@starci/hfs 4.10.1 → 4.11.8

package/templates/be/skeleton/apps/__app__/src/__app__.options.ts

@@ -1,6 +1,7 @@
 import type { HttpSecurityOptions } from "@modules/platform/http-security"
 import type { ServerOptions } from "@modules/platform/config"
 import type { DatabaseConnectionConfig } from "@modules/platform/database"
+import type { HttpOptions } from "@modules/platform/http"
 
 /** Everything the {{app}} app needs from its environment, parsed by `{{app}}.env.ts` and handed to `AppModule.register`. */
 export interface {{appPascal}}Options {
@@ -8,6 +9,8 @@ export interface {{appPascal}}Options {
     readonly server: ServerOptions
     /** The origin allowlist and rate limits. */
     readonly httpSecurity: HttpSecurityOptions
+    /** What the outbound HTTP client trusts beyond Node's bundled certificate authorities. */
+    readonly http: HttpOptions
     /** The primary database connection. */
     readonly database: DatabaseConnectionConfig
 }

package/templates/be/skeleton/apps/__app__/src/compose/platform.ts

@@ -30,7 +30,7 @@ export const platformModules = (options: {{appPascal}}Options): Array<DynamicMod
     RetryModule.register({ isGlobal: true }),
     IdsModule.register({ isGlobal: true }),
     LoggingModule.register({ isGlobal: true }),
-    HttpModule.register({ isGlobal: true }),
+    HttpModule.register({ isGlobal: true, ...options.http }),
     I18nModule.register({
         isGlobal: true,
         bundles: [HTTP_MESSAGES, ERRORS_MESSAGES, HTTP_SECURITY_MESSAGES, IDENTITY_MESSAGES],

package/templates/be/skeleton/src/modules/platform/http/fetch-http-client.client.spec.ts

@@ -1,14 +1,19 @@
 import { Test } from "@nestjs/testing"
 import { mock } from "@starci/jest-preset"
+import { Agent } from "undici"
 import { HttpErrorCode } from "./errors/http.error"
 import { FetchHttpClient } from "./fetch-http-client.client"
+import { HTTP_OPTIONS } from "./http.decorators"
+import type { HttpOptions } from "./http.options"
 
 /** Asymmetric matchers read as `unknown`: jest types them `any`, which may not flow into a property or a typed argument. */
 const anyOf = (type: unknown): unknown => expect.any(type)
 const objectLike = (shape: Record<string, unknown>): unknown => expect.objectContaining(shape)
 
-const build = async (): Promise<FetchHttpClient> => {
-    const moduleRef = await Test.createTestingModule({ providers: [FetchHttpClient] }).compile()
+const build = async (options: HttpOptions = {}): Promise<FetchHttpClient> => {
+    const moduleRef = await Test.createTestingModule({
+        providers: [FetchHttpClient, { provide: HTTP_OPTIONS, useValue: options }],
+    }).compile()
     return moduleRef.get(FetchHttpClient)
 }
 
@@ -233,3 +238,33 @@ describe("FetchHttpClient response stream failures", () => {
         ).rejects.toMatchObject({ code: HttpErrorCode.Timeout, cause: failure })
     })
 })
+
+describe("FetchHttpClient trusted certificate authority", () => {
+    it("sends through fetch's own pool and has nothing to close when no CA is trusted", async () => {
+        const client = await build()
+        const response = responseOf()
+        response.text.mockResolvedValue("{}")
+        const send = jest.spyOn(global, "fetch").mockResolvedValue(response)
+
+        await client.request({ correlationId: "request-1", method: "GET", url: "https://service.test/orders", timeoutMs: 2500 })
+
+        expect(send.mock.calls[0]?.[1]).not.toHaveProperty("dispatcher")
+        await expect(client.onModuleDestroy()).resolves.toBeUndefined()
+    })
+
+    it("sends every request through one pool that trusts the CA, and closes it when the app stops", async () => {
+        const client = await build({ trustedCa: "the run's fake CA" })
+        const response = responseOf()
+        response.text.mockResolvedValue("{}")
+        const send = jest.spyOn(global, "fetch").mockResolvedValue(response)
+
+        await client.request({ correlationId: "request-1", method: "GET", url: "https://idp.test/jwks", timeoutMs: 2500 })
+        await client.request({ correlationId: "request-2", method: "GET", url: "https://service.test/orders", timeoutMs: 2500 })
+
+        const pool = send.mock.calls[0]?.[1]?.dispatcher
+        expect(pool).toBeInstanceOf(Agent)
+        expect(send.mock.calls[1]?.[1]?.dispatcher).toBe(pool)
+        await client.onModuleDestroy()
+        expect(pool).toHaveProperty("closed", true)
+    })
+})

package/templates/be/skeleton/src/modules/platform/http/fetch-http-client.client.ts

@@ -1,11 +1,34 @@
+import { rootCertificates } from "node:tls"
 import { Injectable } from "@nestjs/common"
+import type { OnModuleDestroy } from "@nestjs/common"
+import { Agent } from "undici"
 import { isRecord } from "@modules/platform/primitives"
 import { HttpError, HttpErrorCode } from "./errors/http.error"
+import { InjectHttpOptions } from "./http.decorators"
+import type { HttpOptions } from "./http.options"
 import type { HttpClient, HttpRequest, HttpResponse } from "./http.port"
 
 @Injectable()
 /** The HttpClient adapter over the global `fetch`; the only place outside a spec that calls it. */
-export class FetchHttpClient implements HttpClient {
+export class FetchHttpClient implements HttpClient, OnModuleDestroy {
+    /**
+     * The connection pool that adds `trustedCa` to Node's bundled roots (the CA joins the trusted list, verification stays
+     * on); absent without one, so every request goes through fetch's own default pool as before.
+     */
+    private readonly dispatcher: Agent | undefined
+
+    constructor(@InjectHttpOptions() options: HttpOptions) {
+        this.dispatcher =
+            options.trustedCa === undefined
+                ? undefined
+                : new Agent({ connect: { ca: [...rootCertificates, options.trustedCa] } })
+    }
+
+    /** Closes the pool of the trusted CA, if the app configured one, when the app stops. */
+    async onModuleDestroy(): Promise<void> {
+        await this.dispatcher?.close()
+    }
+
     /** Sends `request` with its deadline and reads the body: parsed JSON, or the raw bytes when the request asks for them. */
     async request(request: HttpRequest): Promise<HttpResponse> {
         const deadline = AbortSignal.timeout(request.timeoutMs)
@@ -38,17 +61,27 @@ export class FetchHttpClient implements HttpClient {
     private async send(request: HttpRequest, signal: AbortSignal): Promise<Response> {
         try {
             const body = this.bodyOf(request)
-            return await fetch(request.url, {
+            const init: RequestInit = {
                 method: request.method,
                 headers: this.headersOf(request),
                 ...(body === undefined ? {} : { body }),
                 signal,
-            })
+            }
+            return await fetch(request.url, this.routed(init))
         } catch (cause) {
             throw this.failure(cause)
         }
     }
 
+    /**
+     * `init` sent through the trusted-CA pool when there is one. @types/node declares fetch over its own copy of undici's
+     * types, which the Agent of the undici package does not match nominally; `Object.assign` keeps the declared type of
+     * `init` and hands fetch the Agent itself.
+     */
+    private routed(init: RequestInit): RequestInit {
+        return this.dispatcher === undefined ? init : Object.assign(init, { dispatcher: this.dispatcher })
+    }
+
     /** The explicit id owns correlation; a copied traceparent would take precedence at the receiving logger. */
     private headersOf(request: HttpRequest): Record<string, string> {
         const extra = Object.fromEntries(

package/templates/be/skeleton/src/modules/platform/http/http.config.ts

@@ -0,0 +1,11 @@
+import type { EnvSource } from "@modules/platform/config"
+import type { HttpOptions } from "./http.options"
+
+/**
+ * Reads the http options: `HTTP_TRUSTED_CA` (or the file `HTTP_TRUSTED_CA_FILE` names) is the PEM of one more certificate
+ * authority the outbound client trusts beside Node's bundled roots; undeclared, the client trusts the bundled roots alone.
+ */
+export const parseHttpConfig = (env: EnvSource): HttpOptions => {
+    const trustedCa = env.optional("HTTP_TRUSTED_CA")
+    return trustedCa === undefined ? {} : { trustedCa }
+}

package/templates/be/skeleton/src/modules/platform/http/http.decorators.ts

@@ -1,9 +1,16 @@
 import { injector } from "@modules/platform/composition"
 import type { TypedParameterDecorator } from "@modules/platform/composition"
+import type { HttpOptions } from "./http.options"
 import type { HttpClient } from "./http.port"
 
+/** Token of the http options, exported so a spec can provide it. */
+export const HTTP_OPTIONS: unique symbol = Symbol("platform.http.options")
+
 /** Token of the HttpClient port. */
 export const HTTP_CLIENT: unique symbol = Symbol("platform.http.client")
 
+/** Injects the options of the http capability. Parameter type: HttpOptions. */
+export const InjectHttpOptions = (): TypedParameterDecorator<HttpOptions> => injector<HttpOptions>(HTTP_OPTIONS)
+
 /** Injects the HttpClient port. Parameter type: HttpClient. */
 export const InjectHttpClient = (): TypedParameterDecorator<HttpClient> => injector<HttpClient>(HTTP_CLIENT)

package/templates/be/skeleton/src/modules/platform/http/http.module-definition.ts

@@ -1,7 +1,9 @@
 import { ConfigurableModuleBuilder } from "@nestjs/common"
+import { HTTP_OPTIONS } from "./http.decorators"
 import type { HttpOptions } from "./http.options"
 
 /** The configurable-module base of the http capability; `isGlobal` is decided by the app root. */
-export const { ConfigurableModuleClass, OPTIONS_TYPE } = new ConfigurableModuleBuilder<HttpOptions>()
-    .setExtras({ isGlobal: false }, (definition, extras) => ({ ...definition, global: extras.isGlobal }))
-    .build()
+export const { ConfigurableModuleClass, OPTIONS_TYPE } =
+    new ConfigurableModuleBuilder<HttpOptions>({ optionsInjectionToken: HTTP_OPTIONS })
+        .setExtras({ isGlobal: false }, (definition, extras) => ({ ...definition, global: extras.isGlobal }))
+        .build()

package/templates/be/skeleton/src/modules/platform/http/http.options.ts

@@ -1,2 +1,9 @@
-/** The http capability takes no options; the empty record keeps `isGlobal` assignable through the configurable module. */
-export type HttpOptions = Record<never, never>
+/** The options of the http capability: what the outbound client trusts beyond Node's bundled certificate authorities. */
+export interface HttpOptions {
+    /**
+     * PEM of one more certificate authority the client trusts, beside Node's bundled roots and never instead of them, so
+     * every other host is still verified as before (the test world passes its per-run fake CA, `w.fake.<name>.ca`).
+     * Absent, the client trusts the bundled roots alone. Verification is never turned off.
+     */
+    readonly trustedCa?: string
+}

package/templates/be/skeleton/src/modules/platform/http/index.ts

@@ -1,3 +1,5 @@
 export { HTTP_ERROR_KINDS } from "./errors/http.error"
 export { HTTP_MESSAGES } from "./messages/http.messages"
+export { parseHttpConfig } from "./http.config"
 export { HttpModule } from "./http.module"
+export type { HttpOptions } from "./http.options"

package/templates/be/skeleton-lite/src/modules/platform/database/database.client.spec.ts

@@ -0,0 +1,96 @@
+import { Test } from "@nestjs/testing"
+import { mockEntityManager } from "@starci/jest-preset"
+import { advisoryXactLock, callDbFunction, notify } from "./database.client"
+import { DatabaseError, DatabaseErrorCode } from "./errors/database.error"
+
+const DATABASE_CLIENT = Symbol("database-client")
+
+const setup = async () => {
+    const moduleRef = await Test.createTestingModule({
+        providers: [{ provide: DATABASE_CLIENT, useFactory: () => ({ advisoryXactLock, callDbFunction, notify }) }],
+    }).compile()
+    return moduleRef.get<{
+        readonly advisoryXactLock: typeof advisoryXactLock
+        readonly callDbFunction: typeof callDbFunction
+        readonly notify: typeof notify
+    }>(DATABASE_CLIENT)
+}
+
+/** What `callDbFunction` throws for `name`, or null when it builds a call. */
+const refusalOf = async (name: string): Promise<unknown> => {
+    const client = await setup()
+    try {
+        await client.callDbFunction(mockEntityManager({ query: ['SELECT * FROM "public"."never"()', []] }), name, [])
+        return null
+    } catch (error) {
+        return error
+    }
+}
+
+describe("callDbFunction", () => {
+    it("calls a schema-qualified function with each part quoted and the arguments as numbered parameters", async () => {
+        const client = await setup()
+        const manager = mockEntityManager({ query: ['SELECT * FROM "public"."job_claim"($1, $2)', [{ id: "job-1" }]] })
+
+        const rows = await client.callDbFunction<{ id: string }>(manager, "public.job_claim", ["mail", 3])
+
+        expect(rows).toEqual([{ id: "job-1" }])
+        expect(manager.query).toHaveBeenCalledWith('SELECT * FROM "public"."job_claim"($1, $2)', ["mail", 3])
+    })
+
+    it("calls a bare pg built-in of the canon's list in pg_catalog", async () => {
+        const client = await setup()
+        const manager = mockEntityManager({ query: ['SELECT * FROM "pg_catalog"."to_regproc"($1)', [{ to_regproc: null }]] })
+
+        const rows = await client.callDbFunction<{ to_regproc: string | null }>(manager, "to_regproc", ["public.job_claim"])
+
+        expect(rows).toEqual([{ to_regproc: null }])
+    })
+
+    it("calls a function of another schema with no arguments", async () => {
+        const client = await setup()
+        const manager = mockEntityManager({ query: ['SELECT * FROM "be_access"."chat_target_member"()', []] })
+
+        const rows = await client.callDbFunction(manager, "be_access.chat_target_member", [])
+
+        expect(rows).toEqual([])
+    })
+
+    it.each([
+        ["a bare name that is not a listed built-in", "job_claim"],
+        ["a pg_catalog name spelt out", "pg_catalog.pg_terminate_backend"],
+        ["a quote inside a part", 'public."job_claim'],
+        ["a second statement smuggled into the name", "public.job_claim(); SELECT 1; --"],
+        ["an upper-case part", "public.Job_Claim"],
+        ["three parts", "db.public.job_claim"],
+        ["an empty schema", ".job_claim"],
+        ["an empty name", ""],
+    ])("refuses %s before any SQL runs", async (_case, name) => {
+        const refusal = await refusalOf(name)
+
+        expect(refusal).toBeInstanceOf(DatabaseError)
+        expect(refusal).toMatchObject({ code: DatabaseErrorCode.IdentifierRejected, params: { name } })
+    })
+})
+
+describe("advisoryXactLock", () => {
+    it("locks the 64-bit hash of the key for the transaction", async () => {
+        const client = await setup()
+        const manager = mockEntityManager({ query: ["SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [{}]] })
+
+        await expect(client.advisoryXactLock(manager, "jobs:mail")).resolves.toBeUndefined()
+
+        expect(manager.query).toHaveBeenCalledWith("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", ["jobs:mail"])
+    })
+})
+
+describe("notify", () => {
+    it("sends the payload on the channel", async () => {
+        const client = await setup()
+        const manager = mockEntityManager({ query: ["SELECT pg_notify($1, $2)", [{}]] })
+
+        await expect(client.notify(manager, "jobs", '{"id":"job-1"}')).resolves.toBeUndefined()
+
+        expect(manager.query).toHaveBeenCalledWith("SELECT pg_notify($1, $2)", ["jobs", '{"id":"job-1"}'])
+    })
+})

package/templates/be/skeleton-lite/src/modules/platform/database/database.client.ts

@@ -0,0 +1,93 @@
+import type { EntityManager } from "typeorm"
+import { DatabaseError, DatabaseErrorCode } from "./errors/database.error"
+
+declare const functionPartBrand: unique symbol
+declare const parameterListBrand: unique symbol
+
+/** One part of a database function name that passed the identifier check: the only caller text a call statement holds. */
+type DbFunctionPart = string & { readonly [functionPartBrand]: true }
+
+/** The numbered parameters `$1, ..., $n` of one call, built from a count alone. */
+type DbParameterList = string & { readonly [parameterListBrand]: true }
+
+/** A function the call statement names: its schema and its name, each part checked. */
+interface DbFunctionTarget {
+    readonly schema: DbFunctionPart
+    readonly name: DbFunctionPart
+}
+
+/** The pg built-ins the canon lists bare in ruleParams.be.dbFunctions; each is called in pg_catalog. */
+const PG_BUILTINS: ReadonlySet<string> = new Set([
+    "pg_advisory_xact_lock",
+    "hashtextextended",
+    "pg_notify",
+    "to_regproc",
+    "gen_random_uuid",
+])
+
+/** The schema that holds the pg built-ins. */
+const BUILTIN_SCHEMA = "pg_catalog"
+
+/** One unquoted lower-case identifier: a part of this shape needs no escaping inside double quotes. */
+const PART_PATTERN = /^[a-z_][a-z0-9_]*$/
+
+function assertFunctionPart(_value: string): asserts _value is DbFunctionPart {
+    // The brand is compile-time only; `functionPart` is the single caller after checking the part.
+}
+
+function assertParameterList(_value: string): asserts _value is DbParameterList {
+    // The brand is compile-time only; `parameterList` is the single caller.
+}
+
+/** The refusal of a name that is not a callable database function. */
+const rejected = (name: string): DatabaseError =>
+    new DatabaseError({ code: DatabaseErrorCode.IdentifierRejected, params: { name } })
+
+/** Checks one part of a function name against the identifier shape and brands it. */
+const functionPart = (part: string, name: string): DbFunctionPart => {
+    if (!PART_PATTERN.test(part)) throw rejected(name)
+    assertFunctionPart(part)
+    return part
+}
+
+/**
+ * The function a name calls: `schema.name` for a function of a migration (never in pg_catalog), or a bare pg built-in of
+ * the canon's list, called in pg_catalog. Anything else is refused before any SQL is built.
+ */
+const functionTarget = (name: string): DbFunctionTarget => {
+    const parts = name.split(".")
+    if (parts.length === 1 && PG_BUILTINS.has(name)) {
+        return { schema: functionPart(BUILTIN_SCHEMA, name), name: functionPart(name, name) }
+    }
+    const [schema, fn] = parts
+    if (parts.length !== 2 || schema === undefined || fn === undefined || schema === BUILTIN_SCHEMA) throw rejected(name)
+    return { schema: functionPart(schema, name), name: functionPart(fn, name) }
+}
+
+/** The numbered parameter list of a call with `count` arguments. */
+const parameterList = (count: number): DbParameterList => {
+    const list = Array.from({ length: count }, (_, index) => `$${String(index + 1)}`).join(", ")
+    assertParameterList(list)
+    return list
+}
+
+/**
+ * Calls one database function TypeORM cannot express (a pg built-in or a SECURITY DEFINER function of a migration) with
+ * numbered parameters. The name is schema-qualified (`public.job_claim`) or a bare built-in of the canon's list, each part
+ * is checked and double-quoted, and the arguments are values, never text of the statement (R334, R68).
+ */
+export const callDbFunction = <T>(manager: EntityManager, name: string, args: ReadonlyArray<unknown>): Promise<ReadonlyArray<T>> => {
+    const target = functionTarget(name)
+    const parameters = parameterList(args.length)
+    return manager.query<Array<T>>(`SELECT * FROM "${target.schema}"."${target.name}"(${parameters})`, [...args])
+}
+
+/** Takes a transaction-scoped advisory lock on the 64-bit hash of `key`; it is released when the manager's transaction ends. */
+export const advisoryXactLock = async (manager: EntityManager, key: string): Promise<void> => {
+    await manager.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [key])
+}
+
+/** Sends one NOTIFY on `channel` with `payload`, delivered when the manager's transaction commits. */
+export const notify = async (manager: EntityManager, channel: string, payload: string): Promise<void> => {
+    await manager.query("SELECT pg_notify($1, $2)", [channel, payload])
+}

package/templates/be/skeleton-lite/src/modules/platform/database/index.ts

@@ -1,5 +1,5 @@
 export { DatabaseModule } from "./database.module"
-export { advisoryXactLock, callDbFunction, notify } from "./database.functions"
+export { advisoryXactLock, callDbFunction, notify } from "./database.client"
 export { DATABASE_PROBE, InjectDatabaseProbe, InjectPrimaryEntityManager, PRIMARY_ENTITY_MANAGER } from "./primary.decorators"
 export { DatabaseProbeService } from "./database-probe.service"
 export type { DatabaseConnectionOptions } from "./database.options"

package/runtime/scripts/hfs/rules/database-queue-outbox.mjs

@@ -1,102 +0,0 @@
-// R258: an app whose queue is BullMQ on a declared Redis may keep its own outbox beside the canon `ruleParams.db.queueOutbox` table. The
-// app declares it in hfs.json `sides.be.queueOutbox` ({table, enqueue, queueParameter}), and a pg_cron tick enqueues through the declared
-// `enqueue` function only while that function's active definition does nothing but write the declared table with its queue column bound
-// to the declared parameter. The checker reads the declaration and the function body; it names no app table or function.
-import pg from 'libpg-query';
-import { sqlStringParts as strings, walkSqlAst as walk, sqlParser } from '../../lib/sql-ast.mjs';
-
-await pg.loadModule();
-
-const sqlTree = sqlParser(pg);
-const STATEMENTS = new Set(['PLpgSQL_stmt_block', 'PLpgSQL_stmt_execsql', 'PLpgSQL_stmt_if', 'PLpgSQL_stmt_assign', 'PLpgSQL_stmt_return']);
-const OTHER_DML = ['UpdateStmt', 'DeleteStmt', 'MergeStmt'];
-const qualified = (name) => name.includes('.') ? name : `public.${name}`;
-
-/** The outbox an app declares, or null: it counts only while the back end declares the redis backing the relay hands rows to. */
-export function queueOutboxDeclaration(declaration) {
-  const be = declaration?.sides?.be;
-  const declared = be?.queueOutbox;
-  if (!declared || !(be.backing ?? []).includes('redis')) return null;
-  return { table: qualified(declared.table), enqueue: qualified(declared.enqueue), parameter: declared.queueParameter };
-}
-
-function plpgsqlStatements(fn, body) {
-  const parameters = (fn.parameters ?? []).map((item) => item.FunctionParameter?.name).filter(Boolean).map((name) => `"${name.replaceAll('"', '""')}" text`).join(',');
-  let tag = '$hfs_outbox$';
-  while (body.includes(tag)) tag = `${tag.slice(0, -1)}_$`;
-  let tree;
-  try { tree = pg.parsePlPgSQLSync(`create function hfs_probe(${parameters}) returns text language plpgsql as ${tag}${body}${tag};`); } catch { return null; }
-  const trees = [];
-  let safe = true;
-  walk(tree, (node) => {
-    for (const key of Object.keys(node)) if (key.startsWith('PLpgSQL_stmt_') && !STATEMENTS.has(key)) safe = false;
-    const expr = node.PLpgSQL_expr;
-    if (expr) trees.push(sqlTree(expr.parseMode === 0 ? expr.query : `select ${expr.query}`));
-  });
-  return safe ? trees : null;
-}
-
-function bodyStatements(fn) {
-  const option = (name) => (fn.options ?? []).find((item) => item.DefElem?.defname === name)?.DefElem?.arg;
-  const language = option('language')?.String?.sval ?? 'sql';
-  const body = strings(option('as')?.List?.items).join('');
-  if (language === 'plpgsql') return plpgsqlStatements(fn, body);
-  if (language !== 'sql') return null;
-  if (fn.sql_body) return (fn.sql_body.List ? fn.sql_body.List.items : [fn.sql_body]).map((stmt) => ({ stmts: [{ stmt }] }));
-  return sqlTree(body)?.stmts?.map((entry) => ({ stmts: [entry] })) ?? null;
-}
-
-/** True when the nodes hold no sub-select or other statement and call only functions `pureCall` admits. */
-function pureNodes(nodes, pureCall) {
-  let ok = true;
-  walk(nodes, (node) => {
-    if (node.SubLink || node.SelectStmt || node.InsertStmt || OTHER_DML.some((key) => node[key])) ok = false;
-    if (node.FuncCall && !pureCall(node.FuncCall)) ok = false;
-  });
-  return ok;
-}
-
-/** `insert into <table> (..., queue, ...) values (..., <parameter>, ...) [on conflict .. do nothing] [returning ..]` with pure other values. */
-function insertOk(declared, insert, pureCall) {
-  if (insert.withClause || `${insert.relation?.schemaname || 'public'}.${insert.relation?.relname}` !== declared.table) return false;
-  if (insert.onConflictClause && insert.onConflictClause.action !== 'ONCONFLICT_NOTHING') return false;
-  const columns = (insert.cols ?? []).map((item) => item.ResTarget?.name);
-  const rows = insert.selectStmt?.SelectStmt?.valuesLists ?? [];
-  const values = rows.length === 1 ? rows[0].List?.items ?? [] : [];
-  const at = columns.indexOf('queue');
-  if (at < 0 || new Set(columns).size !== columns.length || values.length !== columns.length) return false;
-  const bound = values[at].ColumnRef?.fields;
-  if (!bound || strings(bound).join('.') !== declared.parameter || bound.length !== 1) return false;
-  return pureNodes(values.filter((_, index) => index !== at), pureCall);
-}
-
-/** A read of the declared table with pure expressions, or an expression over variables alone. */
-function readOk(declared, tree, pureCall) {
-  let ok = true;
-  walk(tree, (node) => {
-    if (OTHER_DML.some((key) => node[key]) || node.InsertStmt || node.SelectStmt?.intoClause) ok = false;
-    if (node.FuncCall && !pureCall(node.FuncCall)) ok = false;
-    if (node.RangeVar && `${node.RangeVar.schemaname || 'public'}.${node.RangeVar.relname}` !== declared.table) ok = false;
-  });
-  return ok;
-}
-
-function statementOk(declared, tree, pureCall) {
-  const stmt = tree?.stmts?.length === 1 ? tree.stmts[0].stmt : null;
-  if (stmt?.InsertStmt) return insertOk(declared, stmt.InsertStmt, pureCall);
-  return Boolean(stmt?.SelectStmt) && readOk(declared, tree, pureCall);
-}
-
-/**
- * The position of the queue parameter when the active definition of the declared enqueue function only writes the declared outbox
- * (inserts, reads of that table and pure expressions), or -1. `pureCall` admits a function call that does no work.
- */
-export function outboxEnqueueQueueIndex(declared, entry, pureCall) {
-  const fn = entry?.node;
-  if (!fn) return -1;
-  const index = (fn.parameters ?? []).findIndex((item) => item.FunctionParameter?.name === declared.parameter);
-  const trees = bodyStatements(fn);
-  if (index < 0 || !trees?.length || !trees.every((tree) => statementOk(declared, tree, pureCall))) return -1;
-  const inserts = trees.filter((tree) => tree?.stmts?.[0]?.stmt?.InsertStmt).length;
-  return inserts === 1 ? index : -1;
-}

package/templates/be/skeleton-lite/src/modules/platform/database/database.functions.ts

@@ -1,24 +0,0 @@
-import type { EntityManager } from "typeorm"
-
-/** The database functions this app may call, each listed with its reason in ruleParams.be.dbFunctions or hfs.json sides.be.dbFunctions. */
-const IDENTIFIER = /^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)?$/
-
-/**
- * Calls one database function TypeORM cannot express (a pg built-in or a SECURITY DEFINER function of a migration) with numbered
- * parameters; the function name is an identifier the canon lint holds to the listed set, never a value.
- */
-export const callDbFunction = async <T>(manager: EntityManager, name: string, args: ReadonlyArray<unknown>): Promise<ReadonlyArray<T>> => {
-    if (!IDENTIFIER.test(name)) throw new TypeError(`${name} is not a database function name`)
-    const placeholders = args.map((_, index) => `$${String(index + 1)}`).join(", ")
-    return manager.query<Array<T>>(`SELECT * FROM ${name}(${placeholders})`, [...args])
-}
-
-/** Takes a transaction-scoped advisory lock on the 64-bit hash of `key`; it is released when the manager's transaction ends. */
-export const advisoryXactLock = async (manager: EntityManager, key: string): Promise<void> => {
-    await manager.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [key])
-}
-
-/** Sends one NOTIFY on `channel` with `payload`, delivered when the manager's transaction commits. */
-export const notify = async (manager: EntityManager, channel: string, payload: string): Promise<void> => {
-    await manager.query("SELECT pg_notify($1, $2)", [channel, payload])
-}