@starci/hfs 4.0.7 → 4.0.9

package/templates/be/skeleton-lite/src/modules/domain/identity/auth.guard.ts

@@ -0,0 +1,50 @@
+import { Injectable } from "@nestjs/common"
+import type { CanActivate, ExecutionContext } from "@nestjs/common"
+import type { Reflector } from "@nestjs/core"
+import { InjectSupabaseAccessTokenVerifier } from "@modules/integrations/supabase"
+import type { VerifySupabaseAccessToken } from "@modules/integrations/supabase"
+import { InjectReflector } from "@modules/platform/composition"
+import type { Principal } from "@modules/platform/cqrs"
+import { requestOf } from "@modules/platform/http-security"
+import { unwrapOutcome } from "@modules/platform/primitives"
+import { admit } from "./admission.policy"
+import { IdentityError } from "./errors/identity.error"
+import type { PublicMetadata } from "./identity.contracts"
+import { PUBLIC_KEY } from "./identity.decorators"
+
+const bearerToken = (authorization: string | undefined): string | undefined => {
+    const [scheme, token, extra] = authorization?.split(" ") ?? []
+    return scheme?.toLowerCase() === "bearer" && token && extra === undefined ? token : undefined
+}
+
+@Injectable()
+/** The third app guard and default-deny gate: non-public doors require a verified Supabase principal. */
+export class AuthGuard implements CanActivate {
+    constructor(
+        @InjectReflector() private readonly reflector: Reflector,
+        @InjectSupabaseAccessTokenVerifier()
+        private readonly verifyAccessToken: VerifySupabaseAccessToken,
+    ) {}
+
+    /** Verifies the bearer token when the door is not public, then applies the admission policy. */
+    async canActivate(context: ExecutionContext): Promise<boolean> {
+        const metadata = this.reflector.getAllAndOverride<PublicMetadata | undefined>(PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ])
+        let principal: Principal | undefined
+        if (metadata === undefined) {
+            const request = requestOf(context)
+            const token = bearerToken(request.headers.authorization)
+            if (token !== undefined) {
+                const verified = await this.verifyAccessToken(token)
+                if (verified.kind === "ok") {
+                    principal = verified.value
+                    request.principal = verified.value
+                }
+            }
+        }
+        unwrapOutcome(admit(metadata, principal), IdentityError)
+        return true
+    }
+}

package/templates/be/skeleton-lite/src/modules/domain/identity/identity.contracts.ts

@@ -0,0 +1,26 @@
+import type { Principal } from "@modules/platform/cqrs"
+
+declare module "express-serve-static-core" {
+    /** The request carries the principal established by the default-deny auth guard. */
+    interface Request {
+        /** The authenticated Supabase caller, when the door is not public. */
+        principal?: Principal
+    }
+}
+
+/** Why a door is open to anonymous callers; the vocabulary is closed. */
+export enum PublicReason {
+    /** Liveness and readiness probes. */
+    Health = "health",
+    /** A webhook whose signature is verified before its domain intake runs. */
+    SignedWebhook = "signed-webhook",
+}
+
+/** The metadata `@Public` attaches to a door. */
+export interface PublicMetadata {
+    /** Why the door is anonymous. */
+    readonly reason: PublicReason
+}
+
+/** What identity admission returns to the guard. */
+export type IdentityAdmission = Principal | PublicReason

package/templates/be/skeleton-lite/src/modules/domain/identity/identity.decorators.ts

@@ -0,0 +1,19 @@
+import { SetMetadata, createParamDecorator } from "@nestjs/common"
+import type { ExecutionContext } from "@nestjs/common"
+import { requestOf } from "@modules/platform/http-security"
+import type { Principal } from "@modules/platform/cqrs"
+import { IdentityError, IdentityErrorCode } from "./errors/identity.error"
+import type { PublicMetadata } from "./identity.contracts"
+
+/** Metadata key of `@Public`. */
+export const PUBLIC_KEY = "domain.identity.public"
+
+/** Opens a door to anonymous callers, stating why; every other door needs a verified Supabase session. */
+export const Public = (metadata: PublicMetadata): ReturnType<typeof SetMetadata> => SetMetadata(PUBLIC_KEY, metadata)
+
+/** The authenticated Supabase caller established by the default-deny guard. */
+export const CurrentPrincipal = createParamDecorator((_data: unknown, context: ExecutionContext): Principal => {
+    const principal = requestOf(context).principal
+    if (!principal) throw new IdentityError({ code: IdentityErrorCode.Unauthenticated })
+    return principal
+})

package/templates/be/skeleton-lite/src/modules/domain/identity/identity.module.ts

@@ -0,0 +1,26 @@
+import { Module } from "@nestjs/common"
+import type { DynamicModule } from "@nestjs/common"
+import { SUPABASE_ACCESS_TOKEN_VERIFIER } from "@modules/integrations/supabase"
+import { AuthGuard } from "./auth.guard"
+import { ConfigurableModuleClass, OPTIONS_TYPE } from "./identity.module-definition"
+
+@Module({})
+/** The identity capability: its default-deny guard admits only public doors or a verified Supabase principal. */
+export class IdentityModule extends ConfigurableModuleClass {
+    /** Registers identity once per app with the verifier parsed at the composition root. */
+    static register(options: typeof OPTIONS_TYPE): DynamicModule {
+        const base = super.register(options)
+        return {
+            ...base,
+            providers: [
+                ...(base.providers ?? []),
+                {
+                    provide: SUPABASE_ACCESS_TOKEN_VERIFIER,
+                    useValue: options.verifyAccessToken,
+                },
+                AuthGuard,
+            ],
+            exports: [AuthGuard],
+        }
+    }
+}

package/templates/be/skeleton-lite/src/modules/domain/identity/identity.options.ts

@@ -0,0 +1,7 @@
+import type { VerifySupabaseAccessToken } from "@modules/integrations/supabase"
+
+/** The verified identity source used by the default-deny guard. */
+export interface IdentityOptions {
+    /** Cryptographically verifies a Supabase access token before it can become a principal. */
+    readonly verifyAccessToken: VerifySupabaseAccessToken
+}

package/templates/be/skeleton-lite/src/modules/domain/identity/index.ts

@@ -0,0 +1,6 @@
+export { AuthGuard } from "./auth.guard"
+export { IDENTITY_ERROR_KINDS } from "./errors/identity.error"
+export { IDENTITY_MESSAGES } from "./messages/identity.messages"
+export { PublicReason } from "./identity.contracts"
+export { Public } from "./identity.decorators"
+export { IdentityModule } from "./identity.module"

package/templates/be/skeleton-lite/src/modules/integrations/supabase/errors/supabase.error.ts

@@ -0,0 +1,19 @@
+import { DomainError } from "@modules/platform/errors"
+import type { ErrorKind } from "@modules/platform/errors"
+
+/** Codes of the Supabase integration. */
+export enum SupabaseErrorCode {
+    /** The access token failed signature or required-claim verification. */
+    AccessTokenInvalid = "SUPABASE_ACCESS_TOKEN_INVALID",
+    /** A privileged Auth or Storage operation could not reach Supabase. */
+    ProviderUnavailable = "SUPABASE_PROVIDER_UNAVAILABLE",
+}
+
+/** How each Supabase integration code travels. */
+export const SUPABASE_ERROR_KINDS: Record<SupabaseErrorCode, ErrorKind> = {
+    [SupabaseErrorCode.AccessTokenInvalid]: "unauthenticated",
+    [SupabaseErrorCode.ProviderUnavailable]: "unavailable",
+}
+
+/** The one error class of the Supabase integration. */
+export class SupabaseError extends DomainError<SupabaseErrorCode> {}

package/templates/be/skeleton-lite/src/modules/integrations/supabase/index.ts

@@ -0,0 +1,10 @@
+export { createSupabaseAdminClient } from "./supabase.client"
+export { parseSupabaseConfig } from "./supabase.config"
+export {
+    InjectSupabaseAccessTokenVerifier,
+    SUPABASE_ACCESS_TOKEN_VERIFIER,
+    SUPABASE_ADMIN_CLIENT,
+} from "./supabase.decorators"
+export { SUPABASE_ERROR_KINDS } from "./errors/supabase.error"
+export { createSupabaseAccessTokenVerifier } from "./supabase.jwks"
+export type { SupabaseOptions, VerifySupabaseAccessToken } from "./supabase.options"

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.client.ts

@@ -0,0 +1,24 @@
+import { createClient } from "@supabase/supabase-js"
+import type { SupabaseClient } from "@supabase/supabase-js"
+import type { Database } from "../../../../../supabase/types/database.types"
+import type { SupabaseOptions } from "./supabase.options"
+
+/** The privileged surface exposed by this integration: Auth administration and Storage, never database queries. */
+export interface SupabaseAdminClient {
+    /** Supabase Auth administration. */
+    readonly auth: SupabaseClient<Database>["auth"]["admin"]
+    /** Supabase Storage administration. */
+    readonly storage: SupabaseClient<Database>["storage"]
+}
+
+/** Creates the back-end-only client and narrows it to Auth and Storage administration. */
+export const createSupabaseAdminClient = (options: SupabaseOptions): SupabaseAdminClient => {
+    const client: SupabaseClient<Database> = createClient<Database>(options.url, options.serviceRoleKey.reveal(), {
+        auth: {
+            autoRefreshToken: false,
+            detectSessionInUrl: false,
+            persistSession: false,
+        },
+    })
+    return { auth: client.auth.admin, storage: client.storage }
+}

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.config.ts

@@ -0,0 +1,8 @@
+import type { EnvSource } from "@modules/platform/config"
+import type { SupabaseOptions } from "./supabase.options"
+
+/** Reads Supabase configuration with no credential or localhost defaults. */
+export const parseSupabaseConfig = (env: EnvSource): SupabaseOptions => ({
+    url: env.url("SUPABASE_URL"),
+    serviceRoleKey: env.secret("SUPABASE_SERVICE_ROLE_KEY"),
+})

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.decorators.ts

@@ -0,0 +1,17 @@
+import { injector } from "@modules/platform/composition"
+import type { TypedParameterDecorator } from "@modules/platform/composition"
+import type { SupabaseAdminClient } from "./supabase.client"
+import type { VerifySupabaseAccessToken } from "./supabase.options"
+
+/** Token of the integration's Auth and Storage administrator. */
+export const SUPABASE_ADMIN_CLIENT: unique symbol = Symbol("integrations.supabase.admin-client")
+/** Token of the cryptographic Supabase access-token verifier. */
+export const SUPABASE_ACCESS_TOKEN_VERIFIER: unique symbol = Symbol("integrations.supabase.access-token-verifier")
+
+/** Injects the Auth and Storage administrator. Parameter type: SupabaseAdminClient. */
+export const InjectSupabaseAdminClient = (): TypedParameterDecorator<SupabaseAdminClient> =>
+    injector<SupabaseAdminClient>(SUPABASE_ADMIN_CLIENT)
+
+/** Injects the access-token verifier. Parameter type: VerifySupabaseAccessToken. */
+export const InjectSupabaseAccessTokenVerifier = (): TypedParameterDecorator<VerifySupabaseAccessToken> =>
+    injector<VerifySupabaseAccessToken>(SUPABASE_ACCESS_TOKEN_VERIFIER)

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.jwks.ts

@@ -0,0 +1,32 @@
+import { createRemoteJWKSet, jwtVerify } from "jose"
+import { ok, refused } from "@modules/platform/primitives"
+import { SupabaseErrorCode } from "./errors/supabase.error"
+import type { SupabaseOptions, SupabasePrincipal, VerifySupabaseAccessToken } from "./supabase.options"
+
+const AUDIENCE = "authenticated"
+
+/** Creates the verifier for this project's remote JWKS, exact issuer, authenticated audience and pinned algorithm. */
+export const createSupabaseAccessTokenVerifier = (options: SupabaseOptions): VerifySupabaseAccessToken => {
+    const issuer = `${options.url.replace(/\/$/, "")}/auth/v1`
+    const keys = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`))
+    return async (token) => {
+        try {
+            const { payload } = await jwtVerify(token, keys, {
+                algorithms: ["ES256"],
+                audience: AUDIENCE,
+                issuer,
+            })
+            if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.role !== AUDIENCE) {
+                return refused(SupabaseErrorCode.AccessTokenInvalid)
+            }
+            const principal: SupabasePrincipal = {
+                id: payload.sub,
+                role: AUDIENCE,
+                ...(typeof payload.email === "string" ? { email: payload.email } : {}),
+            }
+            return ok(principal)
+        } catch (cause) {
+            return refused(SupabaseErrorCode.AccessTokenInvalid, { cause: String(cause) })
+        }
+    }
+}

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.options.ts

@@ -0,0 +1,24 @@
+import type { Secret } from "@modules/platform/config"
+import type { Outcome } from "@modules/platform/primitives"
+import type { SupabaseErrorCode } from "./errors/supabase.error"
+
+/** The verified identity claims admitted from a Supabase access token. */
+export interface SupabasePrincipal {
+    /** The Auth user identifier from the verified `sub` claim. */
+    readonly id: string
+    /** The verified email claim when the provider issued one. */
+    readonly email?: string
+    /** Supabase's authenticated role, required by the verifier. */
+    readonly role: "authenticated"
+}
+
+/** Verifies one bearer token and returns only claims that passed every cryptographic and semantic check. */
+export type VerifySupabaseAccessToken = (token: string) => Promise<Outcome<SupabasePrincipal, SupabaseErrorCode>>
+
+/** Supabase configuration parsed once at API boot. */
+export interface SupabaseOptions {
+    /** The project origin, used for Auth, Storage, issuer and JWKS endpoints. */
+    readonly url: string
+    /** The service-role credential, held only by the back-end integration. */
+    readonly serviceRoleKey: Secret
+}

package/templates/be/skeleton-lite/src/modules/platform/cqrs/index.ts

@@ -0,0 +1,4 @@
+export type { Principal, PublicExecuteParams } from "./cqrs.contracts"
+export { InjectQueryBus } from "./cqrs.decorators"
+export { ICQRSHandler } from "./cqrs.handler"
+export { CqrsModule } from "./cqrs.module"

package/templates/be/skeleton-lite/src/modules/platform/database/database.module.ts

@@ -0,0 +1,54 @@
+import { Module } from "@nestjs/common"
+import type { DynamicModule } from "@nestjs/common"
+import { TypeOrmModule, getDataSourceToken } from "@nestjs/typeorm"
+import type { DataSource } from "typeorm"
+import { DATABASE_OPTIONS } from "./database.port"
+import { ConfigurableModuleClass, OPTIONS_TYPE } from "./database.module-definition"
+import { PRIMARY_CONNECTION } from "./primary.connection"
+import { PRIMARY_ENTITY_MANAGER } from "./primary.decorators"
+
+/** The token each declared connection provides its shared EntityManager under. */
+type EntityManagerToken = typeof PRIMARY_ENTITY_MANAGER
+
+const ENTITY_MANAGER_TOKENS: ReadonlyMap<string, EntityManagerToken> = new Map<string, EntityManagerToken>([
+    [PRIMARY_CONNECTION, PRIMARY_ENTITY_MANAGER],
+])
+
+@Module({})
+/** Opens each named Supabase PostgreSQL connection and exposes its shared EntityManager without entities or migrations. */
+export class DatabaseModule extends ConfigurableModuleClass {
+    /** Registers the capability once per app with the connections it opens. */
+    static register(options: typeof OPTIONS_TYPE): DynamicModule {
+        const base = super.register(options)
+        const managers = options.connections.flatMap((connection) => {
+            const token = ENTITY_MANAGER_TOKENS.get(connection.name)
+            return token === undefined
+                ? []
+                : [
+                      {
+                          provide: token,
+                          inject: [getDataSourceToken(connection.name)],
+                          useFactory: (source: DataSource) => source.manager,
+                      },
+                  ]
+        })
+        return {
+            ...base,
+            imports: [
+                ...(base.imports ?? []),
+                ...options.connections.map((connection) =>
+                    TypeOrmModule.forRoot({
+                        name: connection.name,
+                        type: "postgres",
+                        url: connection.url.reveal(),
+                        schema: connection.schema,
+                        synchronize: false,
+                        retryAttempts: 2,
+                    }),
+                ),
+            ],
+            providers: [...(base.providers ?? []), ...managers],
+            exports: [DATABASE_OPTIONS, ...managers.map((manager) => manager.provide)],
+        }
+    }
+}

package/templates/be/skeleton-lite/src/modules/platform/database/database.options.ts

@@ -0,0 +1,23 @@
+import type { Secret } from "@modules/platform/config"
+
+/** What the primary connection parser reads from the environment. */
+export interface DatabaseConnectionConfig {
+    /** The logical connection name declared in `hfs.json`. */
+    readonly name: string
+    /** The Supabase PostgreSQL provider; schema changes remain under `supabase/migrations`. */
+    readonly provider: "supabase"
+    /** The dedicated least-privilege application role's connection URL. */
+    readonly url: Secret
+}
+
+/** Runtime connection options add only the isolated PostgreSQL schema; lite has no entity or migration registry. */
+export interface DatabaseConnectionOptions extends DatabaseConnectionConfig {
+    /** The schema named by the `hfs.json` isolation contract. */
+    readonly schema?: string
+}
+
+/** Options of the database capability. */
+export interface DatabaseOptions {
+    /** The connections this app opens; one per physical database. */
+    readonly connections: ReadonlyArray<DatabaseConnectionOptions>
+}

package/templates/be/skeleton-lite/src/modules/platform/database/database.port.ts

@@ -0,0 +1,10 @@
+import { injector } from "@modules/platform/composition"
+import type { TypedParameterDecorator } from "@modules/platform/composition"
+import type { DatabaseOptions } from "./database.options"
+
+/** Token of the options of the database capability. */
+export const DATABASE_OPTIONS: unique symbol = Symbol("platform.database.options")
+
+/** Injects the options of the database capability. Parameter type: DatabaseOptions. */
+export const InjectDatabaseOptions = (): TypedParameterDecorator<DatabaseOptions> =>
+    injector<DatabaseOptions>(DATABASE_OPTIONS)

package/templates/be/skeleton-lite/src/modules/platform/database/database.sql.ts

@@ -0,0 +1,49 @@
+import type { EntityManager } from "typeorm"
+import { DatabaseError, DatabaseErrorCode } from "./errors/database.error"
+
+declare const sqlTextBrand: unique symbol
+declare const sqlIdentBrand: unique symbol
+
+/** SQL text built by the `sql` tag: the only kind of string `EntityManager.query` accepts. */
+export type SqlText = string & { readonly [sqlTextBrand]: true }
+
+/** A checked identifier: the only value a `sql` tag substitution accepts. */
+export type SqlIdent = string & { readonly [sqlIdentBrand]: true }
+
+/** The biggest page a client can ask for. */
+export const PAGE_SIZE_MAX = 100
+/** The biggest number of rows a server-side list read returns. */
+export const LIST_ROWS_MAX = 500
+/** The size of the keyset batches a background scan reads. */
+export const BATCH_ROWS = 500
+
+const IDENT_PATTERN = /^[a-z_][a-z0-9_]*$/
+
+function assertSqlText(_value: string): asserts _value is SqlText {
+    // The brand is compile-time only; the `sql` tag is its single caller.
+}
+
+function assertSqlIdent(_value: string): asserts _value is SqlIdent {
+    // The brand is compile-time only; `ident` is the single caller after checking the name.
+}
+
+/** Builds SQL text whose only substitutions are already checked identifiers. */
+{{> be/common/sql-tag.ts.partial}}
+
+/** Checks a dynamic identifier against the names the caller allows and brands it. */
+{{> be/common/sql-ident.ts.partial}}
+
+type NotFoundFactory = () => never
+
+/** Requires the row selected by an id-and-owner statement and lets the capability own its typed not-found error. */
+export const requireOwnedRow = async <T>(
+    entityManager: EntityManager,
+    statement: SqlText,
+    id: string,
+    ownerId: string,
+    notFound: NotFoundFactory,
+): Promise<T> => {
+    const row = (await entityManager.query<Array<T>>(statement, [id, ownerId]))[0]
+    if (row === undefined) return notFound()
+    return row
+}

package/templates/be/skeleton-lite/src/modules/platform/database/index.ts

@@ -0,0 +1,4 @@
+export { DatabaseModule } from "./database.module"
+export type { DatabaseConnectionOptions } from "./database.options"
+export { DATABASE_ERROR_KINDS } from "./errors/database.error"
+export { parsePrimaryDatabaseConfig } from "./primary.config"

package/templates/be/skeleton-lite/src/modules/platform/database/migration-runner.service.ts

@@ -0,0 +1,21 @@
+import { spawn } from "node:child_process"
+import { Injectable } from "@nestjs/common"
+
+const runDbPush = (): Promise<void> =>
+    new Promise((resolve, reject) => {
+        const command = process.platform === "win32" ? "npm.cmd" : "npm"
+        const child = spawn(command, ["run", "db:push"], { stdio: "inherit" })
+        child.once("error", reject)
+        child.once("exit", (code) =>
+            code === 0 ? resolve() : reject(new Error(`db:push exited ${code ?? "without a status"}`)),
+        )
+    })
+
+@Injectable()
+/** The lite migration runner delegates the Supabase schema authority to the managed db:push wrapper. */
+export class MigrationRunnerService {
+    /** Runs the managed wrapper and propagates a CLI or migration failure. */
+    async run(): Promise<void> {
+        await runDbPush()
+    }
+}

package/templates/be/skeleton-lite/src/modules/platform/database/primary.config.ts

@@ -0,0 +1,11 @@
+import type { EnvSource } from "@modules/platform/config"
+import type { DatabaseConnectionOptions } from "./database.options"
+import { PRIMARY_CONNECTION } from "./primary.connection"
+
+/** Reads the least-privilege Supabase PostgreSQL connection with no default. */
+export const parsePrimaryDatabaseConfig = (env: EnvSource): DatabaseConnectionOptions => ({
+    name: PRIMARY_CONNECTION,
+    provider: "supabase",
+    url: env.secret("PRIMARY_DB_URL"),
+    schema: env.string("PRIMARY_DB_SCHEMA"),
+})

package/templates/be/skeleton-lite/src/modules/platform/database/seed-runner.service.ts

@@ -0,0 +1,28 @@
+import { readFile } from "node:fs/promises"
+import { Injectable } from "@nestjs/common"
+import type { EntityManager } from "typeorm"
+import type { SqlText } from "./database.sql"
+import { InjectPrimaryEntityManager } from "./primary.decorators"
+
+const SEED_FILE = "supabase/seed.sql"
+
+function assertSeedText(_text: string): asserts _text is SqlText {
+    // The brand is compile-time only; this function's caller reads the tracked seed file verbatim.
+}
+
+const seedText = (text: string): SqlText => {
+    assertSeedText(text)
+    return text
+}
+
+@Injectable()
+/** Executes the one tracked Supabase seed through the shared least-privilege EntityManager. */
+export class SeedRunnerService {
+    constructor(@InjectPrimaryEntityManager() private readonly entityManager: EntityManager) {}
+
+    /** Reads and executes the tracked seed when it contains at least one statement. */
+    async run(): Promise<void> {
+        const text = seedText(await readFile(SEED_FILE, "utf8"))
+        if (text.trim() !== "") await this.entityManager.query(text)
+    }
+}

package/templates/be/skeleton-lite/src/modules/platform/http-security/http-security.module.ts

@@ -0,0 +1,25 @@
+import { Module } from "@nestjs/common"
+import type { DynamicModule } from "@nestjs/common"
+import { WEBHOOK_SIGNATURE } from "./http-security.decorators"
+import { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } from "./http-security.module-definition"
+import { RequestValidationService } from "./request-validation.service"
+import { WebhookSignatureService } from "./webhook-signature.service"
+
+@Module({})
+/** The http-security capability: the options its guards (registered by each api app) read. */
+export class HttpSecurityModule extends ConfigurableModuleClass {
+    /** Registers the capability once per app. */
+    static register(options: typeof OPTIONS_TYPE): DynamicModule {
+        const base = super.register(options)
+        return {
+            ...base,
+            providers: [
+                ...(base.providers ?? []),
+                RequestValidationService,
+                WebhookSignatureService,
+                { provide: WEBHOOK_SIGNATURE, useExisting: WebhookSignatureService },
+            ],
+            exports: [MODULE_OPTIONS_TOKEN, RequestValidationService, WebhookSignatureService, WEBHOOK_SIGNATURE],
+        }
+    }
+}

package/templates/be/skeleton-lite/src/modules/platform/http-security/index.ts

@@ -0,0 +1,9 @@
+export { HTTP_SECURITY_ERROR_KINDS } from "./errors/http-security.error"
+export { requestOf } from "./execution-request.mapper"
+export { parseHttpSecurityConfig } from "./http-security.config"
+export { HttpSecurityModule } from "./http-security.module"
+export type { HttpSecurityOptions } from "./http-security.options"
+export { HTTP_SECURITY_MESSAGES } from "./messages/http-security.messages"
+export { OriginGuard } from "./origin.guard"
+export { RateLimitGuard } from "./rate-limit.guard"
+export { RequestValidationService } from "./request-validation.service"

package/templates/be/skeleton-lite/src/modules/platform/i18n/index.ts

@@ -0,0 +1,4 @@
+export type { Locale, MessageBundle } from "./i18n.contracts"
+export { InjectMessageCatalog, InjectRequestLocale } from "./i18n.decorators"
+export { I18nModule } from "./i18n.module"
+export type { MessageCatalog, RequestLocale } from "./i18n.port"

package/templates/be/skeleton-lite/src/modules/platform/logging/index.ts

@@ -0,0 +1,5 @@
+export { createJsonLogger } from "./json-logger.service"
+export { InjectLogger } from "./logging.decorators"
+export { LoggingLogEvent } from "./logging.log-events"
+export { LoggingModule } from "./logging.module"
+export type { Logger } from "./logging.port"

package/templates/be/table/error.ts.tpl

@@ -0,0 +1,16 @@
+import { DomainError } from "@modules/platform/errors"
+import type { ErrorKind } from "@modules/platform/errors"
+
+/** Codes of the {{name}} capability. */
+export enum {{Name}}ErrorCode {
+    /** No row owned by the authenticated principal has the requested id. */
+    NotFound = "{{upper}}_NOT_FOUND",
+}
+
+/** How each {{name}} code travels. */
+export const {{upper}}_ERROR_KINDS: Record<{{Name}}ErrorCode, ErrorKind> = {
+    [{{Name}}ErrorCode.NotFound]: "not-found",
+}
+
+/** The one error class of the {{name}} capability. */
+export class {{Name}}Error extends DomainError<{{Name}}ErrorCode> {}

package/templates/be/table/index.ts.tpl

@@ -0,0 +1,2 @@
+export { {{upper}}_ERROR_KINDS } from "./errors/{{name}}.error"
+export { {{Name}}Module } from "./{{name}}.module"

package/templates/be/table/migration.sql.tpl

@@ -0,0 +1,51 @@
+create table public.{{tableSql}} (
+    id uuid primary key default gen_random_uuid(),
+    owner_id uuid not null references auth.users (id) on delete cascade,
+    created_at timestamptz not null default now(),
+    updated_at timestamptz not null default now()
+);
+
+create index {{table}}_owner_id_idx on public.{{tableSql}} (owner_id);
+
+alter table public.{{tableSql}} enable row level security;
+
+create trigger {{table}}_set_updated_at
+before update on public.{{tableSql}}
+for each row
+execute function private.set_updated_at();
+
+create policy "{{table}}_authenticated_select"
+on public.{{tableSql}}
+for select
+to authenticated
+using (owner_id = (select auth.uid()));
+
+create policy "{{table}}_authenticated_insert"
+on public.{{tableSql}}
+for insert
+to authenticated
+with check (owner_id = (select auth.uid()));
+
+create policy "{{table}}_authenticated_update"
+on public.{{tableSql}}
+for update
+to authenticated
+using (owner_id = (select auth.uid()))
+with check (owner_id = (select auth.uid()));
+
+create policy "{{table}}_authenticated_delete"
+on public.{{tableSql}}
+for delete
+to authenticated
+using (owner_id = (select auth.uid()));
+
+create policy "{{table}}_app_be_select"
+on public.{{tableSql}}
+for select
+to app_be
+using (owner_id is not null);
+
+revoke all on table public.{{tableSql}} from public, anon;
+grant select, insert, delete on table public.{{tableSql}} to authenticated;
+grant update (updated_at) on table public.{{tableSql}} to authenticated;
+grant select on table public.{{tableSql}} to app_be;

package/templates/be/table/module-definition.ts.tpl

@@ -0,0 +1,7 @@
+import { ConfigurableModuleBuilder } from "@nestjs/common"
+import type { {{Name}}Options } from "./{{name}}.options"
+
+/** The configurable-module base of the {{name}} capability. */
+export const { ConfigurableModuleClass, OPTIONS_TYPE } = new ConfigurableModuleBuilder<{{Name}}Options>()
+    .setExtras({ isGlobal: false }, (definition, extras) => ({ ...definition, global: extras.isGlobal }))
+    .build()