@starci/hfs 4.9.9 → 4.10.0

package/release/records.mjs

@@ -0,0 +1,54 @@
+// records.mjs - the release records of an app, all under <git common dir>/starci-release (gate.mjs releaseDir):
+//   <head>.l4.json        the L4 record: every gate of the release gate passed on a clean HEAD (gate.mjs writes it)
+//   <head>.urgent.json    the URGENT record (owner ruling urgent-release, 2026-10-29): `release push --urgent` tagged and pushed HEAD after the
+//                         fast local checks alone; it names who (role), why (reason), the checks with their verdicts and the commit, and
+//                         carries the back-fill verdict once `release gate --backfill <tag>` has run the full gate on the same commit
+//   <head12>/rows.json    every gate row run on that head (name, command, verdict, log and its sha256), so a later urgent push reuses a green
+//                         row whose command and log are unchanged instead of running it again
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const URGENT_SCHEMA = 'starci-app-urgent-record/1';
+/** The owner's ruling an urgent record cites: CI and the full gate wait for the back-fill, the safety floor of the deploy never does. */
+export const URGENT_RULING = 'owner ruling urgent-release 2026-10-29: an urgent release ships after the fast local checks; the full gate runs later on the same tag (release gate --backfill) and the deploy safety floor is never skipped';
+
+const readJson = (file) => {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+};
+
+const writeJson = (file, value) => {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+};
+
+/** The sha256 of a file, or null when it cannot be read. */
+export const fileSha256 = (file) => {
+  try { return createHash('sha256').update(fs.readFileSync(file)).digest('hex'); } catch { return null; }
+};
+
+export const l4Path = (dir, head) => path.join(dir, `${head}.l4.json`);
+export const urgentPath = (dir, head) => path.join(dir, `${head}.urgent.json`);
+const rowsPath = (dir, head) => path.join(dir, head.slice(0, 12), 'rows.json');
+
+/** The urgent record of `head`, or null when there is none or it is not an urgent record of that head. */
+export function readUrgent(dir, head) {
+  const record = readJson(urgentPath(dir, head));
+  return record?.schema === URGENT_SCHEMA && record.head === head ? record : null;
+}
+
+export const writeUrgent = (dir, record) => writeJson(urgentPath(dir, record.head), record);
+
+/** Appends a gate row to the rows of `head` (a row of the same name is replaced). */
+export function recordRow(dir, head, row) {
+  const file = rowsPath(dir, head);
+  const rows = (readJson(file) ?? []).filter((known) => known?.name !== row.name);
+  writeJson(file, [...rows, row]);
+}
+
+/** The recorded green row of `head` whose name and command match and whose log still has the recorded sha256, or null. */
+export function greenRow(dir, head, name, command) {
+  const rows = readJson(rowsPath(dir, head)) ?? [];
+  const row = rows.find((known) => known?.name === name && known.command === command && known.pass === true);
+  return row && row.log && fileSha256(row.log) === row.logSha256 ? row : null;
+}

package/release/urgent.mjs

@@ -0,0 +1,129 @@
+// urgent.mjs - `starci app release push --urgent --reason "<text>"`, the sanctioned urgent path (owner ruling urgent-release, 2026-10-29: an urgent
+// deploy needs no CI). It runs only the fast local checks (app check, typecheck, lint of the files changed since the previous release tag, unit), or
+// reuses a green row the gate already recorded for HEAD with the same command and an unchanged log; tags HEAD (annotated) and pushes the default
+// branch and the tag in ONE atomic push through the repository's hook (never --no-verify, `git push --dry-run --atomic` first); then writes the
+// URGENT record <git common dir>/starci-release/<HEAD>.urgent.json naming who (the caller's role), why (the reason), each check with its verdict and the
+// commit. The candidate CI is not waited for. The full gate runs later on the same tag (`release gate --backfill <tag>`, gate.mjs), and the deploy
+// safety floor (backup, migrate preview then execute, readiness, rollback) is never skipped (stack/urgent-floor.mjs).
+import fs from 'node:fs';
+import path from 'node:path';
+import { firstLine } from '../stack/context.mjs';
+import { failure, refusal } from '../stack/errors.mjs';
+import { assertUnmoved, git, inspect, releaseDir, runGate, summaryOf } from './gate.mjs';
+import { assertNames, branchRefs, probe, tagRefs } from './push.mjs';
+import { URGENT_RULING, URGENT_SCHEMA, greenRow, recordRow, writeUrgent } from './records.mjs';
+
+/** The fast local checks of an urgent release, by gate name, in the order they run. */
+export const URGENT_CHECKS = Object.freeze(['app-check', 'typecheck', 'lint', 'test']);
+const REASON_MAX = 500;
+const CHANGED_MAX = 200;
+const PATH_WORD = /^[A-Za-z0-9_@%+=:,./\\-]+$/u;
+const MANAGED_LINT = 'npm run lint';
+
+/** The reason, one line of plain text; an urgent release without one is refused. */
+function reasonOf(value) {
+  const reason = String(value ?? '').replaceAll(/\s+/gu, ' ').trim();
+  if (reason === '') throw refusal('RELEASE_URGENT_REASON_MISSING', 'an urgent release says why: --reason "<text>"');
+  if (reason.length > REASON_MAX) throw refusal('RELEASE_URGENT_REASON_MISSING', `--reason is one line of at most ${REASON_MAX} characters`);
+  return reason;
+}
+
+/** The newest release tag reachable from HEAD's parent, or null on a first release. */
+function previousTag(ctx, prefix) {
+  const found = git(ctx, ['describe', '--tags', '--abbrev=0', '--match', `${prefix}[0-9]*`, 'HEAD^'], { allowFail: true });
+  return found.code === 0 && found.stdout !== '' ? found.stdout : null;
+}
+
+/** The lint row of an urgent release: the managed whole-app lint narrowed to the source files changed since the previous release tag. */
+function changedLint(ctx, gate, prefix) {
+  if (gate.command.join(' ') !== MANAGED_LINT) return { gate, note: null };
+  const since = previousTag(ctx, prefix);
+  if (!since) return { gate, note: 'no previous release tag: the whole app is linted' };
+  const files = git(ctx, ['diff', '--name-only', '--diff-filter=d', `${since}..HEAD`]).stdout.split('\n').map((file) => file.trim())
+    .filter((file) => /\.(?:[cm]?[jt]sx?|css)$/u.test(file));
+  if (files.length === 0) return { gate: null, note: `no source file changed since ${since}` };
+  if (files.length > CHANGED_MAX || !files.every((file) => PATH_WORD.test(file))) return { gate, note: `${files.length} changed file(s) since ${since}: the whole app is linted` };
+  return { gate: { ...gate, command: ['npx', 'starci', 'app', 'lint', '--changed', ...files] }, note: `${files.length} file(s) changed since ${since}` };
+}
+
+/** The urgent checks this app declares, from its release gates; a lint row is narrowed to the changed files. */
+function urgentGates(ctx, config, prefix) {
+  const declared = URGENT_CHECKS.map((name) => config.gates.find((gate) => gate.name === name)).filter(Boolean);
+  if (declared.length === 0) throw refusal('RELEASE_URGENT_NO_CHECKS', `the release gates declare none of ${URGENT_CHECKS.join(', ')}: an urgent release still runs its fast local checks`);
+  return declared.map((gate) => (gate.name === 'lint' ? { name: gate.name, ...changedLint(ctx, gate, prefix) } : { name: gate.name, gate, note: null }));
+}
+
+/** Runs (or reuses) each check in order and stops at the first red one. Returns the rows of the record. */
+function runChecks(ctx, checks, { common, head, dir, platform }) {
+  fs.mkdirSync(dir, { recursive: true });
+  const rows = [];
+  for (const check of checks) {
+    if (!check.gate) {
+      rows.push({ name: check.name, command: null, pass: true, reused: false, detail: check.note, log: null, logSha256: null });
+      continue;
+    }
+    const command = check.gate.command.join(' ');
+    const reused = greenRow(common, head, check.name, command);
+    if (reused) {
+      rows.push({ ...reused, reused: true, ...(check.note ? { note: check.note } : {}) });
+      continue;
+    }
+    const row = runGate(ctx, check.gate, { dir, platform, credentialNames: [] });
+    recordRow(common, head, row);
+    rows.push({ ...row, reused: false, ...(check.note ? { note: check.note } : {}) });
+    if (!row.pass) break;
+  }
+  return rows;
+}
+
+const checkLine = (row) => (row.command === null ? `SKIP ${row.name} (${row.detail})` : `${row.reused ? 'REUSED ' : ''}${summaryOf(row)}`);
+
+function planOf(checks) {
+  return ['urgent checks (each must pass; a green row recorded for HEAD with the same command and log is reused):',
+    ...checks.map((check) => `  ${check.name.padEnd(10)} ${check.gate ? check.gate.command.join(' ') : '(nothing to run)'}${check.note ? `  [${check.note}]` : ''}`)];
+}
+
+/**
+ * `starci app release push --urgent`. options: { execute, remote, reason, role, platform }. Dry run prints the checks, the tag and the push it would
+ * make; --execute runs them, tags, pushes atomically and writes the urgent record. A red check is RELEASE_URGENT_CHECK_RED: nothing tagged, nothing pushed.
+ */
+export async function releaseUrgentPush(ctx, config, options = {}) {
+  const reason = reasonOf(options.reason);
+  const role = options.role ?? 'unset';
+  const remote = options.remote ?? 'origin';
+  const branch = config.defaultBranch;
+  assertNames(remote, branch);
+  const facts = inspect(ctx, config, {});
+  const { head, chosen } = facts;
+  const common = releaseDir(ctx);
+  const dir = path.join(common, head.slice(0, 12));
+  const checks = urgentGates(ctx, config, config.tagPrefix);
+  const out = [...facts.out, `urgent         ${URGENT_RULING}`, `reason         ${reason}`, `role           ${role}`, ...planOf(checks)];
+  const data = { head, tag: chosen.tag, remote, branch, urgent: true, reason, role, checks: [], pushed: false };
+  if (facts.red.length > 0) return { ok: false, lines: [...out, ...facts.red.map((item) => `RED: ${item}`), 'nothing run, nothing pushed.'], data: { ...data, red: facts.red } };
+  const red = [];
+  const refs = [...branchRefs(ctx, { head, remote, branch }, red).refs, ...(chosen.state === 'on-head' ? tagRefs(ctx, { remote, tag: chosen.tag }, red) : [`refs/tags/${chosen.tag}`])];
+  out.push(`plan           git tag -a ${chosen.tag}${chosen.state === 'on-head' ? ' (already on HEAD)' : ''}, then git push --atomic ${remote} ${refs.join(' ') || '(nothing)'}; no candidate CI`);
+  if (red.length > 0) return { ok: false, lines: [...out, ...red.map((item) => `RED: ${item}`), 'nothing run, nothing pushed.'], data: { ...data, red } };
+  if (options.execute !== true) return { ok: true, lines: [...out, 'dry run: no check run, nothing tagged or pushed. ready; re-run with --execute.'], data };
+  const rows = runChecks(ctx, checks, { common, head, dir, platform: options.platform ?? process.platform });
+  data.checks = rows;
+  out.push(...rows.map(checkLine));
+  const failed = rows.find((row) => !row.pass);
+  if (failed) throw failure('RELEASE_URGENT_CHECK_RED', `${failed.name} is red (${failed.detail}; log ${failed.log}): nothing tagged, nothing pushed`);
+  assertUnmoved(ctx, head);
+  if (chosen.state !== 'on-head') git(ctx, ['tag', '-a', chosen.tag, '-m', `URGENT release ${chosen.tag} on ${head.slice(0, 12)} by ${role}: ${reason} (fast local checks only; back-fill: starci app release gate --backfill ${chosen.tag})`, head]);
+  if (refs.length > 0) {
+    const hook = probe(ctx, remote, refs, red);
+    out.push(...hook.lines);
+    if (red.length > 0) return { ok: false, lines: [...out, ...red.map((item) => `RED: ${item}`), `nothing pushed; ${chosen.tag} stays local.`], data };
+    const run = git(ctx, ['push', '--atomic', remote, ...refs], { allowFail: true });
+    if (run.code !== 0) return { ok: false, lines: [...out, `push failed: ${firstLine(run.stderr)}; ${chosen.tag} stays local.`], data };
+  }
+  const record = {
+    schema: URGENT_SCHEMA, head, tag: chosen.tag, createdAt: new Date(ctx.now()).toISOString(), producedBy: 'starci app release push --urgent',
+    role, reason, ruling: URGENT_RULING, remote, branch, refs, pushed: true, checks: rows, backfill: null,
+  };
+  writeUrgent(common, record);
+  return { ok: true, lines: [...out, `pushed to ${remote}: ${refs.join(' ') || '(already there)'}`, `URGENT record written: ${path.join(common, `${head}.urgent.json`)}`, `back-fill later: starci app release gate --backfill ${chosen.tag} --execute (in a clean checkout of ${chosen.tag})`], data: { ...data, pushed: true, record: path.join(common, `${head}.urgent.json`) } };
+}

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.8
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.6.6
+    version: 3.7.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.4.7
+    version: 9.5.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.8
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.8
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
@@ -85,12 +85,12 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.4.1
+    version: 2.5.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
-    why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+    why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeQueryBuilder, queueQueryBuilders, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
     version: 1.2.3
     group: starci
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.9.9
+    version: 4.10.0
     group: starci
     install: registry
     side: both
@@ -241,6 +241,16 @@ pins:
     group: framework
     side: be
     why: readiness probes with dependency indicators use Terminus (the liveness route of the scaffolded skeleton does not, being a thin door over the liveness service); every measured product back end resolves 11.1.1.
+  '@langchain/core':
+    version: 1.3.1
+    group: framework
+    side: be
+    why: 'the LangChain core of the one AI integration (BE-AI-3): prompt templates, output parsers, runnables and BaseRetriever; @langchain/openai takes it as its peer. The registry latest on 2026-10-29.'
+  '@langchain/openai':
+    version: 1.8.0
+    group: framework
+    side: be
+    why: 'ChatOpenAI and OpenAIEmbeddings of the one AI integration, pointed at the ai-router gateway with a virtual key (BE-AI-1, BE-AI-3, R327); peer @langchain/core ^1.3.1. The registry latest on 2026-10-29.'
   '@nestjs/cqrs':
     version: 11.0.3
     group: framework
@@ -533,7 +543,7 @@ pins:
     version: 3.1150.0
     group: framework
     side: be
-    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces, Supabase Storage); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
+    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
   '@aws-sdk/s3-request-presigner':
     version: 3.1150.0
     group: framework
@@ -584,27 +594,47 @@ pins:
     group: framework
     side: be
     why: 'the Express 5 integration @nestjs/apollo loads at boot (R111 nestjs-apollo-express5, knowledge/hfs/peer-integrations.yaml); every api app that serves GraphQL installs it; the latest registry version on 2026-10-13.'
-  # --- Supabase lite
-  '@supabase/ssr':
-    version: 0.12.7
+  # --- lite identity (integrations/passport, ruling lite-self-hosted-postgres-passport-minio)
+  '@nestjs/passport':
+    version: 11.0.5
     group: framework
-    side: fe
-    why: the one server/browser client factory for a lite Next app; exact version registry-checked for the lite scaffold.
-  '@supabase/supabase-js':
-    version: 2.117.2
+    side: be
+    why: 'PassportStrategy of integrations/passport; 11.0.5 is CommonJS on the Nest 11 line (12.0.0 is ESM-only and breaks Nest 11 jest under the CommonJS transform of @starci/jest-preset), as nivo-lite runs it.'
+  passport:
+    version: 0.7.0
     group: framework
-    side: both
-    why: the generated Database-typed client used by the FE data owner and the BE Auth/Storage integration.
+    side: be
+    why: the strategy runtime under @nestjs/passport (its peer range ^0.5 || ^0.6 || ^0.7).
+  passport-google-oauth20:
+    version: 2.0.0
+    group: framework
+    side: be
+    why: Google OAuth 2.0 (authorization code with state and PKCE) of integrations/passport.
+  passport-local:
+    version: 1.0.0
+    group: framework
+    side: be
+    why: the email and password strategy of integrations/passport.
+  bcryptjs:
+    version: 3.0.3
+    group: framework
+    side: be
+    why: 'bcrypt in pure JavaScript (no native build on the alpine image); verifies the $2a$/$2b$ hashes auth.users carries over.'
+  '@types/passport-google-oauth20':
+    version: 2.0.17
+    group: framework
+    side: be
+    why: types of passport-google-oauth20.
+  '@types/passport-local':
+    version: 1.0.38
+    group: framework
+    side: be
+    why: types of passport-local.
   jose:
     version: 6.2.12
     group: framework
     side: be
-    why: verifies Supabase access tokens against the project JWKS with issuer, audience, expiry and algorithm checks.
-  supabase:
-    version: 2.119.0
-    group: tooling
-    side: both
-    why: the root CLI wrapper owns local schema lifecycle and generates the committed database types.
+    why: signs the app's own ES256 access tokens and verifies them against its own key set (createLocalJWKSet) in integrations/passport.
   class-transformer:
     version: 0.5.1
     group: framework

package/runtime/knowledge/hfs/design-truths.yaml

@@ -29,7 +29,7 @@ outsideTheGates:
     entries: [node_modules, dist, build, coverage, .next, storybook-static, "*.tsbuildinfo", __generated__, .starci]
   - id: root-output-and-records
     cite: {ruling: design-truths-confirmed}
-    entries: [reports, contracts, supabase/types, .starcistacks, .starciwork, package-lock.json]
+    entries: [reports, contracts, .starcistacks, .starciwork, package-lock.json]
 
 # The gate limits of the Sonar gate (knowledge/sonar-gate.yaml): a floor is a number that may not be lower, a ceiling a number that may not be higher.
 gateLimits:

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -37,10 +37,10 @@ concerns:
   - id: rest
     tier: core
     packages: [axios]
-    home: [fe.modules.api]
+    home: [fe.modules.api, fe.modules.auth]
     pattern: FE-API-REST
     forbids: [ky, superagent, node-fetch, cross-fetch, isomorphic-fetch]
-    why: modules/api/rest/<area>/*.ts for uploads, presigned URLs and auth endpoints only; GraphQL carries every other call.
+    why: modules/api/rest/<area>/*.ts for uploads and presigned URLs, and modules/auth/auth-door.ts for the app's own auth doors only; GraphQL carries every other call.
   - id: data
     tier: core
     packages: [swr]
@@ -99,8 +99,8 @@ concerns:
     packages: []
     home: [fe.modules.auth]
     pattern: FE-AUTH
-    forbids: []
-    why: modules/auth is the identity-provider client (lite - the @supabase/supabase-js auth client; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
+    forbids: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-js']
+    why: modules/auth is the session issuer's client (lite - auth-door.ts over the app's own back-end auth doors with the in-memory token store; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
   - id: i18n
     tier: core
     packages: [next-intl]
@@ -256,13 +256,6 @@ concerns:
     pattern: FE-RULE-OWNERSHIP
     forbids: []
     why: The selected Grammar family's lint package runs beside the universal front-end canon; the family catalog declares the package and factory.
-  - id: auth-supabase
-    tier: opt
-    packages: ['@supabase/supabase-js', '@supabase/ssr']
-    home: [fe.modules.auth]
-    pattern: FE-AUTH
-    forbids: []
-    why: the lite auth provider client and PKCE server cookie adapter, confined to modules/auth; data still goes through the back end.
   - id: framework-support
     tier: opt
     packages: [server-only, rxjs]