@starci/eslint-grammar-core 0.15.34 → 0.16.2

package/runtime/engine/secrets.mjs

@@ -1,134 +1,202 @@
 import fs from 'node:fs';
 import path from 'node:path';
-
 /** The host-local credential filename, resolved only against a verified runtime main root. */
-export const SECRET_ENV_FILE='secret.env';
+export const SECRET_ENV_FILE = 'secret.env';
 /** The configured credential variable grammar shared by validation and secret resolution. */
-export const ENV_NAME=/^[A-Z_][A-Z0-9_]{0,63}$/;
-export const CREDENTIAL_FILE_MAX_BYTES=1024*1024;
+export const ENV_NAME = /^[A-Z_][A-Z0-9_]{0,63}$/;
+export const CREDENTIAL_FILE_MAX_BYTES = 1024 * 1024;
 const resolvedValues = new Set();
-const remember = value => {
-  if (typeof value === 'string' && value.length >= 6) resolvedValues.add(value);
-  return value;
+const remember = (value) => {
+    if (typeof value === 'string' && value.length >= 6)
+        resolvedValues.add(value);
+    return value;
 };
-
 /** Filter credentials resolved by this process; the values never leave their resolution owner. */
 export function redactResolvedSecrets(text) {
-  let clean = text;
-  for (const value of resolvedValues) if (clean.includes(value)) clean = clean.split(value).join('[redacted:resolved-secret]');
-  return clean;
+    let clean = text;
+    for (const value of resolvedValues)
+        if (clean.includes(value))
+            clean = clean.split(value).join('[redacted:resolved-secret]');
+    return clean;
 }
-
 /** Check lexical availability only; blank and conventional template markers never prove provider validity. */
-export function credentialPresent(value){
-  if(typeof value!=='string'||!value.trim())return false;
-  return !/^(?:CHANGE_ME|REPLACE_ME|PLACEHOLDER|TODO|<[^>]*>|YOUR_[A-Z0-9_]+)$/i.test(value.trim());
+export function credentialPresent(value) {
+    if (typeof value !== 'string' || !value.trim())
+        return false;
+    return !/^(?:CHANGE_ME|REPLACE_ME|PLACEHOLDER|TODO|<[^>]*>|YOUR_[A-Z0-9_]+)$/i.test(value.trim());
 }
-
 /** Read one configured credential file with a finite byte budget; no effects beyond the read. */
-export function readSecretBytes(file){
-  const before=fs.lstatSync(file);
-  if(!before.isFile()||before.isSymbolicLink())throw new Error('credential file must be a regular file');
-  if(before.size>CREDENTIAL_FILE_MAX_BYTES)throw new Error('credential file exceeds the byte budget');
-  const fd=fs.openSync(file,fs.constants.O_RDONLY|(fs.constants.O_NOFOLLOW??0));
-  let bytes;
-  try{
-    const stat=fs.fstatSync(fd);
-    if(!stat.isFile()||stat.dev!==before.dev||stat.ino!==before.ino)throw new Error('credential file changed during resolution');
-    bytes=Buffer.alloc(CREDENTIAL_FILE_MAX_BYTES+1);
-    let count=0;
-    while(count<bytes.length){const n=fs.readSync(fd,bytes,count,bytes.length-count,null);if(n===0){break;}count+=n;}
-    if(count>CREDENTIAL_FILE_MAX_BYTES)throw new Error('credential file exceeds the byte budget');
-    return bytes.subarray(0,count);
-  }catch(error){bytes?.fill(0);throw error;}finally{fs.closeSync(fd);}
+export function readSecretBytes(file) {
+    const before = fs.lstatSync(file);
+    if (!before.isFile() || before.isSymbolicLink())
+        throw new Error('credential file must be a regular file');
+    if (before.size > CREDENTIAL_FILE_MAX_BYTES)
+        throw new Error('credential file exceeds the byte budget');
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    let bytes;
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino)
+            throw new Error('credential file changed during resolution');
+        bytes = Buffer.alloc(CREDENTIAL_FILE_MAX_BYTES + 1);
+        let count = 0;
+        while (count < bytes.length) {
+            const n = fs.readSync(fd, bytes, count, bytes.length - count, null);
+            if (n === 0) {
+                break;
+            }
+            count += n;
+        }
+        if (count > CREDENTIAL_FILE_MAX_BYTES)
+            throw new Error('credential file exceeds the byte budget');
+        return bytes.subarray(0, count);
+    }
+    catch (error) {
+        bytes?.fill(0);
+        throw error;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
 }
-
-const readCredentialFile = file => { const bytes=readSecretBytes(file); try{return bytes.toString('utf8');}finally{bytes.fill(0);} };
-
-const DOTENV_LINE_PARTS = [String.raw`^\s*`, String.raw`(?:export\s+)?`, String.raw`([A-Za-z_]\w*)`, String.raw`\s*=\s*`, String.raw`([^\r\n\u2028\u2029]*)`, String.raw`\s*$`];
+const readCredentialFile = (file) => { const bytes = readSecretBytes(file); try {
+    return bytes.toString('utf8');
+}
+finally {
+    bytes.fill(0);
+} };
+const DOTENV_LINE_PARTS = [String.raw `^\s*`, String.raw `(?:export\s+)?`, String.raw `([A-Za-z_]\w*)`, String.raw `\s*=\s*`, String.raw `([^\r\n\u2028\u2029]*)`, String.raw `\s*$`];
 const DOTENV_LINE = new RegExp(DOTENV_LINE_PARTS.join(''));
-
 /** Parse a dotenv file (KEY=VALUE lines, # comments, optional export/quotes). An absent file is {}. */
-export function readDotenv(file){
-  let text='';try{text=readCredentialFile(file);}catch(error){if(error?.code==='ENOENT'){return {};}throw error;}
-  const out={};
-  for(const line of text.split(/\r?\n/)){
-    const m=DOTENV_LINE.exec(line);
-    if(!m)continue;
-    let value=m[2].trimEnd();
-    if(value.length>=2&&(value.startsWith('"')||value.startsWith("'"))&&value.at(-1)===value[0])value=value.slice(1,-1);
-    out[m[1]]=value;
-  }
-  return out;
+export function readDotenv(file) {
+    let text = '';
+    try {
+        text = readCredentialFile(file);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return {};
+        }
+        throw error;
+    }
+    const out = {};
+    for (const line of text.split(/\r?\n/)) {
+        const m = DOTENV_LINE.exec(line);
+        if (!m)
+            continue;
+        const name = m[1];
+        let value = m[2].trimEnd();
+        if (value.length >= 2 && (value.startsWith('"') || value.startsWith("'")) && value.at(-1) === value[0])
+            value = value.slice(1, -1);
+        out[name] = value;
+    }
+    return out;
 }
-
 /**
  * Resolve a configured variable or its supported NAME_FILE custody pointer. An explicitly supplied
  * blank variable disables the value; it must not resurrect a file value. Never print the result.
  */
-export function connectorSecret(name,env=process.env){
-  if(typeof name!=='string'||!ENV_NAME.test(name))return null;
-  if(Object.hasOwn(env,name))return typeof env[name]==='string'?remember(env[name].trim()||null):null;
-  const pointer=typeof env[`${name}_FILE`]==='string'?env[`${name}_FILE`].trim():'';
-  if(!pointer)return null;
-  try{const value=readCredentialFile(pointer).trim();return remember(value||null);}catch{return null;}
+export function connectorSecret(name, env = process.env) {
+    if (typeof name !== 'string' || !ENV_NAME.test(name))
+        return null;
+    const direct = env[name];
+    if (Object.hasOwn(env, name))
+        return typeof direct === 'string' ? remember(direct.trim() || null) : null;
+    const filePointer = env[`${name}_FILE`];
+    const pointer = typeof filePointer === 'string' ? filePointer.trim() : '';
+    if (!pointer)
+        return null;
+    try {
+        const value = readCredentialFile(pointer).trim();
+        return remember(value || null);
+    }
+    catch {
+        return null;
+    }
 }
-
 /**
  * Load the verified runtime main's local credentials below the actual environment without mutating
  * either input. The caller owns repository identity; this base-tier reader never infers a root from cwd.
  * Absence is allowed so the action-specific gate can name only the credentials that action requires.
  */
-export function secretEnv(verifiedRuntimeRoot,env=process.env){
-  if(typeof verifiedRuntimeRoot!=='string'||!path.isAbsolute(verifiedRuntimeRoot))
-    throw new TypeError('secretEnv requires an absolute verified runtime root');
-  if(env===null||typeof env!=='object'||Array.isArray(env))throw new TypeError('secretEnv requires an environment mapping');
-  const root=fs.lstatSync(verifiedRuntimeRoot);
-  if(!root.isDirectory()||root.isSymbolicLink())throw new Error('secretEnv runtime root must be a regular directory');
-  const file=path.join(verifiedRuntimeRoot,SECRET_ENV_FILE);
-  let stat;
-  try{stat=fs.lstatSync(file);}catch(error){if(error?.code==='ENOENT'){return {...env};}throw error;}
-  if(!stat.isFile()||stat.isSymbolicLink())throw new Error('secret.env must be a regular file');
-  const local = readDotenv(file);
-  const resolved = {...local,...env};
-  for (const name of Object.keys(local)) if (typeof resolved[name] === 'string') remember(resolved[name]);
-  return resolved;
+export function secretEnv(verifiedRuntimeRoot, env = process.env) {
+    if (typeof verifiedRuntimeRoot !== 'string' || !path.isAbsolute(verifiedRuntimeRoot))
+        throw new TypeError('secretEnv requires an absolute verified runtime root');
+    if (env === null || typeof env !== 'object' || Array.isArray(env))
+        throw new TypeError('secretEnv requires an environment mapping');
+    const root = fs.lstatSync(verifiedRuntimeRoot);
+    if (!root.isDirectory() || root.isSymbolicLink())
+        throw new Error('secretEnv runtime root must be a regular directory');
+    const file = path.join(verifiedRuntimeRoot, SECRET_ENV_FILE);
+    let stat;
+    try {
+        stat = fs.lstatSync(file);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return { ...env };
+        }
+        throw error;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('secret.env must be a regular file');
+    const local = readDotenv(file);
+    const resolved = { ...local, ...env };
+    for (const name of Object.keys(local))
+        if (typeof resolved[name] === 'string')
+            remember(resolved[name]);
+    return resolved;
 }
-
-const sopsRefuse=(reason,message)=>{
-  const error=new Error(`SOPS identity [${reason}]: ${message}`);
-  error.name='SopsIdentityRefusal';error.identityRefusal=reason;
-  return {mode:'refused',env:null,error};
+const sopsRefuse = (reason, message) => {
+    const error = new Error(`SOPS identity [${reason}]: ${message}`);
+    error.name = 'SopsIdentityRefusal';
+    error.identityRefusal = reason;
+    return { mode: 'refused', env: null, error };
 };
-const sopsInlineIdentity=(env,name)=>{
-  if(!credentialPresent(env[name]))return sopsRefuse('disabled-inline','SOPS_AGE_KEY is explicitly empty or invalid');
-  remember(env[name].trim());
-  return {...sopsRefuse('inline-context-unqualified','the supplied SOPS_AGE_KEY awaits an owned selected-identity isolation capability; no SOPS process was launched'),inlineName:name};
+const sopsInlineIdentity = (env, name) => {
+    const inline = env[name];
+    if (!credentialPresent(inline))
+        return sopsRefuse('disabled-inline', 'SOPS_AGE_KEY is explicitly empty or invalid');
+    remember(inline.trim());
+    return { ...sopsRefuse('inline-context-unqualified', 'the supplied SOPS_AGE_KEY awaits an owned selected-identity isolation capability; no SOPS process was launched'), inlineName: name };
 };
-const sopsFileIdentity=(env,file)=>{
-  if(!credentialPresent(file))return sopsRefuse('invalid-file','the original identity file selection is empty or invalid');
-  if(!path.isAbsolute(file))return sopsRefuse('identity-file-location-unqualified','select the original identity by its absolute path; caller and SOPS working directories may differ');
-  try{
-    const stat=fs.lstatSync(file);
-    if(!stat.isFile()||stat.isSymbolicLink())return sopsRefuse('identity-file-unavailable','the explicitly selected original identity must be a regular non-symlink file');
-  }catch{return sopsRefuse('identity-file-unavailable','the explicitly selected original identity file is unavailable');}
-  return {mode:'file',env:{...env,SOPS_AGE_KEY_FILE:file},error:null};
+const sopsFileIdentity = (env, file) => {
+    if (!credentialPresent(file))
+        return sopsRefuse('invalid-file', 'the original identity file selection is empty or invalid');
+    if (!path.isAbsolute(file))
+        return sopsRefuse('identity-file-location-unqualified', 'select the original identity by its absolute path; caller and SOPS working directories may differ');
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return sopsRefuse('identity-file-unavailable', 'the explicitly selected original identity must be a regular non-symlink file');
+    }
+    catch {
+        return sopsRefuse('identity-file-unavailable', 'the explicitly selected original identity file is unavailable');
+    }
+    return { mode: 'file', env: { ...env, SOPS_AGE_KEY_FILE: file }, error: null };
 };
 /** Select a supplied age identity without inventing custody or running a key tool. Inline execution awaits its owned isolation capability. */
-export function sopsIdentityEnv(env,{identity=null,required=false,platform=process.platform}={}){
-  if(!env||typeof env!=='object'||Array.isArray(env))return sopsRefuse('invalid-environment','an environment mapping is required');
-  const names=name=>Object.keys(env).filter(key=>platform==='win32'?key.toUpperCase()===name:key===name);
-  const inline=names('SOPS_AGE_KEY'),files=names('SOPS_AGE_KEY_FILE');
-  if(inline.length>1||files.length>1)return sopsRefuse('ambiguous-environment','multiple Windows aliases select an age identity');
-  if(inline.length)return sopsInlineIdentity(env,inline[0]);
-  let file=identity;
-  if(files.length){
-    const value=env[files[0]];
-    if(!credentialPresent(value))return sopsRefuse('disabled-file','SOPS_AGE_KEY_FILE is explicitly empty or invalid');
-    if(identity!==null&&identity!==undefined&&identity!==value)return sopsRefuse('conflicting-files','two different original identity files were explicitly selected');
-    file=value;
-  }
-  if(file!==null&&file!==undefined)return sopsFileIdentity(env,file);
-  if(required)return sopsRefuse('identity-not-supplied','supply SOPS_AGE_KEY locally or select the original SOPS_AGE_KEY_FILE; no home default was inferred');
-  return {mode:'public-recipient',env:{...env},error:null};
+export function sopsIdentityEnv(env, { identity = null, required = false, platform = process.platform } = {}) {
+    if (!env || typeof env !== 'object' || Array.isArray(env))
+        return sopsRefuse('invalid-environment', 'an environment mapping is required');
+    const names = (name) => Object.keys(env).filter(key => platform === 'win32' ? key.toUpperCase() === name : key === name);
+    const inline = names('SOPS_AGE_KEY'), files = names('SOPS_AGE_KEY_FILE');
+    if (inline.length > 1 || files.length > 1)
+        return sopsRefuse('ambiguous-environment', 'multiple Windows aliases select an age identity');
+    if (inline.length)
+        return sopsInlineIdentity(env, inline[0]);
+    let file = identity;
+    if (files.length) {
+        const value = env[files[0]];
+        if (!credentialPresent(value))
+            return sopsRefuse('disabled-file', 'SOPS_AGE_KEY_FILE is explicitly empty or invalid');
+        if (identity !== null && identity !== undefined && identity !== value)
+            return sopsRefuse('conflicting-files', 'two different original identity files were explicitly selected');
+        file = value;
+    }
+    if (file !== null && file !== undefined)
+        return sopsFileIdentity(env, file);
+    if (required)
+        return sopsRefuse('identity-not-supplied', 'supply SOPS_AGE_KEY locally or select the original SOPS_AGE_KEY_FILE; no home default was inferred');
+    return { mode: 'public-recipient', env: { ...env }, error: null };
 }

package/runtime/engine/sonar-config.mjs

@@ -1,21 +1,24 @@
-import {isPlainObject as plain} from './plain-object.mjs';
-import {invalid} from './invalid-config.mjs';
-
+import { isPlainObject as plain } from './plain-object.mjs';
+import { invalid } from './invalid-config.mjs';
 /** The keys of the sonar block. */
-const SONAR_KEYS=Object.freeze(['organization']);
+const SONAR_KEYS = Object.freeze(['organization']);
 /** A SonarCloud organization key: lowercase letters, digits, hyphens and underscores, starting with a letter or a digit. */
-const ORGANIZATION=/^[a-z0-9][a-z0-9_-]*$/;
-
+const ORGANIZATION = /^[a-z0-9][a-z0-9_-]*$/;
 /**
  * config.yaml `sonar` - {organization?}: the key of the SonarCloud organization the release's Sonar proof of the example apps analyses in
  * (the project key is <organization>_<key the example declares>). It is configuration, not a secret; the environment variable
  * SONAR_ORGANIZATION wins over it, the repository variable of the same name is what CI reads. Null or absent means "not set yet".
  */
-export function validateSonar(sonar){
-  if(sonar===null)return;
-  const bad=invalid('sonar');
-  if(!plain(sonar))bad(' must be {organization?: <SonarCloud organization key>} or null.');
-  for(const key of Object.keys(sonar))if(!SONAR_KEYS.includes(key))bad(` has unknown key ${key} (allowed: ${SONAR_KEYS.join(', ')}).`);
-  const value=sonar.organization;
-  if(value!==undefined&&value!==null&&!(typeof value==='string'&&ORGANIZATION.test(value)))bad('.organization must be a SonarCloud organization key (lowercase letters, digits, - and _) or null.');
+export function validateSonar(sonar) {
+    if (sonar === null)
+        return;
+    const bad = invalid('sonar');
+    if (!plain(sonar))
+        return bad(' must be {organization?: <SonarCloud organization key>} or null.');
+    for (const key of Object.keys(sonar))
+        if (!SONAR_KEYS.includes(key))
+            bad(` has unknown key ${key} (allowed: ${SONAR_KEYS.join(', ')}).`);
+    const value = sonar.organization;
+    if (value !== undefined && value !== null && !(typeof value === 'string' && ORGANIZATION.test(value)))
+        bad('.organization must be a SonarCloud organization key (lowercase letters, digits, - and _) or null.');
 }

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -17,7 +17,7 @@ pins:
   # --- @starci packages. Every @starci package is a PUBLISHED npm package (install: registry): a product repository
   # installs the exact pinned version from the npm registry in the root and every workspace package.json, never `file:`.
   '@starci/heroicons':
-    version: 0.3.4
+    version: 0.3.5
     group: starci
     install: registry
     side: fe
@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.34
+    version: 0.16.2
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.8.21
+    version: 3.9.2
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.23
+    version: 9.6.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.34
+    version: 0.16.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.34
+    version: 0.16.2
     group: starci
     install: registry
     side: fe
@@ -85,28 +85,28 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.5.2
+    version: 2.5.3
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
     why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeQueryBuilder, queueQueryBuilders, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
-    version: 1.3.2
+    version: 1.3.3
     group: starci
     install: registry
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. A fake declared https (defineHttpFake) serves TLS with the run''s ephemeral in-memory fake CA and publishes its PEM as w.fake.<name>.ca for the app''s own client to trust; verification is never turned off. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/ai-router':
-    version: 0.4.0
+    version: 0.4.1
     group: starci
     install: registry
     side: be
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.11.22
+    version: 4.12.2
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -19,7 +19,7 @@
 schema: starci/hfs-rules@3
 version: 3.1.0
 gates:
-  pre-commit: the managed L0 hook runs app hygiene, managed-file drift, ESLint per side and stylelint on staged source, and prettier on staged files; typecheck and targeted specs belong to the op gate under R225
+  pre-commit: the managed L0 hook runs app check --staged, managed-file drift, ESLint per side and stylelint on staged source, and prettier on staged files; typecheck and targeted specs belong to the op gate under R225
   pre-push: the managed app hook invokes the bundled push policy under R225; it starts no source check, build or test
   settle: the op gate `starci gate run` over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
   land: the workflow's finish, the only time main is touched - gate.mjs over the whole workflow branch against its merge-base with main, the merge guard, review.verify of the exact head that lands, the branch rebased onto main, then main fast-forwarded and pushed
@@ -918,7 +918,7 @@ rules:
     code: "BE_TEST_TOPOLOGY"
     editions: [lite, full]
     docs: [docs/quality-bar.md#r47-test-topology]
-    law: "One jest config, projects `unit`, `integration`, `e2e` and `contract`, live by folder, `diagnostics: false`; unit specs are `<name>.<role>.spec.ts` beside the file they test: required for the roles of `ruleParams.be.unitRoles` (`<name>.service.spec.ts` beside a `<name>.service.ts`, `<name>.cli.spec.ts` beside a cli command `<name>.cli.ts` of `src/features/cli`), optional for any other logic role (`ruleParams.be.logicRoles`) inside a slot whose `coverage` is required and beside a logic file such a slot declares (`logic`: `passport.tokens.spec.ts` beside `passport.tokens.ts`), except that the commit adding a measured logic file stages its `<name>.<role>.spec.ts` beside it (owner 2026-10-20, judged by `starci app hygiene` in the pre-commit hook), and nowhere else but beside a webhook or realtime door that has no service of its own (`<provider>.webhook.spec.ts`, `<channel>.gateway.spec.ts`, `<x>.subscription.spec.ts`) (every unit-tested subject has exactly one; any other `*.spec.ts` outside `be/src/tests/{world,integration,e2e,contract}` is a finding, including specs in apps), and the unit project collects coverage from the logic roles of the measured roots and the logic files their slots declare only (the scope derived from the slot manifest, R204) with a per-file threshold of 100 on lines, branches, functions and statements (`test` runs `--coverage`; `importHelpers` and `tslib`); `be/src/tests/world/` is the ONLY test infrastructure: `global-setup.ts` starts the app's own stack (`.starcistacks/<env>`, named by `stack` in `test-world.config.ts`, the declaration of the test-world library in its one named form `export const { useTestWorld, useSandbox } = defineTestWorld({...})` (a default export is not read): every service it declares runs REAL, behind toxiproxy, images and versions read from the stack at run time, never spelled in test source) or attaches to a warm one that answers, and runs the migrations once over the cli app's connections (the runner of the cli migrate command); `global-teardown.ts` stops only what its setup started; `use-test-world.ts` exports `useTestWorld({ apps } | { modules })` (`world.apps.<name>.api`, `world.db.<connection>`, `world.infra.<service>` with `latency(ms)`, `cut()` and `restore()` on the real service, `world.fake.<provider>`, `world.waitFor`) and `fakes/<provider>/` holds the network-edge fakes (`failNext`, `replayWebhook`, `delay`, payload fixtures) of external SaaS the team does not operate ONLY: a fake of a service the stack declares is refused, except stateless compute that needs special hardware or an external model (GPU inference, a self-hosted embedding model), whose `stacks` entry in `test-world.config.ts` declares `{ fakedBy: <fake>, reason }` with a non-empty `reason` (a stateful service, or one with a persistent volume, is never accepted); it alone owns containers, DataSource, migrations and `process.env`; nothing under `be/src/tests` overrides a provider or DI token; `be/src/tests/integration/<capability>/*.integration-spec.ts` (`{ modules }`, with the real peer apps its client calls beside them as `apps`; real infrastructure, no HTTP door of ours), `be/src/tests/e2e/<area>/*.e2e-spec.ts` (`{ apps }`) and `be/src/tests/contract/<provider>/*.contract-spec.ts` (provider sandboxes, skipped without sandbox config, run only by `test:contract`, never by `test` or `test:e2e`) agree folder with suffix; an integration or e2e spec passes `useTestWorld` one object literal with plain keys (no variable, spread or computed key) and calls it; the contract layer has no skip either: a contract spec writes `sandbox.describe(...)` from the test-world library's `useSandbox(...)`, and when the sandbox config is absent that describe registers one failing test naming the missing keys (the body never runs), and every `fakes/<provider>/` that serves payload fixtures (`payloads/*.json`) has a `contract/<provider>/*.contract-spec.ts` that references those fixtures and asserts `shapeOf(real)` equals `shapeOf(fixture)` (the helper `shapeOf` is named by `ruleParams.be.contractShape` of the slot manifest; fakes the test-world library provides are guarded by the library); no `.test.ts`, `int-spec` or `harness-spec`, no `live/` and no `be/src/tests/e2e/world`."
+    law: "One jest config, projects `unit`, `integration`, `e2e` and `contract`, live by folder, `diagnostics: false`; unit specs are `<name>.<role>.spec.ts` beside the file they test: required for the roles of `ruleParams.be.unitRoles` (`<name>.service.spec.ts` beside a `<name>.service.ts`, `<name>.cli.spec.ts` beside a cli command `<name>.cli.ts` of `src/features/cli`), optional for any other logic role (`ruleParams.be.logicRoles`) inside a slot whose `coverage` is required and beside a logic file such a slot declares (`logic`: `passport.tokens.spec.ts` beside `passport.tokens.ts`), except that the commit adding a measured logic file stages its `<name>.<role>.spec.ts` beside it (owner 2026-10-20, judged by `starci app check --staged` in the pre-commit hook), and nowhere else but beside a webhook or realtime door that has no service of its own (`<provider>.webhook.spec.ts`, `<channel>.gateway.spec.ts`, `<x>.subscription.spec.ts`) (every unit-tested subject has exactly one; any other `*.spec.ts` outside `be/src/tests/{world,integration,e2e,contract}` is a finding, including specs in apps), and the unit project collects coverage from the logic roles of the measured roots and the logic files their slots declare only (the scope derived from the slot manifest, R204) with a per-file threshold of 100 on lines, branches, functions and statements (`test` runs `--coverage`; `importHelpers` and `tslib`); `be/src/tests/world/` is the ONLY test infrastructure: `global-setup.ts` starts the app's own stack (`.starcistacks/<env>`, named by `stack` in `test-world.config.ts`, the declaration of the test-world library in its one named form `export const { useTestWorld, useSandbox } = defineTestWorld({...})` (a default export is not read): every service it declares runs REAL, behind toxiproxy, images and versions read from the stack at run time, never spelled in test source) or attaches to a warm one that answers, and runs the migrations once over the cli app's connections (the runner of the cli migrate command); `global-teardown.ts` stops only what its setup started; `use-test-world.ts` exports `useTestWorld({ apps } | { modules })` (`world.apps.<name>.api`, `world.db.<connection>`, `world.infra.<service>` with `latency(ms)`, `cut()` and `restore()` on the real service, `world.fake.<provider>`, `world.waitFor`) and `fakes/<provider>/` holds the network-edge fakes (`failNext`, `replayWebhook`, `delay`, payload fixtures) of external SaaS the team does not operate ONLY: a fake of a service the stack declares is refused, except stateless compute that needs special hardware or an external model (GPU inference, a self-hosted embedding model), whose `stacks` entry in `test-world.config.ts` declares `{ fakedBy: <fake>, reason }` with a non-empty `reason` (a stateful service, or one with a persistent volume, is never accepted); it alone owns containers, DataSource, migrations and `process.env`; nothing under `be/src/tests` overrides a provider or DI token; `be/src/tests/integration/<capability>/*.integration-spec.ts` (`{ modules }`, with the real peer apps its client calls beside them as `apps`; real infrastructure, no HTTP door of ours), `be/src/tests/e2e/<area>/*.e2e-spec.ts` (`{ apps }`) and `be/src/tests/contract/<provider>/*.contract-spec.ts` (provider sandboxes, skipped without sandbox config, run only by `test:contract`, never by `test` or `test:e2e`) agree folder with suffix; an integration or e2e spec passes `useTestWorld` one object literal with plain keys (no variable, spread or computed key) and calls it; the contract layer has no skip either: a contract spec writes `sandbox.describe(...)` from the test-world library's `useSandbox(...)`, and when the sandbox config is absent that describe registers one failing test naming the missing keys (the body never runs), and every `fakes/<provider>/` that serves payload fixtures (`payloads/*.json`) has a `contract/<provider>/*.contract-spec.ts` that references those fixtures and asserts `shapeOf(real)` equals `shapeOf(fixture)` (the helper `shapeOf` is named by `ruleParams.be.contractShape` of the slot manifest; fakes the test-world library provides are guarded by the library); no `.test.ts`, `int-spec` or `harness-spec`, no `live/` and no `be/src/tests/e2e/world`."
     kinds: [check, codemod, lint]
     gates: [land, ci]
     failureCodes: ["BE_TEST_TOPOLOGY", "BE_CONTRACT_UNGUARDED", "BE_UNIT_SPEC_NOT_STAGED"]
@@ -3619,7 +3619,7 @@ rules:
     docs: [docs/lite-edition.md#edition-validation]
     templateNa: "The hfs.json edition declaration is generated programmatically by packages/hfs/scaffold/app.mjs; no managed declaration template exists. Forbidden paths are rejected rather than scaffolded."
     code: "HFS_EDITION_INVALID"
-    law: "hfs.json names an edition the manifest knows (full, or lite; absent means full). Lite is a minimal production (case-10): the same monorepo, code structure, slots, patterns and back-end unit specs, one stateless instance type that scales horizontally, its own PostgreSQL db service, Passport identity and S3-compatible storage (ruling:lite-self-hosted-postgres-passport-minio), and one minimal instance of each backing service a declared capability needs (hfs.json sides.be.backing: Redis for the queue, with AOF persistence); vector search uses pgvector in the db service (owner:lite-vector-is-pgvector, which excludes Qdrant from lite); a backing service is declared or absent, never on by default. The queue is BullMQ on Redis in both editions, fed by the Postgres outbox; pg_cron ticks enqueue through that outbox; the event bus keeps its lite adapter (pgmq-backed topics or in-process delivery) because full's event bus is Kafka, not Redis; cache and locks are Postgres unless Redis is declared; the api and sidecars run on docker-swarm on a VPS. The realtime pattern serves SSE (the default for one-way push), the same socket.io gateway or the restricted GraphQL subscription inside the be api process (scales horizontally and stateless: the memory hub is for a single replica or tests only, and replicas > 1 use the Redis hub and the sharded @socket.io/redis-adapter when Redis is declared, else the Postgres hub and @socket.io/postgres-adapter; both shared socket adapters force websocket-only connections with no sticky sessions; R212 case-9, which amends the realtime clauses of case-2, case-3 and case-5; the GraphQL subscription door is R212 case-7 and owner:lite-graphql-subscription-door), and both editions share knowledge/hfs/fe-stack.yaml. Lite requires application-stacks.yaml and permits environment metadata, runbooks, infra/swarm and encrypted-secret custody, while refusing infra/compose, infra/k8s, infra/terraform and backing components other than its db service (runtime/{config,env}, seeds and the sealed secrets of its environments are allowed). Contract specs and `test:contract` are allowed (owner 2026-10-14); it has no e2e spec, `test:e2e`, `test:stack` or `test:browser` script, e2e workflow, browser journey, Work catalog, shell, features, resources, UAT or br records, test container, toxiproxy, browser-runner or Kafka dependency, client library of an undeclared backing service (HFS_BACKING_UNDECLARED), declared backing service without a consumer (HFS_BACKING_UNUSED), or a supabase/ tree (LITE_DB_MIGRATION). Its .starciwork is optional and admits only .gitignore, workspace.yaml and brand/**; workspace.yaml is optional and carries project identity and repo roles for the Work tools."
+    law: "hfs.json names an edition the manifest knows (full, or lite; absent means full). Lite is a minimal production (case-10): the same monorepo, code structure, slots, patterns and back-end unit specs, one stateless instance type that scales horizontally, its own PostgreSQL db service, Passport identity and S3-compatible storage (ruling:lite-self-hosted-postgres-passport-minio), and one minimal instance of each backing service a declared capability needs (hfs.json sides.be.backing: Redis for the queue, with AOF persistence); vector search uses pgvector in the db service (owner:lite-vector-is-pgvector, which excludes Qdrant from lite); a backing service is declared or absent, never on by default. The queue is BullMQ on Redis in both editions, fed by the Postgres outbox; pg_cron ticks enqueue through that outbox; the event bus keeps its lite adapter (pgmq-backed topics or in-process delivery) because full's event bus is Kafka, not Redis; cache and locks are Postgres unless Redis is declared; the api and sidecars run on docker-swarm on a VPS. The realtime pattern serves SSE (the default for one-way push), the same socket.io gateway or the restricted GraphQL subscription inside the be api process (scales horizontally and stateless: the memory hub is for a single replica or tests only, and replicas > 1 use the Redis hub and the sharded @socket.io/redis-adapter when Redis is declared, else the Postgres hub and @socket.io/postgres-adapter; both shared socket adapters force websocket-only connections with no sticky sessions; R212 case-9, which amends the realtime clauses of case-2, case-3 and case-5; the GraphQL subscription door is R212 case-7 and owner:lite-graphql-subscription-door), and both editions share knowledge/hfs/fe-stack.yaml. Lite requires application-stacks.yaml and permits environment metadata, runbooks, infra/swarm and encrypted-secret custody, while refusing infra/compose, infra/k8s, infra/terraform and backing components other than its db service (runtime/{config,env}, seeds and the sealed secrets of its environments are allowed). Contract specs and `test:contract` are allowed (owner 2026-10-14); it has no e2e spec, `test:e2e`, `test:world` or `test:browser` script, e2e workflow, browser journey, Work catalog, shell, features, resources, UAT or br records, test container, toxiproxy, browser-runner or Kafka dependency, client library of an undeclared backing service (HFS_BACKING_UNDECLARED), declared backing service without a consumer (HFS_BACKING_UNUSED), or a supabase/ tree (LITE_DB_MIGRATION). Its .starciwork is optional and admits only .gitignore, workspace.yaml and brand/**; workspace.yaml is optional and carries project identity and repo roles for the Work tools."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_EDITION_INVALID", "HFS_EDITION_FORBIDDEN_PRESENT", "HFS_STARCIWORK_LITE_FORBIDDEN", "HFS_BACKING_UNDECLARED", "HFS_BACKING_UNUSED"]
@@ -4157,7 +4157,7 @@ rules:
     code: "ENV_VALUE_SHAPE"
     editions: [lite, full]
     docs: [docs/host-secrets.md#r249]
-    law: "A stored environment value parses as the type its `EnvSource` reader declares (an integer, `true`/`false`, an absolute URL, a duration `250`/`30s`/`5m`/`2h`, a member of the declared enum, a nonempty string or secret): `starci app secret verify <env>` decrypts every member in memory and reports each key and its violated shape, never a value, and a concrete (non-placeholder) value of a `*.env.example` parses the same way."
+    law: "A stored environment value parses as the type its `EnvSource` reader declares (an integer, `true`/`false`, an absolute URL, a duration `250`/`30s`/`5m`/`2h`, a member of the declared enum, a nonempty string or secret): `starci app secret verify --env <env>` decrypts every member in memory and reports each key and its violated shape, never a value, and a concrete (non-placeholder) value of a `*.env.example` parses the same way."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["ENV_VALUE_SHAPE"]
@@ -5242,7 +5242,7 @@ rules:
       - {path: packages/hfs/src/mcp-tools-snapshot.spec.mjs, editions: [lite, full], codes: [HFS_MCP_TOOLS_SNAPSHOT]}
   - id: R303
     code: "HFS_BYPASS_MARKER"
-    law: "A product repository holds no bypass of a check (owner ruling loosening-always-red): no inline disable of any tool (eslint, stylelint, tslint, prettier, biome), no ts-ignore, ts-expect-error or ts-nocheck directive, no Sonar exclusion comment, no istanbul, c8 or v8 coverage ignore, no skipped, focused or todo test or skip option, and no failure swallowed in a hook, script or workflow (`|| true`, `; true`, `continue-on-error`, `set +e`, `HUSKY=0`, `--no-verify`, `fail_ci_if_error: false`, `--passWithNoTests`, `--coverageThreshold`, `--no-error-on-unmatched-pattern`, a `--max-warnings` budget). A marker is read where it acts: a suppression word opens a comment, a test marker stands in code, a swallowed failure stands in a shell line or in the string a script hands a shell; the same words quoted as data are no bypass. The runtime tree is judged by the same library (R236). A front end has no specs, but its source is still judged for the inline disables. `starci app check` reads the tracked tree and `starci app hygiene` (the managed pre-commit hook) the staged files from the index, so the bypass fails at the commit."
+    law: "A product repository holds no bypass of a check (owner ruling loosening-always-red): no inline disable of any tool (eslint, stylelint, tslint, prettier, biome), no ts-ignore, ts-expect-error or ts-nocheck directive, no Sonar exclusion comment, no istanbul, c8 or v8 coverage ignore, no skipped, focused or todo test or skip option, and no failure swallowed in a hook, script or workflow (`|| true`, `; true`, `continue-on-error`, `set +e`, `HUSKY=0`, `--no-verify`, `fail_ci_if_error: false`, `--passWithNoTests`, `--coverageThreshold`, `--no-error-on-unmatched-pattern`, a `--max-warnings` budget). A marker is read where it acts: a suppression word opens a comment, a test marker stands in code, a swallowed failure stands in a shell line or in the string a script hands a shell; the same words quoted as data are no bypass. The runtime tree is judged by the same library (R236). A front end has no specs, but its source is still judged for the inline disables. `starci app check` reads the tracked tree and `starci app check --staged` (the managed pre-commit hook) the staged files from the index, so the bypass fails at the commit."
     kinds: [check]
     gates: [pre-commit, land, ci]
     failureCodes: ["HFS_BYPASS_MARKER"]
@@ -5803,7 +5803,7 @@ rules:
         ruling: "The lite database is self-hosted PostgreSQL in the app stack; its migrations live in db/migrations and starci app db migrate applies them."
   - id: R333
     code: "BE_ENTITY_SCHEMA_DRIFT"
-    law: "Every TypeORM entity column of an app's entity list (be/src/modules/platform/database/entities.ts) matches the schema its SQL migrations build: `starci app db drift` applies db/bootstrap.sql and every active db/migrations/*.sql to a scratch database (a container of the app's db image, or the empty database --url-env names), reads information_schema.columns and pg_catalog, and refuses a missing table, a missing column, a type that differs once both are normalised to PostgreSQL's format_type names (an enum by its type name), and a nullability that differs. A database column no entity maps is fine. A host that cannot provide the scratch database gets no verdict (exit 2, needs a database), never a green."
+    law: "Every TypeORM entity column of an app's entity list (be/src/modules/platform/database/entities.ts) matches the schema its SQL migrations build: `starci app db drift` applies db/bootstrap.sql and every active db/migrations/*.sql to a scratch database (a container of the app's db image, or the empty database --db-url-env names), reads information_schema.columns and pg_catalog, and refuses a missing table, a missing column, a type that differs once both are normalised to PostgreSQL's format_type names (an enum by its type name), and a nullability that differs. A database column no entity maps is fine. A host that cannot provide the scratch database gets no verdict (exit 2, needs a database), never a green."
     kinds: [check]
     gates: [ci]
     failureCodes: ["BE_ENTITY_SCHEMA_DRIFT"]
@@ -5890,3 +5890,92 @@ rules:
       - {path: packages/eslint-canon-be/src/event-bus-lite.spec.ts, edition: lite, codes: [BE_EVENT_BUS_LITE_SHAPE]}
     witness:
       - {path: packages/eslint-canon-be/src/event-bus-lite.spec.ts, edition: lite, codes: [BE_EVENT_BUS_LITE_SHAPE]}
+  - id: R337
+    code: "HFS_AUTH_COOKIE_DOMAIN_MISSING"
+    law: "In a lite app whose api uses the skeleton's passport (a tracked src/modules/integrations/passport/passport.config.ts), a docker-swarm environment whose rendered stack serves the web and the api on different hosts gives the api an AUTH_COOKIE_DOMAIN: a declared value in services.api.environment, a row of the environment's runtime/env/KEYS.md or a key sealed under its secrets/. Otherwise the refresh cookie is host-only on the api host, is absent from the Cookie header the web server forwards to the api, the api refuses the session and the user loops back to sign-in. The hosts are read from the rendered stack (web: NEXT_PUBLIC_SITE_URL, AUTH_WEB_ORIGIN, deploy.verify.http, HTTP_SECURITY_ALLOWED_ORIGINS; api: AUTH_JWT_ISSUER, GOOGLE_CALLBACK_URL, NEXT_PUBLIC_API_URL, deploy.verify.http), ports ignored, an unknown host is not judged. The finding names both hosts and their common parent domain as the value to set. A declared AUTH_COOKIE_DOMAIN that is not a bare domain (no scheme, port, path, leading dot or IP) or is not a parent of the web and the api hosts is a finding too. Same host: no key is required."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_AUTH_COOKIE_DOMAIN_MISSING"]
+    enforcers:
+      - {kind: hfs, id: stacks-auth-cookie-domain, at: scripts/hfs/rules/stacks-auth-cookie-domain.mjs}
+    editions: [lite]
+    docs:
+      - contexts/project/stacks.md
+    proves:
+      - {path: packages/hfs/src/hfs-stacks-auth-cookie-domain.spec.mjs, edition: lite}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
+      - {path: packages/hfs/templates/be/skeleton-lite/src/modules/integrations/passport/passport.config.ts, edition: lite}
+      - {path: packages/hfs/src/hfs-stacks-auth-cookie-domain.spec.mjs, edition: lite}
+    witness:
+      - {path: packages/hfs/src/hfs-stacks-auth-cookie-domain.spec.mjs, edition: lite}
+
+  - id: R338
+    code: "FE_GENERATED_ART_OUTSIDE_FRAME"
+    law: "Generated art, a .webp or .png under the public /images/ tree, renders only through Grammar's Mascot (the character size scale sm, md, lg, hero) or inside a MediaFrame; a bare Image, img or other src-taking element drawing it takes whatever box its page gives, so the same art comes out at a different size on every screen."
+    kinds: [lint]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["FE_GENERATED_ART_OUTSIDE_FRAME"]
+    enforcers:
+      - {kind: eslint-grammar-core, id: generated-art-in-mascot-or-media-frame}
+    editions: [lite, full]
+    docs: [knowledge/patterns/fe/ui.yaml#FE-UI]
+    templateNa: "A template draws no generated art; the art is the app's."
+    proves:
+      - packages/eslint-grammar-core/src/mascot.spec.ts
+    exemplifiedBy:
+      - {path: packages/eslint-grammar-core/src/mascot.spec.ts, editions: [lite, full], codes: [FE_GENERATED_ART_OUTSIDE_FRAME]}
+    witness:
+      - {path: packages/eslint-grammar-core/src/mascot.spec.ts, editions: [lite, full], codes: [FE_GENERATED_ART_OUTSIDE_FRAME]}
+    cases:
+      - id: case-1
+        date: "2026-10-30"
+        source: owner
+        quote: "Generated art renders at one consistent size across screens (relayed by the nivo-lite app)."
+        ruling: "Grammar's Mascot owns the character size scale (sm 96px, md 160px, lg 240px, hero up to its cap), always contained on a transparent ground; generated art under /images/ renders through Mascot or inside MediaFrame, never a bare Image."
+  - id: R339
+    code: "FE_MASCOT_ASSET_SLOT_MISSING"
+    law: "Every Grammar Mascot names its assetSlot (a non-empty value), tying the rendered art to the asset workflow's request; an element with a spread attribute is not judged."
+    kinds: [lint]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["FE_MASCOT_ASSET_SLOT_MISSING"]
+    enforcers:
+      - {kind: eslint-grammar-core, id: mascot-asset-slot-required}
+    editions: [lite, full]
+    docs: [knowledge/patterns/fe/ui.yaml#FE-UI]
+    templateNa: "A template draws no mascot; the art is the app's."
+    proves:
+      - packages/eslint-grammar-core/src/mascot.spec.ts
+    exemplifiedBy:
+      - {path: packages/eslint-grammar-core/src/mascot.spec.ts, editions: [lite, full], codes: [FE_MASCOT_ASSET_SLOT_MISSING]}
+    witness:
+      - {path: packages/eslint-grammar-core/src/mascot.spec.ts, editions: [lite, full], codes: [FE_MASCOT_ASSET_SLOT_MISSING]}
+    cases:
+      - id: case-1
+        date: "2026-10-30"
+        source: owner
+        quote: "A Mascot reuses the provenance props of Image and MediaFrame; a Mascot without an assetSlot is a finding (relayed by the nivo-lite app)."
+        ruling: "Mascot takes AssetSlotProps (assetSlot, assetSha256, assetPrompt) and emits them as data-asset-* on its root; the lint requires assetSlot on every Mascot."
+  - id: R340
+    code: "FE_RAISED_SURFACE_IN_SURFACE"
+    law: "A Grammar surface that accepts a depth prop (SurfaceListCard) does not pass depth=\"top\" when a SurfaceCard, SurfaceListCard or SurfaceAccordionCard of the same file encloses it: a nested surface is subordinate (outlined, BOUNDARY-5), never raised again (BOUNDARY-6, DNA-COMMON-NO-RAISED-SURFACE-IN-SURFACE); the Grammar resolves the depth from the surface context. A depth computed at run time is not judged."
+    kinds: [lint]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["FE_RAISED_SURFACE_IN_SURFACE"]
+    enforcers:
+      - {kind: eslint-grammar-core, id: no-raised-surface-in-surface}
+    editions: [lite, full]
+    docs: [knowledge/patterns/fe/ui.yaml#FE-UI]
+    templateNa: "A template forces no surface depth; the app composes its surfaces."
+    proves:
+      - packages/eslint-grammar-core/src/surface-depth.spec.ts
+    exemplifiedBy:
+      - {path: packages/eslint-grammar-core/src/surface-depth.spec.ts, editions: [lite, full], codes: [FE_RAISED_SURFACE_IN_SURFACE]}
+    witness:
+      - {path: packages/eslint-grammar-core/src/surface-depth.spec.ts, editions: [lite, full], codes: [FE_RAISED_SURFACE_IN_SURFACE]}
+    cases:
+      - id: case-1
+        date: "2026-10-31"
+        source: owner
+        quote: "A list inside another surface is outlined (BOUNDARY-5, DNA-COMMON-NO-RAISED-SURFACE-IN-SURFACE); SurfaceListCard takes its depth from the surface context (grammar 0.16.2)."
+        ruling: "SurfaceListCard resolves its depth from the surface context like SurfaceCard and SurfaceAccordionCard; an app that forces depth=\"top\" on a surface nested in another surface raises a surface inside a surface, so the lint refuses it."