@starci/eslint-canon-fe 9.4.7 → 9.5.0

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -2,27 +2,23 @@
 // against a loaded manifest remain in slots.mjs; this module mirrors modules/schemas/hfs-repo.schema.yaml only.
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { APP_KIND, connectionShapeProblems, NAME, PACKAGE_NAME, RUNTIME_KIND, SLOT_ID } from './manifest-shape.mjs';
+import { dbFunctionsOk } from './rule-params-shape.mjs';
 import { kindShapeProblems, patternShapeProblems } from './declaration-slots.mjs';
 import { byCodeUnit } from '../lib/list.mjs';
 
-/** Shape problems of the optional hfs.json `supabase` block whose auth posture DB_CONFIG_POLICY checks. */
-const isSupabaseStringList = (value) => Array.isArray(value) && value.every((entry) => typeof entry === 'string' && entry.trim());
+/** Shape problems of the optional hfs.json `db` block of a lite app: the environment variable naming its database, its image, forced RLS and its application role. */
+const isStringList = (value) => Array.isArray(value) && value.every((entry) => typeof entry === 'string' && entry.trim());
 
-function supabaseValueProblems(block) {
-  const bad = [];
-  if (block.enableSignup !== undefined && typeof block.enableSignup !== 'boolean') bad.push('supabase.enableSignup must be true or false');
-  if (block.jwtExpiry !== undefined && !(Number.isInteger(block.jwtExpiry) && block.jwtExpiry > 0 && block.jwtExpiry <= 3600)) bad.push('supabase.jwtExpiry must be an integer of seconds, 3600 at most');
-  if (block.siteUrl !== undefined && (typeof block.siteUrl !== 'string' || !block.siteUrl.trim())) bad.push('supabase.siteUrl must be a URL string');
-  for (const key of ['redirectUrls', 'forceRls']) if (block[key] !== undefined && !isSupabaseStringList(block[key])) bad.push(`supabase.${key} must be a list of strings`);
-  return bad;
-}
-
-function supabaseBlockProblems(block) {
+function dbBlockProblems(block) {
   if (block === undefined) return [];
-  if (!isPlainObject(block)) return ['supabase must be an object'];
+  if (!isPlainObject(block)) return ['db must be an object'];
   const bad = [];
-  for (const key of Object.keys(block)) if (!['enableSignup', 'jwtExpiry', 'siteUrl', 'redirectUrls', 'forceRls'].includes(key)) bad.push(`supabase has unknown key ${key}`);
-  bad.push(...supabaseValueProblems(block));
+  for (const key of Object.keys(block)) if (!['urlEnv', 'image', 'forceRls', 'forceRlsExemptions', 'appRole'].includes(key)) bad.push(`db has unknown key ${key}`);
+  if (block.urlEnv !== undefined && (typeof block.urlEnv !== 'string' || !/^[A-Z][A-Z0-9_]*$/.test(block.urlEnv))) bad.push('db.urlEnv must name an UPPER_CASE environment variable');
+  if (block.image !== undefined && (typeof block.image !== 'string' || !/@sha256:[0-9a-f]{64}$/.test(block.image))) bad.push('db.image must be a digest-pinned image reference');
+  if (block.forceRls !== undefined && !isStringList(block.forceRls)) bad.push('db.forceRls must be a list of strings');
+  if (block.appRole !== undefined && (typeof block.appRole !== 'string' || !/^[a-z][a-z0-9_]*$/.test(block.appRole))) bad.push('db.appRole must name a role');
+  if (block.forceRlsExemptions !== undefined && !Array.isArray(block.forceRlsExemptions)) bad.push('db.forceRlsExemptions must be a list of { table, reason }');
   return bad;
 }
 
@@ -95,7 +91,8 @@ function declarationSideProblems(side, value, names) {
   const bad = [];
   const at = `sides.${side}`;
   if (!isPlainObject(value)) return [`${at} must be an object`];
-  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing', 'queueOutbox'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing', 'queueOutbox', 'dbFunctions'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  if (value.dbFunctions !== undefined && (side !== 'be' || !dbFunctionsOk(value.dbFunctions))) bad.push(`${at}.dbFunctions belongs to the be side and lists {name, reason} database functions with unique names`);
   bad.push(...appShapeProblems(value.apps, at, side, names));
   if (isBadUniqueList(value.optionalSlots, (slot) => SLOT_ID.test(String(slot)))) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
   if (value.backing !== undefined && side !== 'be') bad.push('backing belongs to the be side');
@@ -127,13 +124,13 @@ function observeBlockProblems(observe) {
   return bad;
 }
 
-const DECLARATION_KEYS = new Set(['hfs', 'kind', 'project', 'edition', 'supabase', 'sides', 'browser', 'lexicon', 'observe']);
+const DECLARATION_KEYS = new Set(['hfs', 'kind', 'project', 'edition', 'db', 'sides', 'browser', 'lexicon', 'observe']);
 const RUNTIME_DECLARATION_KEYS = new Set(['hfs', 'kind', 'project']);
 
 function productDeclarationProblems(declaration, profiles) {
   const bad = [];
   for (const key of Object.keys(declaration)) if (!DECLARATION_KEYS.has(key)) bad.push(`unknown key ${key}`);
-  bad.push(...supabaseBlockProblems(declaration.supabase), ...lexiconBlockProblems(declaration.lexicon), ...observeBlockProblems(declaration.observe));
+  bad.push(...dbBlockProblems(declaration.db), ...lexiconBlockProblems(declaration.lexicon), ...observeBlockProblems(declaration.observe));
   if (declaration.browser !== undefined && declaration.browser !== true) bad.push('browser is `true` when the app has a browser journey (slot app.browser), and is left out otherwise');
   if (declaration.kind !== APP_KIND) bad.push(`kind must be ${APP_KIND} (a product is one app repository with a be and an fe side) or ${RUNTIME_KIND} (the StarCi runtime repository)`);
   if (!isPlainObject(declaration.sides) || Object.keys(declaration.sides).sort(byCodeUnit).join() !== profiles.join()) { bad.push('sides must declare exactly be and fe'); return bad; }

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -15,12 +15,12 @@ const ENV_PREFIX =/^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$/;
 const CONTEXT_ISOLATIONS = Object.freeze(["database", "schema"]);
 /** The app kinds that may own a context: the services, never the migrate or cli apps that only run migrations. */
 const CONTEXT_OWNER_KINDS = Object.freeze(["api", "worker"]);
-/** The database engines a connection may run on: a self-described Postgres, or the Postgres of a Supabase project. */
-const CONNECTION_PROVIDERS = Object.freeze(["postgres", "supabase"]);
+/** The database engine a connection runs on. */
+const CONNECTION_PROVIDERS = Object.freeze(["postgres"]);
 /** The editions an app repository may declare in hfs.json (`full` when absent): the filter slots.mjs applies. */
 export const EDITIONS = Object.freeze(["full", "lite"]);
-/** What decides where schema changes live (ruleParams.<side>.schemaAuthority): TypeORM migrations under persistence/, or the Supabase migration tree. */
-export const SCHEMA_AUTHORITIES = Object.freeze(["typeorm", "supabase"]);
+/** What decides where schema changes live (ruleParams.<side>.schemaAuthority): TypeORM migrations under persistence/, or the SQL migration tree db/migrations. */
+export const SCHEMA_AUTHORITIES = Object.freeze(["typeorm", "sql"]);
 /**
  * The shape problems of the `connections` of one side: a list of {name, envPrefix, owner, isolation}, the owner an api or worker app
  * of the same side (a connection is a bounded context and one service owns it), isolation `database` or `schema`.

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -62,6 +62,9 @@ function beSpecificProblems(be, manifest) {
   return bad;
 }
 
+/** True for an absent list or a list of {name, reason} database functions, names unique. */
+export const dbFunctionsOk = (list) => list === undefined || (Array.isArray(list) && list.every((entry) => isPlainObject(entry) && Object.keys(entry).sort().join() === 'name,reason' && /^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)?$/.test(entry.name) && typeof entry.reason === 'string' && entry.reason.trim().length > 0) && new Set(list.map((entry) => entry.name)).size === list.length);
+
 /** The shape problems of `m.ruleParams`. */
 export function ruleParamsProblems(m) {
   const bad = [];
@@ -71,7 +74,7 @@ export function ruleParamsProblems(m) {
     // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
     // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
     if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite', 'dbFunctions']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !dbFunctionsOk(rp.be.dbFunctions) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority', 'dbFunctions'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + '), dbFunctions ([{name, reason}]) and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
     bad.push(...beSpecificProblems(rp.be, m));
     if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
     if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names) and queueOutbox ({table: <schema>.<table>, columns: [unique column names including queue]})');

package/runtime/scripts/hfs/rules/database-constants.mjs

@@ -1,26 +1,24 @@
-// Single source of database-rule finding codes and owned Supabase paths.
+// Single source of database-rule finding codes and the owned db/ paths of a lite app (slot app.db).
 export const DB_MIGRATION_SHAPE = 'DB_MIGRATION_SHAPE';
 export const DB_RLS_REQUIRED = 'DB_RLS_REQUIRED';
 export const DB_DYNAMIC_DDL = 'DB_DYNAMIC_DDL';
 export const DB_POLICY_SHAPE = 'DB_POLICY_SHAPE';
 export const DB_DEFINER_SAFE = 'DB_DEFINER_SAFE';
 export const DB_STORAGE_POLICY = 'DB_STORAGE_POLICY';
-export const DB_CONFIG_POLICY = 'DB_CONFIG_POLICY';
-export const DB_TYPES_DRIFT = 'DB_TYPES_DRIFT';
+export const LITE_DB_MIGRATION = 'LITE_DB_MIGRATION';
 export const DB_BASELINE_SHAPE = 'DB_BASELINE_SHAPE';
 export const DB_ARCHIVE_MUTATED = 'DB_ARCHIVE_MUTATED';
 export const DB_PGMQ_DECLARED = 'DB_PGMQ_DECLARED';
 export const DB_CRON_OWNED = 'DB_CRON_OWNED';
 export const DB_EXTENSION_ALLOWED = 'DB_EXTENSION_ALLOWED';
-export const DB_API_EXPOSED = 'DB_API_EXPOSED';
 export const DB_MIGRATION_DESTRUCTIVE = 'DB_MIGRATION_DESTRUCTIVE';
 export const HFS_SEED_PII = 'HFS_SEED_PII';
 export const DB_VAULT_WRITE = 'DB_VAULT_WRITE';
 
-export const MIGRATIONS_DIR = 'supabase/migrations';
-/** The migrations retired at a baseline cutover (slot app.supabase.migrations.archive): never applied, never judged by L02-L08. */
-export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/_archive`;
-/** True for a migration the Supabase CLI applies: a path under supabase/migrations/ outside the archive. */
+export const DB_DIR = 'db';
+export const MIGRATIONS_DIR = `${DB_DIR}/migrations`;
+/** The migrations retired at a baseline cutover (slot app.db.migrations.archive): never applied, never judged by L02-L08. */
+export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/archive`;
+/** True for a migration `starci app db migrate` applies: a path under db/migrations/ outside the archive. */
 export const isActiveMigration = (file) => file.startsWith(`${MIGRATIONS_DIR}/`) && !file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`);
-export const CONFIG_FILE = 'supabase/config.toml';
-export const TYPES_FILE = 'supabase/types/database.types.ts';
+export const SEED_FILE = `${DB_DIR}/seed.sql`;

package/runtime/scripts/hfs/rules/database-migrations.mjs

@@ -74,7 +74,7 @@ function localMigrationFindings(local) {
   const stamps = new Map();
   for (const entry of local) {
     if (!entry.match) {
-      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is not named <ts14>_<kebab>.sql; a migration is created by \`npm run db:new\` (supabase migration new), never renamed by hand`, { expected: '<ts14>_<kebab>.sql' }));
+      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is not named <ts14>_<kebab>.sql; a migration is created by \`npm run db:new\` (starci app db new), never renamed by hand`, { expected: '<ts14>_<kebab>.sql' }));
       continue;
     }
     const stamp = migrationStamp(entry.match[1]);
@@ -143,8 +143,8 @@ function removedMigrationFindings(local, retired, baseNames, baseSha) {
 }
 
 /**
- * L02 findings for names, stamps, ordering and immutability of supabase/migrations/*.sql. `archived` are the files of
- * supabase/migrations/_archive/ (app.supabase.migrations.archive): never judged, and a migration moved there at a baseline
+ * L02 findings for names, stamps, ordering and immutability of db/migrations/*.sql. `archived` are the files of
+ * db/migrations/archive/ (app.db.migrations.archive): never judged, and a migration moved there at a baseline
  * cutover is retired from the ordering chain, not removed. New files append after HEAD's active migrations; timestamps
  * on archived migrations, remote branches and the wall clock do not constrain a replacement baseline.
  */

package/runtime/scripts/hfs/slot-app-view.mjs

@@ -49,7 +49,7 @@ function sideCrossing(repo, fromSide, toSide, toPath) {
 function importAllowedApp({ repo, root, sides }, fromPath, toPath) {
   const from = splitSide(fromPath);
   const to = splitSide(toPath);
-  // A side file may read an app-root path (supabase/types/) only through a declared read, exactly as it reads the other side.
+  // A side file may read an app-root path (db/types/) only through a declared read, exactly as it reads the other side.
   if (from && from.side !== to?.side) return sideCrossing(repo, from.side, to?.side ?? null, toPath);
   if (from && to) return sides[from.side].importAllowed(from.rest, to.rest);
   return root.importAllowed(fromPath, toPath);

package/runtime/scripts/hfs/slots.mjs

@@ -120,6 +120,7 @@ function sideDeclaration(manifest, declaration, name, edition, providers) {
     connections: Object.freeze((s.connections ?? []).map(connectionView)),
     providers,
     reads: Object.freeze([...(s.reads ?? [])]),
+    dbFunctions: Object.freeze((s.dbFunctions ?? []).map((entry) => Object.freeze({ ...entry }))),
     ...(s.grammar === undefined ? {} : { grammar: s.grammar }),
     ...(s.extraPackages === undefined ? {} : { extraPackages: Object.freeze(s.extraPackages.map(entry => Object.freeze({ ...entry }))) }),
     manifestVersion: manifest.version,
@@ -221,7 +222,8 @@ function createScopeResolver(manifest, repo) {
     trackingOf,
     /** True only for a path a slot owns and requires to be committed. */
     isTracked: (p) => trackingOf(p) === 'tracked',
-    ruleParams: () => ruleParams(manifest, profile, edition),
+    // The app's own database functions (hfs.json sides.be.dbFunctions) join the canon's list (R334).
+    ruleParams: () => withDeclaredDbFunctions(ruleParams(manifest, profile, edition), repo.dbFunctions),
     allowedImports: (tier) => manifest.tiers[profile]?.[tier]?.mayImport ?? null,
   });
 }
@@ -235,13 +237,17 @@ function createScopeResolver(manifest, repo) {
  */
 export function createSlotResolver(manifest, repo) {
   if (repo.profile !== APP_SCOPE) return createScopeResolver(manifest, repo);
-  // The root declares no connection of its own, yet a provider slot of the app profile (app.supabase*) is enabled by a
+  // The root declares no connection of its own, yet a provider slot of the app profile is enabled by a
   // side's connection with that provider: the root scope reads the union of the sides' connections.
   const root = createScopeResolver(manifest, { ...repo, connections: SIDES.flatMap((side) => repo.sides[side].connections) });
   const sides = Object.fromEntries(PROFILES.map((side) => [side, createScopeResolver(manifest, repo.sides[side])]));
   return appResolver(repo, root, sides);
 }
 
+/** The rule parameters with the app's declared database functions appended to `dbFunctions` (be only), frozen. */
+const withDeclaredDbFunctions = (params, declared = []) => (params.dbFunctions === undefined && !declared.length ? params
+  : Object.freeze({ ...params, dbFunctions: Object.freeze([...(params.dbFunctions ?? []), ...declared]) }));
+
 /** The rule parameters of one profile (be: infraOwners, suffixes, bannedSuffixes and the rest over the shared ruleParams.common fileLines and duplicateBlock; fe: common alone or with its overrides; runtime: ruleParams.runtime of a runtime manifest), as a frozen deep copy. Under `edition` lite the `lite` overrides of ruleParams.<profile> merge over the base (the `lite` key itself is never returned). */
 export function ruleParams(manifest, profile, edition = 'full') {
   const profiles = manifestKind(manifest) === RUNTIME_KIND ? [RUNTIME_KIND] : PROFILES;

package/runtime/scripts/lib/secret-patterns.mjs

@@ -100,7 +100,7 @@ const SECRET_NAME_TEST = NAME_WORD(SECRET_WORD, String.raw`(?:[_\-.]|[A-Z]|[^A-Z
 const BENIGN_TAIL_TEST = NAME_WORD(BENIGN_WORD, '$');
 
 /** True when a bare variable `name` holds secret material as an identifier segment (DB_PASSWORD, dbPassword,
- *  SUPABASE_SERVICE_ROLE_KEY) and does not end in a config suffix (PASSWORD_MIN_LENGTH, SECRET_FILE,
+ *  STORAGE_SECRET_ACCESS_KEY) and does not end in a config suffix (PASSWORD_MIN_LENGTH, SECRET_FILE,
  *  tokenBudget). The same name judgement the `assigned-secret` patterns make, for callers that read keys. */
 export const secretNameLike = (name) => SECRET_NAME_TEST.test(name) && !BENIGN_TAIL_TEST.test(name);
 
@@ -117,7 +117,7 @@ export const SECRET_PATTERNS = [
   { name: 'jwt', re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
   { name: 'age-secret-key', re: /\bAGE-SECRET-KEY-1[0-9A-Z]{20,}\b/ },
   { name: 'password-connection-string', re: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:[^@\s/${}]{8,}@/iu },
-  // A value written `env(NAME)` (the Supabase config.toml reference form) names a variable, not a secret.
+  // A value written `env(NAME)` (a config reference form) names a variable, not a secret.
   // A keyword-assigned value that names itself a stand-in (a test stub's `accessToken: "fixture-..."`) is no
   // candidate; only this heuristic takes the exemption, never a provider-shaped token above.
   // A spec file's keyword-assigned values are test inputs (a spec's sign-in

package/dist/callback-shape.d.ts

@@ -1,7 +0,0 @@
-import { type Recommended, type Rules } from "./lib/rule.js";
-/** A callback stays a PKCE exchange and redirect, with every side effect owned by the auth helper. */
-export declare const callbackShape: import("./lib/rule.js").Rule<"shape", []>;
-/** The rule R287 contributes to the front-end plugin. */
-export declare const rules: Rules;
-/** Every callback shape violation is an error. */
-export declare const recommended: Recommended;