@starci/hfs 4.0.8 → 4.0.10

package/templates/app/skeleton-lite/supabase/config.toml

@@ -0,0 +1,41 @@
+project_id = "{{project}}"
+
+[api]
+enabled = true
+port = {{supabasePortApi}}
+schemas = ["public", "graphql_public"]
+extra_search_path = ["public", "extensions"]
+max_rows = 1000
+
+[db]
+port = {{supabasePortDb}}
+shadow_port = {{supabasePortShadow}}
+major_version = 17
+
+[db.pooler]
+enabled = false
+port = {{supabasePortPooler}}
+
+[studio]
+port = {{supabasePortStudio}}
+
+[inbucket]
+port = {{supabasePortInbucket}}
+
+[analytics]
+port = {{supabasePortAnalytics}}
+
+[auth]
+enabled = true
+site_url = "http://127.0.0.1:3000"
+additional_redirect_urls = ["http://127.0.0.1:3000/auth/callback"]
+enable_signup = false
+jwt_expiry = 3600
+
+[auth.email]
+enable_signup = false
+
+[auth.external.google]
+enabled = false
+client_id = "env(SUPABASE_AUTH_GOOGLE_CLIENT_ID)"
+secret = "env(SUPABASE_AUTH_GOOGLE_SECRET)"

package/templates/app/skeleton-lite/supabase/migrations/__timestamp___baseline.sql

@@ -0,0 +1,56 @@
+drop role if exists app_be;
+create role app_be login noinherit;
+
+create schema if not exists private;
+
+revoke all on schema private from public, anon, authenticated;
+
+create function private.set_updated_at()
+returns trigger
+language plpgsql
+set search_path = ''
+as $$
+begin
+    new.updated_at = now();
+    return new;
+end;
+$$;
+
+create table public.profiles (
+    id uuid primary key references auth.users (id) on delete cascade,
+    display_name text not null check (char_length(display_name) between 1 and 120),
+    created_at timestamptz not null default now(),
+    updated_at timestamptz not null default now()
+);
+
+alter table public.profiles enable row level security;
+
+create trigger profiles_set_updated_at
+before update on public.profiles
+for each row
+execute function private.set_updated_at();
+
+create policy profiles_authenticated_select
+on public.profiles
+for select
+to authenticated
+using ((select auth.uid()) = id);
+
+create policy profiles_authenticated_insert
+on public.profiles
+for insert
+to authenticated
+with check ((select auth.uid()) = id);
+
+create policy profiles_authenticated_update
+on public.profiles
+for update
+to authenticated
+using ((select auth.uid()) = id)
+with check ((select auth.uid()) = id);
+
+grant usage on schema public to authenticated;
+grant usage on schema public to app_be;
+revoke all on table public.profiles from public, anon;
+grant select, insert on table public.profiles to authenticated;
+grant update (display_name) on table public.profiles to authenticated;

package/templates/app/task-graph/turbo.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://turbo.build/schema.json",
+  "ui": "stream",
+  "agentGuidance": false,
+  // Turbo strips undeclared env from task processes: the SWC cache variable must pass so next finds its native-binding cache when the default cache root has a host ACL @swc/core refuses (a Windows AppContainer grant).
+  "globalPassThroughEnv": ["SWC_NATIVE_BINDING_CACHE", "NEXT_TELEMETRY_DISABLED"],
+  "tasks": {
+    "build": {
+      "dependsOn": ["^build"],
+      "outputs": [".next/**", "!.next/cache/**", "dist/**"]
+    },
+    "dev": {
+      "cache": false,
+      "persistent": true
+    },
+    "lint": {
+      "dependsOn": ["^build"]
+    },
+    "typecheck": {
+      "dependsOn": ["^build"]
+    }
+  }
+}

package/templates/app/tool-config-lite/prettierignore

@@ -0,0 +1,2 @@
+{{> app/tool-config/prettierignore}}
+supabase/types/

package/templates/app/tool-config-lite/prettierrc

@@ -0,0 +1 @@
+{{> app/tool-config/prettierrc}}

package/templates/app/upgrade-full/.starcistacks/application-stacks.yaml

@@ -0,0 +1,38 @@
+schema: starci/application-stacks@1
+sources:
+  - repository: "{{project}}"
+components:
+  supabase-postgres:
+    image: postgres:16@sha256:1a6ab3f5345eb6dbe04a1349529caabdb0ab09293a09590fad07b2246bfa4b54
+    role: stateful
+    compose: infra/compose/postgres.yaml
+    purpose: The pinned PostgreSQL-compatible database behind the Supabase project.
+    required: true
+  api:
+    image: "{{project}}/api:0.0.0"
+    role: service
+    compose: infra/compose/api.yaml
+    purpose: The Nest API that owns privileged and cross-tenant operations.
+    required: true
+environments:
+  dev:
+    status: supported
+    runtime: docker-compose
+    composeFiles:
+      - infra/compose/compose.yaml
+    components:
+      supabase-postgres: { port: 5432 }
+      api: { port: 3001 }
+    runbook: README.md
+    secrets: []
+k8s:
+  status: deferred
+  reason: The upgrade establishes the full local stack first; deployment topology is selected separately.
+services:
+  sonar:
+    provider: sonarqube
+    mode: disabled
+    reason: Enable the repository's Sonar service when a host and project token are provisioned.
+    qualityGate: starci-quality
+    ci: { wiring: not-used }
+    ownerAction: none

package/templates/app/upgrade-full/.starcistacks/dev/README.md

@@ -0,0 +1,10 @@
+# Development stack
+
+The full-edition development stack keeps PostgreSQL and the API in one declared Docker Compose project.
+
+- Prepare: provide `PRIMARY_DB_URL` to the API through the normal secret custody flow.
+- Up: `docker compose -f infra/compose/compose.yaml up -d`.
+- Status: `docker compose -f infra/compose/compose.yaml ps`.
+- Logs: `docker compose -f infra/compose/compose.yaml logs`.
+- Down: `docker compose -f infra/compose/compose.yaml down`.
+- Verify: call the API health endpoint and run `npm run lint`.

package/templates/app/upgrade-full/.starcistacks/dev/infra/compose/api.yaml

@@ -0,0 +1,13 @@
+services:
+  api:
+    image: "{{project}}/api:0.0.0"
+    build:
+      context: ../../../..
+      dockerfile: be/apps/api/Dockerfile
+    environment:
+      PRIMARY_DB_URL: postgres://postgres@supabase-postgres:5432/postgres
+    ports:
+      - "3001:3000"
+    depends_on:
+      supabase-postgres:
+        condition: service_healthy

package/templates/app/upgrade-full/.starcistacks/dev/infra/compose/compose.yaml

@@ -0,0 +1,3 @@
+include:
+  - postgres.yaml
+  - api.yaml

package/templates/app/upgrade-full/.starcistacks/dev/infra/compose/postgres.yaml

@@ -0,0 +1,12 @@
+services:
+  supabase-postgres:
+    image: postgres:16@sha256:1a6ab3f5345eb6dbe04a1349529caabdb0ab09293a09590fad07b2246bfa4b54
+    environment:
+      POSTGRES_HOST_AUTH_METHOD: trust
+    ports:
+      - "5432:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 5s
+      retries: 12

package/templates/app/upgrade-full/.starcistacks/dev/infra/metadata.json

@@ -0,0 +1,7 @@
+{
+  "project": "{{project}}",
+  "ports": {
+    "api": 3001,
+    "supabasePostgres": 5432
+  }
+}

package/templates/be/common/main-listen.ts.partial

@@ -0,0 +1,14 @@
+    const app = await NestFactory.create(AppModule.register(options), { rawBody: true })
+    app.enableCors({ origin: [...options.httpSecurity.allowedOrigins] })
+    app.enableShutdownHooks()
+    await app.listen(options.server.port)
+    createJsonLogger(new SystemClockService()).info(LoggingLogEvent.ServerStarted, {
+        service: "{{app}}",
+        port: options.server.port,
+    })
+}
+
+bootstrap().catch((error: unknown) => {
+    createJsonLogger(new SystemClockService()).error(LoggingLogEvent.StartupFailed, error, { service: "{{app}}" })
+    process.exitCode = 1
+})

package/templates/be/common/sql-ident.ts.partial

@@ -0,0 +1,7 @@
+export const ident = (name: string, allowed: ReadonlyArray<string>): SqlIdent => {
+    if (!IDENT_PATTERN.test(name) || !allowed.includes(name)) {
+        throw new DatabaseError({ code: DatabaseErrorCode.IdentifierRejected })
+    }
+    assertSqlIdent(name)
+    return name
+}

package/templates/be/common/sql-tag.ts.partial

@@ -0,0 +1,5 @@
+export const sql = (strings: TemplateStringsArray, ...identifiers: ReadonlyArray<SqlIdent>): SqlText => {
+    const text = strings.reduce((built, part, index) => `${built}${part}${identifiers[index] ?? ""}`, "")
+    assertSqlText(text)
+    return text
+}

package/templates/be/image/api/Dockerfile

@@ -0,0 +1,38 @@
+# {{project}}/{{app}} - the {{app}} api app. The build context is the APP ROOT (the folder holding the one package.json and
+# package-lock.json), not this folder:
+#
+#   docker build -f be/apps/{{app}}/Dockerfile -t {{project}}/{{app}}:<tag> .
+#
+# It follows the image canon (knowledge/hfs/docker.md) and diverges from it nowhere. No secret is built in: credentials are
+# mounted at run time and .dockerignore keeps them out of the build context.
+
+FROM {{nodeImage}} AS manifests
+WORKDIR /app
+COPY package.json package-lock.json ./
+COPY fe fe
+RUN find fe -type f ! -name package.json -delete
+
+FROM {{nodeImage}} AS build
+WORKDIR /app
+COPY --from=manifests /app ./
+RUN npm ci --ignore-scripts
+
+COPY be/tsconfig.json be/tsconfig.build.json be/
+COPY be/src be/src
+COPY be/apps/{{app}} be/apps/{{app}}
+RUN npm run build:be
+
+FROM {{nodeImage}} AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT={{port}}
+
+COPY --from=manifests /app ./
+RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
+
+COPY --from=build /app/be/dist be/dist
+
+USER node
+EXPOSE {{port}}
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+CMD ["node", "be/dist/apps/{{app}}/src/main.js"]

package/templates/be/image/cli/Dockerfile

@@ -0,0 +1,38 @@
+# {{project}}/{{app}} - the {{app}} command app: every one-off action (migrate, seed, sync, backup) is one command of this
+# image, run with the command as its arguments, e.g. `docker run --rm {{project}}/{{app}}:<tag> migrate run`. The build context is
+# the APP ROOT (the folder holding the one package.json and package-lock.json), not this folder:
+#
+#   docker build -f be/apps/{{app}}/Dockerfile -t {{project}}/{{app}}:<tag> .
+#
+# It follows the image canon (knowledge/hfs/docker.md) and diverges from it nowhere. No secret is built in: credentials are
+# mounted at run time and .dockerignore keeps them out of the build context.
+
+FROM {{nodeImage}} AS manifests
+WORKDIR /app
+COPY package.json package-lock.json ./
+COPY fe fe
+RUN find fe -type f ! -name package.json -delete
+
+FROM {{nodeImage}} AS build
+WORKDIR /app
+COPY --from=manifests /app ./
+RUN npm ci --ignore-scripts
+
+COPY be/tsconfig.json be/tsconfig.build.json be/
+COPY be/src be/src
+COPY be/apps/{{app}} be/apps/{{app}}
+RUN npm run build:be
+
+FROM {{nodeImage}} AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+
+COPY --from=manifests /app ./
+RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
+
+COPY --from=build /app/be/dist be/dist
+
+USER node
+HEALTHCHECK NONE
+ENTRYPOINT ["node", "be/dist/apps/{{app}}/src/main.js"]
+CMD ["--help"]

package/templates/be/image/worker/Dockerfile

@@ -0,0 +1,36 @@
+# {{project}}/{{app}} - the {{app}} worker app (no listener). The build context is the APP ROOT (the folder holding the one
+# package.json and package-lock.json), not this folder:
+#
+#   docker build -f be/apps/{{app}}/Dockerfile -t {{project}}/{{app}}:<tag> .
+#
+# It follows the image canon (knowledge/hfs/docker.md) and diverges from it nowhere. No secret is built in: credentials are
+# mounted at run time and .dockerignore keeps them out of the build context.
+
+FROM {{nodeImage}} AS manifests
+WORKDIR /app
+COPY package.json package-lock.json ./
+COPY fe fe
+RUN find fe -type f ! -name package.json -delete
+
+FROM {{nodeImage}} AS build
+WORKDIR /app
+COPY --from=manifests /app ./
+RUN npm ci --ignore-scripts
+
+COPY be/tsconfig.json be/tsconfig.build.json be/
+COPY be/src be/src
+COPY be/apps/{{app}} be/apps/{{app}}
+RUN npm run build:be
+
+FROM {{nodeImage}} AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+
+COPY --from=manifests /app ./
+RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
+
+COPY --from=build /app/be/dist be/dist
+
+USER node
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD pgrep -f "apps/{{app}}/src/main.js" > /dev/null || exit 1
+CMD ["node", "be/dist/apps/{{app}}/src/main.js"]

package/templates/be/inbox/database-client.ts.tpl

@@ -0,0 +1,50 @@
+import type { EntityManager } from "typeorm"
+import { DatabaseError, DatabaseErrorCode } from "./errors/database.error"
+import type { SqlText } from "./database.sql"
+
+interface WebhookInboxStatements {
+    readonly insert: SqlText
+    readonly complete: SqlText
+}
+
+interface AcceptWebhookDelivery extends WebhookInboxStatements {
+    readonly entityManager: EntityManager
+    readonly provider: string
+    readonly deliveryId: string | undefined
+    readonly payload: object
+    readonly process: (manager: EntityManager) => Promise<void>
+}
+
+interface InboxIdentity {
+    readonly id: string
+}
+
+/**
+ * Claims and processes one delivery in one EntityManager transaction. A conflict returns without calling `process`, so
+ * a redelivery receives the original empty acknowledgement and cannot repeat the domain mutation.
+ */
+export const acceptWebhookDelivery = async ({
+    entityManager,
+    insert,
+    complete,
+    provider,
+    deliveryId,
+    payload,
+    process,
+}: AcceptWebhookDelivery): Promise<void> => {
+    const normalizedDeliveryId = deliveryId?.trim()
+    if (!normalizedDeliveryId) {
+        throw new DatabaseError({ code: DatabaseErrorCode.WebhookDeliveryIdRequired })
+    }
+    await entityManager.transaction(async (manager) => {
+        const claimed = await manager.query<Array<InboxIdentity>>(insert, [
+            provider,
+            normalizedDeliveryId,
+            JSON.stringify(payload),
+        ])
+        const identity = claimed[0]
+        if (identity === undefined) return
+        await process(manager)
+        await manager.query(complete, [identity.id])
+    })
+}

package/templates/be/inbox/index.ts.tpl

@@ -0,0 +1,2 @@
+export { @@Provider@@InboxModule } from "./@@provider@@-inbox.module"
+export { @@Provider@@InboxService } from "./@@provider@@-inbox.service"

package/templates/be/inbox/migration.sql.tpl

@@ -0,0 +1,29 @@
+create table public.@@table@@ (
+    id uuid primary key default gen_random_uuid(),
+    provider text not null check (provider = '@@provider@@'),
+    delivery_id text not null,
+    received_at timestamptz not null default now(),
+    payload jsonb not null,
+    processed_at timestamptz,
+    constraint @@table@@_provider_delivery_id_key unique (provider, delivery_id)
+);
+
+alter table public.@@table@@ enable row level security;
+
+-- The dedicated app_be PostgreSQL role is the only application path. With no anon or authenticated policy,
+-- RLS denies those PostgREST roles by default; the service-role JWT is deliberately not granted here.
+create policy "@@table@@_app_be_select"
+on public.@@table@@ for select to app_be
+using (provider = '@@provider@@');
+
+create policy "@@table@@_app_be_insert"
+on public.@@table@@ for insert to app_be
+with check (provider = '@@provider@@');
+
+create policy "@@table@@_app_be_update"
+on public.@@table@@ for update to app_be
+using (provider = '@@provider@@')
+with check (provider = '@@provider@@');
+
+revoke all on table public.@@table@@ from public, anon, authenticated;
+grant select, insert, update on table public.@@table@@ to app_be;

package/templates/be/inbox/module-definition.ts.tpl

@@ -0,0 +1,6 @@
+import { ConfigurableModuleBuilder } from "@nestjs/common"
+import type { @@Provider@@InboxOptions } from "./@@provider@@-inbox.options"
+
+export const { ConfigurableModuleClass, OPTIONS_TYPE } = new ConfigurableModuleBuilder<@@Provider@@InboxOptions>()
+    .setExtras({ isGlobal: false }, (definition, extras) => ({ ...definition, global: extras.isGlobal }))
+    .build()

package/templates/be/inbox/module.ts.tpl

@@ -0,0 +1,14 @@
+import { Module } from "@nestjs/common"
+import type { DynamicModule } from "@nestjs/common"
+import { ConfigurableModuleClass, OPTIONS_TYPE } from "./@@provider@@-inbox.module-definition"
+import { @@Provider@@InboxService } from "./@@provider@@-inbox.service"
+
+@Module({})
+/** The durable, provider-specific inbox composed once by the API app. */
+export class @@Provider@@InboxModule extends ConfigurableModuleClass {
+    /** Registers the @@provider@@ inbox and exposes its intake to the webhook door. */
+    static register(options: typeof OPTIONS_TYPE): DynamicModule {
+        const base = super.register(options)
+        return { ...base, providers: [...(base.providers ?? []), @@Provider@@InboxService], exports: [@@Provider@@InboxService] }
+    }
+}

package/templates/be/inbox/options.ts.tpl

@@ -0,0 +1,2 @@
+/** The @@provider@@ inbox has no runtime options; its provider and table are static generator output. */
+export interface @@Provider@@InboxOptions {}

package/templates/be/inbox/service.ts.tpl

@@ -0,0 +1,33 @@
+import { Injectable } from "@nestjs/common"
+import type { EntityManager } from "typeorm"
+import { @@service@@ } from "@@serviceModule@@"
+import { acceptWebhookDelivery, InjectPrimaryEntityManager } from "@modules/platform/database"
+import { COMPLETE_@@providerUpper@@_INBOX, INSERT_@@providerUpper@@_INBOX } from "./persistence/@@provider@@-inbox.sql"
+
+interface @@Provider@@Delivery {
+    readonly id: string
+}
+
+type @@Provider@@DeliveryId = string | undefined
+
+@Injectable()
+/** Claims each @@provider@@ delivery once, then runs the domain intake and completion marker in the same transaction. */
+export class @@Provider@@InboxService {
+    constructor(
+        @InjectPrimaryEntityManager() private readonly entityManager: EntityManager,
+        private readonly deliveries: @@service@@,
+    ) {}
+
+    /** A duplicate is acknowledged without invoking the domain intake a second time. */
+    accept@@Provider@@Delivery(deliveryId: @@Provider@@DeliveryId, delivery: @@Provider@@Delivery): Promise<void> {
+        return acceptWebhookDelivery({
+            entityManager: this.entityManager,
+            insert: INSERT_@@providerUpper@@_INBOX,
+            complete: COMPLETE_@@providerUpper@@_INBOX,
+            provider: "@@provider@@",
+            deliveryId,
+            payload: delivery,
+            process: (manager) => this.deliveries.accept@@Provider@@Delivery(delivery, manager),
+        })
+    }
+}

package/templates/be/inbox/sql.ts.tpl

@@ -0,0 +1,16 @@
+import { sql } from "@modules/platform/database"
+
+/** Claims one @@provider@@ delivery and returns its durable inbox identity only to the winning transaction. */
+export const INSERT_@@providerUpper@@_INBOX = sql`INSERT INTO public.@@table@@ (provider, delivery_id, payload)
+VALUES ($1, $2, $3::jsonb)
+ON CONFLICT (provider, delivery_id) DO NOTHING
+RETURNING id`
+
+/** Marks the claimed delivery complete before the same transaction commits. */
+export const COMPLETE_@@providerUpper@@_INBOX = sql`WITH completed AS (
+    UPDATE public.@@table@@
+    SET processed_at = now()
+    WHERE id = $1
+    RETURNING id
+)
+SELECT id FROM completed`

package/templates/be/inbox/webhook-door.ts.tpl

@@ -0,0 +1,36 @@
+import { Body, Controller, Headers, HttpCode, HttpStatus, Post, Req } from "@nestjs/common"
+import type { RawBodyRequest } from "@nestjs/common"
+import type { Request } from "express"
+import { Public, PublicReason } from "@modules/domain/identity"
+import { @@Provider@@InboxService } from "@modules/domain/@@provider@@-inbox"
+import { InjectWebhookSignature, RateLimit, RateTier } from "@modules/platform/http-security"
+import type { WebhookSignatureService } from "@modules/platform/http-security"
+import { @@Event@@Request } from "./dto/@@event@@.request"
+
+@Controller("webhooks/@@provider@@")
+/**
+ * POST /webhooks/@@provider@@, the signed intake door of the @@provider@@ notifier. The signature and replay window are proven
+ * first; the verified delivery goes to one domain intake that claims its inbox row and processes it in one transaction.
+ */
+export class @@Provider@@Webhook {
+    constructor(
+        @InjectWebhookSignature() private readonly signature: WebhookSignatureService,
+        private readonly deliveries: @@Provider@@InboxService,
+    ) {}
+
+    /** Acknowledges with 204 and no body: a duplicate receives the same acknowledgement without being processed again. */
+    @Post()
+    @HttpCode(HttpStatus.NO_CONTENT)
+    @Public({ reason: PublicReason.SignedWebhook })
+    @RateLimit(RateTier.Strict)
+    async receive(
+        @Req() request: RawBodyRequest<Request>,
+        @Headers("x-@@provider@@-signature") signature: string | undefined,
+        @Headers("x-@@provider@@-timestamp") timestamp: string | undefined,
+        @Headers("x-@@provider@@-delivery-id") deliveryId: string | undefined,
+        @Body() delivery: @@Event@@Request,
+    ): Promise<void> {
+        this.signature.verify({ provider: "@@provider@@", rawBody: request.rawBody, signature, timestamp })
+        await this.deliveries.accept@@Provider@@Delivery(deliveryId, delivery)
+    }
+}

package/templates/be/patterns/api/application.command.http.ts.tpl

@@ -0,0 +1,10 @@
+import { Command } from "@nestjs/cqrs"
+import type { ExecuteParams } from "@modules/platform/cqrs"
+import type { @@Action@@Request, @@Action@@Result } from "./@@action@@.contracts"
+
+/** Asks to run @@action@@ for the authenticated caller. */
+export class @@Action@@Command extends Command<@@Action@@Result> {
+    constructor(readonly params: ExecuteParams<@@Action@@Request>) {
+        super()
+    }
+}

package/templates/be/patterns/api/application.command.ts.tpl

@@ -0,0 +1,10 @@
+import { Command } from "@nestjs/cqrs"
+import type { ExecuteParams } from "@modules/platform/cqrs"
+import type { @@Action@@Request, @@Action@@Result } from "./@@action@@.contracts"
+
+/** Asks to run @@action@@ for the caller. */
+export class @@Action@@Command extends Command<@@Action@@Result> {
+    constructor(readonly params: ExecuteParams<@@Action@@Request>) {
+        super()
+    }
+}

package/templates/be/patterns/api/application.contracts.ts.tpl

@@ -0,0 +1,11 @@
+/** What @@action@@ takes. */
+export interface @@Action@@Request {
+    /** The id of the subject. */
+    readonly id: string
+}
+
+/** What @@action@@ answers. */
+export interface @@Action@@Result {
+    /** The id of the subject. */
+    readonly id: string
+}

package/templates/be/patterns/api/application.handler.http.ts.tpl

@@ -0,0 +1,22 @@
+import { CommandHandler } from "@nestjs/cqrs"
+import { @@service@@ } from "@@serviceModule@@"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import type { @@Action@@Result } from "./@@action@@.contracts"
+import { @@Action@@Command } from "./@@action@@.command"
+
+@CommandHandler(@@Action@@Command)
+/** Runs @@action@@ for the authenticated principal through one domain-service call. */
+export class @@Action@@Handler extends ICQRSHandler<@@Action@@Command, @@Action@@Result> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly @@serviceCamel@@: @@service@@,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: @@Action@@Command): Promise<@@Action@@Result> {
+        return this.@@serviceCamel@@.@@actionCamel@@(command.params.principal.id, command.params.request.id)
+    }
+}

package/templates/be/patterns/api/application.handler.ts.tpl

@@ -0,0 +1,22 @@
+import { CommandHandler } from "@nestjs/cqrs"
+import { @@service@@ } from "@@serviceModule@@"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import type { @@Action@@Result } from "./@@action@@.contracts"
+import { @@Action@@Command } from "./@@action@@.command"
+
+@CommandHandler(@@Action@@Command)
+/** Runs @@action@@: the domain service decides and writes in one transaction. */
+export class @@Action@@Handler extends ICQRSHandler<@@Action@@Command, @@Action@@Result> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly @@serviceCamel@@: @@service@@,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: @@Action@@Command): Promise<@@Action@@Result> {
+        return this.@@serviceCamel@@.@@actionCamel@@(command.params.request)
+    }
+}

package/templates/be/patterns/api/feature.index.http.ts.tpl

@@ -0,0 +1 @@
+export { @@Feature@@HttpModule } from "./transport/http/@@feature@@-http.module"