@starci/hfs 4.0.7 → 4.0.9

package/runtime/scripts/{lib/hfs-slots.mjs → hfs/slots.mjs}

@@ -2,27 +2,39 @@
 //   which slot owns path P           slotOf(P) / classifyPath(P)   (an unknown path reports its nearest slot)
 //   is import A -> B allowed         importAllowed(A, B)           (tier matrix, cross-owner entry, cross-app, layers)
 //   which files are required         requiredFiles(P) / requiredPaths()
-//   is this path tracked             isTracked(P) / trackingOf(P)
-// The rule catalog (knowledge/hfs/rules.yaml, modules/schemas/hfs-rules.schema.yaml) loads through loadRuleCatalog / rules().
+//   is this path tracked             isTracked(P) / trackingOf(P); the rule catalog (knowledge/hfs/rules.yaml, modules/schemas/hfs-rules.schema.yaml) loads through loadRuleCatalog / rules().
 // Every check and lint rule of HFS reads knowledge/hfs/slots.yaml through this module; none keeps its own path
 // list. The manifest shape is modules/schemas/hfs-slots.schema.yaml and hfs.json is modules/schemas/hfs-repo.schema.yaml;
-// the installed runtime carries no npm dependency, so this file re-states those shapes instead of loading ajv
-// (tests/hfs-slots.spec.mjs proves the two agree).
+// the installed runtime carries no npm dependency, so this file re-states those shapes instead of loading ajv (tests/hfs/hfs-slots.spec.mjs proves the two agree).
 //
 // A product is ONE app repository: hfs.json at the app root has kind `app` and declares its two sides, `be` and `fe`, each in
 // the folder of that name. The resolver of the app answers for the whole tree: a root path with the slots of profile `app`,
 // a path below a side folder with that side's resolver (profile be or fe, the side folder as its root: the side view), so
 // every check and lint rule runs unchanged with a side folder as its repository root. Nothing crosses sides except the
 // paths the declaration lists in `sides.<side>.reads` (a subset of the manifest's `sides.<side>.reads`).
+//
+// One loader, two manifest kinds. `kind: app` (the default; knowledge/hfs/slots.yaml) is the product standard above.
+// `kind: runtime` (knowledge/hfs/runtime-slots.yaml, schema starci/runtime-slots@<major>) is the standard of the StarCi
+// runtime repository itself: one profile `runtime`, no sides and no app kinds, slot ids runtime.<name>, the tracked value
+// `generated` (a copy written only by the slot's `generatedBy`). A runtime repository declares itself with
+// hfs.json {"hfs": <major>, "kind": "runtime", "project": <name>}.
+import { ruleParamsProblems } from './rule-params-shape.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
 import { parseYaml } from '../../engine/yaml.mjs';
-import { braceVariants, globExpression } from './glob.mjs';
-import { posixPath } from './path-key.mjs';
+import { braceVariants, globExpression } from '../lib/glob.mjs';
+import { posixPath } from '../lib/path-key.mjs';
+import { captureNames } from '../lib/i18n.mjs';
 import { isPlainObject } from '../../engine/plain-object.mjs';
-
+import { APP_KIND, EDITIONS, ENV_PREFIX, MANIFEST_KINDS, NAME, PRESENCE, RUNTIME_KIND, SEMVER, TESTS, TRACKED, manifestKind, runtimeSemanticProblems, runtimeShapeProblems, slotProblems, tierMapProblems } from './manifest-shape.mjs';
+import { declaredSlotEnabled, optionalSlotProblems, triggerProblems } from './declaration-slots.mjs';
+import { declarationShapeProblems } from './declaration-shape.mjs';
+import { declarationEdition, editionRuleParams, effectiveSlot, enforcerJudgedInEdition, judgedInEdition, litePresenceOf, ruleEditionProblems, slotInEdition } from './edition-slots.mjs';
+export { litePresenceOf, slotInEdition } from './edition-slots.mjs';
 export const HFS_MANIFEST_FILE = 'knowledge/hfs/slots.yaml';
+/** The manifest of kind runtime: the standard tree of the StarCi runtime repository (judged by scripts/hfs/runtime-check.mjs). */
+export const RUNTIME_MANIFEST_FILE = 'knowledge/hfs/runtime-slots.yaml';
 export const HFS_DECLARATION_FILE = 'hfs.json';
 
 /** A refusal with a catalogued code (modules/kernel/failure-codes.yaml) and the facts a check reports. */
@@ -35,13 +47,6 @@ export class HfsSlotsError extends Error {
   }
 }
 
-const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
-const NAME = /^[a-z][a-z0-9-]*$/;
-const ENV_PREFIX = /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$/;
-const SLOT_ID = /^(app|repo|be|fe)\.[a-z0-9-]+(\.[a-z0-9-]+)*$/;
-const PRESENCE = ['required', 'optional', 'opt-in', 'forbidden'];
-const TRACKED = ['tracked', 'ignored', 'external'];
-const TESTS = ['unit-beside', 'e2e', 'none'];
 /** The sides of an app; each lives in the folder of its name and is the profile of its slots. */
 const PROFILES = ['be', 'fe'];
 export const SIDES = Object.freeze([...PROFILES]);
@@ -67,13 +72,11 @@ export function appRelativeMessages(side, sideRoot) {
 }
 
 const SCOPES = [APP_SCOPE, ...PROFILES];
-const APP_KIND = 'app';
-const strList = (v) => Array.isArray(v) && v.every((s) => typeof s === 'string' && s.length > 0);
 
 // ------------------------------------------------------------------------------------------------ patterns
 
 const VAR = /<([A-Za-z][A-Za-z0-9-]*)>/g;
-const varsOf = (text) => [...String(text).matchAll(VAR)].map((m) => m[1]);
+const varsOf = (text) => captureNames(text, VAR);
 const hasWildcard = (segment) => /[*?]/.test(segment);
 
 /** Weight of one pattern segment: literal 4, literal mixed with a variable 3, a bare variable 2, a wildcard 1, `**` 0. */
@@ -151,7 +154,9 @@ const fail = (code, message, details) => { throw new HfsSlotsError(code, message
 function manifestShapeProblems(m) {
   const bad = [];
   if (!isPlainObject(m)) return ['the manifest is not a map'];
-  const allowed = new Set(['schema', 'version', 'versioning', 'presenceValues', 'trackedValues', 'testValues', 'sides', 'appKinds', 'tiers', 'ruleParams', 'crossOwner', 'crossApp', 'slots', 'consumers']);
+  if (!MANIFEST_KINDS.includes(manifestKind(m))) return [`kind must be one of ${MANIFEST_KINDS.join(', ')}`];
+  if (manifestKind(m) === RUNTIME_KIND) return runtimeShapeProblems(m);
+  const allowed = new Set(['schema', 'kind', 'version', 'versioning', 'presenceValues', 'trackedValues', 'testValues', 'editions', 'sides', 'appKinds', 'triggerKinds', 'tiers', 'ruleParams', 'crossOwner', 'crossApp', 'slots', 'consumers', 'naming']);
   for (const key of Object.keys(m)) if (!allowed.has(key)) bad.push(`unknown top-level key ${key}`);
   if (!/^starci\/hfs-slots@\d+$/.test(String(m.schema))) bad.push('schema must be starci/hfs-slots@<major>');
   if (!SEMVER.test(String(m.version))) bad.push('version must be MAJOR.MINOR.PATCH');
@@ -159,11 +164,13 @@ function manifestShapeProblems(m) {
   if (JSON.stringify(m.presenceValues) !== JSON.stringify(PRESENCE)) bad.push(`presenceValues must be ${PRESENCE.join(', ')}`);
   if (JSON.stringify(m.trackedValues) !== JSON.stringify(TRACKED)) bad.push(`trackedValues must be ${TRACKED.join(', ')}`);
   if (JSON.stringify(m.testValues) !== JSON.stringify(TESTS)) bad.push(`testValues must be ${TESTS.join(', ')}`);
+  if (JSON.stringify(m.editions) !== JSON.stringify(EDITIONS)) bad.push(`editions must be ${EDITIONS.join(', ')}`);
   if (!isPlainObject(m.sides) || Object.keys(m.sides).sort().join() !== PROFILES.join()) bad.push('sides must be a map with exactly be and fe');
   else for (const side of PROFILES) {
     const def = m.sides[side];
-    if (!isPlainObject(def) || Object.keys(def).join() !== 'reads' || !Array.isArray(def.reads) || !def.reads.every((r) => typeof r === 'string' && /^(be|fe)\/([^/]+\/)+$/.test(r)) || new Set(def.reads).size !== def.reads.length) bad.push(`sides.${side} must be {reads: [unique <side>/<dir>/ paths]}`);
+    if (!isPlainObject(def) || Object.keys(def).join() !== 'reads' || !Array.isArray(def.reads) || !def.reads.every((r) => typeof r === 'string' && /^[a-z][a-z0-9-]*\/([^/]+\/)+$/.test(r)) || new Set(def.reads).size !== def.reads.length) bad.push(`sides.${side} must be {reads: [unique <owner>/<dir>/ paths]}`);
   }
+  if (m.triggerKinds !== undefined && (!Array.isArray(m.triggerKinds) || !m.triggerKinds.length || !m.triggerKinds.every((k) => NAME.test(String(k))) || new Set(m.triggerKinds).size !== m.triggerKinds.length)) bad.push('triggerKinds must be a non-empty list of unique names');
   for (const key of ['appKinds', 'tiers']) {
     if (!isPlainObject(m[key])) { bad.push(`${key} must be a map with be and fe`); continue; }
     for (const extra of Object.keys(m[key])) if (!PROFILES.includes(extra)) bad.push(`${key}.${extra} is not a profile`);
@@ -174,67 +181,11 @@ function manifestShapeProblems(m) {
     if (kinds !== undefined && (!Array.isArray(kinds) || !kinds.length || !kinds.every((k) => NAME.test(String(k))) || new Set(kinds).size !== kinds.length)) bad.push(`appKinds.${profile} must be a non-empty list of unique names`);
     const tiers = m.tiers?.[profile];
     if (tiers === undefined) continue;
-    if (!isPlainObject(tiers) || !Object.keys(tiers).length) { bad.push(`tiers.${profile} must be a non-empty map`); continue; }
-    for (const [tier, def] of Object.entries(tiers)) {
-      if (!NAME.test(tier)) bad.push(`tiers.${profile}.${tier} is not a tier name`);
-      if (!isPlainObject(def) || !Array.isArray(def.mayImport) || !def.mayImport.every((t) => NAME.test(String(t)))) bad.push(`tiers.${profile}.${tier}.mayImport must be a list of tier names`);
-      for (const key of Object.keys(def ?? {})) if (!['mayImport', 'acyclic', 'lowerLayerOnly'].includes(key)) bad.push(`tiers.${profile}.${tier}.${key} is not a tier field`);
-    }
-  }
-  const blockOk = (v) => isPlainObject(v) && Number.isInteger(v.lines) && v.lines >= 2 && Number.isInteger(v.tokens) && v.tokens >= 1 && Object.keys(v).length === 2;
-  const fileLinesOk = (v) => isPlainObject(v) && Number.isInteger(v.soft) && v.soft >= 1 && typeof v.hardGrowth === 'boolean' && Object.keys(v).length === 2;
-  const rp = m.ruleParams;
-  if (!isPlainObject(rp) || Object.keys(rp).some((k) => !PROFILES.includes(k)) || !PROFILES.every((p) => isPlainObject(rp[p]))) bad.push('ruleParams must be a map with be and fe');
-  else {
-    if (!fileLinesOk(rp.be.fileLines) || !blockOk(rp.be.duplicateBlock) || Object.keys(rp.be).length !== 7) bad.push('ruleParams.be needs fileLines {soft, hardGrowth}, duplicateBlock {lines >= 2, tokens >= 1}, infraOwners, specDoubles, suffixes, bannedSuffixes and contractShape {helper}');
-    if (!isPlainObject(rp.be.contractShape) || Object.keys(rp.be.contractShape).length !== 1 || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(String(rp.be.contractShape.helper))) bad.push('ruleParams.be.contractShape must be {helper: <identifier>}');
-    const owners = rp.be.infraOwners;
-    const ownerId = /^(platform|integrations)\/[a-z][a-z0-9-]*$/;
-    if (!isPlainObject(owners) || !Object.keys(owners).length || !Object.entries(owners).every(([key, list]) => key && Array.isArray(list) && list.every((o) => ownerId.test(String(o))) && new Set(list).size === list.length)) bad.push('ruleParams.be.infraOwners must map a non-empty specifier to a list of unique platform/<capability> or integrations/<provider> owners ([] means nowhere)');
-    const roleList = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => /^[a-z][a-z0-9-]*$/.test(String(x))) && new Set(v).size === v.length;
-    if (!roleList(rp.be.suffixes)) bad.push('ruleParams.be.suffixes must be a non-empty list of unique kebab-case role suffixes');
-    if (!roleList(rp.be.bannedSuffixes)) bad.push('ruleParams.be.bannedSuffixes must be a non-empty list of unique kebab-case suffixes');
-    else if (roleList(rp.be.suffixes) && rp.be.suffixes.some((x) => rp.be.bannedSuffixes.includes(x))) bad.push('ruleParams.be.suffixes and bannedSuffixes must be disjoint');
-    const formNames = ['call', 'new', 'curried', 'object', 'primitive', 'array'];
-    const formsOk = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => formNames.includes(x)) && new Set(v).size === v.length;
-    const doubleOk = (v) => isPlainObject(v) && /^[A-Za-z][A-Za-z0-9]*$/.test(String(v.double)) && formsOk(v.forms);
-    const regexOk = (v) => { try { return typeof v === 'string' && v.length > 0 && Boolean(new RegExp(v)); } catch { return false; } };
-    const sd = rp.be.specDoubles;
-    if (!isPlainObject(sd) || Object.keys(sd).sort().join() !== 'doubles,fallback,kit' || typeof sd.kit !== 'string' || !sd.kit || !Array.isArray(sd.doubles) || !sd.doubles.length || !sd.doubles.every((e) => doubleOk(e) && regexOk(e.token) && Object.keys(e).length === 3) || !doubleOk(sd.fallback) || Object.keys(sd.fallback).length !== 2) bad.push('ruleParams.be.specDoubles must be {kit, doubles: [{token: regex, double, forms}], fallback: {double, forms}} with forms drawn from call, new, curried, object, primitive, array');
-    if (!fileLinesOk(rp.fe.fileLines) || !blockOk(rp.fe.duplicateBlock) || Object.keys(rp.fe).length !== 2) bad.push('ruleParams.fe needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}');
+    bad.push(...tierMapProblems(profile, tiers));
   }
+  bad.push(...ruleParamsProblems(m));
   if (!Array.isArray(m.slots) || !m.slots.length) { bad.push('slots must be a non-empty list'); return bad; }
-  const slotKeys = new Set(['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'rules', 'goesTo', 'why', 'since', 'retiredIn', 'successor']);
-  m.slots.forEach((slot, index) => {
-    const at = isPlainObject(slot) && typeof slot.id === 'string' ? `slot ${slot.id}` : `slots[${index}]`;
-    if (!isPlainObject(slot)) { bad.push(`${at} is not a map`); return; }
-    for (const key of Object.keys(slot)) if (!slotKeys.has(key)) bad.push(`${at}: unknown field ${key}`);
-    if (!SLOT_ID.test(String(slot.id))) bad.push(`${at}: id must look like be.transport.http`);
-    if (!Array.isArray(slot.profiles) || !slot.profiles.length || !slot.profiles.every((p) => SCOPES.includes(p)) || new Set(slot.profiles).size !== slot.profiles.length || (slot.profiles.includes(APP_SCOPE) && slot.profiles.length !== 1)) bad.push(`${at}: profiles must be [app] or a unique non-empty subset of be, fe`);
-    else if ((slot.profiles[0] === APP_SCOPE) !== String(slot.id).startsWith(`${APP_SCOPE}.`)) bad.push(`${at}: an app-root slot has profiles [app] and an id app.<name>, and only it`);
-    if (typeof slot.path !== 'string' || !slot.path) bad.push(`${at}: path is required`);
-    if (!PRESENCE.includes(slot.presence)) bad.push(`${at}: presence must be one of ${PRESENCE.join(', ')}`);
-    if (!TRACKED.includes(slot.tracked)) bad.push(`${at}: tracked must be one of ${TRACKED.join(', ')}`);
-    if (!NAME.test(String(slot.tier))) bad.push(`${at}: tier must be a tier name, none or inherit`);
-    if (!TESTS.includes(slot.tests)) bad.push(`${at}: tests must be one of ${TESTS.join(', ')}`);
-    if (slot.owner !== undefined && typeof slot.owner !== 'boolean') bad.push(`${at}: owner must be a boolean`);
-    if (slot.appKind !== undefined && !NAME.test(String(slot.appKind))) bad.push(`${at}: appKind must be a name`);
-    if (slot.minInstances !== undefined && !(Number.isInteger(slot.minInstances) && slot.minInstances >= 1)) bad.push(`${at}: minInstances must be a positive integer`);
-    if (slot.requiredWhen !== undefined && slot.requiredWhen !== 'connections') bad.push(`${at}: requiredWhen may only be connections`);
-    if (slot.requiredInstances !== undefined && !(isPlainObject(slot.requiredInstances) && Object.values(slot.requiredInstances).every((v) => strList(v) && v.length))) bad.push(`${at}: requiredInstances must map a variable to a non-empty list of names`);
-    for (const key of ['requires', 'allows', 'forbids', 'layers', 'kinds']) if (slot[key] !== undefined && !strList(slot[key])) bad.push(`${at}: ${key} must be a list of strings`);
-    if (slot.kinds !== undefined && strList(slot.kinds) && (!slot.kinds.length || new Set(slot.kinds).size !== slot.kinds.length || slot.kinds.some((k) => !NAME.test(k) || (slot.layers ?? []).includes(k)))) bad.push(`${at}: kinds must be a non-empty list of unique folder names that are not layers`);
-    if (slot.roles !== undefined && !(isPlainObject(slot.roles) && Object.keys(slot.roles).length && Object.entries(slot.roles).every(([role, file]) => NAME.test(role) && typeof file === 'string' && file && !file.includes('/')))) bad.push(`${at}: roles must map a role name to a file name`);
-    if (slot.composedBy !== undefined && !(strList(slot.composedBy) && slot.composedBy.length && new Set(slot.composedBy).size === slot.composedBy.length)) bad.push(`${at}: composedBy must be a non-empty list of unique app kinds`);
-    if (slot.budget !== undefined && !(isPlainObject(slot.budget) && Object.keys(slot.budget).length && Object.values(slot.budget).every((v) => Number.isInteger(v) && v >= 1))) bad.push(`${at}: budget must map names to positive integers`);
-    if (slot.managedBy !== undefined && !NAME.test(String(slot.managedBy))) bad.push(`${at}: managedBy must be a template id`);
-    if (slot.rules !== undefined && !(Array.isArray(slot.rules) && slot.rules.every((r) => /^[A-Z][A-Z0-9_]*\*?$/.test(String(r))) && new Set(slot.rules).size === slot.rules.length)) bad.push(`${at}: rules must be unique rule ids`);
-    if (slot.since !== undefined && !SEMVER.test(String(slot.since))) bad.push(`${at}: since must be a version`);
-    if (slot.retiredIn !== undefined && !(Number.isInteger(slot.retiredIn) && slot.retiredIn >= 2)) bad.push(`${at}: retiredIn must be a major`);
-    if (slot.retiredIn !== undefined && typeof slot.successor !== 'string') bad.push(`${at}: a retired slot names its successor`);
-    if (slot.tracked === 'external' && (typeof slot.goesTo !== 'string' || slot.presence !== 'forbidden')) bad.push(`${at}: an external slot is forbidden and says where it goes (goesTo)`);
-    if (slot.presence === 'forbidden' && slot.tracked !== 'external') bad.push(`${at}: a forbidden slot is external`);
-  });
+  m.slots.forEach((slot, index) => bad.push(...slotProblems(slot, index, APP_KIND, { appScope: APP_SCOPE, scopes: SCOPES })));
   return bad;
 }
 
@@ -256,6 +207,7 @@ function manifestSemanticProblems(m) {
         const tiers = m.tiers[profile];
         if (slot.tier !== 'none' && slot.tier !== 'inherit' && !(slot.tier in tiers)) bad.push(`slot ${slot.id}: tier ${slot.tier} is not a ${profile} tier`);
         if (slot.appKind !== undefined && !m.appKinds[profile].includes(slot.appKind)) bad.push(`slot ${slot.id}: app kind ${slot.appKind} is not a ${profile} kind`);
+        bad.push(...triggerProblems(slot, m.triggerKinds));
       }
       if (slot.appKind === undefined) {
         for (const variant of braceVariants(slot.path)) {
@@ -267,6 +219,15 @@ function manifestSemanticProblems(m) {
     }
     if (slot.appKind !== undefined && !pathVars.has('app')) bad.push(`slot ${slot.id}: an app-kind slot binds <app> in its path`);
     if (slot.requiredWhen !== undefined && slot.presence !== 'required') bad.push(`slot ${slot.id}: requiredWhen belongs to a required slot`);
+    if (!slotInEdition(m, slot, 'lite') && (slot.litePresence !== undefined || slot.lite !== undefined)) bad.push(`slot ${slot.id}: litePresence/lite on a slot lite never sees (editions)`);
+    if (isPlainObject(slot.litePresence) && slot.profiles.includes(APP_SCOPE)) bad.push(`slot ${slot.id}: an app-root slot takes a bare litePresence, not a per-side map`);
+    for (const profile of slot.profiles) if (litePresenceOf(slot, profile) === 'forbidden' && typeof slot.goesTo !== 'string') bad.push(`slot ${slot.id}: forbidden in lite for ${profile}, so it says where the content goes (goesTo)`);
+    if (slot.lite?.path !== undefined) {
+      for (const name of varsOf(slot.lite.path)) if (!pathVars.has(name)) bad.push(`slot ${slot.id}: lite.path binds <${name}>, which the path does not`);
+      for (const variant of braceVariants(slot.lite.path)) {
+        try { compileVariant(slot, variant); } catch (error) { bad.push(`slot ${slot.id}: lite.path ${variant} does not compile (${error.message})`); }
+      }
+    }
     for (const name of Object.keys(slot.requiredInstances ?? {})) if (!pathVars.has(name)) bad.push(`slot ${slot.id}: requiredInstances names <${name}>, which the path does not bind`);
     for (const file of Object.values(slot.roles ?? {})) for (const name of varsOf(file)) if (!pathVars.has(name)) bad.push(`slot ${slot.id}: roles names <${name}> in ${file}, which the path does not bind`);
     for (const entry of slot.requires ?? []) for (const name of varsOf(entry)) if (!pathVars.has(name)) bad.push(`slot ${slot.id}: requires ${entry} uses <${name}>, which the path does not bind`);
@@ -277,11 +238,15 @@ function manifestSemanticProblems(m) {
     for (const kind of slot.composedBy ?? []) if (!slot.profiles.every((p) => m.appKinds[p].includes(kind))) bad.push(`slot ${slot.id}: composedBy names ${kind}, which is not an app kind of every profile of the slot`);
     if (slot.layers !== undefined && slot.tier !== 'none' && !slot.profiles.every((p) => m.tiers[p][slot.tier]?.lowerLayerOnly)) bad.push(`slot ${slot.id}: layers need a lowerLayerOnly tier`);
   }
+  if (manifestKind(m) === RUNTIME_KIND) return [...bad, ...runtimeSemanticProblems(m)];
   for (const side of PROFILES) for (const read of m.sides[side].reads) {
     const [owner, ...rest] = read.split('/');
     const below = rest.join('/');
     if (owner === side) bad.push(`sides.${side}.reads names ${read}, which is its own side`);
-    else if (!m.slots.some((s) => s.profiles.includes(owner) && s.presence !== 'forbidden' && braceVariants(s.path).some((v) => v.startsWith(below)))) bad.push(`sides.${side}.reads names ${read}, which no ${owner} slot owns`);
+    // A side read is a path of the other side (be/contracts/); an app-root read (supabase/types/) names a tree an app slot owns.
+    else if (PROFILES.includes(owner)) {
+      if (!m.slots.some((s) => s.profiles.includes(owner) && s.presence !== 'forbidden' && braceVariants(s.path).some((v) => v.startsWith(below)))) bad.push(`sides.${side}.reads names ${read}, which no ${owner} slot owns`);
+    } else if (!m.slots.some((s) => s.profiles.includes(APP_SCOPE) && s.presence !== 'forbidden' && braceVariants(s.path).some((v) => v.startsWith(read)))) bad.push(`sides.${side}.reads names ${read}, which no app-root slot owns`);
   }
   for (const profile of PROFILES) {
     for (const [tier, def] of Object.entries(m.tiers[profile])) {
@@ -313,56 +278,13 @@ export function loadSlotManifest({ root = skillRoot, file = path.join(root, HFS_
 
 // ------------------------------------------------------------------------------------- declaration
 
-/** Shape problems of a parsed hfs.json, in the words of modules/schemas/hfs-repo.schema.yaml. */
-function declarationShapeProblems(d) {
-  const bad = [];
-  if (!isPlainObject(d)) return ['hfs.json is not an object'];
-  for (const key of Object.keys(d)) if (!['hfs', 'kind', 'project', 'sides'].includes(key)) bad.push(`unknown key ${key}`);
-  if (!(Number.isInteger(d.hfs) && d.hfs >= 1)) bad.push('hfs must be the pinned manifest major (an integer, 1 or more)');
-  if (d.kind !== APP_KIND) bad.push(`kind must be ${APP_KIND}: a product is one app repository with a be and an fe side`);
-  if (!NAME.test(String(d.project))) bad.push('project must be a project name');
-  if (!isPlainObject(d.sides) || Object.keys(d.sides).sort().join() !== PROFILES.join()) { bad.push('sides must declare exactly be and fe'); return bad; }
-  const names = new Map();
-  for (const side of PROFILES) {
-    const s = d.sides[side];
-    const at = `sides.${side}`;
-    if (!isPlainObject(s)) { bad.push(`${at} must be an object`); continue; }
-    for (const key of Object.keys(s)) if (!['apps', 'optionalSlots', 'connections', 'reads'].includes(key)) bad.push(`${at} has unknown key ${key}`);
-    if (!Array.isArray(s.apps) || !s.apps.length) bad.push(`${at}.apps must list every ${side}/apps/<name> with its kind`);
-    else s.apps.forEach((app, i) => {
-      if (!isPlainObject(app) || !NAME.test(String(app.name)) || !NAME.test(String(app.kind)) || Object.keys(app).some((k) => k !== 'name' && k !== 'kind')) bad.push(`${at}.apps[${i}] must be {name, kind}`);
-      // The root scripts name every app (start:<app>), so an app name is unique across both sides.
-      else if (names.has(app.name)) bad.push(`app ${app.name} is declared twice (${names.get(app.name)} and ${side})`);
-      else names.set(app.name, side);
-    });
-    if (s.optionalSlots !== undefined && (!Array.isArray(s.optionalSlots) || !s.optionalSlots.every((v) => SLOT_ID.test(String(v))) || new Set(s.optionalSlots).size !== s.optionalSlots.length)) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
-    if (s.reads !== undefined && (!Array.isArray(s.reads) || !s.reads.every((r) => typeof r === 'string' && r.length > 0) || new Set(s.reads).size !== s.reads.length)) bad.push(`${at}.reads must be a unique list of paths`);
-    if (s.connections !== undefined) {
-      if (side !== 'be') { bad.push('connections belong to the be side'); continue; }
-      // One physical database = one entry (R84): {name, envPrefix}; names and env prefixes unique, no prefix inside another's keys.
-      const list = Array.isArray(s.connections) ? s.connections : null;
-      if (!list || !list.every((c) => isPlainObject(c) && NAME.test(String(c.name)) && ENV_PREFIX.test(String(c.envPrefix)) && Object.keys(c).length === 2)) bad.push('connections must be a list of {name: kebab-case database name, envPrefix: UPPER_SNAKE prefix of its env keys}');
-      else {
-        if (new Set(list.map((c) => c.name)).size !== list.length) bad.push('connections names must be unique');
-        for (const a of list) for (const b of list) if (a !== b && `${b.envPrefix}_`.startsWith(`${a.envPrefix}_`)) bad.push(`connections ${a.name} and ${b.name} share env keys (${a.envPrefix}_ covers ${b.envPrefix}_)`);
-      }
-    }
-  }
-  return bad;
-}
-
 const declarationInvalid = (problems, file) => fail('HFS_DECLARATION_INVALID', `hfs.json is refused: ${problems.slice(0, 5).join('; ')}${problems.length > 5 ? `; and ${problems.length - 5} more` : ''}`, { file, problems });
 
 /** One side of a declaration checked against the manifest: app kinds of the profile, opt-in slots, required app kinds, reads. */
 function sideProblems(manifest, side, s) {
   const bad = [];
   for (const app of s.apps) if (!manifest.appKinds[side].includes(app.kind)) bad.push(`${side} app ${app.name} has kind ${app.kind}, which is not a ${side} kind (${manifest.appKinds[side].join(', ')})`);
-  for (const id of s.optionalSlots ?? []) {
-    const slot = manifest.slots.find((candidate) => candidate.id === id);
-    if (!slot || !slot.profiles.includes(side)) bad.push(`sides.${side}.optionalSlots names ${id}, which is not a ${side} slot`);
-    else if (slot.presence !== 'opt-in') bad.push(`sides.${side}.optionalSlots names ${id}, which is ${slot.presence}, not opt-in`);
-    else if (slot.appKind !== undefined) bad.push(`sides.${side}.optionalSlots names ${id}; an app of kind ${slot.appKind} enables it`);
-  }
+  bad.push(...optionalSlotProblems(manifest, side, s));
   for (const read of s.reads ?? []) if (!manifest.sides[side].reads.includes(read)) bad.push(`sides.${side}.reads names ${read}; ${side} may read only ${manifest.sides[side].reads.join(', ') || 'nothing of the other side'}`);
   const connections = s.connections ?? [];
   for (const slot of manifest.slots) {
@@ -380,24 +302,47 @@ function sideProblems(manifest, side, s) {
  * its two sides under `sides`), or with `side` that side's view: the declaration a check of the side folder runs under.
  */
 export function resolveRepoDeclaration(manifest, declaration, { file = HFS_DECLARATION_FILE, side = null } = {}) {
-  const problems = declarationShapeProblems(declaration);
+  const problems = declarationShapeProblems(declaration, PROFILES);
   if (problems.length) declarationInvalid(problems, file);
+  if (declaration.kind !== manifestKind(manifest)) declarationInvalid([`hfs.json is of kind ${declaration.kind}, but the manifest it is judged by is of kind ${manifestKind(manifest)}`], file);
   if (declaration.hfs !== manifest.major)
     fail('HFS_MANIFEST_MAJOR_MISMATCH', `hfs.json pins manifest major ${declaration.hfs} but the manifest is ${manifest.version}`, { pinned: declaration.hfs, manifest: manifest.version, manifestMajor: manifest.major, file });
+  if (declaration.kind === RUNTIME_KIND) {
+    if (side !== null) fail('HFS_DECLARATION_INVALID', 'a runtime repository has no sides', { file, side });
+    return Object.freeze({
+      hfs: declaration.hfs,
+      kind: RUNTIME_KIND,
+      project: declaration.project,
+      side: null,
+      profile: RUNTIME_KIND,
+      apps: Object.freeze([]),
+      optionalSlots: Object.freeze([]),
+      connections: Object.freeze([]),
+      reads: Object.freeze([]),
+      manifestVersion: manifest.version,
+    });
+  }
+  const { edition, known, valid } = declarationEdition(manifest, declaration);
+  if (!valid) fail('HFS_EDITION_INVALID', `hfs.json edition is ${JSON.stringify(declaration.edition)}; the editions this manifest knows are ${known.join(', ')} (absent means full)`, { file, edition: declaration.edition });
   const bad = PROFILES.flatMap((name) => sideProblems(manifest, name, declaration.sides[name]));
   if (bad.length) declarationInvalid(bad, file);
   if (side !== null && !PROFILES.includes(side)) fail('HFS_DECLARATION_INVALID', `${side} is not a side of an app (be, fe)`, { file, side });
+  // A provider declared on any connection enables the provider slots of every profile (a fe side declares none): each view carries the union.
+  const providers = Object.freeze([...new Set(PROFILES.flatMap((name) => (declaration.sides[name].connections ?? []).map((c) => c.provider).filter((p) => p !== undefined)))]);
   const sides = Object.fromEntries(PROFILES.map((name) => {
     const s = declaration.sides[name];
     return [name, Object.freeze({
       hfs: declaration.hfs,
       kind: APP_KIND,
       project: declaration.project,
+      edition,
       side: name,
       profile: name,
       apps: Object.freeze(s.apps.map((a) => Object.freeze({ name: a.name, kind: a.kind }))),
       optionalSlots: Object.freeze([...(s.optionalSlots ?? [])]),
-      connections: Object.freeze((s.connections ?? []).map((c) => Object.freeze({ name: c.name, envPrefix: c.envPrefix }))),
+      patterns: Object.freeze([...(s.patterns ?? [])]), kinds: Object.freeze([...(s.kinds ?? [])]),
+      connections: Object.freeze((s.connections ?? []).map((c) => Object.freeze({ name: c.name, envPrefix: c.envPrefix, owner: c.owner, isolation: c.isolation, ...(c.provider !== undefined ? { provider: c.provider } : {}) }))),
+      providers,
       reads: Object.freeze([...(s.reads ?? [])]),
       manifestVersion: manifest.version,
     })];
@@ -407,12 +352,14 @@ export function resolveRepoDeclaration(manifest, declaration, { file = HFS_DECLA
     hfs: declaration.hfs,
     kind: APP_KIND,
     project: declaration.project,
+    edition,
     side: null,
     profile: APP_SCOPE,
-    // The root declares no app, opt-in slot or connection of its own: each side does.
+    // The root declares no app or connection of its own (each side does); its one opt-in slot is the browser journey (`browser: true`).
     apps: Object.freeze([]),
-    optionalSlots: Object.freeze([]),
+    optionalSlots: Object.freeze(declaration.browser === true ? ['app.browser'] : []),
     connections: Object.freeze([]),
+    providers,
     reads: Object.freeze([]),
     sides: Object.freeze(sides),
     manifestVersion: manifest.version,
@@ -454,14 +401,18 @@ const isEntryFile = (name) => name === 'index.ts' || name === 'index.tsx';
  */
 function createScopeResolver(manifest, repo) {
   const profile = repo.profile;
-  const slots = manifest.slots.filter((s) => s.profiles.includes(profile));
+  const edition = repo.edition ?? 'full';
+  const slots = manifest.slots.filter((s) => s.profiles.includes(profile) && slotInEdition(manifest, s, edition)).map((s) => effectiveSlot(s, profile, edition));
   const byId = new Map(slots.map((s) => [s.id, s]));
   const variants = slots.flatMap(variantsOf);
   const appKind = new Map(repo.apps.map((a) => [a.name, a.kind]));
 
   const slotEnabled = (slot) => {
+    // A provider slot is gated by its provider in every edition: litePresence may lift it to required, but it still
+    // exists for this repository only while a connection declares the provider.
+    if (slot.provider !== undefined) return declaredSlotEnabled(slot, repo);
     if (slot.presence !== 'opt-in') return true;
-    return slot.appKind !== undefined ? repo.apps.some((a) => a.kind === slot.appKind) : repo.optionalSlots.includes(slot.id);
+    return declaredSlotEnabled(slot, repo);
   };
   const clean = (p) => posixPath(p).replace(/\/+$/, '');
 
@@ -599,10 +550,11 @@ function createScopeResolver(manifest, repo) {
       const b = layerIndex(byId.get((toOwner ?? to).slot), toOwner?.root ?? to.root);
       if (a >= 0 && b >= 0 && b <= a) return { allowed: false, reason: 'layerOrder', fromLayer: fromSlot.layers[a], toLayer: fromSlot.layers[b] };
     }
-    if (toOwner) {
+    // A runtime owner is imported file by file (crossOwner of knowledge/hfs/runtime-slots.yaml): no public entry.
+    if (toOwner && repo.kind !== RUNTIME_KIND) {
       const relative = to.path === toOwner.root ? '' : to.path.slice(toOwner.root.length + 1);
-      const ownerTier = byId.get(toOwner.slot).tier;
-      const entry = isEntryFile(relative) || (ownerTier === 'package' && relative === 'src/index.ts') || (ownerTier === 'app' && relative === 'app.module.ts');
+      const ownerSlot = byId.get(toOwner.slot);
+      const entry = isEntryFile(relative) || (byId.get(to.slot).entries ?? []).includes(to.path.slice(to.root.length + 1)) || (ownerSlot.tier === 'package' && relative === 'src/index.ts') || (ownerSlot.tier === 'app' && relative === 'app.module.ts');
       if (!entry) return { allowed: false, reason: 'notPublicEntry', owner: toOwner.root, path: to.path };
     }
     return { allowed: true, reason: 'allowed', fromTier, toTier };
@@ -631,7 +583,7 @@ function createScopeResolver(manifest, repo) {
     const minimums = [];
     const expandApps = (slot) => repo.apps.filter((a) => slot.appKind === undefined || a.kind === slot.appKind);
     for (const slot of slots) {
-      if (slot.presence !== 'required') continue;
+      if (slot.presence !== 'required' || !slotEnabled(slot)) continue;
       if (slot.requiredWhen === 'connections' && !repo.connections.length) continue;
       if (slot.minInstances) minimums.push({ slot: slot.id, min: slot.minInstances, ...(slot.appKind ? { appKind: slot.appKind } : {}) });
       for (const variant of braceVariants(slot.path)) {
@@ -679,7 +631,7 @@ function createScopeResolver(manifest, repo) {
     requiredPaths,
     trackingOf,
     isTracked,
-    ruleParams: () => ruleParams(manifest, profile),
+    ruleParams: () => ruleParams(manifest, profile, edition),
     allowedImports: (tier) => manifest.tiers[profile]?.[tier]?.mayImport ?? null,
   });
 }
@@ -693,7 +645,9 @@ function createScopeResolver(manifest, repo) {
  */
 export function createSlotResolver(manifest, repo) {
   if (repo.profile !== APP_SCOPE) return createScopeResolver(manifest, repo);
-  const root = createScopeResolver(manifest, repo);
+  // The root declares no connection of its own, yet a provider slot of the app profile (app.supabase*) is enabled by a
+  // side's connection with that provider: the root scope reads the union of the sides' connections.
+  const root = createScopeResolver(manifest, { ...repo, connections: SIDES.flatMap((side) => repo.sides[side].connections) });
   const sides = Object.fromEntries(PROFILES.map((side) => [side, createScopeResolver(manifest, repo.sides[side])]));
   const clean = (p) => posixPath(p).replace(/\/+$/, '');
   /** { side, rest } when `p` lies below a side folder, else null. */
@@ -740,6 +694,10 @@ export function createSlotResolver(manifest, repo) {
       if (from && to && from.side !== to.side) {
         return reads(from.side, toPath) ? { allowed: true, reason: 'sideRead', fromSide: from.side, toSide: to.side } : { allowed: false, reason: 'crossSide', fromSide: from.side, toSide: to.side, reads: repo.sides[from.side].reads };
       }
+      // A side file may read an app-root path (supabase/types/) only through a declared read, exactly as it reads the other side.
+      if (from && !to) {
+        return reads(from.side, toPath) ? { allowed: true, reason: 'sideRead', fromSide: from.side, toSide: null } : { allowed: false, reason: 'crossSide', fromSide: from.side, toSide: null, reads: repo.sides[from.side].reads };
+      }
       if (from && to) return sides[from.side].importAllowed(from.rest, to.rest);
       return root.importAllowed(fromPath, toPath);
     },
@@ -763,11 +721,11 @@ export function createSlotResolver(manifest, repo) {
   });
 }
 
-/** The rule parameters of one profile (be: fileLines, duplicateBlock, infraOwners, suffixes, bannedSuffixes; fe: fileLines, duplicateBlock), as a frozen deep copy. */
-export function ruleParams(manifest, profile) {
-  if (!PROFILES.includes(profile)) fail('HFS_MANIFEST_INVALID', `ruleParams has no profile ${profile}`, { profile });
-  const deepFreeze = (v) => { if (v && typeof v === 'object') Object.values(v).forEach(deepFreeze); return Object.freeze(v); };
-  return deepFreeze(structuredClone(manifest.ruleParams[profile]));
+/** The rule parameters of one profile (be: infraOwners, suffixes, bannedSuffixes and the rest over the shared ruleParams.common fileLines and duplicateBlock; fe: common alone or with its overrides; runtime: ruleParams.runtime of a runtime manifest), as a frozen deep copy. Under `edition` lite the `lite` overrides of ruleParams.<profile> merge over the base (the `lite` key itself is never returned). */
+export function ruleParams(manifest, profile, edition = 'full') {
+  const profiles = manifestKind(manifest) === RUNTIME_KIND ? [RUNTIME_KIND] : PROFILES;
+  if (!profiles.includes(profile)) fail('HFS_MANIFEST_INVALID', `ruleParams has no profile ${profile}`, { profile });
+  return editionRuleParams({ ...manifest.ruleParams.common, ...manifest.ruleParams[profile] }, edition);
 }
 
 /**
@@ -781,19 +739,19 @@ export function openHfs({ root = skillRoot, repoRoot, declaration, side = null,
 
 // ------------------------------------------------------------------------------------------ rule catalog
 
-export const HFS_RULES_FILE = 'knowledge/hfs/rules.yaml';
-export const RULE_GATES = Object.freeze(['pre-commit', 'pre-push', 'settle', 'land', 'ci', 'sonar']);
-export const ENFORCER_FAMILIES = Object.freeze(['eslint-be', 'eslint-fe', 'stylelint', 'machine', 'hfs', 'work-validate', 'sonar']);
-export const RULE_KINDS = Object.freeze(['codemod', 'lint', 'check', 'design']);
+const HFS_RULES_FILE = 'knowledge/hfs/rules.yaml';
+const RULE_GATES = Object.freeze(['pre-commit', 'pre-push', 'settle', 'land', 'ci', 'sonar', 'runtime']);
+const ENFORCER_FAMILIES = Object.freeze(['eslint-be', 'eslint-fe', 'stylelint', 'machine', 'hfs', 'work-validate', 'sonar', 'runtime']);
+const RULE_KINDS = Object.freeze(['codemod', 'lint', 'check', 'design']);
 const FINDING_CODE = /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/;
 const ENFORCER_ID = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
-const FILE_ENFORCERS = ['machine', 'hfs', 'work-validate', 'sonar'];
+const FILE_ENFORCERS = ['machine', 'hfs', 'work-validate', 'sonar', 'runtime'];
 
 /** Shape and semantic problems of a parsed knowledge/hfs/rules.yaml, in the words of modules/schemas/hfs-rules.schema.yaml. */
 function ruleCatalogProblems(d) {
   const bad = [];
   if (!isPlainObject(d)) return ['the rule catalog is not a map'];
-  for (const key of Object.keys(d)) if (!['schema', 'version', 'gates', 'enforcerKinds', 'rules'].includes(key)) bad.push(`unknown top-level key ${key}`);
+  for (const key of Object.keys(d)) if (!['schema', 'version', 'gates', 'enforcerKinds', 'rules', 'retired'].includes(key)) bad.push(`unknown top-level key ${key}`);
   const schemaOk = /^starci\/hfs-rules@\d+$/.test(String(d.schema));
   if (!schemaOk) bad.push('schema must be starci/hfs-rules@<major>');
   if (!SEMVER.test(String(d.version))) bad.push('version must be MAJOR.MINOR.PATCH');
@@ -811,13 +769,14 @@ function ruleCatalogProblems(d) {
     const at = `rules[${index}]`;
     if (!isPlainObject(r)) { bad.push(`${at} is not a map`); return; }
     const label = typeof r.id === 'string' ? r.id : at;
-    for (const key of Object.keys(r)) if (!['id', 'code', 'law', 'kinds', 'gates', 'failureCodes', 'enforcers'].includes(key)) bad.push(`${label} has unknown key ${key}`);
+    for (const key of Object.keys(r)) if (!['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'enforcers'].includes(key)) bad.push(`${label} has unknown key ${key}`);
     // A retired rule leaves its id unused for good (never reused), so ids only have to increase.
     if (!/^R\d{2,3}$/.test(String(r.id))) bad.push(`${at}.id must be R<two or three digits>`);
     else if (index > 0 && typeof d.rules[index - 1]?.id === 'string' && Number(r.id.slice(1)) <= Number(d.rules[index - 1].id.slice(1))) bad.push(`${label} is out of order: ids must increase, and ${d.rules[index - 1].id} comes before it`);
     if (!FINDING_CODE.test(String(r.code))) bad.push(`${label}.code must be an UPPER_SNAKE finding code`);
     if (typeof r.law !== 'string' || !r.law.trim()) bad.push(`${label}.law is missing`);
     if (typeof r.law === 'string' && r.law.includes('\n')) bad.push(`${label}.law must be one line`);
+    if (r.scope !== undefined && r.scope !== 'runtime') bad.push(`${label}.scope is absent or runtime`);
     const enumList = (key, allowed) => {
       if (!Array.isArray(r[key]) || !r[key].length) { bad.push(`${label}.${key} must be a non-empty list`); return []; }
       for (const v of r[key]) if (!allowed.includes(v)) bad.push(`${label}.${key} has ${JSON.stringify(v)}, not one of ${allowed.join(', ')}`);
@@ -825,6 +784,7 @@ function ruleCatalogProblems(d) {
       return r[key];
     };
     enumList('kinds', RULE_KINDS);
+    bad.push(...ruleEditionProblems(r, label));
     const gates = enumList('gates', RULE_GATES);
     if (gates.length) {
       if (!gates.includes('land')) bad.push(`${label} must run at the land gate (every rule does)`);
@@ -844,7 +804,8 @@ function ruleCatalogProblems(d) {
     r.enforcers.forEach((e, n) => {
       const eat = `${label}.enforcers[${n}]`;
       if (!isPlainObject(e)) { bad.push(`${eat} is not a map`); return; }
-      for (const key of Object.keys(e)) if (!['kind', 'id', 'status', 'at'].includes(key)) bad.push(`${eat} has unknown key ${key}`);
+      for (const key of Object.keys(e)) if (!['kind', 'id', 'status', 'at', 'editions'].includes(key)) bad.push(`${eat} has unknown key ${key}`);
+      bad.push(...ruleEditionProblems(e, eat));
       if (!ENFORCER_FAMILIES.includes(e.kind)) bad.push(`${eat}.kind must be one of ${ENFORCER_FAMILIES.join(', ')}`);
       if (!ENFORCER_ID.test(String(e.id))) bad.push(`${eat}.id must be kebab-case`);
       if (seen.has(`${e.kind}:${e.id}`)) bad.push(`${eat} repeats ${e.kind}:${e.id}`);
@@ -853,7 +814,7 @@ function ruleCatalogProblems(d) {
       if (e.at !== undefined) {
         if (typeof e.at !== 'string' || !e.at.trim() || e.at.startsWith('/') || e.at.includes('..')) bad.push(`${eat}.at must be a repository-relative path`);
         if (e.status === 'planned') bad.push(`${eat} is planned, so it has no file yet (at)`);
-        if (!FILE_ENFORCERS.includes(e.kind)) bad.push(`${eat}.at belongs to a machine, hfs, work-validate or sonar enforcer only`);
+        if (!FILE_ENFORCERS.includes(e.kind)) bad.push(`${eat}.at belongs to a machine, hfs, work-validate, sonar or runtime enforcer only`);
       } else if (FILE_ENFORCERS.includes(e.kind) && e.status !== 'planned') bad.push(`${eat} exists, so it names the file (at) that emits its code`);
     });
     if (Array.isArray(r.gates)) {
@@ -886,11 +847,14 @@ export function loadRuleCatalog({ root = skillRoot, file = path.join(root, HFS_R
     version: doc.version, major, minor, patch,
     gates: deepFreeze(structuredClone(doc.gates)),
     enforcerKinds: deepFreeze(structuredClone(doc.enforcerKinds)),
-    rules: list,
+    rules: list, retired: deepFreeze(structuredClone(doc.retired ?? [])),
     /** The rule with this id (R01..), or null. */
     rule: (id) => byId.get(id) ?? null,
     /** The rule that owns this failure code (its own or a sub-check code), or null. */
     byCode: (code) => byCode.get(code) ?? null,
+    /** Whether a finding code is judged under `edition`: a code of a rule that names `editions` without it is not (a code outside the catalog always is). */
+    judgedIn: (code, edition = 'full') => judgedInEdition(byCode.get(code), edition),
+    enforcerJudgedIn: (kind, id, edition = 'full') => enforcerJudgedInEdition(list, kind, id, edition),
     /** The rules that run at a gate. */
     forGate: (gate) => list.filter((r) => r.gates.includes(gate)),
     /** The catalogued why code of a lint finding's rule id (`starci-be/<id>`, `starci-fe/<id>`), or undefined. */

package/runtime/scripts/hfs/sql/pg-parse.mjs

@@ -0,0 +1,46 @@
+// pg-parse.mjs - the one SQL parse entry of the hfs database rules (scripts/hfs/rules/database.mjs): the WASM build
+// of libpg-query, the real PostgreSQL parser compiled to WebAssembly (no native build, no postgres server). It is
+// loaded lazily: a check of an app with no supabase/ tree never pays the module init. parseSql gives the statement
+// tree of a migration (`{version, stmts}`, each stmt `{stmt, stmt_location, stmt_len}` with byte offsets); a
+// plpgsql body (a DO block's or a function's `as` source) is judged through parsePlpgsqlBody, which wraps it in a
+// probe CREATE FUNCTION because libpg-query parses plpgsql only in that form. A parse failure throws the
+// library's SqlError, whose sqlDetails.cursorPosition is the 1-based byte offset of the error.
+
+let loading = null;
+
+/**
+ * The libpg-query module (wasm build), initialized once per process. A bare dynamic import so the package can be
+ * absent until a supabase/ tree exists to judge; the caller reports the load failure, not this module.
+ */
+function loadPgParser() {
+  loading ??= (async () => {
+    const module = await import('libpg-query');
+    const lib = module.default?.parseSync ? module.default : module;
+    await lib.loadModule();
+    return lib;
+  })();
+  return loading;
+}
+
+/** The parse tree of `text` ({version, stmts}); throws SqlError on invalid SQL. */
+export async function parseSql(text) {
+  return (await loadPgParser()).parseSync(text);
+}
+
+/**
+ * The plpgsql AST of a function/DO body: libpg-query's plpgsql parser only accepts a whole CREATE FUNCTION, so
+ * `body` is wrapped in a probe function under a dollar tag that does not collide with the body's own tags.
+ * Answers the PLpgSQL_function node; throws on a body that is not valid plpgsql.
+ */
+export async function parsePlpgsqlBody(body, parameters = [], returnKind = 'void') {
+  let i = 0;
+  let tag = `$hfs_probe_${i}$`;
+  while (body.includes(tag)) { i += 1; tag = `$hfs_probe_${i}$`; }
+  const args = parameters.map((parameter) => parameter?.FunctionParameter?.name).filter(Boolean)
+    .map((name) => `"${name.replace(/"/g, '""')}" text`).join(', ');
+  const returns = returnKind === 'setof' ? 'setof text' : returnKind === 'trigger' ? 'trigger' : returnKind === 'scalar' ? 'text' : 'void';
+  const result = await (await loadPgParser()).parsePlPgSQLSync(
+    `create function hfs_probe(${args}) returns ${returns} language plpgsql as ${tag}${body}${tag};`,
+  );
+  return result?.plpgsql_funcs?.[0]?.PLpgSQL_function ?? null;
+}

package/runtime/scripts/hfs/test-world-slot.mjs

@@ -0,0 +1,6 @@
+// test-world-slot.mjs - the one answer of the machine checks to "is this slot the test world": the slot `be.tests.world` or one of its
+// sub-slots (`be.tests.world.kit`, the world's inlined helpers), which form one test composition root. The lint side asks the same of
+// the slot view through `inTestWorld` of packages/eslint/be/lib/hfs.mjs.
+
+/** True when `slot` (a slot id, or a file's slot) belongs to the test world family. */
+export const isTestWorldSlot = (slot) => typeof slot === 'string' && (slot === 'be.tests.world' || slot.startsWith('be.tests.world.'));

package/runtime/scripts/{lib/hfs-tree.mjs → hfs/tree.mjs}

@@ -4,16 +4,17 @@
 // Read-only: it walks the file system and asks git, nothing else.
 import fs from 'node:fs';
 import path from 'node:path';
-import { gitOutput } from '../api/git/lib.mjs';
-import { posixPath } from './path-key.mjs';
+import { lsFiles } from '../api/git/ls-files.mjs';
+import { gitOutputOf } from '../lib/git.mjs';
+import { posixPath } from '../lib/path-key.mjs';
 
 /** Directory names no tree check enters: git's own store and installed packages. */
 const NEVER_WALKED = new Set(['.git', 'node_modules']);
 /** Two sibling names this close (Levenshtein) are the same name misspelt. */
-export const GHOST_DISTANCE = 2;
+const GHOST_DISTANCE = 2;
 
 /** Levenshtein distance of two names. */
-export function editDistance(a, b) {
+function editDistance(a, b) {
   let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
   for (let i = 1; i <= a.length; i += 1) {
     const row = [i];
@@ -75,6 +76,6 @@ export function treeFacts(tree) {
 
 /** Entries git neither tracks nor ignores, as it prints them (a wholly untracked directory is one entry ending in '/'). */
 export function untrackedEntries(repoRoot) {
-  const out = gitOutput(['ls-files', '-z', '--others', '--exclude-standard', '--directory', '--no-empty-directory'], { dir: repoRoot, maxBuffer: 256 * 1024 * 1024 });
+  const out = gitOutputOf(lsFiles(['-z', '--others', '--exclude-standard', '--directory', '--no-empty-directory'], { dir: repoRoot, maxBuffer: 256 * 1024 * 1024 }), 'git ls-files');
   return out.split('\0').filter(Boolean).map(posixPath);
 }