@starci/eslint-grammar-offset-pop 0.15.10 → 0.15.12

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.15.12 - 2026-10-29
+
+- Changed: the peer moves to the 0.15.12 cohort; the bundled slot manifest 3.10.0 adds the lite slot `be.platform.database.entities`, the entity registry (slot fields `role: entity-registry` and `importedBy`, validated by the manifest shape); the bundled canon pins name hfs 4.10.1, eslint-canon-be 3.7.1, eslint-canon-fe 9.5.1 and the Grammar family 0.15.12. No rule changed.
+
+## 0.15.11 - 2026-10-29
+
+- Changed: the peer moves to the 0.15.11 cohort; the bundled slot manifest 3.9.0 replaces the lite `app.supabase*` slots with `app.db` (`db/migrations`, `db/migrations/archive`, `db/seed.sql`, the managed `db/bootstrap.sql`), `be.integrations.supabase` with `be.integrations.passport` and `be.integrations.object-storage`, removes `fe.route.callback`, sets lite `schemaAuthority: sql`, gives lite TypeORM entities in `be.persistence`, adds `ruleParams.be.dbFunctions`, and moves the S3 SDKs to `integrations/object-storage` and the identity libraries to `integrations/passport` in `infraOwners` (`@supabase/*`, `minio` and `bcrypt` nowhere); the bundled rule catalog retires R216, R217, R219, R254 and R287 and adds R328-R334; the bundled canon pins name hfs 4.10.0, eslint-canon-be 3.7.0, eslint-canon-fe 9.5.0 and the Grammar family 0.15.11, pin `@nestjs/passport` 11.0.5 (CommonJS on the Nest 11 line), `passport` 0.7.0, `passport-google-oauth20` 2.0.0, `passport-local` 1.0.0, `bcryptjs` 3.0.3 and their types (tokens are signed and verified with `jose`; `@nestjs/jwt` stays allowed in `integrations/passport` but unpinned), and drop `@supabase/ssr`, `@supabase/supabase-js` and the `supabase` CLI. No rule changed.
+
+
 ## 0.15.10 - 2026-10-29
 
 - Changed: `@starci/eslint-grammar-core` 0.15.10 is the peer dependency; the bundled slot manifest gives the model libraries their owners in `ruleParams.be.infraOwners` (`@starci/ai-router` to `integrations/ai-gateway`, `@langchain/*` to `integrations/ai`; `openai`, `langchain`, `@langchain/langgraph`, `@langchain/community` and the provider SDKs nowhere) and lists R326 and R327 on `be.integrations`; the bundled canon pins name hfs 4.9.11, eslint-canon-be 3.6.8, eslint-canon-fe 9.4.9, the Grammar family 0.15.10 (grammar, eslint-grammar-core, eslint-grammar-offset-pop), and pin `@langchain/core` 1.3.1 and `@langchain/openai` 1.8.0. No rule changed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-grammar-offset-pop",
-  "version": "0.15.10",
+  "version": "0.15.12",
   "description": "Offset Pop Grammar lint: the inherited Common component contract over its own visual family.",
   "keywords": [
     "eslint",
@@ -44,7 +44,7 @@
   "peerDependencies": {
     "eslint": ">=9",
     "typescript": ">=5.9",
-    "@starci/eslint-grammar-core": "0.15.10"
+    "@starci/eslint-grammar-core": "0.15.12"
   },
   "devDependencies": {
     "@starci/eslint-canon-fe": "file:../eslint-canon-fe",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.10
+    version: 0.15.12
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.6.8
+    version: 3.7.1
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.4.9
+    version: 9.5.1
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.10
+    version: 0.15.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.10
+    version: 0.15.12
     group: starci
     install: registry
     side: fe
@@ -85,12 +85,12 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.4.1
+    version: 2.5.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
-    why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+    why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeQueryBuilder, queueQueryBuilders, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
     version: 1.2.3
     group: starci
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.9.11
+    version: 4.10.1
     group: starci
     install: registry
     side: both
@@ -543,7 +543,7 @@ pins:
     version: 3.1150.0
     group: framework
     side: be
-    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces, Supabase Storage); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
+    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
   '@aws-sdk/s3-request-presigner':
     version: 3.1150.0
     group: framework
@@ -594,27 +594,47 @@ pins:
     group: framework
     side: be
     why: 'the Express 5 integration @nestjs/apollo loads at boot (R111 nestjs-apollo-express5, knowledge/hfs/peer-integrations.yaml); every api app that serves GraphQL installs it; the latest registry version on 2026-10-13.'
-  # --- Supabase lite
-  '@supabase/ssr':
-    version: 0.12.7
+  # --- lite identity (integrations/passport, ruling lite-self-hosted-postgres-passport-minio)
+  '@nestjs/passport':
+    version: 11.0.5
     group: framework
-    side: fe
-    why: the one server/browser client factory for a lite Next app; exact version registry-checked for the lite scaffold.
-  '@supabase/supabase-js':
-    version: 2.117.2
+    side: be
+    why: 'PassportStrategy of integrations/passport; 11.0.5 is CommonJS on the Nest 11 line (12.0.0 is ESM-only and breaks Nest 11 jest under the CommonJS transform of @starci/jest-preset), as nivo-lite runs it.'
+  passport:
+    version: 0.7.0
     group: framework
-    side: both
-    why: the generated Database-typed client used by the FE data owner and the BE Auth/Storage integration.
+    side: be
+    why: the strategy runtime under @nestjs/passport (its peer range ^0.5 || ^0.6 || ^0.7).
+  passport-google-oauth20:
+    version: 2.0.0
+    group: framework
+    side: be
+    why: Google OAuth 2.0 (authorization code with state and PKCE) of integrations/passport.
+  passport-local:
+    version: 1.0.0
+    group: framework
+    side: be
+    why: the email and password strategy of integrations/passport.
+  bcryptjs:
+    version: 3.0.3
+    group: framework
+    side: be
+    why: 'bcrypt in pure JavaScript (no native build on the alpine image); verifies the $2a$/$2b$ hashes auth.users carries over.'
+  '@types/passport-google-oauth20':
+    version: 2.0.17
+    group: framework
+    side: be
+    why: types of passport-google-oauth20.
+  '@types/passport-local':
+    version: 1.0.38
+    group: framework
+    side: be
+    why: types of passport-local.
   jose:
     version: 6.2.12
     group: framework
     side: be
-    why: verifies Supabase access tokens against the project JWKS with issuer, audience, expiry and algorithm checks.
-  supabase:
-    version: 2.119.0
-    group: tooling
-    side: both
-    why: the root CLI wrapper owns local schema lifecycle and generates the committed database types.
+    why: signs the app's own ES256 access tokens and verifies them against its own key set (createLocalJWKSet) in integrations/passport.
   class-transformer:
     version: 0.5.1
     group: framework

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.7.0
+version: 3.10.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -38,6 +38,9 @@ versioning:
 # or environment reads (BE_APP_OPTIONS_COMPOSITION). Secrets use EnvSource.secret(): <NAME>_FILE first, plain <NAME> only
 # when the file key is absent; .starcistacks owns custody. Capability <capability>.config.ts roles stay unchanged.
 # 3.3.0 is a minor (alpha.16): it ADDS the optional app.ci-stack-deploy slot, the managed workflow of the starci app stack verbs.
+# 3.9.0 (ruling:lite-self-hosted-postgres-passport-minio, 2026-10-29) is a major for lite and changes no full slot but the S3 owner's
+# folder: lite leaves Supabase. The app.supabase* and be.integrations.supabase slots and fe.route.callback are removed; app.db (db/, its
+# migrations, archive, seed and managed bootstrap), be.integrations.passport and be.integrations.object-storage are added; lite's schemaAuthority is sql.
 # 3.4.0 is a minor (alpha.25): it ADDS the opt-in be.contract.mcp-tools slot, the committed MCP tool-catalog snapshot of an app.
 # 3.5.0 is a minor (alpha.27): it ADDS the opt-in app.browser-config slot, the managed browser/tsconfig.json that type-checks the browser
 # journey (enabled with app.browser by `browser: true`).
@@ -45,6 +48,8 @@ versioning:
 # 2026-10-24: lite may serve SSE, and SSE is the default door for one-way push), and lets fe.modules.api hold the SSE stream operations (sse/).
 # 3.7.0 is a minor (alpha.31): it ADDS the optional app.scripts.integration slot (scripts/integration/*.mjs, the product test-support scripts that only the integration harness runs) and the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
 # transport client layer), and lets fe.hooks.swr hold the SWR subscription hooks (api/sse/subscriptions/useSubscribe<X>Swr.ts, one useSWRSubscription per stream operation).
+# 3.10.0 is a minor (2026-10-29): it ADDS the lite be.platform.database.entities slot, the entity registry (slot fields role and importedBy), so the
+# tier matrix and the public-entry rules admit exactly its <c>Entities imports and its deep importers (persistence.md BE-PERSISTENCE-3).
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -65,6 +70,10 @@ versioning:
 #   outcomeHome true on a file slot: the one file that declares the repository's Outcome union. A repository holds exactly one such
 #               file (modules/api/outcome.ts, the api package's outcome.ts, or modules/db/outcome.ts of a lite app),
 #               and no other file declares an Outcome union (one-outcome-union, FE_TRANSPORT_OWNER).
+#   role        on a file slot: the one part it plays that a rule reads. entity-registry = the lite PRIMARY_ENTITIES list
+#               (be.platform.database.entities): the one platform file that imports capability <c>Entities, imported by deep path
+#               only from the files importedBy names (architecture/entity-registry.mjs).
+#   importedBy  on a slot with a role: the side-relative path patterns of the only files that import its file by deep path.
 #   requires    files or directories that must exist inside each instance; <var> is replaced by the bound name,
 #               a leading / means repository root; a trailing / means directory.
 #   requiredInstances  variable -> names that must exist as instances (config, logging ... of platform).
@@ -102,34 +111,34 @@ versioning:
 #               requiredInstances, why), each shaped as the same field in the slot body; every other field is the edition's.
 #               `why` under lite names the adapter behind the slot's ports (pgmq, Postgres locks, in-process socket.io).
 #               `tests` is never overlaid: a lite slot owes exactly the unit specs its full slot owes.
-#   provider    the hfs.json connections[].provider that enables this opt-in slot (supabase); never an app kind.
+#   provider    the hfs.json connections[].provider that enables this opt-in slot (postgres); never an app kind.
 #   since       the manifest version that introduced the slot.
 presenceValues: [required, optional, opt-in, forbidden]
 trackedValues: [tracked, ignored, external]
 testValues: [unit-beside, e2e, none]
 
 # The editions a repository declares in hfs.json `edition` (absent means full). ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite IS
-# the full architecture with Supabase backing services - the same monorepo, slots, CQRS shape and patterns (queue,
+# the full architecture on its own self-hosted PostgreSQL (ruling:lite-self-hosted-postgres-passport-minio) - the same monorepo, slots, CQRS shape and patterns (queue,
 # event bus, saga, reactors, projection, realtime, webhooks, fenced job), declared in hfs.json the same way, and the same unit
 # specs (unitRoles, logicRoles, 100 per file, @starci/jest-preset doubles, builders). What differs is ADAPTERS and DELIVERY
-# (ruling:R212/case-10): schema authority in supabase/migrations, the queue port on BullMQ over the Redis hfs.json
+# (ruling:R212/case-10): schema authority in db/migrations, the queue port on BullMQ over the Redis hfs.json
 # sides.be.backing declares (as in full, fed by the Postgres outbox), event-bus ports on pgmq-backed topics or in-process
 # delivery, cache and locks on Postgres or the declared Redis, schedules on pg_cron (+ pg_net) enqueueing through the queue
-# outbox, storage and auth on Supabase. Realtime uses SSE or the socket.io gateway
+# outbox, storage on S3-compatible MinIO (integrations/object-storage) and auth through integrations/passport. Realtime uses SSE or the socket.io gateway
 # in the api process, which scales horizontally and stateless (memory hub for one replica or tests; the Redis hub and @socket.io/redis-adapter when Redis is declared, else the Postgres hub and @socket.io/postgres-adapter, for N replicas; websocket only, no sticky sessions). Integration and provider sandbox contract specs are optional;
 # declared patterns owe their integration proofs (R284). Lite has no e2e world. Production uses declared docker-swarm under
-# .starcistacks/production/infra/swarm/ (owner ruling 2026-10-14); lite runs no self-hosted database, and runs only the backing
-# services sides.be.backing declares. The front end is full's (R97).
+# .starcistacks/production/infra/swarm/ (owner ruling 2026-10-14); lite runs its PostgreSQL as the db service of its
+# stack and only the backing services sides.be.backing declares. The front end is full's (R97).
 # Lite is this same manifest filtered: a slot whose `editions` lacks lite does not exist for a lite app, `litePresence` replaces
 # presence and a `lite` map replaces the fields it names. The edition is chosen once at scaffold; there is no upgrade
 # or downgrade between lite and full. Lite contracts are allowed (owner decision 2026-10-14).
 editions: [full, lite]
 
 # The two sides of an app: the folder of each is its profile name (be/, fe/). `reads` lists the only paths of the OTHER side a side
-# may read (hfs.json sides.<side>.reads names a subset), or a tree an app-root slot owns (supabase/types/); nothing else crosses sides.
+# may read (hfs.json sides.<side>.reads names a subset), or a tree an app-root slot owns; nothing else crosses sides.
 sides:
-  be: {reads: [supabase/types/]}   # the generated Database types of a Supabase connection (server code types its PostgREST calls)
-  fe: {reads: [be/contracts/, supabase/types/]}     # be/contracts/: the committed contract snapshots, the input of the front end's codegen; supabase/types/: the same generated types
+  be: {reads: []}
+  fe: {reads: [be/contracts/]}     # be/contracts/: the committed contract snapshots, the input of the front end's codegen
 
 # The trigger kinds of the back end's features: what starts the work of a feature. A feature slot names its kind in `trigger`; no kind imports another
 # (BE_KIND_ISOLATION), every cross-kind call is an event on the bus, and only be/apps/* compose features.
@@ -192,9 +201,9 @@ crossApp: apps never import each other; shared code is a packages/<pkg> slot.
 ruleParams:
   db:
     # R259: btree_gist supplies UUID equality for the booking interval exclusion constraint.
-    # R259: unaccent is a first-party Supabase extension used by Vietnamese-content search functions.
+    # R259: unaccent ships in the supabase/postgres image of the db service, used by Vietnamese-content search functions.
     extensions: [pgmq, pg_cron, pgcrypto, pg_trgm, vector, uuid-ossp, pg_net, supabase_vault, unaccent, btree_gist]
-    # R258 DB_CRON_OWNED: THE queue outbox of a Supabase schema (the relay hands its unsent rows to BullMQ, ruling:R212/case-10). A pg_cron
+    # R258 DB_CRON_OWNED: THE queue outbox of a lite schema (the relay hands its unsent rows to BullMQ, ruling:R212/case-10). A pg_cron
     # job enqueues only by inserting one row into this table, writing only these columns, one of which is `queue`.
     queueOutbox: {table: public.queue, columns: [queue, payload, created_at, correlation_id]}
   common:
@@ -218,8 +227,18 @@ ruleParams:
       "node:https": [platform/http]
       http: [platform/http]
       https: [platform/http]
-      "@aws-sdk/client-s3": [integrations/object-storage]       # the ObjectStorage port: one S3 adapter for MinIO, S3, Spaces and Supabase Storage
+      "@aws-sdk/client-s3": [integrations/object-storage]       # the ObjectStorage port: one S3 adapter for MinIO, S3 and Spaces (R331)
       "@aws-sdk/s3-request-presigner": [integrations/object-storage]
+      minio: []                                          # storage goes through the S3 client of integrations/object-storage
+      "@supabase": []                                    # no Supabase client in a back end
+      "@nestjs/passport": [integrations/passport]        # the identity libraries (R328)
+      passport: [integrations/passport]
+      passport-google-oauth20: [integrations/passport]
+      passport-local: [integrations/passport]
+      "@nestjs/jwt": [integrations/passport]
+      jose: [integrations/passport]
+      bcryptjs: [integrations/passport]
+      bcrypt: []
       cache-manager: [integrations/cache, integrations/redis]
       "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability
       redis: [integrations/cache, integrations/redis]
@@ -391,21 +410,41 @@ ruleParams:
     # end may declare in hfs.json sides.be.backing. `clients` are the libraries that consume the service: one of them as a dependency
     # is its consumer, and under lite none of them may be a dependency while the service is undeclared. `patterns` are the declared
     # patterns that need the service. `images` are the image repositories (the last path segment) a stack runs it from.
-    # `editions` limits admission: owner:lite-vector-is-pgvector keeps vector search on Supabase pgvector in lite.
+    # `editions` limits admission: owner:lite-vector-is-pgvector keeps vector search on pgvector in lite.
     backing:
       redis: {clients: [bullmq, "@nestjs/bullmq", bull, "@nestjs/bull", ioredis, redis, "@keyv/redis", cache-manager-redis-yet, cache-manager-ioredis-yet, "@socket.io/redis-adapter"], patterns: [queue, fenced-job], images: [redis, redis-stack, redis-stack-server]}
       qdrant: {clients: ["@qdrant/js-client-rest", "@qdrant/qdrant-js"], patterns: [], images: [qdrant], editions: [full]}
     # Edition lite (ruleParams(manifest, 'be', 'lite') merges these keys over the base; a map merges one level deep): the schema
-    # authority is the Supabase migration tree (supabase/migrations/*.sql, forward-only), so a lite back end holds no TypeORM
+    # authority is the SQL migration tree (db/migrations/*.sql, forward-only), so a lite back end holds no TypeORM
     # migration or entity under be/ (R34/R35 read schemaAuthority; be.persistence's lite overlay allows neither). The unit roles,
     # logic roles and spec doubles are full's (owner ruling 2026-10-12 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4). infraOwners: full's owners,
     # bullmq in platform/queue and ioredis/redis in integrations/cache and integrations/redis (ruling:R212/case-10: the queue is
     # Redis in both editions; a backing library is legal only when hfs.json sides.be.backing declares its service, which
-    # HFS_BACKING_UNDECLARED checks), except Kafka, which is owned nowhere (platform/event-bus runs Supabase Queues (pgmq) through
+    # HFS_BACKING_UNDECLARED checks), except Kafka, which is owned nowhere (platform/event-bus runs pgmq queues through
     # the shared EntityManager); realtime is the same socket.io gateway as full, run inside the api process, scaled horizontally and stateless (hub redis when
     # Redis is declared, else hub postgres with @socket.io/postgres-adapter; no sticky sessions).
+    # R334: the database functions code may call through platform/database's callDbFunction, advisoryXactLock and notify helpers,
+    # each {name, reason}; the canon lists the pg built-ins it uses itself, and an app adds its own in hfs.json sides.be.dbFunctions.
+    dbFunctions:
+      - {name: pg_advisory_xact_lock, reason: "advisoryXactLock: a transaction-scoped lock TypeORM has no API for"}
+      - {name: hashtextextended, reason: "advisoryXactLock: the 64-bit key of a text lock name"}
+      - {name: pg_notify, reason: "notify: LISTEN/NOTIFY of the Postgres realtime hub"}
+      - {name: to_regproc, reason: "callDbFunction: whether an optional database function exists"}
+      - {name: job_claim, reason: "platform/jobs (add job, lite): the fenced claim upsert of jobs.sql"}
+      - {name: job_advance, reason: "platform/jobs (add job, lite): the token-guarded step write of jobs.sql"}
+      - {name: job_complete, reason: "platform/jobs (add job, lite): the token-guarded completion of jobs.sql"}
+      - {name: job_fail, reason: "platform/jobs (add job, lite): the token-guarded failure of jobs.sql"}
+      - {name: queue_write, reason: "platform/queue (add queue, lite): the outbox insert of queue-outbox.sql"}
+      - {name: queue_waiting, reason: "platform/queue (add queue, lite): the relay read FOR UPDATE SKIP LOCKED of queue-outbox.sql"}
+      - {name: queue_mark_sent, reason: "platform/queue (add queue, lite): the relay mark of queue-outbox.sql"}
+      - {name: inbox_claim_event, reason: "platform/inbox (add webhook, lite): the conflict-safe delivery claim"}
+      - {name: inbox_claim_client, reason: "platform/inbox (add webhook, lite): the client claim upsert returning its committed outcome"}
+      - {name: inbox_save_client_outcome, reason: "platform/inbox (add webhook, lite): the saved client outcome"}
+      - {name: inbox_sweep_clients, reason: "platform/inbox (add webhook, lite): the bounded retention sweep FOR UPDATE SKIP LOCKED"}
+      - {name: event_bus_write, reason: "platform/event-bus (add webhook, lite): the typed envelope insert of the outbox"}
+
     lite:
-      schemaAuthority: supabase
+      schemaAuthority: sql
       infraOwners:
         kafkajs: []
         "@qdrant/js-client-rest": []
@@ -435,7 +474,7 @@ slots:
   - id: app.package-manifest
     since: 3.1.0
     profiles: [app]
-    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite manages Supabase and wiring scripts; full also manages e2e and stack test scripts. Both may run optional contracts."
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite manages its database and wiring scripts; full also manages e2e and stack test scripts. Both may run optional contracts."
     # The one package.json of the app, at the app root: be's dependencies and every tool, and every script; npm workspaces are
     # exactly fe/apps/* and fe/packages/* (HFS_MONO_WORKSPACES), each with its own package.json. be has no package.json of its own.
     path: package.json
@@ -504,7 +543,7 @@ slots:
   - id: app.format-config
     since: 3.1.0
     profiles: [app]
-    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite additionally ignores Supabase-generated row types when formatting; full has its TypeORM schema authority."
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite additionally ignores the generated database row types when formatting; full has its TypeORM schema authority."
     # The one formatter configuration of the app (prettier walks up from every file of both sides to it): .prettierrc names
     # @starci/prettier-config, .prettierignore is the template.
     path: "{.prettierrc,.prettierignore}"
@@ -513,7 +552,7 @@ slots:
     tier: none
     tests: none
     managedBy: tool-config
-    liteManagedBy: tool-config-lite     # the same files plus the generated supabase/types, which the Supabase CLI writes unformatted
+    liteManagedBy: tool-config-lite     # the same files as full
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL]
   - id: app.tool-config-optional
     since: 3.1.0
@@ -556,7 +595,7 @@ slots:
   - id: app.ci
     since: 3.1.0
     profiles: [app]
-    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite CI proves boot through R272 wiring and checks Supabase artifacts; full also provides its e2e lane."
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite CI proves boot through R272 wiring and checks its database artifacts; full also provides its e2e lane."
     path: ".github/workflows/ci.yml"
     presence: required
     tracked: tracked
@@ -581,7 +620,7 @@ slots:
   - id: app.ci-images
     since: 3.1.0
     profiles: [app]
-    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite renders its Supabase-backed image workflow; full renders images for its separately deployed services."
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite renders its image workflow; full renders images for its separately deployed services."
     # Builds every image of the app (one matrix entry per declared app, path-filtered), never pushes: rendered by starci app sync.
     path: ".github/workflows/images.yml"
     presence: required
@@ -596,7 +635,7 @@ slots:
     exemplifiedBy:
       - packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml
       - {path: packages/hfs/src/hfs-release-provenance.spec.mjs, edition: full}
-    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite manages its Supabase database deploy workflow; full owns an optional provider-specific workflow."
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite manages its database deploy workflow; full owns an optional provider-specific workflow."
     # The database deploy workflow: workflow_dispatch only (like app.ci-e2e); starci app sync renders it under the managed ci group.
     path: ".github/workflows/db-deploy.yml"
     presence: optional
@@ -634,7 +673,7 @@ slots:
     since: 3.1.0
     profiles: [app]
     # Production delivery tooling for the app's own processes: compose files, Caddyfile, *.env.example and ops shell scripts.
-    # Lite still keeps its backing services on Supabase and its encrypted custody in app.starcistacks; R06 scans every file here.
+    # Lite keeps its encrypted custody in app.starcistacks; R06 scans every file here.
     path: "deploy/"
     presence: optional
     tracked: tracked
@@ -718,7 +757,7 @@ slots:
     profiles: [app]
     exemplifiedBy:
       - {path: packages/hfs/templates/app/skeleton/scripts/codegen.mjs, edition: full}
-    editionWhy: "Lite manages its Supabase codegen script; full owns operational scripts through the generic path (ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4))."
+    editionWhy: "Lite manages its database-types codegen script; full owns operational scripts through the generic path (ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4))."
     # The app's operational scripts only (`*.mjs`, `*.cjs`, `*.ps1`, `*.sh`), or nothing: an empty folder is `scripts/.gitkeep`, which
     # `starci app scaffold` writes. A spec or a test (BE_SPEC_PLACEMENT, FE_NO_TESTS), a check or lint source (`check-*`, `eslint-local-rules*`,
     # a local eslint plugin: HFS_REPO_LOCAL_CHECK) and anything that re-implements a canon check is not an operational script and has no place here.
@@ -803,7 +842,7 @@ slots:
   - id: app.starcistacks
     since: 3.1.0
     profiles: [app]
-    editionWhy: "owner:lite-production-swarm: lite requires declared docker-swarm production with Supabase backing; owner:dev-docker-prod-swarm keeps dependencies in Docker Linux containers in dev and the app and dependencies on Swarm in prod except hosted Supabase."
+    editionWhy: "owner:lite-production-swarm: lite requires declared docker-swarm production with its PostgreSQL as a stack service; owner:dev-docker-prod-swarm keeps dependencies in Docker Linux containers in dev and the app and dependencies on Swarm in prod."
     exemplifiedBy:
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/, edition: lite}
@@ -818,7 +857,7 @@ slots:
              "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
     # Owner ruling 2026-10-14: lite declares docker-swarm production, app runtime config, sealed custody and seed data.
-    # Supabase supplies the database and broker; production has no Compose or host cron.
+    # The db service supplies the database and broker (pgmq, pg_cron); production has no Compose or host cron.
     lite:
       requires: [application-stacks.yaml]
       allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/swarm/**", "<env>/infra/metadata.json",
@@ -881,122 +920,78 @@ slots:
     goesTo: ".starcistacks/<env>/secrets/<slug>.enc (at the app root); decrypted values only in memory or under %LOCALAPPDATA%/StarCi/secrets/<project>/<env>/ via *_FILE"
     rules: [HFS_PLAINTEXT_SECRET]
 
-  # ----- app root: the Supabase project of an app whose connection declares provider: supabase (every lite app) -------
-  - id: app.supabase
-    profiles: [app]
-    exemplifiedBy:
-      - packages/hfs/templates/app/skeleton-lite/supabase/
-      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: full}
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): Supabase is required in lite; full enables it only through a declared connection."
-    # The one Supabase project directory, at the app root beside be/, fe/ and .starcistacks (never under a side).
-    path: "supabase/"
-    presence: opt-in              # enabled by a connection with provider: supabase; required under edition lite
-    provider: supabase
-    litePresence: required
-    tracked: tracked
-    tier: none
-    tests: none
-    since: 2.1.0
-  - id: app.supabase.config
+  # ----- app root: the database of a lite app (ruling:lite-self-hosted-postgres-passport-minio): a self-hosted PostgreSQL in the app's
+  # stack (the `db` service, image supabase/postgres for pg_cron, pg_net, pgmq, vector, unaccent and pgcrypto), migrated by
+  # `starci app db migrate --url-env <NAME>`. A full app keeps its TypeORM migrations under be/ and has no such folder.
+  - id: app.db
     profiles: [app]
+    editions: [lite]
     exemplifiedBy:
-      - packages/hfs/templates/app/skeleton-lite/supabase/config.toml
-      - {path: packages/hfs/src/db-config-policy.spec.mjs, edition: full}
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires Supabase configuration; full requires it only when Supabase is declared."
-    # The project configuration: auth keys are env(NAME) references, never literals (L08 judges its policy keys).
-    path: "supabase/config.toml"
-    presence: opt-in
-    provider: supabase
-    litePresence: required
+      - packages/hfs/templates/app/skeleton-lite/db/
+    # The one database directory, at the app root beside be/, fe/ and .starcistacks (never under a side).
+    path: "db/"
+    presence: required
     tracked: tracked
     tier: none
     tests: none
-    since: 2.1.0
-  - id: app.supabase.migrations
+    since: 3.9.0
+  - id: app.db.migrations
     profiles: [app]
+    editions: [lite]
     exemplifiedBy:
-      - packages/hfs/templates/app/skeleton-lite/supabase/migrations/__timestamp___baseline.sql
-      - {path: packages/hfs/src/db-migration-shape.spec.mjs, edition: full}
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite uses Supabase schema authority and requires a migration; full opts into that provider."
-    # The schema authority of an app on Supabase: forward-only SQL migrations named <timestamp14>_<kebab-name>.sql,
-    # one file per change, immutable once on origin/main (L02-L08 judge them).
-    path: "supabase/migrations/<stamp>_<name>.sql"
-    presence: opt-in
-    provider: supabase
-    litePresence: required
-    lite: {minInstances: 1}
+      - packages/hfs/templates/app/skeleton-lite/db/migrations/__timestamp___baseline.sql
+      - {path: packages/hfs/src/db-migration-shape.spec.mjs, edition: lite}
+    # The schema authority of a lite app: forward-only SQL migrations named <timestamp14>_<kebab-name>.sql, one file per change,
+    # immutable once on origin/main, applied in order by `starci app db migrate` and recorded in the history table.
+    path: "db/migrations/<stamp>_<name>.sql"
+    presence: required
+    minInstances: 1
     tracked: tracked
     tier: none
     tests: none
-    since: 2.1.0
-  - id: app.supabase.migrations.archive
+    since: 3.9.0
+    rules: [DB_MIGRATION_SHAPE, LITE_DB_MIGRATION]
+  - id: app.db.migrations.archive
     profiles: [app]
-    # The migrations an existing app retired at its cutover (owner ruling 2026-10-13, migration baseline policy): the live schema is
-    # dumped into ONE baseline migration written to the current standard, marked applied on production without a re-run, and the
-    # older files move here. The Supabase CLI applies only supabase/migrations/<stamp>_<name>.sql, never this folder, and no
-    # migration rule (L02-L08) judges it; new migrations append after the baseline.
-    path: "supabase/migrations/_archive/"
-    presence: opt-in
-    provider: supabase
+    editions: [lite]
+    # The migrations an app retired at a baseline cutover: the live schema is dumped into ONE baseline migration, marked applied
+    # without a re-run, and the older files move here. `starci app db migrate` never applies this folder and no migration rule judges it.
+    path: "db/migrations/archive/"
+    presence: optional
     tracked: tracked
     tier: none
     tests: none
-    since: 3.0.0
-  - id: app.supabase.seed
+    since: 3.9.0
+  - id: app.db.seed
     profiles: [app]
-    path: "supabase/seed.sql"
+    editions: [lite]
+    path: "db/seed.sql"
     presence: optional            # synthetic dev data only; a lite app seeds nothing it cannot regenerate
     tracked: tracked
     tier: none
     tests: none
-    since: 2.1.0
-  - id: app.supabase.types
-    profiles: [app]
-    templateNa: "Database row types are generated from the app's Supabase schema by contract:emit; a hand-authored scaffold template would invent the schema contract."
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires generated Supabase row types; full enables them with the provider."
-    # The generated Database types (database.types.ts) contract:emit writes from the migrations; both sides read it
-    # (sides.<side>.reads supabase/types/); drift against regeneration is L09.
-    path: "supabase/types/database.types.ts"
-    presence: opt-in
-    provider: supabase
-    litePresence: required
-    tracked: tracked
-    tier: none
-    tests: none
-    since: 2.1.0
-    exemplifiedBy:
-      - {path: packages/hfs/src/db-types-returned-collector.spec.mjs, edition: full}
-  - id: app.supabase.templates
+    since: 3.9.0
+  - id: app.db.bootstrap
     profiles: [app]
-    path: "supabase/templates/*.html"
-    presence: optional            # the auth e-mail templates Supabase serves
+    editions: [lite]
+    # The managed pre-migration bootstrap (templates/app/db-bootstrap): the auth, storage and extensions schemas, auth.users with the
+    # GoTrue column set, auth.uid/role/jwt stubs, the NOLOGIN browser roles and the realtime publication, so migrations written for a
+    # hosted Supabase apply to the self-hosted db service. `starci app db migrate` applies it before the first migration of an empty database.
+    path: "db/bootstrap.sql"
+    presence: required
     tracked: tracked
+    managedBy: db-bootstrap
     tier: none
     tests: none
-    since: 2.1.0
-  - id: app.supabase.local-state
-    profiles: [app]
-    path: "supabase/{.temp,.branches}/"
-    presence: optional
-    tracked: ignored              # the local CLI's working state: exists, never committed
-    tier: none
-    tests: none
-    since: 2.1.0
-  - id: app.supabase.functions
-    profiles: [app]
-    path: "supabase/functions/"
-    presence: forbidden           # a Deno runtime is a second language runtime outside the lint canon and the slot machine (lite v1)
-    tracked: external
-    tier: none
-    tests: none
-    goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a job of a queue (BullMQ on the declared Redis, its tick enqueued through the queue outbox) or a cli command on a schedule (pg_cron / pg_net)"
-    since: 2.1.0
+    since: 3.9.0
+    rules: [HFS_MANAGED_FILE_DRIFT]
+
 
   # ----- side root (both sides): what a standalone repository root holds, less the app-root files ----------
   - id: repo.side-root-forbidden
     since: 3.1.0
     profiles: [be, fe]
-    path: "{package.json,package-lock.json,hfs.json,README.md,.gitignore,.gitattributes,.husky/,.github/,.starciwork/,.starcistacks/,supabase/,.sops.yaml,sonar-project.properties,codecov.yml,.prettierrc,.prettierignore,scripts/}"
+    path: "{package.json,package-lock.json,hfs.json,README.md,.gitignore,.gitattributes,.husky/,.github/,.starciwork/,.starcistacks/,db/,.sops.yaml,sonar-project.properties,codecov.yml,.prettierrc,.prettierignore,scripts/}"
     presence: forbidden
     tracked: external
     tier: none
@@ -1266,8 +1261,8 @@ slots:
       - {path: packages/hfs/src/mcp-tools-snapshot.spec.mjs, editions: [lite, full]}
 
   # ----- BE: apps (one slot per app kind; a new kind = a new slot, minor bump) ---------------------------
-  # The files of every app (owner ruling 2026-10-14, R245 and R246, since 3.1.0), each with a line budget that
-  # BE_APP_COMPOSITION_BUDGET holds absolutely (not a ratchet):
+  # The files of every app (owner ruling 2026-10-14, R245 and R246, since 3.1.0), each with a line budget (lines excluding
+  # import declarations, multi-line imports included) that BE_APP_COMPOSITION_BUDGET holds absolutely (not a ratchet):
   #   main.ts            the entry: builds EnvSource once, imports and calls read<App>Env from <app>.env.ts, builds options and boots.
   #   <app>.env.ts       exports interface <App>Env and read<App>Env(env: EnvSource): <App>Env (for example ApiEnv/readApiEnv);
   #                      fail-fast environment parsing only, via EnvSource and unchanged capability parse helpers; no localhost
@@ -1317,7 +1312,7 @@ slots:
   - id: be.app.cli
     since: 3.1.0
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): Supabase CLI owns lite migrations; a lite cli app is optional for declared operator commands."
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): `starci app db migrate` owns lite migrations; a lite cli app is optional for declared operator commands."
     # The ONE app of every one-off action (migrate, seed, sync, backup, any operator command): be/apps/cli, on nest-commander.
     # main.ts boots with CommandFactory.run (BE_CLI_BOOTSTRAP); app.module.ts composes the platform and the cli feature root
     # (src/features/cli/cli.module.ts); cli.env.ts exports CliEnv and readCliEnv(env: EnvSource): CliEnv, and cli.options.ts carries the env-derived values,
@@ -1327,7 +1322,7 @@ slots:
     path: "apps/<app>/src/"
     appKind: cli
     presence: opt-in
-    litePresence: optional        # lite: schema migration is the Supabase CLI's job; a cli app exists only when the app declares one
+    litePresence: optional        # lite: schema migration is `starci app db migrate`'s job; a cli app exists only when the app declares one
     tracked: tracked
     tier: app
     owner: true
@@ -1678,7 +1673,7 @@ slots:
   - id: be.persistence
     since: 3.1.0
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): Supabase migrations own lite tables, with SQL and row types here; full keeps TypeORM entities and migrations here."
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): db/migrations own lite tables and both editions map them with TypeORM entities here (ruling:lite-persistence-typeorm-entities); full also keeps its TypeORM migrations here."
     path: "src/modules/{domain,platform,projections}/<capability>/persistence/"
     # R178: the platform capabilities whose tables exist on EVERY connection that uses them (the event-bus outbox, the inbox of every service, the job table); their arrays may be
     # registered on several declared connections. Any other capability registers its arrays on exactly one (BE_SCHEMA_OWNER).
@@ -1689,15 +1684,17 @@ slots:
     requires: [connection.ts]     # the capability's <c>Entities / <c>Migrations arrays (the owner index re-exports the two arrays by name); no CONNECTION alias: the connection is the one the apps register the arrays on
     allows: ["entities/<table>.entity.ts", "migrations/<epochMs13>-<kebab-name>.ts", "<name>.sql.ts", "<name>.rows.ts", connection.ts]
     forbids: [index.ts, "<name>.repository.ts"]
-    # Lite keeps the shared-EntityManager persistence (raw SqlText + rows types over the generated Database row types) but the
-    # schema authority is supabase/migrations (ruleParams.be.lite.schemaAuthority): no TypeORM entity and no be migration.
+    # Lite maps its tables with the same TypeORM entities as full (ruling:lite-persistence-typeorm-entities): each capability's
+    # persistence/entities/<table>.entity.ts and an entities/index.ts exporting its <c>Entities array, which platform/database
+    # lists by name; the schema authority stays db/migrations (ruleParams.be.lite.schemaAuthority), so no be migration and no
+    # raw SQL file (R334 BE_PERSISTENCE_NO_RAW_SQL).
     lite:
-      requires: []                 # no TypeORM arrays to re-export: the persistence of a lite capability is its sql and rows files
-      allows: ["<name>.sql.ts", "<name>.rows.ts", connection.ts]
-      forbids: [index.ts, "<name>.repository.ts", entities/, migrations/]
+      requires: []
+      allows: ["entities/<table>.entity.ts", entities/index.ts, connection.ts]
+      forbids: [index.ts, "<name>.repository.ts", migrations/, "<name>.sql.ts", "<name>.rows.ts"]
     tests: none
     coverage: none
-    rules: [BE_SCHEMA_OWNER, BE_SCHEMA_AUTHORITY, BE_SQL_OUTSIDE_PERSISTENCE, BE_SQL_TABLE_OWNER, BE_SQL_RETURNING_SHAPE, BE_CONTEXT_COUPLING, BE_CONTEXT_PLATFORM_TABLES]
+    rules: [BE_SCHEMA_OWNER, BE_SCHEMA_AUTHORITY, BE_SQL_OUTSIDE_PERSISTENCE, BE_PERSISTENCE_NO_RAW_SQL, BE_SQL_TABLE_OWNER, BE_SQL_RETURNING_SHAPE, BE_CONTEXT_COUPLING, BE_CONTEXT_PLATFORM_TABLES]
   - id: be.platform
     since: 3.1.0
     profiles: [be]
@@ -1720,6 +1717,21 @@ slots:
     coverage: required
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE]
+  - id: be.platform.database.entities
+    since: 3.10.0
+    profiles: [be]
+    editions: [lite]
+    editionWhy: "lite registers the one PRIMARY_ENTITIES list on its single primary connection; full registers each capability's <c>Entities per connection from persistence/connection.ts."
+    path: "src/modules/platform/database/entities.ts"
+    presence: optional
+    tracked: tracked
+    tier: inherit
+    role: entity-registry
+    importedBy: ["apps/*/src/compose/*.ts", "apps/*/src/app.module.ts", "src/tests/world/**"]
+    tests: none
+    coverage: none
+    why: "the entity registry (persistence.md BE-PERSISTENCE-3): it lists every capability's <c>Entities array by name, no glob, as PRIMARY_ENTITIES, the one list the primary connection maps, and exports nothing else. It is the one platform file that imports domain and platform capabilities, each import naming only that capability's <c>Entities from its index.ts (BE_TIER_DIRECTION, ARCH_OWNER_EXPORT_BYPASS); DatabaseModule and the platform/database index never import it, and only the files importedBy names (app composition and the test world) import it, by the deep path @modules/platform/database/entities (BE_PUBLIC_SURFACE), since database.module, this list and the capability indexes would otherwise form a cycle that fails at boot"
+    rules: [BE_TIER_DIRECTION, BE_PUBLIC_SURFACE, BE_SCHEMA_OWNER]
   - id: be.platform.logging
     since: 3.5.0
     profiles: [be]
@@ -1748,7 +1760,7 @@ slots:
     owner: true
     lite:
       why: >-
-        the same EventPublisher and EventConsumer ports on Supabase Queues (pgmq): the outbox relay sends each committed row to the
+        the same EventPublisher and EventConsumer ports on pgmq queues: the outbox relay sends each committed row to the
         pgmq queue of every consumer group of its topic through the shared EntityManager, a consumer reads with a visibility
         timeout, retries by letting it lapse and archives the message on dead letter (read_ct over the budget); a single api may
         deliver in process. No Kafka (knowledge/patterns/be/event-bus.yaml liteAdapter)
@@ -1762,7 +1774,7 @@ slots:
   - id: be.platform.queue
     since: 3.1.0
     profiles: [be]
-    editionWhy: "ruling:R212/case-10: both editions implement the queue ports with BullMQ on Redis; lite declares its Redis in hfs.json sides.be.backing and keeps the outbox table in a supabase migration."
+    editionWhy: "ruling:R212/case-10: both editions implement the queue ports with BullMQ on Redis; lite declares its Redis in hfs.json sides.be.backing and keeps the outbox table in a db migration."
     path: "src/modules/platform/queue/"
     presence: opt-in
     pattern: queue                # the ONE BullMQ owner: the outbox relay into queues (jobId = outbox id) and job schedulers (knowledge/patterns/be/queues.yaml)
@@ -1773,7 +1785,7 @@ slots:
       why: >-
         the same QueueOutbox and QueueWorkerRegistry ports and full's BullMQ adapter on the declared Redis (backing: [redis]): the
         relay adds each committed outbox row with the outbox id as the job id, workers retry with exponential backoff and keep a
-        job that exhausts its attempts as failed (the dead letter); the outbox table comes from a supabase migration, and a
+        job that exhausts its attempts as failed (the dead letter); the outbox table comes from a db migration, and a
         schedule is a BullMQ job scheduler or a pg_cron tick that inserts one outbox row (knowledge/patterns/be/queues.yaml liteAdapter)
     requires: [index.ts, queue.module.ts, queue.port.ts, queue.contracts.ts, queue-outbox.service.ts, queue-outbox.service.spec.ts]
     tests: unit-beside
@@ -1867,7 +1879,7 @@ slots:
   - id: be.platform.jobs
     since: 3.1.0
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite persists fenced claims in Supabase migrations and dispatches through the BullMQ queue on its declared Redis (ruling:R212/case-10); full uses TypeORM schema authority and the same queue adapter."
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite persists fenced claims in db migrations and dispatches through the BullMQ queue on its declared Redis (ruling:R212/case-10); full uses TypeORM schema authority and the same queue adapter."
     path: "src/modules/platform/jobs/"
     presence: opt-in
     pattern: fenced-job           # the ONE fencing primitive: the job entity, the claim that bumps the token, guarded writes (knowledge/patterns/be/jobs.yaml)
@@ -1882,7 +1894,7 @@ slots:
   - id: be.projections
     since: 3.1.0
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite projection tables live in Supabase migrations; full keeps the TypeORM projection entity beside its projection."
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite projection tables live in db migrations; full keeps the TypeORM projection entity beside its projection."
     path: "src/modules/projections/<name>/"
     presence: opt-in
     pattern: projection           # a read model: only its projection writes its table; recompute is idempotent and replayable; readers use get*
@@ -1891,7 +1903,7 @@ slots:
     owner: true
     requires: [index.ts, "<name>.module.ts", "<name>.projection.ts", "<name>.projection-entity.ts"]
     allows: [index.ts, "<name>.module.ts", "<name>.module-definition.ts", "<name>.options.ts", "<name>.projection.ts", "<name>.projection-entity.ts", "<name>.contracts.ts", persistence/]
-    lite:                         # the read model's table is a supabase migration with its rows type (lite's schema authority): no TypeORM projection entity
+    lite:                         # the read model's table is a db migration (lite's schema authority) mapped by its entity under persistence/entities/ (R334)
       requires: [index.ts, "<name>.module.ts", "<name>.projection.ts"]
       allows: [index.ts, "<name>.module.ts", "<name>.module-definition.ts", "<name>.options.ts", "<name>.projection.ts", "<name>.contracts.ts", persistence/]
     tests: unit-beside            # a measured slot: <name>.projection.spec.ts beside its projection is legal (the file owes 100 per file; a spec of its own is optional)
@@ -1924,28 +1936,44 @@ slots:
     why: a self-hosted ML model client is an integration; weights and datasets are never in git, and a language model is called through the ai-router gateway by the integrations/ai LangChain client (BE-AI-1, BE-AI-3)
     rules: [BE_TIER_DIRECTION, BE_INFRA_OWNER, BE_INTEGRATION_SPEC_MISSING]
 
-  - id: be.integrations.supabase
+  - id: be.integrations.passport
+    profiles: [be]
+    editions: [lite]
+    exemplifiedBy:
+      - packages/hfs/templates/be/skeleton-lite/src/modules/integrations/passport/
+    # The one owner of the lite identity libraries (ruleParams.be.infraOwners: @nestjs/passport, passport, passport-google-oauth20,
+    # passport-local, @nestjs/jwt, jose, bcryptjs): the Google OAuth 2.0 strategy (state and PKCE), the local email and password
+    # strategy (bcrypt), the app's own asymmetric access tokens and their JWKS, and the rotating refresh cookie. domain/identity
+    # verifies a token through this integration's verifier and builds the principal (contexts/code/be/api-auth.md).
+    path: "src/modules/integrations/passport/"
+    presence: required
+    tracked: tracked
+    tier: integrations
+    owner: true
+    requires: [index.ts, passport.config.ts, passport.options.ts, passport.decorators.ts, passport.tokens.ts, passport.password.ts, passport.cookie.ts]   # Secrets, no defaults (R44); options and named injectors (R83); tokens and JWKS; bcrypt; the refresh cookie
+    allows: [index.ts, passport.config.ts, passport.options.ts, passport.decorators.ts, passport.tokens.ts, passport.password.ts, passport.cookie.ts, strategies/, errors/]
+    tests: unit-beside
+    rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER, BE_AUTH_PASSPORT_OWNER, BE_AUTH_JWT_OWN_JWKS, BE_AUTH_REFRESH_COOKIE]
+    coverage: required
+    since: 3.9.0
+  - id: be.integrations.object-storage
     profiles: [be]
     exemplifiedBy:
-      - packages/hfs/templates/be/skeleton-lite/src/modules/integrations/supabase/
-      - {path: packages/hfs/src/be-supabase-jwt-verified.spec.mjs, edition: full}
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires the Supabase Auth and Storage integration; full opts in through a connection."
-    # The only be import of @supabase/* (L10): the Auth admin and Storage admin client, plus the JWKS-based verification of
-    # the Supabase access token the guard chain reads (L16). The connection itself is ordinary Postgres (the shared
-    # EntityManager of the declared connection); what lives here are the service calls no database role covers.
-    path: "src/modules/integrations/supabase/"
-    presence: opt-in              # enabled by a connection with provider: supabase; required under edition lite
-    provider: supabase
+      - packages/hfs/templates/be/skeleton-lite/src/modules/integrations/object-storage/
+    # The one owner of the S3 client (@aws-sdk/client-s3 and @aws-sdk/s3-request-presigner) over S3-compatible storage (MinIO in
+    # lite): the ObjectStorage port with presigned PUT and GET; no other module imports an S3 SDK or minio.
+    path: "src/modules/integrations/object-storage/"
+    presence: optional
     litePresence: required
     tracked: tracked
     tier: integrations
     owner: true
-    requires: [index.ts, supabase.config.ts, supabase.options.ts, supabase.decorators.ts, supabase.client.ts, supabase.jwks.ts]   # Secrets, no defaults (R44); the options and the named injector (R83); the admin client; the token verification
-    allows: [index.ts, supabase.config.ts, supabase.options.ts, supabase.decorators.ts, supabase.client.ts, supabase.jwks.ts, errors/]
+    requires: [index.ts, storage.config.ts, storage.options.ts, storage.decorators.ts, storage.client.ts]
+    allows: [index.ts, storage.config.ts, storage.options.ts, storage.decorators.ts, storage.client.ts, errors/]
     tests: unit-beside
-    rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT]
+    rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER, BE_STORAGE_OWNER]
     coverage: required
-    since: 2.1.0
+    since: 3.9.0
 
   # ----- BE: tests (owner test layout 2026-09-30). Unit specs are <name>.service.spec.ts beside their service and nothing else; everything else
   # lives under src/tests/, one folder per kind, and the folder and the file suffix always agree (a file whose suffix does
@@ -1953,15 +1981,15 @@ slots:
   - id: be.tests.world
     since: 3.1.0
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite integration proofs use the local Supabase stack and network fakes; full also boots apps and self-hosted services."
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite integration proofs use the local db service and network fakes; full also boots apps and self-hosted services."
     path: "src/tests/world/"
     presence: optional
     tracked: tracked
     tier: e2e
     lite:
       why: >-
-        the world of the optional integration specs of a lite app: global-setup.ts connects to the local Supabase CLI stack
-        (`starci supabase start`, with the migrations applied by the local stack) and starts no container, no toxiproxy and no stack of its
+        the world of the optional integration specs of a lite app: global-setup.ts connects to the local db service
+        (`npm run db:start`, with the migrations applied by `npm run db:push`) and starts no container, no toxiproxy and no stack of its
         own; use-test-world.ts exports useTestWorld({ modules: [...] }) -> world.db.<connection> (the shared EntityManager) and
         world.fake.<provider> (a network-edge fake of an external SaaS). There is no world.apps (no e2e) and no world.infra
         (no self-hosted service to cut)
@@ -2030,7 +2058,7 @@ slots:
   - id: be.tests.integration
     since: 3.1.0
     profiles: [be]
-    editionWhy: "Lite integration specs use the local Supabase CLI stack without containers or toxiproxy (ruling:R212/case-1, amended by ruling:R212/case-2 (owner:lite-production-swarm) and ruling:R212/case-4, with contracts allowed by owner:lite-contract-specs); R284 requires declared-pattern proofs there. Full additionally proves infrastructure outages through its world (R112)."
+    editionWhy: "Lite integration specs use the local db service without containers or toxiproxy (ruling:R212/case-1, amended by ruling:R212/case-2 (owner:lite-production-swarm) and ruling:R212/case-4, with contracts allowed by owner:lite-contract-specs); R284 requires declared-pattern proofs there. Full additionally proves infrastructure outages through its world (R112)."
     path: "src/tests/integration/<capability>/*.integration-spec.ts"
     presence: optional
     tracked: tracked
@@ -2039,8 +2067,8 @@ slots:
     coverage: none
     lite:
       why: >-
-        optional under lite: one capability module through useTestWorld({ modules }) against the local Supabase CLI stack
-        (`starci supabase start`), run by test:integration; no container, no toxiproxy and no outage through the world (R112 is full's)
+        optional under lite: one capability module through useTestWorld({ modules }) against the local db service
+        (`npm run db:start`), run by test:integration; no container, no toxiproxy and no outage through the world (R112 is full's)
     why: one capability module through useTestWorld({ modules }), no HTTP door of ours (SQL, transactions, concurrency, inbox claims on the real database; and every integration client, `<capability>` being its provider folder, against our real infra, a real peer app or the library fake at the network edge, with its success, its ErrorCode refusal mapping and an outage through the world, R112); run by test:integration
     rules: [BE_TEST_TOPOLOGY, BE_INTEGRATION_SPEC_MISSING]
   - id: be.tests.e2e
@@ -2053,7 +2081,7 @@ slots:
     tracked: tracked
     tier: e2e
     tests: e2e
-    goesTo: "the full edition: a lite app has no e2e world; its logic is proven by unit specs and its database by optional integration specs on `starci supabase start`"
+    goesTo: "the full edition: a lite app has no e2e world; its logic is proven by unit specs and its database by optional integration specs on `npm run db:start`"
     coverage: none
     why: flow e2e through useTestWorld({ apps }); external services are the world's network fakes; run by test:e2e
     rules: [HFS_CI_E2E_AUTOMATIC, BE_TEST_TOPOLOGY, BE_E2E_FLOW]
@@ -2112,7 +2140,7 @@ slots:
     tracked: tracked
     tier: route
     # ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4) (lite = full): routes are thin and the front end serves no API - health/live is the one
-    # route handler of this slot, the Supabase auth callback is fe.route.callback, and no file holds a Server Action
+    # route handler of this slot, the OAuth callback is a back-end door, and no file holds a Server Action
     # (FE_ROUTE_HANDLER_FORBIDDEN, FE_SERVER_ACTION_FORBIDDEN).
     allows: ["[locale]/**/{page,layout,template,loading,error,not-found,default}.tsx", "[locale]/providers.tsx",
              global-error.tsx, page.tsx,   # the root page.tsx only redirects (FE_ROUTE_FILES_THIN)
@@ -2143,20 +2171,6 @@ slots:
     tests: none
     goesTo: "apps/<app>/src/proxy.ts: Next >= 16 reads proxy.ts and refuses middleware.ts"
     rules: [FE_NEXT_CONVENTIONS]
-  - id: fe.route.callback
-    profiles: [fe]
-    # The auth callback of a Supabase session (the PKCE code exchange), kept only when the auth flow truly needs a server exchange
-    # (prefer the client-side PKCE exchange in fe.modules.auth): the one non-health route handler of an app with a Supabase
-    # connection; an app without one has no route handler in fe/ (L15).
-    path: "apps/<app>/src/app/auth/callback/route.ts"
-    presence: opt-in
-    provider: supabase
-    tracked: tracked
-    tier: route
-    tests: none
-    since: 2.1.0
-    rules: [FE_ROUTE_HANDLER_FORBIDDEN, FE_CALLBACK_SHAPE, FE_SUPABASE_CLIENT_OWNER, FE_SERVICE_ROLE_FORBIDDEN]
-
   - id: fe.feature
     since: 3.1.0
     profiles: [fe]
@@ -2488,18 +2502,17 @@ slots:
   - id: fe.modules.auth
     profiles: [fe]
     # The identity-provider client (fe-stack auth, FE-AUTH): the session, the access token the Apollo link attaches and the
-    # sign-in/sign-out calls. With a Supabase connection it is the ONLY fe importer of @supabase/supabase-js and uses its auth API
-    # only; Supabase on the front end never reads or writes data (owner ruling 2026-10-13).
+    # sign-in/sign-out calls. It talks only to the app's own back-end auth doors and holds no credential: the refresh token lives in
+    # the back end's httpOnly cookie and the access token in memory (ruling:lite-self-hosted-postgres-passport-minio).
     path: "apps/<app>/src/modules/auth/"
     presence: optional
     tracked: tracked
     tier: modules
     owner: true
     requires: [index.ts]
-    entries: [server.ts]   # the server-only PKCE exchange API used by the opted-in callback route
     tests: none
     since: 3.0.0
-    rules: [FE_SUPABASE_CLIENT_OWNER, FE_SERVICE_ROLE_FORBIDDEN]
+    rules: [FE_STACK_FORBIDDEN]
   - id: fe.modules.toast
     profiles: [fe]
     # Mutation feedback (fe-stack toast, FE-TOAST): the HeroUI toast wrapper, showGraphQLToast over a GraphQLResponse and the

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -2,27 +2,23 @@
 // against a loaded manifest remain in slots.mjs; this module mirrors modules/schemas/hfs-repo.schema.yaml only.
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { APP_KIND, connectionShapeProblems, NAME, PACKAGE_NAME, RUNTIME_KIND, SLOT_ID } from './manifest-shape.mjs';
+import { dbFunctionsOk } from './rule-params-shape.mjs';
 import { kindShapeProblems, patternShapeProblems } from './declaration-slots.mjs';
 import { byCodeUnit } from '../lib/list.mjs';
 
-/** Shape problems of the optional hfs.json `supabase` block whose auth posture DB_CONFIG_POLICY checks. */
-const isSupabaseStringList = (value) => Array.isArray(value) && value.every((entry) => typeof entry === 'string' && entry.trim());
+/** Shape problems of the optional hfs.json `db` block of a lite app: the environment variable naming its database, its image, forced RLS and its application role. */
+const isStringList = (value) => Array.isArray(value) && value.every((entry) => typeof entry === 'string' && entry.trim());
 
-function supabaseValueProblems(block) {
-  const bad = [];
-  if (block.enableSignup !== undefined && typeof block.enableSignup !== 'boolean') bad.push('supabase.enableSignup must be true or false');
-  if (block.jwtExpiry !== undefined && !(Number.isInteger(block.jwtExpiry) && block.jwtExpiry > 0 && block.jwtExpiry <= 3600)) bad.push('supabase.jwtExpiry must be an integer of seconds, 3600 at most');
-  if (block.siteUrl !== undefined && (typeof block.siteUrl !== 'string' || !block.siteUrl.trim())) bad.push('supabase.siteUrl must be a URL string');
-  for (const key of ['redirectUrls', 'forceRls']) if (block[key] !== undefined && !isSupabaseStringList(block[key])) bad.push(`supabase.${key} must be a list of strings`);
-  return bad;
-}
-
-function supabaseBlockProblems(block) {
+function dbBlockProblems(block) {
   if (block === undefined) return [];
-  if (!isPlainObject(block)) return ['supabase must be an object'];
+  if (!isPlainObject(block)) return ['db must be an object'];
   const bad = [];
-  for (const key of Object.keys(block)) if (!['enableSignup', 'jwtExpiry', 'siteUrl', 'redirectUrls', 'forceRls'].includes(key)) bad.push(`supabase has unknown key ${key}`);
-  bad.push(...supabaseValueProblems(block));
+  for (const key of Object.keys(block)) if (!['urlEnv', 'image', 'forceRls', 'forceRlsExemptions', 'appRole'].includes(key)) bad.push(`db has unknown key ${key}`);
+  if (block.urlEnv !== undefined && (typeof block.urlEnv !== 'string' || !/^[A-Z][A-Z0-9_]*$/.test(block.urlEnv))) bad.push('db.urlEnv must name an UPPER_CASE environment variable');
+  if (block.image !== undefined && (typeof block.image !== 'string' || !/@sha256:[0-9a-f]{64}$/.test(block.image))) bad.push('db.image must be a digest-pinned image reference');
+  if (block.forceRls !== undefined && !isStringList(block.forceRls)) bad.push('db.forceRls must be a list of strings');
+  if (block.appRole !== undefined && (typeof block.appRole !== 'string' || !/^[a-z][a-z0-9_]*$/.test(block.appRole))) bad.push('db.appRole must name a role');
+  if (block.forceRlsExemptions !== undefined && !Array.isArray(block.forceRlsExemptions)) bad.push('db.forceRlsExemptions must be a list of { table, reason }');
   return bad;
 }
 
@@ -95,7 +91,8 @@ function declarationSideProblems(side, value, names) {
   const bad = [];
   const at = `sides.${side}`;
   if (!isPlainObject(value)) return [`${at} must be an object`];
-  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing', 'queueOutbox'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing', 'queueOutbox', 'dbFunctions'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  if (value.dbFunctions !== undefined && (side !== 'be' || !dbFunctionsOk(value.dbFunctions))) bad.push(`${at}.dbFunctions belongs to the be side and lists {name, reason} database functions with unique names`);
   bad.push(...appShapeProblems(value.apps, at, side, names));
   if (isBadUniqueList(value.optionalSlots, (slot) => SLOT_ID.test(String(slot)))) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
   if (value.backing !== undefined && side !== 'be') bad.push('backing belongs to the be side');
@@ -127,13 +124,13 @@ function observeBlockProblems(observe) {
   return bad;
 }
 
-const DECLARATION_KEYS = new Set(['hfs', 'kind', 'project', 'edition', 'supabase', 'sides', 'browser', 'lexicon', 'observe']);
+const DECLARATION_KEYS = new Set(['hfs', 'kind', 'project', 'edition', 'db', 'sides', 'browser', 'lexicon', 'observe']);
 const RUNTIME_DECLARATION_KEYS = new Set(['hfs', 'kind', 'project']);
 
 function productDeclarationProblems(declaration, profiles) {
   const bad = [];
   for (const key of Object.keys(declaration)) if (!DECLARATION_KEYS.has(key)) bad.push(`unknown key ${key}`);
-  bad.push(...supabaseBlockProblems(declaration.supabase), ...lexiconBlockProblems(declaration.lexicon), ...observeBlockProblems(declaration.observe));
+  bad.push(...dbBlockProblems(declaration.db), ...lexiconBlockProblems(declaration.lexicon), ...observeBlockProblems(declaration.observe));
   if (declaration.browser !== undefined && declaration.browser !== true) bad.push('browser is `true` when the app has a browser journey (slot app.browser), and is left out otherwise');
   if (declaration.kind !== APP_KIND) bad.push(`kind must be ${APP_KIND} (a product is one app repository with a be and an fe side) or ${RUNTIME_KIND} (the StarCi runtime repository)`);
   if (!isPlainObject(declaration.sides) || Object.keys(declaration.sides).sort(byCodeUnit).join() !== profiles.join()) { bad.push('sides must declare exactly be and fe'); return bad; }

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -15,12 +15,12 @@ const ENV_PREFIX =/^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$/;
 const CONTEXT_ISOLATIONS = Object.freeze(["database", "schema"]);
 /** The app kinds that may own a context: the services, never the migrate or cli apps that only run migrations. */
 const CONTEXT_OWNER_KINDS = Object.freeze(["api", "worker"]);
-/** The database engines a connection may run on: a self-described Postgres, or the Postgres of a Supabase project. */
-const CONNECTION_PROVIDERS = Object.freeze(["postgres", "supabase"]);
+/** The database engine a connection runs on. */
+const CONNECTION_PROVIDERS = Object.freeze(["postgres"]);
 /** The editions an app repository may declare in hfs.json (`full` when absent): the filter slots.mjs applies. */
 export const EDITIONS = Object.freeze(["full", "lite"]);
-/** What decides where schema changes live (ruleParams.<side>.schemaAuthority): TypeORM migrations under persistence/, or the Supabase migration tree. */
-export const SCHEMA_AUTHORITIES = Object.freeze(["typeorm", "supabase"]);
+/** What decides where schema changes live (ruleParams.<side>.schemaAuthority): TypeORM migrations under persistence/, or the SQL migration tree db/migrations. */
+export const SCHEMA_AUTHORITIES = Object.freeze(["typeorm", "sql"]);
 /**
  * The shape problems of the `connections` of one side: a list of {name, envPrefix, owner, isolation}, the owner an api or worker app
  * of the same side (a connection is a bounded context and one service owns it), isolation `database` or `schema`.
@@ -87,7 +87,9 @@ export const MANIFEST_KINDS = [APP_KIND, RUNTIME_KIND];
 export const manifestKind = (m) => (isPlainObject(m) && m.kind !== undefined ? m.kind : APP_KIND);
 const strList = (v) => stringList(v);
 
-const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'editionWhy', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'templateNa', 'exemplifiedBy'];
+const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'editionWhy', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'templateNa', 'exemplifiedBy', 'role', 'importedBy'];
+/** The roles a file slot may play that a rule reads (`role`): the entity registry of persistence.md BE-PERSISTENCE-3 (architecture/entity-registry.mjs). */
+const SLOT_ROLES = ['entity-registry'];
 /** The fields a slot's `lite` overlay may hold: the same keys it would carry in the slot body, resolved under edition lite. */
 const LITE_OVERLAY_KEYS = ['path', 'requires', 'allows', 'forbids', 'minInstances', 'requiredInstances', 'why'];
 /** A runtime slot has no app kind, side composition, layer or managed template; it may name the generator of a generated copy. */
@@ -249,6 +251,8 @@ function slotEntryProblems(slot, at) {
     else if (Array.isArray(slot.allows) && slot.entries.some((entry) => !slot.allows.includes(entry))) bad.push(`${at}: every entry must be one of the names the slot allows`);
   }
   if (slot.outcomeHome !== undefined && !(slot.outcomeHome === true && typeof slot.path === 'string' && slot.path && !slot.path.endsWith('/'))) bad.push(`${at}: outcomeHome is true and belongs to a file slot (the one file that declares the repository's Outcome union)`);
+  if (slot.role !== undefined && !(SLOT_ROLES.includes(slot.role) && typeof slot.path === 'string' && slot.path && !slot.path.endsWith('/'))) bad.push(`${at}: role is one of ${SLOT_ROLES.join(', ')} and belongs to a file slot`);
+  if (slot.importedBy !== undefined && !(slot.role !== undefined && strList(slot.importedBy) && slot.importedBy.length && new Set(slot.importedBy).size === slot.importedBy.length && slot.importedBy.every(relPath))) bad.push(`${at}: importedBy is a non-empty list of unique relative path patterns of the only files that import the slot's file by deep path, on a slot with a role`);
   return bad;
 }
 

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -62,6 +62,9 @@ function beSpecificProblems(be, manifest) {
   return bad;
 }
 
+/** True for an absent list or a list of {name, reason} database functions, names unique. */
+export const dbFunctionsOk = (list) => list === undefined || (Array.isArray(list) && list.every((entry) => isPlainObject(entry) && Object.keys(entry).sort().join() === 'name,reason' && /^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)?$/.test(entry.name) && typeof entry.reason === 'string' && entry.reason.trim().length > 0) && new Set(list.map((entry) => entry.name)).size === list.length);
+
 /** The shape problems of `m.ruleParams`. */
 export function ruleParamsProblems(m) {
   const bad = [];
@@ -71,7 +74,7 @@ export function ruleParamsProblems(m) {
     // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
     // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
     if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite', 'dbFunctions']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !dbFunctionsOk(rp.be.dbFunctions) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority', 'dbFunctions'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + '), dbFunctions ([{name, reason}]) and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
     bad.push(...beSpecificProblems(rp.be, m));
     if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
     if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names) and queueOutbox ({table: <schema>.<table>, columns: [unique column names including queue]})');

package/runtime/scripts/hfs/slot-app-view.mjs

@@ -49,7 +49,7 @@ function sideCrossing(repo, fromSide, toSide, toPath) {
 function importAllowedApp({ repo, root, sides }, fromPath, toPath) {
   const from = splitSide(fromPath);
   const to = splitSide(toPath);
-  // A side file may read an app-root path (supabase/types/) only through a declared read, exactly as it reads the other side.
+  // A side file may read an app-root path (db/types/) only through a declared read, exactly as it reads the other side.
   if (from && from.side !== to?.side) return sideCrossing(repo, from.side, to?.side ?? null, toPath);
   if (from && to) return sides[from.side].importAllowed(from.rest, to.rest);
   return root.importAllowed(fromPath, toPath);

package/runtime/scripts/hfs/slots.mjs

@@ -120,6 +120,7 @@ function sideDeclaration(manifest, declaration, name, edition, providers) {
     connections: Object.freeze((s.connections ?? []).map(connectionView)),
     providers,
     reads: Object.freeze([...(s.reads ?? [])]),
+    dbFunctions: Object.freeze((s.dbFunctions ?? []).map((entry) => Object.freeze({ ...entry }))),
     ...(s.grammar === undefined ? {} : { grammar: s.grammar }),
     ...(s.extraPackages === undefined ? {} : { extraPackages: Object.freeze(s.extraPackages.map(entry => Object.freeze({ ...entry }))) }),
     manifestVersion: manifest.version,
@@ -221,7 +222,8 @@ function createScopeResolver(manifest, repo) {
     trackingOf,
     /** True only for a path a slot owns and requires to be committed. */
     isTracked: (p) => trackingOf(p) === 'tracked',
-    ruleParams: () => ruleParams(manifest, profile, edition),
+    // The app's own database functions (hfs.json sides.be.dbFunctions) join the canon's list (R334).
+    ruleParams: () => withDeclaredDbFunctions(ruleParams(manifest, profile, edition), repo.dbFunctions),
     allowedImports: (tier) => manifest.tiers[profile]?.[tier]?.mayImport ?? null,
   });
 }
@@ -235,13 +237,17 @@ function createScopeResolver(manifest, repo) {
  */
 export function createSlotResolver(manifest, repo) {
   if (repo.profile !== APP_SCOPE) return createScopeResolver(manifest, repo);
-  // The root declares no connection of its own, yet a provider slot of the app profile (app.supabase*) is enabled by a
+  // The root declares no connection of its own, yet a provider slot of the app profile is enabled by a
   // side's connection with that provider: the root scope reads the union of the sides' connections.
   const root = createScopeResolver(manifest, { ...repo, connections: SIDES.flatMap((side) => repo.sides[side].connections) });
   const sides = Object.fromEntries(PROFILES.map((side) => [side, createScopeResolver(manifest, repo.sides[side])]));
   return appResolver(repo, root, sides);
 }
 
+/** The rule parameters with the app's declared database functions appended to `dbFunctions` (be only), frozen. */
+const withDeclaredDbFunctions = (params, declared = []) => (params.dbFunctions === undefined && !declared.length ? params
+  : Object.freeze({ ...params, dbFunctions: Object.freeze([...(params.dbFunctions ?? []), ...declared]) }));
+
 /** The rule parameters of one profile (be: infraOwners, suffixes, bannedSuffixes and the rest over the shared ruleParams.common fileLines and duplicateBlock; fe: common alone or with its overrides; runtime: ruleParams.runtime of a runtime manifest), as a frozen deep copy. Under `edition` lite the `lite` overrides of ruleParams.<profile> merge over the base (the `lite` key itself is never returned). */
 export function ruleParams(manifest, profile, edition = 'full') {
   const profiles = manifestKind(manifest) === RUNTIME_KIND ? [RUNTIME_KIND] : PROFILES;