@starci/hfs 5.4.0 → 5.5.0

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -38,7 +38,7 @@ pins:
     source: packages/next-data/package.json
     why: 'the SWR data helpers of every front end (fe-stack data, owner:next-data-package): pollingRestart, the viewer and tenant key helpers, viewerSwrConfig and the viewer cache; each operation hook stays in the app and the package holds no component.'
   '@starci/grammar':
-    version: 0.21.16
+    version: 0.21.17
     group: starci
     install: registry
     side: fe
@@ -52,28 +52,28 @@ pins:
     source: packages/next-i18n/package.json
     why: 'the next-intl stack of every front end (fe-stack i18n, owner:next-i18n-package): defineI18n over the locales of the app, the locale-negotiating proxy, the locale-aware navigation, the request config that loads the catalogs of the app and the locale read of the [locale] layout; the app keeps its message catalogs and writes none of the stack.'
   '@starci/eslint-canon-be':
-    version: 3.14.1
+    version: 3.15.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.12.1
+    version: 9.13.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.16
+    version: 0.21.17
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.16
+    version: 0.21.17
     group: starci
     install: registry
     side: fe
@@ -99,7 +99,7 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.6.2
+    version: 2.7.0
     group: starci
     install: registry
     side: be
@@ -127,14 +127,14 @@ pins:
     source: packages/nest-kit/package.json
     why: 'the module definition of every back-end module: defineConfigurableModule and defineCapabilityModule return the module base class, the options token and the options types with their types stated, so a <x>.module-definition.ts is one call that the lint on stated export types (R368) and the duplicate-code check (R21) both accept; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/auth':
-    version: 0.2.1
+    version: 0.3.0
     group: starci
     install: registry
     side: both
     source: packages/auth/package.json
     why: 'the lite sign-in: the NestJS module (EdDSA access tokens with a multi-key JWKS, passwords, Google OAuth with state and PKCE, rotating refresh sessions, the sign-in budget, the refresh cookie), the front-end client and its React bindings, the door contracts and test doubles; the one importer of the identity libraries, reached by a back end only through integrations/passport; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/auth-oidc':
-    version: 0.1.1
+    version: 0.1.2
     group: starci
     install: registry
     side: both
@@ -155,7 +155,7 @@ pins:
     source: packages/mail/package.json
     why: 'outgoing mail of a back end: a NestJS module and the Mailer port over SMTP (connect, greeting, socket and total timeouts, STARTTLS required by default, recipient, message and attachment checks, a shared SMTP target policy, coded errors, typed escaping render helpers returning { subject, text, html }), with @starci/mail/testing for its specs; the only importer of nodemailer (R90).'
   '@starci/hfs':
-    version: 5.4.0
+    version: 5.5.0
     group: starci
     install: registry
     side: both
@@ -592,7 +592,7 @@ pins:
     version: 3.1150.0
     group: framework
     side: be
-    why: 'the S3 transport inside @starci/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces), which depends on it at exactly this version and which no app file imports; 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
+    why: 'the S3 transport inside @starci/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces), which depends on it at exactly this version and which no app file imports; 3.1150.0 is the release of 2026-10-12.'
   '@aws-sdk/s3-request-presigner':
     version: 3.1150.0
     group: framework
@@ -602,7 +602,7 @@ pins:
     version: 10.1.7
     group: framework
     side: be
-    why: 'the SMTP client inside @starci/mail, which depends on it at exactly this version and which no app file imports; 10.1.7 is the release of 2026-10-18, chosen over newer ones that had not aged two weeks.'
+    why: 'the SMTP client inside @starci/mail, which depends on it at exactly this version and which no app file imports; 10.1.7 is the release of 2026-10-18.'
   '@apollo/server':
     version: 5.5.1
     group: framework
@@ -652,7 +652,7 @@ pins:
     version: 6.29.0
     group: framework
     side: be
-    why: 'the Agent of platform/http (its one owner, R90): FetchHttpClient hands fetch a pool that trusts HttpOptions.trustedCa beside the bundled roots (a test world''s per-run fake CA); the 6 line is the undici the Node 22 runtime of the app images bundles, and its Agent also serves the fetch of Node 24; 6.29.0 is the release of 2026-09-25, chosen over newer ones that had not aged two weeks.'
+    why: 'the Agent of platform/http (its one owner, R90): FetchHttpClient hands fetch a pool that trusts HttpOptions.trustedCa beside the bundled roots (a test world''s per-run fake CA); the 6 line is the undici the Node 22 runtime of the app images bundles, and its Agent also serves the fetch of Node 24; 6.29.0 is the release of 2026-09-25.'
   # --- lite identity (integrations/passport, ruling lite-self-hosted-postgres-passport-minio)
   '@nestjs/passport':
     version: 11.0.5

package/runtime/knowledge/hfs/ci-standard.yaml

@@ -77,7 +77,7 @@ items:
     check: ci-standard
   - id: sonar-lint-per-side
     title: the Sonar lint runs per side
-    requires: "a lint with a Sonar import (`starci app check --gate lint --out`) names its side (--side be|fe); the reports are merged into reports/lint.sonar.json afterwards; no combined lint with Sonar"
+    requires: "a lint with a Sonar import (`starci app check --gate lint --out`) names its side (--side be|fe|packages); the reports are merged into reports/lint.sonar.json afterwards; no combined lint with Sonar"
     covers: [app-ci, runtime]
     check: ci-standard
   - id: test-sharding
@@ -87,7 +87,7 @@ items:
     check: ci-standard
   - id: lint-parallel
     title: lint each side in its own job
-    requires: "the lint job is a matrix over side [be, fe]; each side lints (with its own Sonar report when a token is set) in parallel, and the sonar job merges the reports"
+    requires: "the lint job is a matrix over side [be, fe], plus packages in an app with root packages; each scope lints (with its own Sonar report when a token is set) in parallel and on its own, and the sonar job merges the reports"
     covers: [app-ci]
     check: ci-standard
   - id: cache-saved-always

package/runtime/knowledge/hfs/rules.yaml

@@ -3299,7 +3299,7 @@ rules:
     code: "HFS_DOCKER_BUILD_CONTEXT"
     editions: [lite, full]
     docs: [docs/application-stacks.md#r187]
-    law: "Every app image is built from the app root: the header comment of an app's Dockerfile states `starci docker build <app>` for its own path, and no COPY or ADD source leaves the build context (a `..` segment or an absolute path)."
+    law: "Every app image is built from the app root: the header comment of an app's Dockerfile states `starci docker build <app>` for its own path, no COPY or ADD source leaves the build context (a `..` segment or an absolute path), and the image of a Next app whose front end reads be/contracts/ copies that folder exactly when the app holds it (a COPY of a missing folder fails the build, a missing COPY leaves the codegen without its contract)."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DOCKER_BUILD_CONTEXT"]
@@ -5791,7 +5791,7 @@ rules:
         ruling: "Lite storage is the MinIO already running on the Tay Son host, reached through the one S3 integration."
   - id: R332
     code: "LITE_DB_MIGRATION"
-    law: "A lite app's schema lives only in db/: every schema change is one db/migrations/<ts14>_<kebab>.sql (archive db/migrations/archive/, seed db/seed.sql), and the tree holds no supabase/ folder and no SQL file outside db/ but a .starcistacks seed."
+    law: "A lite app's schema lives only in db/: every schema change is one db/migrations/<ts14>_<kebab>.sql (archive db/migrations/archive/, the managed db/bootstrap.sql), every other SQL file under db/ is refused, and the tree holds no supabase/ folder and no SQL file outside db/ but the sql/ entries of its seed levels (R375)."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["LITE_DB_MIGRATION"]
@@ -6628,3 +6628,16 @@ rules:
       - {path: contexts/project/stacks.md#project-stacks-11-a-customised-service-is-an-image-the-app-builds-the-same-in-every-environment, editions: [lite, full]}
     proves:
       - {path: packages/hfs/src/stacks-service-images.spec.mjs, editions: [lite, full]}
+  - id: R375
+    code: "HFS_SEEDS_SHAPE"
+    law: "Seed data lives only in the seed levels of `.starcistacks/`, where `seeds/` is applied in every environment first and `<env>/seeds/` in the one environment the stack declaration names `<env>`; each level is a `seeds.yaml` manifest (schema starci/seeds@1) whose entries list every file of its `sql/`, `data/` and `files/` folders; a seed is never a migration (no statement that creates, alters, drops, truncates, grants, revokes or comments on an object), never custody, a data document validates against the schema its entry names, a level a production environment applies holds no test data but the one test account an environment declares (a test-account entry with its reason), and a document names a secret only as a reference to a sealed seeds-<name> member of its environment."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_SEEDS_SHAPE", "HFS_SEED_MANIFEST", "HFS_SEED_DDL", "HFS_SEED_DATA_SCHEMA", "HFS_SEED_TEST_DATA", "HFS_SEED_SECRET_REF"]
+    enforcers:
+      - {kind: hfs, id: seeds-shape, at: scripts/hfs/rules/seeds.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: contexts/project/stacks.md#project-stacks-12-seed-data-lives-in-the-seed-levels-of-the-stack, editions: [lite, full]}
+    proves:
+      - {path: packages/hfs/src/hfs-seeds-shape.spec.mjs, editions: [lite, full]}

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.17.0
+version: 3.19.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -61,6 +61,10 @@ versioning:
 # 3.17.0 (ruling auth-oidc-package, 2026-11-03) adds the optional full-edition be.integrations.keycloak, the glue of @starci/auth-oidc (the OIDC client of the
 # identity provider behind the PrincipalVerifier of @starci/auth), and gives @starci/auth-oidc to it in ruleParams.be.infraOwners.
 # 3.17.0 (ruling module-packages, 2026-11-03) adds the optional app.packages and app.module-registry: the workspace packages of the app root (the agent SDK, the module packages, the managed registry).
+# 3.18.0 (ruling seed-levels, 2026-11-03) gives app.starcistacks its two seed levels, the shared .starcistacks/seeds/ and each environment's
+# <env>/seeds/, each a seeds.yaml manifest and the folders sql/, data/ and files/, and retires app.db.seed (its rows are the shared level's
+# sql/ entries); `starci app codemod seeds-layout` moves an older app's seed data into them.
+# 3.19.0 (ruling root-packages-any-name, 2026-11-03) widens app.packages to any packages/<name>/: the agent SDK, a block library, a module package.
 # 3.15.0 (ruling app-check-cache, 2026-10-31) adds the optional app.starcistacks.cache, the committed check cache of the app (.starcistacks/cache/, both editions).
 # 3.14.0 (ruling app-secrets-one-standard, 2026-10-29) adds the optional app.ci-stack-key-restore, the managed workflow that writes the
 # deploy server's age identity back from its GitHub Environment backup.
@@ -502,7 +506,7 @@ ruleParams:
     # R334 (lite): the only `.query(` outside platform/database's composer and the test world is the pass-through of a file listed here
     # (or in hfs.json sides.be.sqlPassThrough), whose SQL text is not the app's own. Paths are relative to the side folder.
     sqlPassThrough:
-      - {file: src/modules/platform/database/seed-runner.service.ts, reason: "the tracked seed file's text, run as it is (db/seed.sql); the app writes no SQL there"}
+      - {file: src/modules/platform/database/seed-runner.service.ts, reason: "the tracked seed files' text, run as it is (the sql/ entries of .starcistacks/seeds/, then of .starcistacks/<env>/seeds/); the app writes no SQL there"}
 
     lite:
       schemaAuthority: sql
@@ -891,10 +895,10 @@ slots:
   - id: app.packages
     since: 3.17.0
     profiles: [app]
-    editionWhy: Lite and full share the slot; a product's agent SDK and its agent modules are workspace packages in both.
-    # A workspace package of the app ROOT (packages/agent-sdk, packages/module-<name>): first-party source that both sides import through its
+    editionWhy: Lite and full share the slot; every root workspace package of a product (its agent SDK, a block library, a module package, a reviewed plugin package) is one in both.
+    # A workspace package of the app ROOT (packages/<name>: the agent SDK, a block library, packages/module-<name>): first-party source that both sides import through its
     # package entry points and never past them (ARCH_INTERNAL_IMPORT_OUTSIDE), linted by the root eslint config by subpath.
-    path: "packages/{agent-sdk,module-<name>}/"
+    path: "packages/<name>/"
     presence: optional
     tracked: tracked
     tier: none
@@ -964,16 +968,18 @@ slots:
     tests: none
     requires: [application-stacks.yaml]
     allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,swarm,k8s,terraform}/**", "<env>/infra/metadata.json",
-             "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.{enc.yaml,enc}", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
+             "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.{enc.yaml,enc}", "<env>/secrets/.gitkeep",
+             "seeds/seeds.yaml", "seeds/{sql,data,files}/**", "<env>/seeds/seeds.yaml", "<env>/seeds/{sql,data,files}/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
-    # Owner ruling 2026-10-14: lite declares docker-swarm production, app runtime config, sealed custody and seed data.
+    # Owner ruling 2026-10-14: lite declares docker-swarm production, app runtime config, sealed custody and the seed levels.
     # The db service supplies the database; schedules are platform/jobs ticks (R335); production has no Compose or host cron.
     lite:
       requires: [application-stacks.yaml]
       allows: [application-stacks.yaml, images/db/Dockerfile, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,swarm}/**", "<env>/infra/metadata.json",
-               "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.{enc.yaml,enc}", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
+               "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.{enc.yaml,enc}", "<env>/secrets/.gitkeep",
+             "seeds/seeds.yaml", "seeds/{sql,data,files}/**", "<env>/seeds/seeds.yaml", "<env>/seeds/{sql,data,files}/**"]
       forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
-    rules: [HFS_STACKS_SHAPE, HFS_STACKS_IN_SIDE, HFS_PLAINTEXT_SECRET, HFS_IDENTITY_CUSTODY]
+    rules: [HFS_STACKS_SHAPE, HFS_STACKS_IN_SIDE, HFS_PLAINTEXT_SECRET, HFS_IDENTITY_CUSTODY, HFS_SEEDS_SHAPE, HFS_SEED_MANIFEST, HFS_SEED_DDL, HFS_SEED_DATA_SCHEMA, HFS_SEED_TEST_DATA, HFS_SEED_SECRET_REF, HFS_SEED_PII]
   - id: app.sops
     since: 3.1.0
     profiles: [app]
@@ -1072,15 +1078,6 @@ slots:
     tier: none
     tests: none
     since: 3.9.0
-  - id: app.db.seed
-    profiles: [app]
-    editions: [lite]
-    path: "db/seed.sql"
-    presence: optional            # synthetic dev data only; a lite app seeds nothing it cannot regenerate
-    tracked: tracked
-    tier: none
-    tests: none
-    since: 3.9.0
   - id: app.db.image
     profiles: [app]
     editions: [lite]

package/runtime/modules/kernel/failure-codes.yaml

@@ -4233,6 +4233,67 @@ HFS_SEED_PII:
   owner: op-retry
   kind: check-finding
 
+HFS_SEEDS_SHAPE:
+  title: "Seed data lives in a seed level of .starcistacks and holds no custody"
+  title_vi: "Dữ liệu seed nằm ngoài cấp seed hoặc chứa custody"
+  meaning_vi: "Một tệp dưới `.starcistacks/seeds/` hoặc `.starcistacks/<env>/seeds/` không phải `seeds.yaml` và không nằm trong `sql/`, `data/`, `files/`; hoặc thuộc cấp seed của một môi trường không được khai báo; hoặc là custody (envelope `.enc`, khoá `.pem`/`.key`, tệp `.env`)."
+  causes_vi:
+    - "Vi phạm R375: dữ liệu seed chỉ nằm trong hai cấp seed của `.starcistacks/`, mỗi cấp là một manifest và các thư mục sql/, data/, files/."
+    - "Một secret được đặt cạnh seed thay vì niêm phong bằng sops trong `.starcistacks/<env>/secrets/`."
+  nextStep_vi: "Chuyển tệp vào thư mục loại của cấp seed (`starci app codemod seeds-layout` chuyển dữ liệu cũ); niêm phong secret bằng `starci app secret set --env <env>` và xoá bản rõ."
+  owner: op-retry
+  kind: check-finding
+
+HFS_SEED_MANIFEST:
+  title: "Every seed file is an entry of its level's seeds.yaml"
+  title_vi: "Manifest seeds.yaml thiếu, sai hoặc không liệt kê tệp seed"
+  meaning_vi: "Cấp seed có tệp nhưng không có `seeds.yaml`, manifest không đọc được hoặc sai schema starci/seeds@1, một mục trỏ tới đường dẫn không tồn tại, `after` nêu id không có hoặc tạo vòng, hay một tệp trong sql/, data/, files/ không thuộc mục nào."
+  causes_vi:
+    - "Vi phạm R375: manifest là nơi khai báo thứ tự, loại, đích và chế độ (once, upsert) của mọi seed."
+  nextStep_vi: "Thêm hoặc sửa mục `{ id, kind, path, target, mode, after? }` trong `seeds.yaml` của cấp đó cho tệp được nêu."
+  owner: op-retry
+  kind: check-finding
+
+HFS_SEED_DDL:
+  title: "A seed only writes rows: seed data is never a migration"
+  title_vi: "Seed chứa câu lệnh thay đổi schema"
+  meaning_vi: "Một tệp SQL của mục sql có câu lệnh CREATE, ALTER, DROP, TRUNCATE, GRANT, REVOKE hoặc COMMENT: thay đổi schema hoặc quyền, việc chỉ migration được làm."
+  causes_vi:
+    - "Vi phạm R375 và BE-PERSISTENCE-1: dữ liệu seed không bao giờ là migration, và migration là nơi duy nhất thay đổi schema."
+  nextStep_vi: "Chuyển câu lệnh schema thành một migration (lite: `db/migrations/<ts14>_<kebab>.sql`), để seed chỉ ghi dòng dữ liệu một cách idempotent (`on conflict do nothing` hoặc upsert)."
+  owner: op-retry
+  kind: check-finding
+
+HFS_SEED_DATA_SCHEMA:
+  title: "A data seed validates against the schema its entry names"
+  title_vi: "Tài liệu seed không khớp schema đã khai báo"
+  meaning_vi: "Một tài liệu JSON hoặc YAML của mục data không qua được JSON schema mà mục đó nêu (`schema`, do app khai báo), hoặc schema đó không đọc được."
+  causes_vi:
+    - "Vi phạm R375: app sở hữu ý nghĩa và schema của dữ liệu, harness kiểm tra tài liệu trước khi lệnh của app nạp nó."
+  nextStep_vi: "Sửa tài liệu cho khớp schema, hoặc sửa đường dẫn `schema` của mục trỏ tới schema app khai báo."
+  owner: op-retry
+  kind: check-finding
+
+HFS_SEED_TEST_DATA:
+  title: "A level production applies holds no test data"
+  title_vi: "Seed áp dụng cho production chứa dữ liệu thử"
+  meaning_vi: "Cấp seed dùng chung hoặc cấp của một môi trường không phải docker-compose có danh tính example.test hoặc giá trị, tên tệp bắt đầu bằng uat- hay test- ngoài mục test-account duy nhất mà môi trường đó khai báo."
+  causes_vi:
+    - "Vi phạm R375: dữ liệu thử (tài khoản mẫu, workspace mẫu) chỉ nằm trong cấp seed của môi trường dev."
+  nextStep_vi: "Chuyển dữ liệu thử vào `.starcistacks/dev/seeds/`, hoặc khai báo tài khoản thử duy nhất của production là một mục `kind: test-account` có `reason`; chỉ để dữ liệu ban đầu thật (gói, danh mục) ở cấp dùng chung."
+  owner: op-retry
+  kind: check-finding
+
+HFS_SEED_SECRET_REF:
+  title: "A seed names a secret only as a sealed seeds-<name> member of its environment"
+  title_vi: "Tham chiếu secret của seed sai tên hoặc thiếu member niêm phong"
+  meaning_vi: "Một tài liệu seed có `{ \"secret\": \"<member>\" }` mà tên không có dạng seeds-<name>, hoặc môi trường của cấp đó (cấp dùng chung: mọi môi trường) không có `.starcistacks/<env>/secrets/<member>.enc.yaml`."
+  causes_vi:
+    - "Vi phạm R375: giá trị bí mật của seed nằm trong custody sops của môi trường, được bước seed mở trong bộ nhớ, không bao giờ nằm trong tệp seed."
+  nextStep_vi: "Niêm phong giá trị bằng `starci app secret set --env <env>` vào member seeds-<name> của môi trường đó và tham chiếu đúng tên."
+  owner: op-retry
+  kind: check-finding
+
 HFS_SERVICE_PLACEMENT:
   title: "A back-end service lives only at be/apps/<service>"
   title_vi: "Dịch vụ back end nằm ngoài be/apps/<service>"
@@ -5668,10 +5729,10 @@ BE_STORAGE_OWNER:
 LITE_DB_MIGRATION:
   title: "A lite schema change lives outside db/migrations"
   title_vi: "Thay đổi schema của app lite nằm ngoài db/migrations"
-  meaning_vi: "`<path>` là tệp của thư mục supabase/ hoặc một tệp SQL ngoài db/ (trừ seed của .starcistacks)."
+  meaning_vi: "`<path>` là tệp của thư mục supabase/, một tệp SQL ngoài db/ (trừ mục sql của các cấp seed trong `.starcistacks/`), hoặc một tệp SQL trong db/ không phải migration, archive hay bootstrap."
   causes_vi:
-    - "Vi phạm R332: schema của app lite chỉ nằm trong db/migrations/<ts14>_<kebab>.sql, archive và seed trong db/."
-  nextStep_vi: "Chuyển migration sang db/migrations (giữ nguyên stamp), seed sang db/seed.sql, types sang db/types/; xoá supabase/."
+    - "Vi phạm R332: schema của app lite chỉ nằm trong db/migrations/<ts14>_<kebab>.sql, archive và db/bootstrap.sql; dữ liệu seed nằm trong các cấp seed của `.starcistacks/` (R375)."
+  nextStep_vi: "Chuyển migration sang db/migrations (giữ nguyên stamp), seed sang `.starcistacks/seeds/sql/` (`starci app codemod seeds-layout`), types sang db/types/; xoá supabase/."
   owner: op-retry
   kind: check-finding
 

package/runtime/scripts/hfs/architecture/root-packages.mjs

@@ -1,4 +1,4 @@
-// root-packages.mjs - the workspace packages of an app ROOT (packages/agent-sdk, packages/module-<name>, the managed packages/modules).
+// root-packages.mjs - the workspace packages of an app ROOT (packages/<name>: the agent SDK, a block library, a module package, the managed packages/modules).
 // They lie outside both side folders and belong to no side; both sides import them by package name, through their package entry points
 // (the `exports` of the manifest), so the import graph reads them as first-party packages and the back-end canon never reads them as
 // a third-party library. The app root's one package.json lists them in `workspaces`; the patterns that start with a side folder

package/runtime/scripts/hfs/check.mjs

@@ -18,6 +18,9 @@
 //   HFS_MIN_INSTANCES             fewer instances of a slot than minInstances
 //   HFS_PLAINTEXT_SECRET          (R06, rules/secrets.mjs) a plaintext secret file or value in a tracked file; a `.enc` that is no sops envelope
 //   HFS_STACKS_SHAPE              (R10, rules/stacks.mjs) invalid stack shape, Swarm runtime policy, host crontab installation or lite backing duplication
+//   HFS_SEEDS_SHAPE, HFS_SEED_MANIFEST, HFS_SEED_DDL, HFS_SEED_DATA_SCHEMA, HFS_SEED_TEST_DATA, HFS_SEED_SECRET_REF (R375, rules/seeds.mjs) seed
+//                                 data outside the seed levels or unlisted, custody, a schema statement, a document off its schema, test data
+//                                 production applies outside its one test account, a secret reference to no sealed seeds-<name> member
 //   HFS_CI_MISSING_CANON          (R13, rules/pipeline.mjs) CI without the pinned `starci app check`, pre-push without typecheck or lint
 //   HFS_DEP_VERSION_SKEW          (R14, rules/deps.mjs) a dependency at two versions in the workspace, or a nested copy in the lockfile
 //   HFS_CONTRACT_SNAPSHOT_DRIFT   (R23, rules/contract.mjs) an uncommitted back-end snapshot, or a front-end copy that differs from it
@@ -108,7 +111,7 @@ export const CHECK_CODES = Object.freeze([
     'HFS_SLOT_UNDECLARED', 'HFS_SLOT_NOT_ENABLED', 'HFS_SLOT_AMBIGUOUS', 'HFS_TRACKED_MUST_BE_IGNORED', 'HFS_FORBIDDEN_PRESENT',
     'HFS_SLOT_REQUIRED_MISSING', 'HFS_MIN_INSTANCES', 'HFS_CANON_PIN_DRIFT', 'HFS_SIZE_SOFT_BACKLOG', 'BE_SOURCE_FORM',
     'HFS_MANAGED_FILE_DRIFT', 'HFS_TOOL_CONFIG_LOCAL', 'HFS_RULE_OFF_WITHOUT_REPLACEMENT', 'HFS_TS_STRICT',
-    'HFS_PLAINTEXT_SECRET', 'HFS_STACKS_SHAPE', 'HFS_CI_MISSING_CANON', 'HFS_DEP_VERSION_SKEW', 'HFS_CONTRACT_SNAPSHOT_DRIFT', 'HFS_MCP_TOOLS_SNAPSHOT',
+    'HFS_PLAINTEXT_SECRET', 'HFS_STACKS_SHAPE', 'HFS_SEEDS_SHAPE', 'HFS_SEED_MANIFEST', 'HFS_SEED_DDL', 'HFS_SEED_DATA_SCHEMA', 'HFS_SEED_TEST_DATA', 'HFS_SEED_SECRET_REF', 'HFS_CI_MISSING_CANON', 'HFS_DEP_VERSION_SKEW', 'HFS_CONTRACT_SNAPSHOT_DRIFT', 'HFS_MCP_TOOLS_SNAPSHOT',
     'BE_TEST_TOPOLOGY', 'BE_SPEC_PLACEMENT', 'HFS_REPO_LOCAL_CHECK', 'HFS_LINT_SUPPRESSION_FILE', 'HFS_BYPASS_MARKER', 'HFS_PROOF_COMMAND_FILE_MISSING', 'HFS_PEER_INTEGRATION_MISSING', 'BE_INTEGRATION_SPEC_MISSING', 'FE_GRAPHQL_CONTRACT', 'FE_NO_TESTS', 'HFS_MONO_WORKSPACES', 'HFS_MONO_FE_WORKSPACE', 'HFS_MONO_NEST_PROJECTS', 'HFS_MONO_WORKSPACE_DEP', 'BE_CLI_REQUIRED', 'FE_WIRE_GENERATED', 'FE_I18N_PLACEMENT', 'FE_I18N_CATALOG', 'HFS_SERVICE_PLACEMENT', 'HFS_IMAGE_UNPINNED', 'HFS_SERVICE_STACK_DECLARATION', 'HFS_EVENT_CONTRACT', 'BE_ASYNC_SPEC_MISSING', 'BE_SAGA_STEP_COMPENSATION', 'BE_SAGA_STATE_VERSIONED', 'BE_SAGA_EVENT_CONTRACT', 'BE_SAGA_CONSUMER_DEDUPE', 'BE_EVENT_CLASS_CONTRACT', 'BE_PATTERN_SPEC_MISSING', 'BE_CONTRACT_BREAKING', 'BE_KIND_DECLARATION', 'BE_KIND_EMPTY', 'HFS_DOCKER_BUILD_CONTEXT', 'HFS_DOCKER_STAGES', 'HFS_DOCKER_ENTRY', 'HFS_DOCKER_BASE_PIN', 'HFS_DOCKER_SECRETS', 'BE_SAGA_E2E_MISSING',
     'FE_STACK_FORBIDDEN', 'HFS_EDITION_FORBIDDEN_PRESENT', 'HFS_BACKING_UNDECLARED', 'HFS_BACKING_UNUSED', 'HFS_LITE_SECRET_CUSTODY', 'HFS_STARCIWORK_LITE_FORBIDDEN',
     'DB_MIGRATION_SHAPE', 'DB_RLS_REQUIRED', 'DB_DYNAMIC_DDL', 'DB_POLICY_SHAPE', 'DB_DEFINER_SAFE', 'DB_STORAGE_POLICY', 'LITE_DB_MIGRATION',

package/runtime/scripts/hfs/coverage-scope.d.mts

@@ -84,4 +84,19 @@ export declare function measuredBy({ roots, roles, files, excludes }: {
 }): (file: string) => boolean;
 /** True when the be-relative `file` is measured by the scope of the whole manifest (measuredBy). */
 export declare const isMeasured: (manifest: ScopeManifest, file: string) => boolean;
+/** The measured scope of the app's root packages, every path app-relative: the folders that hold specs, the files measured and the ones never measured. */
+export interface PackagesCoverage {
+    folders: string[];
+    files: string[];
+    excludes: string[];
+}
+/**
+ * THE derivation of what the root packages measure (BE-TEST-13): every TypeScript file below a package's `src/` but its front-end subtrees and barrels, at
+ * 100 per file in the back end's unit run. The rendered be/jest.config.js, Sonar's coverage exclusions and sources, Codecov's paths and R273 read it.
+ */
+export declare function packagesCoverage(folders: readonly string[]): PackagesCoverage;
+/** The app-relative folders of the root packages a tracked file list holds: each `packages/<name>/` with a `package.json` and a `src/`, the registry aside. */
+export declare function rootPackageFoldersOf(files: readonly string[]): string[];
+/** The one test of whether an app-relative file is measured by a packages scope (a spec never is): R273 asks it. */
+export declare function packageMeasuredBy({ files, excludes }: PackagesCoverage): (file: string) => boolean;
 export {};

package/runtime/scripts/hfs/coverage-scope.mjs

@@ -243,3 +243,29 @@ export function measuredBy({ roots, roles, files, excludes }) {
 }
 /** True when the be-relative `file` is measured by the scope of the whole manifest (measuredBy). */
 export const isMeasured = (manifest, file) => measuredBy(coverageScope(manifest))(file);
+/**
+ * The parts of a root workspace package (`packages/<name>` at the app root, PROJECT-3) that are never measured: its workbench and its public face (front
+ * ends, judged by the front-end canon and the Grammar lint) and its barrels. Everything else below its `src/` is its logic.
+ */
+const PACKAGE_UNMEASURED = Object.freeze(['src/workbench/**', 'src/public/**', 'src/**/index.ts']);
+/**
+ * THE derivation of what the root packages measure (BE-TEST-13): every TypeScript file below a package's `src/` but its front-end subtrees and barrels, at
+ * 100 per file in the back end's unit run. The rendered be/jest.config.js, Sonar's coverage exclusions and sources, Codecov's paths and R273 read it.
+ */
+export function packagesCoverage(folders) {
+    const sorted = [...new Set(folders)].sort(byCodeUnit);
+    return { folders: sorted, files: sorted.map((folder) => `${folder}/src/**/*.ts`), excludes: sorted.flatMap((folder) => PACKAGE_UNMEASURED.map((glob) => `${folder}/${glob}`)) };
+}
+/** The registry of the module packages (slot app.module-registry): managed, it lists the modules and carries no logic of its own. */
+const PACKAGE_REGISTRY = 'modules';
+/** The app-relative folders of the root packages a tracked file list holds: each `packages/<name>/` with a `package.json` and a `src/`, the registry aside. */
+export function rootPackageFoldersOf(files) {
+    const names = new Set(files.map((file) => /^packages\/([^/]+)\/package\.json$/.exec(file)?.[1]).filter((name) => name !== undefined && name !== PACKAGE_REGISTRY));
+    return [...names].filter((name) => files.some((file) => file.startsWith(`packages/${name}/src/`))).map((name) => `packages/${name}`).sort(byCodeUnit);
+}
+/** The one test of whether an app-relative file is measured by a packages scope (a spec never is): R273 asks it. */
+export function packageMeasuredBy({ files, excludes }) {
+    const measured = files.map((glob) => globExpression(glob));
+    const unmeasured = excludes.map((glob) => globExpression(glob));
+    return (file) => !/\.spec\.ts$/.test(file) && measured.some((glob) => glob.test(file)) && !unmeasured.some((glob) => glob.test(file));
+}

package/runtime/scripts/hfs/db-squash.mjs

@@ -2,7 +2,7 @@
 // cutover whose production starts on an empty database. Nothing is rebuilt from migration SQL: the source's schema is dumped with its
 // privileges, the objects of the extensions the target image lacks (--drop-extension) and every function or view whose body reaches their
 // schemas are left out by name, the role facts a per-database dump loses go to a marked section of db/bootstrap.sql, and the reference rows
-// of --seed-tables go to db/seed.sql. The verb proves its own output before it writes anything: a scratch container of the app's db image
+// of --seed-tables go to .starcistacks/seeds/sql/reference.sql, an entry of the shared seed level (every environment). The verb proves its own output before it writes anything: a scratch container of the app's db image
 // replays bootstrap + baseline + seed (the seed twice) and the same projection read back from the replay must equal the source's, or it
 // refuses with the differences. The source is only read; its migration history is never changed.
 import fs from 'node:fs';
@@ -12,9 +12,12 @@ import { randomBytes } from 'node:crypto';
 import { DB_DOCKERFILE, DB_IMAGE_CONTEXT } from '../../../db/image.mjs';
 import { DbVerbError } from './db-errors.mjs';
 import { BOOTSTRAP_FILE, BOOTSTRAP_SQUASH_BEGIN, BOOTSTRAP_SQUASH_END, SEED_FILE, bootstrapSection } from './rules/database-constants.mjs';
+import { addSeedEntries } from './stack-seeds-config.mjs';
 /** The extensions a lite app's db image does not ship, dropped unless --drop-extension names others (pgmq stays: it is the lite event bus). */
 export const DEFAULT_DROPPED_EXTENSIONS = Object.freeze(['pg_net', 'pg_cron']);
 export const SEED_HEADER = '-- Generated by starci app db baseline --squash';
+/** The entry of the shared seed level that declares the reference rows the squash writes (upserted on every change of them). */
+const SQUASH_SEED_ENTRY = { id: 'reference', kind: 'sql', path: 'sql/reference.sql', target: 'primary', mode: 'upsert' };
 // Roles of a hosted platform (Supabase) that a self-hosted lite database never has; a grant naming one is platform state, not the app's.
 const PLATFORM_ROLE = /^(?:supabase_\w+|authenticator|dashboard_user|pgbouncer)$/;
 // Role-level settings carried to the bootstrap; any other setting of a carried role is refused, so no secret travels.
@@ -566,8 +569,12 @@ export function squashBaseline({ root, opts, plan, urlEnv, connection, commandOf
         stdout(`proof: bootstrap + baseline + seed (twice) replayed on ${image}; schema, grants, roles and seed rows equal the source minus ${config.dropped.join(', ')}\n`);
         if (!opts.execute)
             return 0;
-        for (const [file, text] of files)
+        for (const [file, text] of files) {
+            fs.mkdirSync(path.dirname(path.join(root, file)), { recursive: true });
             fs.writeFileSync(path.join(root, file), text, { flag: file === plan.file ? 'wx' : 'w' });
+        }
+        if (projected.seed)
+            addSeedEntries(root, null, [SQUASH_SEED_ENTRY]);
         archive();
         return 0;
     }

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -140,7 +140,7 @@ function observeBlockProblems(observe) {
         bad.push('observe.reporter must name the optional error reporter');
     return bad;
 }
-const DECLARATION_KEYS = new Set(['hfs', 'kind', 'project', 'edition', 'db', 'sides', 'browser', 'lexicon', 'observe']);
+const DECLARATION_KEYS = new Set(['hfs', 'kind', 'project', 'edition', 'db', 'sides', 'browser', 'modules', 'lexicon', 'observe']);
 const RUNTIME_DECLARATION_KEYS = new Set(['hfs', 'kind', 'project']);
 function productDeclarationProblems(declaration, profiles) {
     const bad = [];
@@ -150,6 +150,8 @@ function productDeclarationProblems(declaration, profiles) {
     bad.push(...dbBlockProblems(declaration.db), ...lexiconBlockProblems(declaration.lexicon), ...observeBlockProblems(declaration.observe));
     if (declaration.browser !== undefined && declaration.browser !== true)
         bad.push('browser is `true` when the app has a browser journey (slot app.browser), and is left out otherwise');
+    if (declaration.modules !== undefined && declaration.modules !== 'data')
+        bad.push('modules is `"data"` when the app keeps its modules as data (seeds, no rendered registry package), and is left out otherwise');
     if (declaration.kind !== APP_KIND)
         bad.push(`kind must be ${APP_KIND} (a product is one app repository with a be and an fe side) or ${RUNTIME_KIND} (the StarCi runtime repository)`);
     if (!isPlainObject(declaration.sides) || Object.keys(declaration.sides).sort(byCodeUnit).join() !== profiles.join()) {

package/runtime/scripts/hfs/rules/app-root.mjs

@@ -4,7 +4,8 @@
 //   (HFS_MONO_*, monorepo.mjs), the one cli app (BE_CLI_REQUIRED, cli.mjs), BE_INTEGRATION_SPEC_MISSING (R112,
 //   integration-specs.mjs), FE_GRAPHQL_CONTRACT (R113, fe-contract-documents.mjs), HFS_CI_MISSING_CANON (R13, pipeline.mjs),
 //   BE_TEST_TOPOLOGY (R47, test-topology.mjs), HFS_PROOF_COMMAND_FILE_MISSING (R105, proof-commands.mjs), the app front-end
-//   tree (FE_WIRE_GENERATED, FE_I18N_PLACEMENT, frontend-tree.mjs) and HFS_STACKS_SHAPE (R10, stacks.mjs).
+//   tree (FE_WIRE_GENERATED, FE_I18N_PLACEMENT, frontend-tree.mjs), HFS_STACKS_SHAPE (R10, stacks.mjs) and the root seed data
+//   (HFS_SEED_*: R375, seeds.mjs).
 import { cliFindings } from './cli.mjs';
 import { contractCompatFindings } from './contract-compat.mjs';
 import { depFindings } from './deps.mjs';
@@ -19,6 +20,7 @@ import { peerIntegrationFindings } from './peer-integrations.mjs';
 import { pipelineFindings } from './pipeline.mjs';
 import { proofCommandFindings } from './proof-commands.mjs';
 import { sagaFindings } from './saga.mjs';
+import { seedsFindings } from './seeds.mjs';
 import { serviceFindings } from './services.mjs';
 import { stacksFindings } from './stacks.mjs';
 import { testTopologyFindings } from './test-topology.mjs';
@@ -46,5 +48,6 @@ export function appRootFindings({ repoRoot, files, all, repo, resolver, pins, ph
         ...proofCommandFindings({ repoRoot, files: all, resolver, sides: Object.keys(repo.sides ?? {}) }),
         ...appFrontendFindings({ repoRoot, files: all, repo, phase }),
         ...stacksFindings({ repoRoot, files, resolver }),
+        ...seedsFindings({ repoRoot, files }),
     ];
 }

package/runtime/scripts/hfs/rules/ci-standard.mjs

@@ -6,7 +6,7 @@
 //   sonar-lint-per-side    a lint with --out names --side
 //   required-providers      no continue-on-error; Codecov fail_ci_if_error true; no availability probe, no secret-gated Codecov or Sonar step
 //   test-sharding          the test job is a shard matrix; each shard runs --shard=i/N with STARCI_COVERAGE_SHARD and no threshold or pass-empty flag; the coverage job merges, then proves
-//   lint-parallel          the lint job is a matrix over side [be, fe]
+//   lint-parallel          the lint job is a matrix over side [be, fe], or [be, fe, packages] in an app with root packages
 //   cache-saved-always     no cache keyed by the commit sha; actions/cache/save runs under if: always()
 //   timeouts               every job declares timeout-minutes
 //   sha-pinned-actions     every remote `uses:` names a 40-hex commit sha (docker:// a sha256 digest; ./ local actions allowed)
@@ -123,7 +123,8 @@ function testSharding(doc, say) {
 }
 function lintParallel(doc, say) {
     const sides = record(doc.jobs?.lint) ? doc.jobs.lint.strategy?.matrix?.side : null;
-    return Array.isArray(sides) && sides.map(String).sort(byCodeUnit).join() === 'be,fe' ? [] : [say('lint-parallel', 'the lint job must be a matrix over side [be, fe]')];
+    const joined = Array.isArray(sides) ? sides.map(String).sort(byCodeUnit).join() : '';
+    return joined === 'be,fe' || joined === 'be,fe,packages' ? [] : [say('lint-parallel', 'the lint job must be a matrix over side [be, fe], with packages when the app has root packages')];
 }
 function cacheSavedAlways(doc, say) {
     const out = [];
@@ -174,8 +175,8 @@ function sonarLintPerSide(doc, say) {
     for (const [id, job] of jobsOf(doc)) {
         for (const step of stepsOf(job)) {
             const run = runOf(step);
-            if (/\b(?:npm run lint|app check)\b/.test(run) && /\s--out\b/.test(run) && !/\s--side\s+(?:be\b|fe\b|\$\{\{\s*matrix\.side\s*\}\})/.test(run)) {
-                out.push(say('sonar-lint-per-side', `job ${id}, step ${step.name ?? 'lint'}: a lint with a Sonar import must name its side (--side be|fe) and the reports are merged afterwards; a combined lint with Sonar breaks the standard`));
+            if (/\b(?:npm run lint|app check)\b/.test(run) && /\s--out\b/.test(run) && !/\s--side\s+(?:be\b|fe\b|packages\b|\$\{\{\s*matrix\.side\s*\}\})/.test(run)) {
+                out.push(say('sonar-lint-per-side', `job ${id}, step ${step.name ?? 'lint'}: a lint with a Sonar import must name its side (--side be|fe|packages) and the reports are merged afterwards; a combined lint with Sonar breaks the standard`));
             }
         }
     }

package/runtime/scripts/hfs/rules/coverage-below.mjs

@@ -3,7 +3,7 @@
 // lcov carries lines, functions and branches; the unit runner also enforces its statement threshold.
 import fs from 'node:fs';
 import path from 'node:path';
-import { coverageScope, measuredBy } from '../coverage-scope.mjs';
+import { coverageScope, measuredBy, packageMeasuredBy, packagesCoverage, rootPackageFoldersOf } from '../coverage-scope.mjs';
 import { editionRuleParams, effectiveSlot, slotInEdition } from '../edition-slots.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 import { found } from './read.mjs';
@@ -120,12 +120,17 @@ function inventory({ files, all, repo, manifest }) {
     const effective = manifestOfEdition(manifest, repo.edition ?? 'full');
     const scope = coverageScope(effective, repo.providers ?? repo.sides?.be?.providers ?? []);
     const measures = measuredBy(scope);
-    const candidates = [...new Set((all ?? files ?? []).map(slash))].filter((file) => file.startsWith(prefix) && file.endsWith('.ts') && !SPEC.test(file)).sort(byCodeUnit);
+    const tracked = [...new Set((all ?? files ?? []).map(slash))];
+    // At the app root the root packages are measured too, by the same unit run as the back end (packagesCoverage, BE-TEST-13).
+    const packages = packagesCoverage(prefix ? rootPackageFoldersOf(tracked) : []);
+    const measuresPackage = packageMeasuredBy(packages);
+    const inPackage = (file) => packages.folders.some((folder) => file.startsWith(`${folder}/src/`));
+    const candidates = tracked.filter((file) => (file.startsWith(prefix) || inPackage(file)) && file.endsWith('.ts') && !SPEC.test(file)).sort(byCodeUnit);
     const measured = [];
     const unmeasured = [];
     for (const file of candidates)
-        (measures(file.slice(prefix.length)) ? measured : unmeasured).push(file);
-    return { measured, unmeasured, unmeasuredScopes: scope.none.map((entry) => `${prefix}${entry}`), scope, prefix };
+        ((inPackage(file) ? measuresPackage(file) : measures(file.slice(prefix.length))) ? measured : unmeasured).push(file);
+    return { measured, unmeasured, unmeasuredScopes: [...scope.none.map((entry) => `${prefix}${entry}`), ...packages.excludes], scope, prefix };
 }
 function sourcePath(source) {
     if (source.startsWith('file:')) {
@@ -144,6 +149,9 @@ function matchesSource(source, file, prefix) {
     const choices = [file, relative, ...(prefix ? [] : [`be/${file}`])];
     const windows = /^[a-z]:\//i.test(source) || source.startsWith('//');
     const absolute = source.startsWith('/') || windows;
+    // A relative source is relative to the jest root, the back end: a root package's file is `../packages/<name>/...` there.
+    if (!absolute && prefix && slash(`${prefix}${source}`) === file)
+        return true;
     const key = windows ? source.toLowerCase() : source;
     return choices.some((choice) => {
         const candidate = windows ? choice.toLowerCase() : choice;

package/runtime/scripts/hfs/rules/database-config.mjs

@@ -1,8 +1,9 @@
-// database-config.mjs - the database content checks of db/ (R259: extensions, custody SQL, destructive migrations, seed data). It starts no
+// database-config.mjs - the database content checks of db/ and seeds/ (R259: extensions, custody SQL, destructive migrations, seed data). It starts no
 // database and no Docker process.
 import { found, readText } from './read.mjs';
-import { DB_EXTENSION_ALLOWED, DB_VAULT_WRITE, HFS_SEED_PII, isActiveMigration, SEED_FILE, } from './database-constants.mjs';
-import { databaseExecutableTokens, databaseSqlStatements, databaseSqlTokens, destructiveMigrationFindings } from './database-migrations.mjs';
+import { DB_EXTENSION_ALLOWED, DB_VAULT_WRITE, HFS_SEED_PII, isActiveMigration, } from './database-constants.mjs';
+import { databaseExecutableTokens, databaseSqlStatements, destructiveMigrationFindings } from './database-migrations.mjs';
+import { isSeedFile, seedLiterals } from './seeds.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 const DEFAULT_EXTENSIONS = ['pgcrypto', 'pg_trgm', 'vector', 'uuid-ossp', 'unaccent', 'btree_gist', 'pgmq'];
 const word = (token, value) => token?.t === 'word' && token.v === value;
@@ -108,10 +109,10 @@ function seedPiiFindings(repoRoot, seeds) {
         const text = readText(repoRoot, file);
         if (text === null)
             continue;
-        for (const token of databaseSqlTokens(text)) {
-            if (!['string', 'body'].includes(token.t) || !piiLiteral(token.v))
+        for (const literal of seedLiterals(file, text)) {
+            if (!piiLiteral(literal.v))
                 continue;
-            findings.push(found(HFS_SEED_PII, file, `${file}:${token.line} contains an email or phone literal; seed data uses synthetic identities and the example.test domain`, { line: token.line }));
+            findings.push(found(HFS_SEED_PII, file, `${file}:${literal.line} contains an email or phone literal; seed data uses synthetic identities and the example.test domain`, { line: literal.line }));
         }
     }
     return findings;
@@ -127,7 +128,7 @@ export function databaseConfigFindings({ repoRoot, files = [], all = files, repo
     for (const { file, tokens } of sources)
         findings.push(...extensionFindings(file, tokens, new Set(parameters.extensions)), ...custodySqlFindings(file, tokens));
     findings.push(...destructiveMigrationFindings({ repoRoot, migrations, files: all }));
-    const seeds = all.filter((file) => file === SEED_FILE || /^\.starcistacks\/[^/]+\/seeds\/.+\.sql$/.test(file));
+    const seeds = all.filter((file) => isSeedFile(file) && /\/(?:sql|data)\/.+\.(?:sql|json|ya?ml)$/.test(file));
     findings.push(...seedPiiFindings(repoRoot, seeds));
     return findings.filter((finding) => inScope(finding.path));
 }