@starci/hfs 5.1.0 → 5.3.0

package/lint/run.mjs

@@ -6,11 +6,13 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-// The linters of `starci app check --gate lint`: ESLint once per side and stylelint over the fe stylesheets, through the app's own install.
+// The linters of `starci app check --gate lint`: ESLint once per side (and once for the root workspace packages) and stylelint over the fe stylesheets, through the app's own install.
 //
 //   1. ESLint runs from the side folder with that side's eslint.config.mjs (be/ the be canon, fe/ the fe canon: the per-file rules and the
 //      project-graph rules of the architecture machine, findings on the line of the offending TypeScript file); each side lints only its own
 //      files, so the be rules never see fe/ and the fe rules never see be/;
+//   1b. the root workspace packages (packages/<pkg>/src/**) are a third scope: ESLint runs from the app root with the managed root eslint.config.mjs (sync renders it), the files
+//      app-relative, whole on every run (no result records), the project graph left to the sides;
 //   2. stylelint judges the fe side's stylesheets (sync STYLE_GLOB) from fe/ with its stylelint.config.mjs.
 // `cachedLinters` is the one entry of `app check`: per side it judges only what the records of `.starcistacks/cache/lint/<side>/` cannot
 // vouch for (cache/lint-family.mjs, contexts/project/check-cache.md), and `eslintRepository` is the launcher it and the cacheless run share.
@@ -114,6 +116,41 @@ const eslintFindings = (results, appRoot) => results.flatMap((result) => (result
 })));
 /** The files of `changed` (app-relative) below `side`/, relative to the side folder. */
 const onSide = (changed, side) => changed.filter((file) => file.startsWith(`${side}/`)).map((file) => file.slice(side.length + 1));
+/**
+ * The root workspace packages of an app (`packages/<pkg>/src/**`) are linted by the managed `eslint.config.mjs` of the app root, as a third scope beside
+ * the two sides: its files are app-relative and its working directory is the app root. It has a scope only while the config is there.
+ */
+export const PACKAGES = 'packages';
+export const PACKAGES_CONFIG = 'eslint.config.mjs';
+const hasPackagesLint = (repoRoot) => fs.existsSync(path.join(repoRoot, PACKAGES_CONFIG)) && fs.existsSync(path.join(repoRoot, PACKAGES));
+/** The root config of the app, its default export awaited: the flat config the packages are linted by. */
+async function packagesConfig(repoRoot) {
+    const loaded = await import(__rewriteRelativeImportExtension(`${pathToFileURL(path.join(repoRoot, PACKAGES_CONFIG)).href}?scope=${Date.now()}`));
+    const config = await loaded.default;
+    if (!Array.isArray(config))
+        throw new Error(`${PACKAGES_CONFIG} did not export a flat config`);
+    return config;
+}
+/** The package sources the root config selects, app-relative: the walk stays below `packages/`, where the config's selectors point. */
+async function packageSources(repoRoot) {
+    const scope = canonScope(await packagesConfig(repoRoot));
+    const files = [];
+    const visit = (folder) => {
+        for (const child of fs.readdirSync(path.join(repoRoot, folder), { withFileTypes: true })) {
+            const file = posix(path.join(folder, child.name));
+            if (scope.ignored(file) || scope.ignored(`${file}/__starci_scope_probe__`))
+                continue;
+            if (child.isSymbolicLink())
+                throw new Error(`cannot enumerate symlink ${file}`);
+            if (child.isDirectory())
+                visit(file);
+            else if (child.isFile() && scope.source(file))
+                files.push(file);
+        }
+    };
+    visit(PACKAGES);
+    return files.sort(byCodeUnit);
+}
 const fileKey = (file) => process.platform === 'win32' ? path.resolve(file).toLowerCase() : path.resolve(file);
 const inside = (root, file) => { const rel = path.relative(root, file); return rel !== '..' && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel); };
 /**
@@ -300,29 +337,36 @@ function graphCanonsOf(repoRoot, cwd, side) {
 /** Starts the ESLint child of every side that has work and returns one record per side: skipped, a scope error, or the running child. */
 async function launchEslint({ app, repoRoot, opts, changed, existing, run = runLinter, scopes = {}, handOutGraph = false }) {
     const launches = [];
-    for (const side of app ? SIDES.filter((candidate) => opts.side === undefined || opts.side === candidate) : []) {
-        const sources = onSide(existing, side).filter((file) => /\.(?:[cm]?[jt]sx?)$/.test(file));
+    const scopesToLint = app ? [...SIDES, ...(hasPackagesLint(repoRoot) ? [PACKAGES] : [])].filter((candidate) => opts.side === undefined || opts.side === candidate) : [];
+    for (const side of scopesToLint) {
+        const packages = side === PACKAGES;
+        const sources = (packages ? existing.filter((file) => file.startsWith(`${PACKAGES}/`)) : onSide(existing, side)).filter((file) => /\.(?:[cm]?[jt]sx?)$/.test(file));
         if (changed !== null && !sources.length) {
             launches.push({ side, skipped: 'no changed source file' });
             continue;
         }
-        const cwd = path.join(repoRoot, side);
+        const cwd = packages ? repoRoot : path.join(repoRoot, side);
         let expected;
         // a caller that enumerated the side's scope already (the cache) hands it over: the canon config is loaded and the folders walked once per run
         const known = scopes[side];
         try {
-            expected = changed ? sources : known !== undefined ? [...known] : await sourceFiles({ repoRoot, cwd, side });
+            expected = changed ? sources : known !== undefined ? [...known] : packages ? await packageSources(repoRoot) : await sourceFiles({ repoRoot, cwd, side });
         }
         catch (error) {
-            launches.push({ side, scopeError: `eslint source scope is unavailable in ${side}/: ${String(error?.message ?? error)}` });
+            launches.push({ side, scopeError: `eslint source scope is unavailable in ${packages ? `${PACKAGES}/` : `${side}/`}: ${String(error?.message ?? error)}` });
+            continue;
+        }
+        // nothing the root config selects below packages/ is a scope with no file, not a run
+        if (packages && !expected.length) {
+            launches.push({ side, skipped: 'no package source' });
             continue;
         }
         const head = ['--format', 'json', ...(opts.fix ? ['--fix'] : [])];
-        // the child that builds the canon's project graph for its rules hands the snapshot out when the caller keeps the graph findings (the cache)
-        const graph = handOutGraph ? graphCanonsOf(repoRoot, cwd, side) : undefined;
+        // the child that builds the canon's project graph for its rules hands the snapshot out when the caller keeps the graph findings (the cache); the packages are no side folder and have no graph
+        const graph = handOutGraph && !packages ? graphCanonsOf(repoRoot, cwd, side) : undefined;
         // The files of a diff go to ONE child through a file (a diff of hundreds of long paths outgrows the Windows command line, and each extra
         // child would build the whole TypeScript program again); the whole side is a single directory argument.
-        const launch = Promise.resolve().then(() => run(changed ? { cwd, pkg: 'eslint', bin: 'eslint', args: head, list: sources, bound: repoRoot, ...(graph === undefined ? {} : { graph }) } : { cwd, pkg: 'eslint', bin: 'eslint', args: [...head, '.'], files: expected.length, bound: repoRoot, ...(graph === undefined ? {} : { graph }) }));
+        const launch = Promise.resolve().then(() => run(changed ? { cwd, pkg: 'eslint', bin: 'eslint', args: head, list: sources, bound: repoRoot, ...(graph === undefined ? {} : { graph }) } : { cwd, pkg: 'eslint', bin: 'eslint', args: [...head, packages ? PACKAGES : '.'], files: expected.length, bound: repoRoot, ...(graph === undefined ? {} : { graph }) }));
         launches.push({ side, cwd, expected, run: launch.catch(spawnFailure) });
     }
     return launches;
@@ -358,7 +402,8 @@ export async function eslintRepository({ repoRoot, app = readRepoDeclaration(loa
             const checked = checkedEslintResults({ results: linted.results, expected: launch.expected, cwd: launch.cwd, changed: changed !== null });
             errors.push(...checked.errors);
             linted.results = checked.results;
-            const appRelative = appRelativeMessages(side, path.join(repoRoot, side));
+            // the paths of a side's messages are side-relative and become app-relative; the packages' are app-relative already
+            const appRelative = side === PACKAGES ? ((message) => message) : appRelativeMessages(side, path.join(repoRoot, side));
             for (const result of linted.results)
                 for (const message of result.messages ?? [])
                     message.message = appRelative(message.message);
@@ -497,6 +542,14 @@ export async function cachedLinters({ repoRoot, app, side: only, run, session })
             style.ran = true;
         }
     }
+    // The root packages are small and have no result records: they are linted whole on every run, through the same launcher.
+    if ((only === undefined || only === PACKAGES) && hasPackagesLint(repoRoot)) {
+        const linted = await eslintRepository({ repoRoot, app, opts: { side: PACKAGES }, run });
+        eslint.errors.push(...linted.errors);
+        eslint.raw.push(...linted.raw);
+        eslint.findings.push(...linted.findings);
+        eslint.engine.sides[PACKAGES] = linted.engine.sides[PACKAGES] ?? { files: 0 };
+    }
     session.report(lintFamilyReport(sides));
     return { eslint, stylelint: style, sides };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "5.1.0",
+  "version": "5.3.0",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,43 +30,57 @@ pins:
     side: fe
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
+  '@starci/next-data':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/next-data/package.json
+    why: 'the SWR data helpers of every front end (fe-stack data, owner:next-data-package): pollingRestart, the viewer and tenant key helpers, viewerSwrConfig and the viewer cache; each operation hook stays in the app and the package holds no component.'
   '@starci/grammar':
-    version: 0.21.13
+    version: 0.21.15
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
+  '@starci/next-i18n':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/next-i18n/package.json
+    why: 'the next-intl stack of every front end (fe-stack i18n, owner:next-i18n-package): defineI18n over the locales of the app, the locale-negotiating proxy, the locale-aware navigation, the request config that loads the catalogs of the app and the locale read of the [locale] layout; the app keeps its message catalogs and writes none of the stack.'
   '@starci/eslint-canon-be':
-    version: 3.12.0
+    version: 3.14.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.10.0
+    version: 9.12.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.13
+    version: 0.21.15
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.13
+    version: 0.21.15
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.5.1
+    version: 2.6.0
     group: starci
     install: registry
     side: fe
@@ -85,7 +99,7 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.6.0
+    version: 2.6.2
     group: starci
     install: registry
     side: be
@@ -105,8 +119,43 @@ pins:
     side: be
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
+  '@starci/nest-kit':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: be
+    source: packages/nest-kit/package.json
+    why: 'the module definition of every back-end module: defineConfigurableModule and defineCapabilityModule return the module base class, the options token and the options types with their types stated, so a <x>.module-definition.ts is one call that the lint on stated export types (R368) and the duplicate-code check (R21) both accept; @starci/jest-preset compiles it as an ESM-only dependency.'
+  '@starci/auth':
+    version: 0.2.0
+    group: starci
+    install: registry
+    side: both
+    source: packages/auth/package.json
+    why: 'the lite sign-in: the NestJS module (EdDSA access tokens with a multi-key JWKS, passwords, Google OAuth with state and PKCE, rotating refresh sessions, the sign-in budget, the refresh cookie), the front-end client and its React bindings, the door contracts and test doubles; the one importer of the identity libraries, reached by a back end only through integrations/passport; @starci/jest-preset compiles it as an ESM-only dependency.'
+  '@starci/auth-oidc':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: both
+    source: packages/auth-oidc/package.json
+    why: 'the full sign-in: the OIDC client of the identity provider (Keycloak) behind the PrincipalVerifier of @starci/auth, so guards do not change between editions: the NestJS module (issuer discovery, the JWKS with caching and rotation, algorithm-pinned token checks, role mapping, the authorization code flow with PKCE and nonce), the front-end client (PKCE redirect, one shared refresh, tokens in memory) and the fake issuer for tests; the one importer of jose in a full app, reached by a back end only through integrations/keycloak; @starci/jest-preset compiles it as an ESM-only dependency.'
+  '@starci/object-storage':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: be
+    source: packages/object-storage/package.json
+    why: 'object storage of a back end: a NestJS module and the ObjectStorage port over S3-compatible storage (presigned PUT and GET that sign the content type and size, head, get, put, list, delete, bucket setup, size and content-type limits, coded errors), with @starci/object-storage/testing for its specs; the only importer of @aws-sdk/client-s3 and @aws-sdk/s3-request-presigner (R331).'
+  '@starci/mail':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: be
+    source: packages/mail/package.json
+    why: 'outgoing mail of a back end: a NestJS module and the Mailer port over SMTP (connect, greeting, socket and total timeouts, STARTTLS required by default, recipient, message and attachment checks, a shared SMTP target policy, coded errors, typed escaping render helpers returning { subject, text, html }), with @starci/mail/testing for its specs; the only importer of nodemailer (R90).'
   '@starci/hfs':
-    version: 5.1.0
+    version: 5.3.0
     group: starci
     install: registry
     side: both
@@ -543,12 +592,17 @@ pins:
     version: 3.1150.0
     group: framework
     side: be
-    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
+    why: 'the S3 transport inside @starci/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces), which depends on it at exactly this version and which no app file imports; 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
   '@aws-sdk/s3-request-presigner':
     version: 3.1150.0
     group: framework
     side: be
-    why: 'signs the presigned PUT and GET of integrations/object-storage locally, the same release as client-s3.'
+    why: 'signs the presigned PUT and GET inside @starci/object-storage locally, the same release as client-s3; no app file imports it.'
+  nodemailer:
+    version: 10.1.7
+    group: framework
+    side: be
+    why: 'the SMTP client inside @starci/mail, which depends on it at exactly this version and which no app file imports; 10.1.7 is the release of 2026-10-18, chosen over newer ones that had not aged two weeks.'
   '@apollo/server':
     version: 5.5.1
     group: framework
@@ -649,7 +703,7 @@ pins:
     version: 6.2.12
     group: framework
     side: be
-    why: signs the app's own ES256 access tokens and verifies them against its own key set (createLocalJWKSet) in integrations/passport.
+    why: signs the app's own access tokens and verifies them against its own key set inside @starci/auth, and verifies the identity provider's tokens against its JWKS inside @starci/auth-oidc; no app file imports it.
   class-transformer:
     version: 0.5.1
     group: framework

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -37,17 +37,17 @@ concerns:
   - id: rest
     tier: core
     packages: [axios]
-    home: [fe.modules.api, fe.modules.auth]
+    home: [fe.modules.api]
     pattern: FE-API-REST
     forbids: [ky, superagent, node-fetch, cross-fetch, isomorphic-fetch]
-    why: modules/api/rest/<area>/*.ts for uploads and presigned URLs, and modules/auth/auth-door.ts for the app's own auth doors only; GraphQL carries every other call.
+    why: modules/api/rest/<area>/*.ts for uploads and presigned URLs, only; GraphQL carries every other call.
   - id: data
     tier: core
-    packages: [swr]
+    packages: [swr, '@starci/next-data']
     home: [fe.hooks.swr]
     pattern: FE-DATA-SWR
     forbids: ['@tanstack/react-query', react-query]
-    why: hooks/swr/api/{graphql,rest}/{queries,mutations}/use*Swr.ts wrap one operation each; components call hooks only.
+    why: hooks/swr/api/{graphql,rest}/{queries,mutations}/use*Swr.ts wrap one operation each; components call hooks only. The polling-restart middleware (pollingRestart), the key helpers, the viewer-keyed config and the viewer cache are @starci/next-data's (owner next-data-package); an app imports no Middleware or ScopedMutator type of swr and writes none of them.
   - id: toast
     tier: core
     packages: ['@heroui/react']
@@ -96,18 +96,18 @@ concerns:
       hand-written reader (read-event-stream.ts) and no second SSE library is installed.
   - id: auth
     tier: core
-    packages: []
+    packages: ['@starci/auth', '@starci/auth-oidc']
     home: [fe.modules.auth]
     pattern: FE-AUTH
-    forbids: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-js']
-    why: modules/auth is the session issuer's client (lite - auth-door.ts over the app's own back-end auth doors with the in-memory token store; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
+    forbids: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-js', jose, jwt-decode, next-auth, '@auth/core', keycloak-js, oidc-client-ts]
+    why: modules/auth is the session issuer's client (one @starci/auth client instance over the app's own back-end auth doors, the access token in its memory; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
   - id: i18n
     tier: core
-    packages: [next-intl]
+    packages: [next-intl, '@starci/next-i18n']
     home: [fe.modules.i18n]
     pattern: FE-I18N
     forbids: [i18next, react-i18next, next-i18next, react-intl, '@lingui/react']
-    why: useTranslations for copy and the next-intl formatter for numbers, fixed dates and currency; FE-DATE owns live time display.
+    why: useTranslations for copy and the next-intl formatter for numbers, fixed dates and currency; FE-DATE owns live time display. The routing, the proxy, the navigation, the request config and the locale read of the layout are @starci/next-i18n's (owner next-i18n-package); an app calls no defineRouting, createNavigation, getRequestConfig or createMiddleware.
   - id: ui
     tier: core
     packages: ['@heroui/react', '@heroui/styles', tailwindcss, '@starci/grammar', react-aria-components]

package/runtime/knowledge/hfs/fork-images.yaml

@@ -0,0 +1,7 @@
+# The images the harness owns as StarCi forks (the harness repository's images/sources.json is their owner; stacks-service-images.spec.mts keeps this list
+# equal to it). A service of an app that has an image folder named like a key here is built FROM that repository (R374 STACKS_IMAGE_BASE_NOT_FORK):
+# the fork itself, or the harness runtime layer built on it (openclaw-runtime, images/README.md).
+schema: starci/fork-images@1
+images:
+  minio: ghcr.io/starci183/minio
+  openclaw: ghcr.io/starci183/openclaw-runtime

package/runtime/knowledge/hfs/rules.yaml

@@ -133,8 +133,8 @@ rules:
       - {path: packages/hfs/src/hfs-managed-file-drift.spec.mjs, edition: full, codes: [HFS_MANAGED_FILE_DRIFT]}
   - id: R06
     code: "HFS_PLAINTEXT_SECRET"
-    law: "Secrets exist only as `.starcistacks/<env>/secrets/<slug>.enc`."
-    kinds: [check, design]
+    law: "Secrets exist only as `.starcistacks/<env>/secrets/<slug>.enc`; the committed check cache (`.starcistacks/cache/check/secrets/`) holds codes, paths, positions and digests only, and is judged by what it holds."
+    kinds: [check, design, codemod]
     gates: [pre-commit, land, ci]
     failureCodes: ["HFS_PLAINTEXT_SECRET"]
     enforcers:
@@ -143,7 +143,7 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-managed-rule-coverage.md#r06-plaintext-secrets]
     templateNa: "Encrypted secrets are supplied by the app secret command; plaintext secret files are forbidden and are never scaffolded."
-    proves: [packages/hfs/src/hfs-plaintext-secret.spec.mjs]
+    proves: [packages/hfs/src/hfs-plaintext-secret.spec.mjs, packages/hfs/src/check-cache-secret-records.spec.mjs]
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-plaintext-secret.spec.mjs, editions: [lite, full]}
     witness:
@@ -1216,7 +1216,7 @@ rules:
     code: "FE_I18N_PLACEMENT"
     editions: [lite, full]
     docs: [docs/architecture.md#r59]
-    law: "`next-intl` with `[locale]`; multiple apps share one `fe/packages/<family>-i18n` stack through `createAppI18n`. A single app keeps routing and request configuration in `modules/i18n` and `createNavigation` in the `modules/routes` public entry. The proxy imports routing or a routing-only shared proxy export without evaluating navigation runtime."
+    law: "`next-intl` with `[locale]`; the stack (routing, proxy, navigation, request config, the layout's locale read) is built by `@starci/next-i18n` over the app's `defineI18n` description and by no product source. A single app keeps the description and its request config in `modules/i18n` and builds its navigation with `createI18nNavigation` in the `modules/routes` public entry; apps that share a product share one `fe/packages/<family>-i18n` workspace package that holds the description and composes the package's factories through `createAppI18n`. The proxy is `createProxy` of `@starci/next-i18n/proxy` and never evaluates navigation runtime."
     kinds: [check, codemod, lint]
     gates: [settle, land, ci]
     failureCodes: ["FE_I18N_PLACEMENT", "FE_I18N_NAVIGATION", "FE_I18N_FORMATTER"]
@@ -1269,6 +1269,7 @@ rules:
       - {kind: stylelint, id: raw-brand-value}
       - {kind: stylelint, id: no-apply-raw}
       - {kind: stylelint, id: no-important}
+      - {kind: stylelint, id: no-self-reference}
       - {kind: stylelint, id: globals-shape}
       - {kind: stylelint, id: globals-import-order}
       - {kind: stylelint, id: no-token-redefinition}
@@ -4084,6 +4085,7 @@ rules:
     enforcers:
       - {kind: hfs, id: fe-stack, at: scripts/hfs/rules/fe-stack.mjs}
       - {kind: eslint-fe, id: fe-stack-import}
+      - {kind: eslint-fe, id: swr-extension-from-package}
     proves:
       - {path: packages/eslint/fe/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_STACK_FORBIDDEN]}
       - {path: packages/hfs/src/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_STACK_FORBIDDEN]}
@@ -4262,7 +4264,7 @@ rules:
     editionWhy: "owner:lite-backing-services makes the db service lite's database; application-role and forced-RLS requirements apply to that backing."
     docs: [docs/microservices.md#r255]
     templateNa: "Application roles and table ownership are product-authored db migration content, rather than a scaffolded SQL surface."
-    law: "The declared back-end database role (app_be by default) has only the privileges it needs: role declarations refuse superuser and bypassrls, require noinherit and nobypassrls, and never grant all schema or table privileges. Tables owned by that role enable and force row level security by default; a forceRls exemption identifies the table and carries a nonempty reason. This applies to every edition that declares Supabase."
+    law: "The declared back-end database role (app_be by default) has only the privileges it needs: role declarations refuse superuser and bypassrls, require noinherit and nobypassrls, never grant all schema or table privileges, and leave it with no grant after the last migration on schema auth, on a table or sequence in it, or by default privilege for it (accounts are reached through SECURITY DEFINER doors; a later migration that revokes a grant clears it). Tables owned by that role enable and force row level security by default; a forceRls exemption identifies the table and carries a nonempty reason. This applies to every edition that declares Supabase."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_APP_ROLE", "DB_FORCE_RLS_DEFAULT"]
@@ -4772,7 +4774,7 @@ rules:
 
   - id: R279
     code: "BE_THIRD_PARTY_OWNER"
-    law: "Third-party SDK ownership is derived from the app's package.json dependencies rather than a finite SDK table. A dependency outside the pure-library and framework allowlists is imported only by one integrations/<provider> capability; domain services call that integration's public API. Existing infrastructure owner restrictions remain in force."
+    law: "Third-party SDK ownership is derived from the app's package.json dependencies rather than a finite SDK table. A dependency outside the pure-library and framework allowlists is imported only by one integrations/<provider> capability; domain services call that integration's public API. A workspace package of the app itself (a folder the root workspaces of package.json name) is first-party source and no SDK; what it imports is judged over its own files. Existing infrastructure owner restrictions remain in force."
     kinds: [lint]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["BE_THIRD_PARTY_OWNER"]
@@ -5082,7 +5084,7 @@ rules:
       - {path: packages/hfs/src/hfs-stacks-deploy.spec.mjs, editions: [lite, full]}
   - id: R295
     code: "BE_MODULE_DEFINITION_MISSING"
-    law: "Every NestJS module of the product has a module definition (owner ruling 2026-10-15, owner:module-definition-everywhere): capability modules, sub-modules, features, transport modules and cli groups alike. For a module `<x>` the folder holds `<x>.module-definition.ts` (`export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } = new ConfigurableModuleBuilder<XOptions>().setClassMethodName(\"register\").build()`; the representative module of a capability keeps `.setExtras({ isGlobal: false }, ...)`), `<x>.options.ts` (`export type XOptions`, `Record<string, never>` with a one-line doc when it takes nothing yet) and `<x>.module.ts` (`@Module({...}) export class XModule extends ConfigurableModuleClass {}`, no `register` override except the capability representative's). A module appears in an `imports` array or in an app composition group only as `XModule.register({...})`, never as a bare class. The `AppModule` of an app root and the test world are composition roots and are not judged."
+    law: "Every NestJS module of the product has a module definition (owner ruling 2026-10-15, owner:module-definition-everywhere): capability modules, sub-modules, features, transport modules and cli groups alike. For a module `<x>` the folder holds `<x>.module-definition.ts` (`export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = defineConfigurableModule<XOptions>()` of `@starci/nest-kit`, which states the exported types so the file is neither an inferred surface (R368) nor a clone of its neighbour (R21); the representative module of a capability calls `defineCapabilityModule<XOptions>()`, which adds the `isGlobal` extra defaulting to `false`; `starci app codemod module-definition` rewrites a definition written with `ConfigurableModuleBuilder`), `<x>.options.ts` (`export type XOptions`, `Record<string, never>` with a one-line doc when it takes nothing yet) and `<x>.module.ts` (`@Module({...}) export class XModule extends ConfigurableModuleClass {}`, no `register` override except the capability representative's). A module appears in an `imports` array or in an app composition group only as `XModule.register({...})`, never as a bare class. The `AppModule` of an app root and the test world are composition roots and are not judged."
     kinds: [lint, codemod]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["BE_MODULE_DEFINITION_MISSING"]
@@ -5696,20 +5698,23 @@ rules:
         ruling: "A model call made straight from code uses LangChain with retrieved context, through the ai-router gateway (owner ruling be-ai-langchain-gateway): the LangChain clients point at the gateway's base URL with its virtual key."
   - id: R328
     code: "BE_AUTH_PASSPORT_OWNER"
-    law: "The identity libraries (@nestjs/passport, passport, passport-google-oauth20, passport-local, @nestjs/jwt, jose and bcryptjs) are imported only by integrations/passport, the one owner of the Google OAuth 2.0 strategy (state and PKCE), the local email and password strategy (bcrypt) and the app's own access tokens; bcrypt and every Supabase client are owned nowhere."
+    law: "The identity libraries (@nestjs/passport, passport, passport-google-oauth20, passport-local, @nestjs/jwt, jose and bcryptjs) are the dependencies of @starci/auth (lite) and of @starci/auth-oidc (full, which owns jose for its provider tokens) and are imported by no app file; @starci/auth/server is imported only by integrations/passport and @starci/auth-oidc/server only by integrations/keycloak, each package's one glue. bcrypt and every Supabase client are owned nowhere."
     kinds: [lint]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["BE_AUTH_PASSPORT_OWNER"]
     enforcers:
       - {kind: eslint-be, id: infra-import-owner}
-    editions: [lite]
+    editions: [lite, full]
     docs: [contexts/code/be/api-auth.md]
     proves:
       - packages/eslint-canon-be/src/auth-passport.spec.ts
+      - packages/eslint-canon-be/src/auth-oidc-package.spec.ts
     exemplifiedBy:
       - {path: packages/hfs/templates/be/skeleton-lite/src/modules/integrations/passport/passport.tokens.ts, edition: lite}
+      - {path: packages/auth-oidc/src/server/index.ts, edition: full}
     witness:
       - {path: packages/eslint-canon-be/src/auth-passport.spec.ts, edition: lite, codes: [BE_AUTH_PASSPORT_OWNER]}
+      - {path: packages/eslint-canon-be/src/auth-oidc-package.spec.ts, edition: full, codes: [BE_AUTH_PASSPORT_OWNER]}
     cases:
       - id: case-1
         date: "2026-10-29"
@@ -5718,7 +5723,7 @@ rules:
         ruling: "Lite leaves Supabase: its identity is the app own Passport integration (Google OAuth and email/password) on its self-hosted PostgreSQL; full keeps Keycloak."
   - id: R329
     code: "BE_AUTH_JWT_OWN_JWKS"
-    law: "A lite back-end principal comes only from the app's own access token verified by integrations/passport against its own key set (jose jwtVerify over createLocalJWKSet, issuer, audience and algorithms pinned), never from a remote JWKS, an unverified decode or a request body claim; domain/identity builds the principal from that verification."
+    law: "A lite back-end principal comes only from the app's own access token, verified by @starci/auth (EdDSA pinned, issuer and audience checked, a local key set that may hold several keys), never from a remote JWKS, a token decoded without its signature check, a jwtVerify call in the app or a body claim."
     kinds: [check, lint]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["BE_AUTH_JWT_OWN_JWKS"]
@@ -5742,7 +5747,7 @@ rules:
         ruling: "The lite back end verifies its own asymmetric access tokens against its own JWKS; it trusts no remote identity provider."
   - id: R330
     code: "BE_AUTH_REFRESH_COOKIE"
-    law: "A refresh token travels only in an httpOnly, Secure, SameSite=Strict cookie scoped to the refresh door (set and cleared only through integrations/passport), is rotated on every use with reuse detection, and never appears as a field of a request or response body."
+    law: "A refresh token travels only in the httpOnly, Secure cookie that @starci/auth sets, rotates (with a reuse grace window and reuse detection) and clears; no app file writes that cookie, and the token never appears as a field of a request or response body."
     kinds: [lint]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["BE_AUTH_REFRESH_COOKIE"]
@@ -5764,7 +5769,7 @@ rules:
         ruling: "The refresh token of the lite identity rotates and lives only in an httpOnly cookie; the browser holds no credential."
   - id: R331
     code: "BE_STORAGE_OWNER"
-    law: "The S3 client (@aws-sdk/client-s3 and @aws-sdk/s3-request-presigner) is imported only by integrations/object-storage, the ObjectStorage port over S3-compatible storage (MinIO in lite) with presigned PUT and GET; no module imports minio."
+    law: "The S3 client libraries (@aws-sdk/client-s3 and @aws-sdk/s3-request-presigner) are the dependencies of @starci/object-storage, the ObjectStorage port over S3-compatible storage (MinIO in lite) with presigned PUT and GET, and are imported by no app file; @starci/object-storage is imported only by integrations/object-storage, its one glue; no module imports minio."
     kinds: [lint]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["BE_STORAGE_OWNER"]
@@ -5773,11 +5778,11 @@ rules:
     editions: [lite, full]
     docs: [contexts/code/be/infra.md]
     proves:
-      - packages/eslint-canon-be/src/auth-passport.spec.ts
+      - packages/eslint-canon-be/src/object-storage-package.spec.ts
     exemplifiedBy:
-      - {path: packages/hfs/templates/be/skeleton-lite/src/modules/integrations/object-storage/object-storage.client.ts, edition: lite}
+      - {path: packages/hfs/templates/be/skeleton-lite/src/modules/integrations/object-storage/object-storage.module.ts, edition: lite}
     witness:
-      - {path: packages/eslint-canon-be/src/auth-passport.spec.ts, editions: [lite, full], codes: [BE_STORAGE_OWNER]}
+      - {path: packages/eslint-canon-be/src/object-storage-package.spec.ts, editions: [lite, full], codes: [BE_STORAGE_OWNER]}
     cases:
       - id: case-1
         date: "2026-10-29"
@@ -6576,3 +6581,50 @@ rules:
         source: owner
         quote: "no lint caught it"
         ruling: "A directive below an import broke Nivo's CI build on 2026-11-02; the directive is the first statement of its module and a lint reports it elsewhere."
+  - id: R372
+    code: "STACKS_LOCAL_CONFIG_INVALID"
+    law: "In lite and full apps, every docker-compose environment of .starcistacks/application-stacks.yaml declares a coherent `local` block, judged by the same normalizeLocal the dev verbs of `starci app stack` (doctor, prepare, up, status, logs, verify, down) use: closed fields, one loopback port each, compose services that exist in the compose files, an environment-owned database role (never postgres, never the app role), dev-only custody generators and loopback probes; and a lite app declares at least one such dev environment, so `starci app stack up --env dev` has something to run."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["STACKS_LOCAL_CONFIG_INVALID", "STACKS_DEV_UNDECLARED"]
+    enforcers:
+      - {kind: hfs, id: stacks-local, at: scripts/hfs/rules/stacks-local.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: contexts/project/stacks.md#project-stacks-6-every-runbook-declares-the-same-operations, editions: [lite, full]}
+    proves:
+      - {path: packages/hfs/src/stack-local.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
+    witness:
+      - {path: packages/hfs/src/stack-local.spec.mjs, editions: [lite, full]}
+  - id: R373
+    code: "STACKS_RUNBOOK_DOCKER_COMMAND"
+    law: "The runbook of a docker-compose environment names `starci app stack up --env <env>` and carries no `docker build|run|compose|create|start|stop|pull|push` or `docker stack deploy` command: Docker is run by the harness verb, never by hand (hard rule 8)."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["STACKS_RUNBOOK_DOCKER_COMMAND"]
+    enforcers:
+      - {kind: hfs, id: stacks-local, at: scripts/hfs/rules/stacks-local.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: contexts/project/stacks.md#project-stacks-10-local-runs, editions: [lite, full]}
+    proves:
+      - {path: packages/hfs/src/stack-local.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
+    witness:
+      - {path: packages/hfs/src/stack-local.spec.mjs, editions: [lite, full]}
+  - id: R374
+    code: "STACKS_CODE_BIND_MOUNT"
+    law: "A service the app customises runs from an image built out of `.starcistacks/images/<name>/` (a Dockerfile whose every FROM is digest-pinned and whose final stage is the harness's image for that service, the fork or its runtime layer, when the harness owns one), the same image in every environment; no stack or compose file bind-mounts code, plugins or scripts into a service container (data volumes, secrets, least grants and read-only plain config data files stay allowed)."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["STACKS_CODE_BIND_MOUNT", "STACKS_IMAGE_BASE_UNPINNED", "STACKS_IMAGE_BASE_NOT_FORK", "STACKS_IMAGE_ENV_DIVERGES"]
+    enforcers:
+      - {kind: hfs, id: stacks-service-images, at: scripts/hfs/rules/stacks-service-images.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: contexts/project/stacks.md#project-stacks-11-a-customised-service-is-an-image-the-app-builds-the-same-in-every-environment, editions: [lite, full]}
+    proves:
+      - {path: packages/hfs/src/stacks-service-images.spec.mjs, editions: [lite, full]}