavaScript (no native build on the alpine image); verifies the $2a$/$2b$ hashes auth.users carries over.'
+  '@types/passport-google-oauth20':
+    version: 2.0.17
+    group: framework
+    side: be
+    why: types of passport-google-oauth20.
+  '@types/passport-local':
+    version: 1.0.38
+    group: framework
+    side: be
+    why: types of passport-local.
   jose:
     version: 6.2.12
     group: framework
     side: be
-    why: verifies Supabase access tokens against the project JWKS with issuer, audience, expiry and algorithm checks.
-  supabase:
-    version: 2.119.0
-    group: tooling
-    side: both
-    why: the root CLI wrapper owns local schema lifecycle and generates the committed database types.
+    why: signs the app's own ES256 access tokens and verifies them against its own key set (createLocalJWKSet) in integrations/passport.
   class-transformer:
     version: 0.5.1
     group: framework

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -37,10 +37,10 @@ concerns:
   - id: rest
     tier: core
     packages: [axios]
-    home: [fe.modules.api]
+    home: [fe.modules.api, fe.modules.auth]
     pattern: FE-API-REST
     forbids: [ky, superagent, node-fetch, cross-fetch, isomorphic-fetch]
-    why: modules/api/rest/<area>/*.ts for uploads, presigned URLs and auth endpoints only; GraphQL carries every other call.
+    why: modules/api/rest/<area>/*.ts for uploads and presigned URLs, and modules/auth/auth-door.ts for the app's own auth doors only; GraphQL carries every other call.
   - id: data
     tier: core
     packages: [swr]
@@ -99,8 +99,8 @@ concerns:
     packages: []
     home: [fe.modules.auth]
     pattern: FE-AUTH
-    forbids: []
-    why: modules/auth is the identity-provider client (lite - the @supabase/supabase-js auth client; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
+    forbids: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-js']
+    why: modules/auth is the session issuer's client (lite - auth-door.ts over the app's own back-end auth doors with the in-memory token store; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
   - id: i18n
     tier: core
     packages: [next-intl]
@@ -256,13 +256,6 @@ concerns:
     pattern: FE-RULE-OWNERSHIP
     forbids: []
     why: The selected Grammar family's lint package runs beside the universal front-end canon; the family catalog declares the package and factory.
-  - id: auth-supabase
-    tier: opt
-    packages: ['@supabase/supabase-js', '@supabase/ssr']
-    home: [fe.modules.auth]
-    pattern: FE-AUTH
-    forbids: []
-    why: the lite auth provider client and PKCE server cookie adapter, confined to modules/auth; data still goes through the back end.
   - id: framework-support
     tier: opt
     packages: [server-only, rxjs]