@starci/hfs 4.11.0 → 4.11.8

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -36,11 +36,7 @@ const formsOk = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => FORM_N
 const doubleOk = (v) => isPlainObject(v) && /^[A-Za-z][A-Za-z0-9]*$/.test(String(v.double)) && formsOk(v.forms);
 const regexOk = (v) => { try { return typeof v === 'string' && v.length > 0 && Boolean(new RegExp(v)); } catch { return false; } };
 const dbExtensionsOk = (value) => Array.isArray(value) && value.every((name) => typeof name === 'string' && name.length > 0) && new Set(value).size === value.length;
-const SQL_NAME = /^[a-z_][a-z0-9_]*$/;
-const queueOutboxOk = (value) => isPlainObject(value) && Object.keys(value).sort(byCodeUnit).join() === 'columns,table'
-  && typeof value.table === 'string' && value.table.split('.').length === 2 && value.table.split('.').every((part) => SQL_NAME.test(part))
-  && nonemptyUniqueList(value.columns, (column) => SQL_NAME.test(String(column))) && value.columns.includes('queue');
-const DB_PARAMS = { extensions: dbExtensionsOk, queueOutbox: queueOutboxOk };
+const DB_PARAMS = { extensions: dbExtensionsOk };
 const dbParamsOk = (db) => db === undefined || (isPlainObject(db) && Object.entries(db).every(([key, value]) => Object.hasOwn(DB_PARAMS, key) && DB_PARAMS[key](value)));
 
 function beSpecificProblems(be, manifest) {
@@ -62,8 +58,14 @@ function beSpecificProblems(be, manifest) {
   return bad;
 }
 
-/** True for an absent list or a list of {name, reason} database functions, names unique. */
-export const dbFunctionsOk = (list) => list === undefined || (Array.isArray(list) && list.every((entry) => isPlainObject(entry) && Object.keys(entry).sort().join() === 'name,reason' && /^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)?$/.test(entry.name) && typeof entry.reason === 'string' && entry.reason.trim().length > 0) && new Set(list.map((entry) => entry.name)).size === list.length);
+/** A database function name (R334): `schema.name` outside pg_catalog, or, where `bare` admits it, a pg built-in named alone. */
+const dbFunctionNameOk = (name, bare) => typeof name === 'string' && (/^[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*$/.test(name) ? !name.startsWith('pg_catalog.') : bare && /^[a-z_][a-z0-9_]*$/.test(name));
+
+/**
+ * True for an absent list or a list of {name, reason} database functions, names unique and schema-qualified; `bare` also admits
+ * a bare name, which only the canon's list (ruleParams.be.dbFunctions) uses, for the pg built-ins its helpers call.
+ */
+export const dbFunctionsOk = (list, { bare = false } = {}) => list === undefined || (Array.isArray(list) && list.every((entry) => isPlainObject(entry) && Object.keys(entry).sort().join() === 'name,reason' && dbFunctionNameOk(entry.name, bare) && typeof entry.reason === 'string' && entry.reason.trim().length > 0) && new Set(list.map((entry) => entry.name)).size === list.length);
 
 /** The shape problems of `m.ruleParams`. */
 export function ruleParamsProblems(m) {
@@ -74,10 +76,10 @@ export function ruleParamsProblems(m) {
     // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
     // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
     if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite', 'dbFunctions']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !dbFunctionsOk(rp.be.dbFunctions) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority', 'dbFunctions'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + '), dbFunctions ([{name, reason}]) and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite', 'dbFunctions']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !dbFunctionsOk(rp.be.dbFunctions, { bare: true }) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority', 'dbFunctions'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + '), dbFunctions ([{name, reason}]: a pg built-in bare, every other function schema.name) and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
     bad.push(...beSpecificProblems(rp.be, m));
     if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
-    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names) and queueOutbox ({table: <schema>.<table>, columns: [unique column names including queue]})');
+    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names)');
   }
   return bad;
 }

package/runtime/scripts/hfs/rules/a15-findings.mjs

@@ -48,7 +48,7 @@ export const A15_CODES = [
   'HFS_WORKFLOW_CONTEXT',
   'CI_STANDARD',
   'CI_SECRET_SEALED', 'APP_SECRET_IN_CI', 'CI_DECLARATION_DRIFT',
-  'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BOOT_PROOF_TIMEOUT', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_CRON_OWNED', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_REDIS_PERSISTENCE', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
+  'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BOOT_PROOF_TIMEOUT', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_REDIS_PERSISTENCE', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
   // codes-end
 ];
 

package/runtime/scripts/hfs/rules/database-config.mjs

@@ -7,7 +7,7 @@ import {
 import { databaseExecutableTokens, databaseSqlStatements, databaseSqlTokens, destructiveMigrationFindings } from './database-migrations.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 
-const DEFAULT_EXTENSIONS = ['pgcrypto', 'pg_trgm', 'vector', 'uuid-ossp', 'unaccent', 'btree_gist'];
+const DEFAULT_EXTENSIONS = ['pgcrypto', 'pg_trgm', 'vector', 'uuid-ossp', 'unaccent', 'btree_gist', 'pgmq'];
 const word = (token, value) => token?.t === 'word' && token.v === value;
 const identifier = (token) => token && ['word', 'ident'].includes(token.t) ? token.v : null;
 

package/runtime/scripts/hfs/rules/database-constants.mjs

@@ -9,7 +9,6 @@ export const LITE_DB_MIGRATION = 'LITE_DB_MIGRATION';
 export const DB_BASELINE_SHAPE = 'DB_BASELINE_SHAPE';
 export const DB_ARCHIVE_MUTATED = 'DB_ARCHIVE_MUTATED';
 export const DB_PGMQ_DECLARED = 'DB_PGMQ_DECLARED';
-export const DB_CRON_OWNED = 'DB_CRON_OWNED';
 export const DB_EXTENSION_ALLOWED = 'DB_EXTENSION_ALLOWED';
 export const DB_MIGRATION_DESTRUCTIVE = 'DB_MIGRATION_DESTRUCTIVE';
 export const HFS_SEED_PII = 'HFS_SEED_PII';
@@ -22,3 +21,19 @@ export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/archive`;
 /** True for a migration `starci app db migrate` applies: a path under db/migrations/ outside the archive. */
 export const isActiveMigration = (file) => file.startsWith(`${MIGRATIONS_DIR}/`) && !file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`);
 export const SEED_FILE = `${DB_DIR}/seed.sql`;
+/** The managed pre-migration bootstrap (slot app.db.bootstrap): `starci app sync` renders it, and `db baseline --squash` owns one marked section. */
+export const BOOTSTRAP_FILE = `${DB_DIR}/bootstrap.sql`;
+export const BOOTSTRAP_SQUASH_BEGIN = '-- >>> starci app db baseline --squash: roles, role settings and grants a per-database dump loses (regenerate with the verb; do not edit) >>>';
+export const BOOTSTRAP_SQUASH_END = '-- <<< starci app db baseline --squash <<<';
+/**
+ * db/bootstrap.sql split into the part sync renders (`head`) and the squash section (`section`, from its begin line through its end line, or
+ * null). A begin marker without its end marker is no section, so the whole text stays the rendered part and differs from the render.
+ */
+export function bootstrapSection(text) {
+  const start = text.indexOf(BOOTSTRAP_SQUASH_BEGIN);
+  const end = start < 0 ? -1 : text.indexOf(BOOTSTRAP_SQUASH_END, start);
+  if (start < 0 || end < 0 || (start > 0 && text[start - 1] !== '\n')) return { head: text, section: null };
+  const newline = text.indexOf('\n', end);
+  const stop = newline < 0 ? text.length : newline + 1;
+  return { head: text.slice(0, start) + text.slice(stop), section: text.slice(start, stop) };
+}

package/runtime/scripts/hfs/rules/database-queue-sources.mjs

@@ -1,4 +1,4 @@
-// TypeScript queue constants, event-bus topic queue constants and scheduler references for migration parity.
+// TypeScript queue constants and event-bus topic queue constants for migration parity (R258).
 import pg from 'libpg-query';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -24,60 +24,20 @@ export function sourceValue(ts, node) {
   return node;
 }
 
-function sourceImports(ts, source) {
-  const imports = new Map();
-  for (const statement of source.statements) {
-    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)) continue;
-    const module = statement.moduleSpecifier.text;
-    const clause = statement.importClause;
-    if (clause?.name) imports.set(clause.name.text, { name: 'default', module });
-    const named = clause?.namedBindings;
-    if (named && ts.isNamespaceImport(named)) imports.set(named.name.text, { name: '*', module });
-    for (const item of named?.elements ?? []) imports.set(item.name.text, { name: (item.propertyName ?? item.name).text, module });
-  }
-  return imports;
-}
-
-function sourceExports(ts, source) {
-  const exports = new Map();
-  const stars = [];
-  for (const statement of source.statements) {
-    if (!ts.isExportDeclaration(statement)) continue;
-    const module = statement.moduleSpecifier?.text ?? null;
-    if (!statement.exportClause && module) stars.push(module);
-    for (const item of statement.exportClause?.elements ?? []) exports.set(item.name.text, { name: (item.propertyName ?? item.name).text, module });
-  }
-  return { exports, stars };
-}
-
-function sourceBindings(ts, source) {
-  const bindings = new Map();
-  const visit = (node) => {
-    if ((ts.isVariableDeclaration(node) || ts.isFunctionDeclaration(node)) && node.name && ts.isIdentifier(node.name)) bindings.set(node.name.text, node.initializer ?? node.body);
-    if (ts.isExportAssignment(node)) bindings.set('default', node.expression);
-    ts.forEachChild(node, visit);
-  };
-  visit(source);
-  return { source, bindings, imports: sourceImports(ts, source), ...sourceExports(ts, source) };
-}
-
 export function queueSourceFacts(state, files, inspectSql) {
   const ts = loadTypescript(state.repoRoot, HERE);
-  const sources = new Map();
   if (!ts) {
     if (files.some((file) => QUEUE_FILE.test(file) || TOPIC_FILE.test(file))) queueProblem(state, DB_PGMQ_DECLARED, 'hfs.json', 'queue declarations require the TypeScript parser');
-    return { ts, sources };
+    return;
   }
   for (const file of files.filter((item) => SOURCE_FILE.test(item) && !TEST_FILE.test(item))) {
     const text = readText(state.repoRoot, file);
     if (text === null) continue;
     const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
-    sources.set(file, sourceBindings(ts, source));
     if (QUEUE_FILE.test(file)) addLiteralConstants(state, state.constants, ts, source, file, /(?:^QUEUE$|_QUEUE(?:_NAME)?$|^QUEUE_)/, 'queue names');
     if (TOPIC_FILE.test(file)) addLiteralConstants(state, state.topics, ts, source, file, /_TOPIC_QUEUE$/, 'event-bus topic queue names');
     addSourceSql(state, ts, source, file, inspectSql);
   }
-  return { ts, sources };
 }
 
 function addLiteralConstants(state, into, ts, source, file, name, what) {
@@ -108,71 +68,3 @@ function addSourceSql(state, ts, source, file, inspectSql) {
   };
   visit(source);
 }
-
-function importedFile(files, from, specifier) {
-  const prefix = from.startsWith('be/') ? 'be/' : '';
-  let target = null;
-  if (specifier.startsWith('@modules/')) target = `${prefix}src/modules/${specifier.slice(9)}`;
-  else if (specifier.startsWith('.')) target = path.posix.normalize(path.posix.join(path.posix.dirname(from), specifier));
-  if (target === null) return null;
-  return [target, target.replace(/\.js$/, '.ts'), `${target}.ts`, `${target}/index.ts`].find((file) => files.has(file)) ?? null;
-}
-
-function schedulerBinding(ts, sources, file, name, seen) {
-  const key = `binding:${file}:${name}`;
-  if (seen.has(key)) return [];
-  seen.add(key);
-  const info = sources.get(file);
-  const local = info?.bindings.get(name);
-  if (local) return schedulerValues(ts, sources, file, local, seen);
-  const imported = info?.imports.get(name) ?? info?.exports.get(name);
-  if (imported) {
-    const target = imported.module ? importedFile(sources, file, imported.module) : file;
-    return target ? schedulerBinding(ts, sources, target, imported.name, seen) : [];
-  }
-  const values = [];
-  for (const module of info?.stars ?? []) {
-    const target = importedFile(sources, file, module);
-    if (target) values.push(...schedulerBinding(ts, sources, target, name, seen));
-  }
-  return values;
-}
-
-function schedulerMember(ts, sources, file, node, seen) {
-  if (!ts.isPropertyAccessExpression(node) || !ts.isIdentifier(node.expression)) return null;
-  const imported = sources.get(file)?.imports.get(node.expression.text);
-  if (imported?.name !== '*') return null;
-  const target = importedFile(sources, file, imported.module);
-  return target ? schedulerBinding(ts, sources, target, node.name.text, seen) : [];
-}
-
-function schedulerValues(ts, sources, file, node, seen = new Set()) {
-  node = sourceValue(ts, node);
-  if (!node) return [];
-  const key = `${file}:${node.pos}`;
-  if (seen.has(key)) return [];
-  seen.add(key);
-  if (ts.isIdentifier(node)) return schedulerBinding(ts, sources, file, node.text, seen);
-  const member = schedulerMember(ts, sources, file, node, seen);
-  if (member) return member;
-  const values = [];
-  if (ts.isStringLiteralLike(node)) values.push(node.text);
-  ts.forEachChild(node, (child) => { values.push(...schedulerValues(ts, sources, file, child, seen)); });
-  return values;
-}
-
-export function queueSchedulers({ ts, sources }) {
-  const values = new Map();
-  if (!ts) return values;
-  for (const [file, info] of sources) {
-    if (!/^(?:be\/)?apps\//.test(file)) continue;
-    const visit = (node) => {
-      if ((ts.isPropertyAssignment(node) || ts.isShorthandPropertyAssignment(node)) && node.name.getText(info.source).replaceAll('"', '').replaceAll("'", '') === 'schedulers') {
-        for (const value of schedulerValues(ts, sources, file, node.initializer ?? node.name)) values.set(value, file);
-      }
-      ts.forEachChild(node, visit);
-    };
-    visit(info.source);
-  }
-  return values;
-}

package/runtime/scripts/hfs/rules/database-queues.mjs

@@ -1,25 +1,22 @@
-// R258: the queue is BullMQ on Redis (ruling:R212/case-10), so the active migrations leave no pgmq queue for a queue constant, and
-// every pgmq queue they leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under platform/event-bus. A
-// pg_cron tick has one migration owner and only enqueues: it inserts one row of a queue constant into the queue outbox table of
-// ruleParams.db.queueOutbox. A pgmq.send to a queue that existed when the job was scheduled is the historical form an older
-// migration may still hold; the live job never enqueues that way.
+// R258: pgmq is the event bus (ruling:lite-pgmq-bus-bullmq-jobs) and jobs run on BullMQ, so the active migrations leave no pgmq queue
+// for a queue constant, and every pgmq queue they leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under
+// platform/event-bus, beside its dead-letter queue `<queue>__dead`. A topic binding names a declared queue and a literal pattern,
+// and pgmq grants reach only the q_ and a_ tables of declared queues, for the application role alone.
 // Initialize PostgreSQL's WASM parser at module load; the exported finder itself is synchronous.
 // SQL and TypeScript ASTs keep comments, quoted identifiers and inert string literals out of the inventory.
 import pg from 'libpg-query';
 import { sqlStringParts as strings, walkSqlAst as walk, sqlParser, sqlCallArgument as argument, sqlStringLiteral as sqlLiteral } from '../../lib/sql-ast.mjs';
-import { queueSourceFacts, queueSchedulers, queueProblem as problem } from './database-queue-sources.mjs';
+import { queueSourceFacts, queueProblem as problem } from './database-queue-sources.mjs';
 import { readJson, readText } from './read.mjs';
-import { DB_CRON_OWNED, DB_PGMQ_DECLARED, isActiveMigration } from './database-constants.mjs';
-import { loadSlotManifest } from '../slots.mjs';
-import { queueOutboxDeclaration, outboxEnqueueQueueIndex } from './database-queue-outbox.mjs';
+import { DB_PGMQ_DECLARED, isActiveMigration } from './database-constants.mjs';
 
 await pg.loadModule();
 
-const PURE_CALLS = new Set(['jsonb_build_object', 'json_build_object', 'jsonb_build_array', 'json_build_array', 'to_jsonb', 'now', 'clock_timestamp', 'date_trunc']);
+/** The suffix of a consumer queue's dead-letter queue (templates/be/inbox/platform/event-bus DEAD_QUEUE_SUFFIX). */
+const DEAD_SUFFIX = '__dead';
 const TABLE_PRIVILEGES = ['select', 'insert', 'update', 'delete', 'truncate', 'references', 'trigger', 'maintain'];
 const sqlName = (nodes) => strings(nodes).join('.');
 const callName = (call) => sqlName(call.funcname);
-const qualified = (name, schema = 'public') => name.includes('.') ? name : `${schema}.${name}`;
 
 const sqlTree = sqlParser(pg);
 const walkExecutable = (tree, visit) => walk(tree, visit, true);
@@ -36,7 +33,8 @@ function inspectCalls(state, tree, file, migration) {
   });
   for (const call of callsOf(tree)) {
     inspectQueueCall(state, call, file, migration);
-    inspectCronCall(state, call, file, migration);
+    inspectBindingCall(state, call, file, migration);
+    recordSchedule(state, call, migration);
   }
 }
 
@@ -54,36 +52,30 @@ function inspectQueueCall(state, call, file, migration) {
   }
 }
 
-function recordSchedule(state, call, file) {
+/** A topic binding routes the events of a name to a consumer group's queue: both literal, in an active migration, the queue declared. */
+function inspectBindingCall(state, call, file, migration) {
+  const name = callName(call);
+  if (name !== 'pgmq.bind_topic' && name !== 'pgmq.unbind_topic') return;
+  const pattern = sqlLiteral(argument(call, 0, ['pattern']));
+  const queue = sqlLiteral(argument(call, 1, ['queue_name']));
+  if (!migration || pattern === null || queue === null) problem(state, DB_PGMQ_DECLARED, file, `${name} must name a literal pattern and queue in an active migration`);
+  else if (name === 'pgmq.bind_topic' && !state.created.has(queue)) problem(state, DB_PGMQ_DECLARED, file, `pgmq.bind_topic binds ${queue}, which no earlier pgmq.create declares`);
+}
+
+/**
+ * The pg_cron jobs an archived chain still schedules, which `starci app db baseline` carries over. pg_cron is not an allowed extension
+ * (R259), so no rule judges them here.
+ */
+function recordSchedule(state, call, migration) {
+  if (!migration) return;
+  const name = callName(call);
   const job = sqlLiteral(argument(call, 0, ['job_name']));
-  // The names scheduled and not unscheduled since, in migration order: a name is a duplicate only while it is still scheduled.
-  const entry = { call, file, created: new Map(state.created), functions: new Map(state.functions), active: new Set(state.scheduledNames) };
-  state.schedules.push(entry);
-  if (job !== null) state.scheduledNames.add(job);
+  if (job === null) return;
+  if (name === 'cron.unschedule') state.activeCron.delete(job);
+  if (name !== 'cron.schedule') return;
   const schedule = sqlLiteral(argument(call, 1, ['schedule']));
   const command = sqlLiteral(argument(call, 2, ['command']));
-  if (job !== null && schedule !== null && command !== null) {
-    state.activeCron.set(job, { name: job, schedule, command });
-    state.liveSchedules.set(job, entry);
-  }
-}
-
-function inspectCronCall(state, call, file, migration) {
-  const name = callName(call);
-  if (name === 'cron.schedule' || name === 'cron.schedule_in_database') {
-    if (!migration || name !== 'cron.schedule') problem(state, DB_CRON_OWNED, file, 'cron jobs must be declared by cron.schedule in an active migration');
-    else recordSchedule(state, call, file);
-    return;
-  }
-  if (name !== 'cron.unschedule' || !migration) return;
-  const job = sqlLiteral(argument(call, 0, ['job_name']));
-  if (job !== null) {
-    state.unschedules.push({ name: job, file });
-    state.activeCron.delete(job);
-    state.scheduledNames.delete(job);
-    state.liveSchedules.delete(job);
-  }
-  else problem(state, DB_CRON_OWNED, file, 'cron.unschedule must identify the migration-owned job by literal name');
+  if (schedule !== null && command !== null) state.activeCron.set(job, { name: job, schedule, command });
 }
 
 function plpgsqlTree(body, parameters = []) {
@@ -103,8 +95,7 @@ function dynamicOwnership(state, expression, file, migration) {
     const tree = sqlTree(sql.replace(/%[ILs]/g, 'NULL'));
     walkExecutable(tree, (node) => { if (node.GrantStmt || node.AlterDefaultPrivilegesStmt) recordGrant(state, node, file, migration); });
     for (const call of callsOf(tree)) {
-      if (callName(call) === 'pgmq.create') problem(state, DB_PGMQ_DECLARED, file, 'dynamic SQL cannot own a queue declaration; write the call as static migration SQL');
-      if (callName(call).startsWith('cron.')) problem(state, DB_CRON_OWNED, file, 'dynamic SQL cannot own a cron declaration; write the call as static migration SQL');
+      if (['pgmq.create', 'pgmq.bind_topic'].includes(callName(call))) problem(state, DB_PGMQ_DECLARED, file, 'dynamic SQL cannot own a queue declaration or binding; write the call as static migration SQL');
     }
   }
 }
@@ -155,121 +146,6 @@ function updateQueuePrivilege(acl, grant, privilege) {
   else if (acl.has(privilege)) acl.set(privilege, false);
 }
 
-function migrationStatement(state, node, file) {
-  if (node.CreateFunctionStmt) {
-    const fn = node.CreateFunctionStmt;
-    state.functions.set(qualified(sqlName(fn.funcname)), { node: fn, file });
-    inspectFunctionDeclarations(state, fn, file);
-  }
-  if (node.DropStmt?.removeType === 'OBJECT_FUNCTION') {
-    for (const item of node.DropStmt.objects ?? []) {
-      const name = qualified(sqlName(item.ObjectWithArgs?.objname));
-      state.drops.push({ name, file });
-      state.functions.delete(name);
-    }
-  }
-  if (node.DoStmt) inspectDo(state, node.DoStmt, file);
-}
-
-function migrationFacts(state, files) {
-  for (const file of files.filter((item) => item.endsWith('.sql') && !item.startsWith('db/migrations/archive/')).sort((left, right) => left.localeCompare(right))) {
-    const text = readText(state.repoRoot, file);
-    if (text === null) continue;
-    const tree = sqlTree(text);
-    const active = isActiveMigration(file);
-    const scheduleStart = state.schedules.length;
-    for (const entry of tree?.stmts ?? []) {
-      inspectCalls(state, { stmts: [entry] }, file, active);
-      if (active) migrationStatement(state, entry.stmt, file);
-    }
-    completeScheduleInventory(state, scheduleStart);
-  }
-}
-
-function completeScheduleInventory(state, start) {
-  for (const schedule of state.schedules.slice(start)) {
-    for (const [queue, file] of state.created) if (!schedule.created.has(queue)) schedule.created.set(queue, file);
-    for (const [name, fn] of state.functions) if (!schedule.functions.has(name)) schedule.functions.set(name, fn);
-  }
-}
-
-function singleCall(tree) {
-  if (tree?.stmts?.length !== 1) return null;
-  if (tree.stmts[0].stmt?.ReturnStmt) return tree.stmts[0].stmt.ReturnStmt.returnval?.FuncCall ?? null;
-  const select = tree.stmts[0].stmt?.SelectStmt;
-  if (!select || select.targetList?.length !== 1 || !/^SETOP_NONE$/.test(select.op) || Object.keys(select).some((key) => !['targetList', 'op', 'limitOption'].includes(key))) return null;
-  return select.targetList[0].ResTarget?.val?.FuncCall ?? null;
-}
-
-/** The historical pgmq.send of an existing queue; only a job's original body may hold it. */
-function enqueue(state, call) {
-  if (callName(call) !== 'pgmq.send') return null;
-  const queue = sqlLiteral(argument(call, 0, ['queue_name']));
-  const safe = pureArguments(call);
-  return queue !== null && state.created.has(queue) && safe ? queue : null;
-}
-
-function pureCall(call) {
-  return uuidConstructor(call) || PURE_CALLS.has(callName(call).replace(/^pg_catalog\./, ''));
-}
-
-function pureArguments(call) {
-  return pureExpressions(call.args);
-}
-
-function pureExpressions(nodes) {
-  let safe = callsOf(nodes).every(pureCall);
-  walk(nodes, (node) => {
-    if (['SubLink', 'SelectStmt', 'InsertStmt', 'UpdateStmt', 'DeleteStmt', 'MergeStmt'].some((key) => node[key])) safe = false;
-  });
-  return safe;
-}
-
-/** The queue outbox table and the columns an enqueue may write, from ruleParams.db.queueOutbox; null refuses every outbox enqueue. */
-function queueOutbox(manifest) {
-  const declared = manifest?.ruleParams?.db?.queueOutbox;
-  return declared ? { table: declared.table, columns: new Set(declared.columns) } : null;
-}
-
-/** The queue constant a call of the app's declared outbox enqueue function enqueues (hfs.json sides.be.queueOutbox), or null. */
-function declaredEnqueue(state, call) {
-  const declared = state.declaredOutbox;
-  if (!declared || qualified(callName(call)) !== declared.enqueue) return null;
-  const index = outboxEnqueueQueueIndex(declared, state.functions.get(declared.enqueue), pureCall);
-  const queue = index < 0 ? null : sqlLiteral(argument(call, index, [declared.parameter]));
-  return queue !== null && state.constants.has(queue) && pureArguments(call) ? queue : null;
-}
-
-/** The queue constant one outbox row enqueues: `insert into <outbox> (queue, ...) values ('<queue constant>', ...)` with pure values. */
-function outboxEnqueue(state, insert) {
-  if (!state.outbox || insert.returningClause || insert.returningList || insert.onConflictClause || insert.withClause) return null;
-  if (`${insert.relation?.schemaname || 'public'}.${insert.relation?.relname}` !== state.outbox.table) return null;
-  const columns = (insert.cols ?? []).map((item) => item.ResTarget?.name);
-  if (new Set(columns).size !== columns.length || columns.some((column) => !state.outbox.columns.has(column))) return null;
-  const rows = insert.selectStmt?.SelectStmt?.valuesLists ?? [];
-  const values = rows.length === 1 ? rows[0].List?.items ?? [] : [];
-  const at = columns.indexOf('queue');
-  if (at < 0 || values.length !== columns.length) return null;
-  const queue = sqlLiteral(values[at]);
-  return queue !== null && state.constants.has(queue) && pureExpressions(values) ? queue : null;
-}
-
-/** The queue one statement enqueues to (an outbox row of a queue constant; a pgmq.send only when `legacy`), or null. */
-function singleEnqueue(state, tree, legacy) {
-  const insert = tree?.stmts?.length === 1 ? tree.stmts[0].stmt?.InsertStmt : undefined;
-  if (insert) return outboxEnqueue(state, insert);
-  const call = singleCall(tree);
-  if (!call) return null;
-  return declaredEnqueue(state, call) ?? (legacy ? enqueue(state, call) : null);
-}
-
-/** PostgreSQL's catalog-owned scalar UUID constructor adds an envelope identity without doing work in the tick. */
-function uuidConstructor(call) {
-  return callName(call) === 'pg_catalog.gen_random_uuid' && (call.args?.length ?? 0) === 0
-    && (call.agg_order?.length ?? 0) === 0 && !call.agg_filter && !call.over && !call.agg_star
-    && !call.agg_distinct && !call.agg_within_group && !call.func_variadic;
-}
-
 function functionBody(fn) {
   const option = (name) => (fn.options ?? []).find((item) => item.DefElem?.defname === name)?.DefElem?.arg;
   return { body: strings(option('as')?.List?.items).join(''), language: option('language')?.String?.sval ?? 'sql' };
@@ -289,107 +165,45 @@ function inspectFunctionDeclarations(state, fn, file) {
   }
 }
 
-function standardSqlBody(node) {
-  if (!node) return [];
-  if (node.List) return node.List.items.flatMap(standardSqlBody);
-  return [{ stmts: [{ stmt: node }] }];
+function migrationStatement(state, node, file) {
+  if (node.CreateFunctionStmt) inspectFunctionDeclarations(state, node.CreateFunctionStmt, file);
+  if (node.DoStmt) inspectDo(state, node.DoStmt, file);
 }
 
-function plpgsqlTickTrees(fn, body) {
-  const tree = plpgsqlTree(body, fn.parameters);
-  if (!tree) return null;
-  const trees = [];
-  let safe = true;
-  walk(tree, (item) => {
-    for (const key of Object.keys(item)) {
-      if (key.startsWith('PLpgSQL_stmt_') && !['PLpgSQL_stmt_block', 'PLpgSQL_stmt_perform', 'PLpgSQL_stmt_execsql', 'PLpgSQL_stmt_return'].includes(key)) safe = false;
-      if (key === 'PLpgSQL_expr') trees.push(sqlTree(item[key].query));
+function migrationFacts(state, files) {
+  for (const file of files.filter((item) => item.endsWith('.sql') && !item.startsWith('db/migrations/archive/')).sort((left, right) => left.localeCompare(right))) {
+    const text = readText(state.repoRoot, file);
+    if (text === null) continue;
+    const tree = sqlTree(text);
+    const active = isActiveMigration(file);
+    for (const entry of tree?.stmts ?? []) {
+      inspectCalls(state, { stmts: [entry] }, file, active);
+      if (active) migrationStatement(state, entry.stmt, file);
     }
-  });
-  return safe ? trees : null;
-}
-
-function tickTrees(fn) {
-  const { body, language } = functionBody(fn);
-  if (language === 'plpgsql') return plpgsqlTickTrees(fn, body);
-  if (language !== 'sql') return null;
-  if (fn.sql_body) return standardSqlBody(fn.sql_body);
-  return sqlTree(body)?.stmts?.map((entry) => ({ stmts: [entry] })) ?? null;
-}
-
-function tickQueues(state, fn, legacy) {
-  const trees = tickTrees(fn.node);
-  if (!trees) return null;
-  const queues = trees.map((tree) => singleEnqueue(state, tree, legacy));
-  return queues.length && queues.every(Boolean) ? queues : null;
-}
-
-/** What a cron command enqueues; `legacy` judges a job's original body, which may still pgmq.send to a queue that existed then. */
-function scheduleTarget(state, command, legacy) {
-  const tree = sqlTree(command);
-  const target = singleCall(tree);
-  if (!target) return { tick: null, queues: singleEnqueue(state, tree, legacy) };
-  if (!callName(target).endsWith('_tick')) return { tick: null, queues: declaredEnqueue(state, target) ?? (legacy ? enqueue(state, target) : null) };
-  const tick = qualified(callName(target));
-  const fn = state.functions.get(tick);
-  const queues = fn && pureArguments(target) && tickQueues(state, fn, legacy);
-  return { tick, queues };
-}
-
-function tickRemoval(state, tick, name) {
-  if (!tick) return;
-  for (const drop of state.drops.filter((item) => item.name === tick)) {
-    if (!state.unschedules.some((item) => item.name === name && item.file === drop.file)) problem(state, DB_CRON_OWNED, drop.file, 'removing a scheduled tick requires cron.unschedule of its job name in the same migration');
-  }
-}
-
-function scheduleCheck(state, schedule, schedulers, ticks) {
-  const { call, file } = schedule;
-  const name = sqlLiteral(argument(call, 0, ['job_name']));
-  const command = sqlLiteral(argument(call, 2, ['command']));
-  if (name === null || command === null || sqlLiteral(argument(call, 1, ['schedule'])) === null) {
-    problem(state, DB_CRON_OWNED, file, 'cron.schedule requires literal job name, cadence and command for migration ownership');
-    return;
   }
-  if (schedule.active.has(name)) problem(state, DB_CRON_OWNED, file, 'a cron job name is scheduled once while it is active: cron.unschedule it before a later migration schedules it again');
-  const historical = { ...state, created: schedule.created, functions: schedule.functions };
-  const { tick, queues } = scheduleTarget(historical, command, true);
-  if (!queues) problem(state, DB_CRON_OWNED, file, 'a cron command inserts one row of a queue constant into the queue outbox, directly or through one existing *_tick function that only does that; business DML, dynamic SQL and network calls are refused');
-  if (state.liveSchedules.get(name) === schedule && !scheduleTarget(state, command, false).queues) problem(state, DB_CRON_OWNED, file, 'the live cron job must insert one outbox row of a queue constant (ruling:R212/case-10): it targets a missing queue or tick, still enqueues with pgmq.send, or its current tick no longer only does that');
-  tickOwner(state, tick, name, schedule, ticks);
-  const owners = [name, ...(tick ? [tick, tick.split('.').at(-1)] : []), ...[queues ?? []].flat()];
-  if (owners.some((owner) => schedulers.has(owner))) problem(state, DB_CRON_OWNED, file, 'the tick is also declared in an application scheduler list; give it one owner');
-  tickRemoval(state, tick, name);
 }
 
-/** One tick function has one cron owner at a time: an earlier job of the tick that is still scheduled is a second owner. */
-function tickOwner(state, tick, name, schedule, ticks) {
-  if (!tick) return;
-  const owners = ticks.get(tick) ?? [];
-  if (owners.some((owner) => schedule.active.has(owner))) problem(state, DB_CRON_OWNED, schedule.file, 'a tick function has more than one cron owner');
-  ticks.set(tick, [...owners, name]);
-}
-
-function queueState({ repoRoot, files = [], all = files, repo = {}, manifest }) {
+function queueState({ repoRoot, files = [], all = files, repo = {} }) {
   const paths = [...new Set(all)];
   const declaration = readJson(repoRoot, 'hfs.json') ?? repo;
   if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !paths.some((file) => file.startsWith('db/'))) return null;
-  const state = { repoRoot, appRole: declaration.db?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), declaredOutbox: queueOutboxDeclaration(declaration), scheduledNames: new Set(), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
-  state.sources = queueSourceFacts(state, paths, inspectCalls);
+  const state = { repoRoot, appRole: declaration.db?.appRole ?? 'app_be', findings: [], constants: new Map(), topics: new Map(), created: new Map(), activeCron: new Map(), grants: [], queueAcls: new Map() };
+  queueSourceFacts(state, paths, inspectCalls);
   migrationFacts(state, paths);
   return state;
 }
 
 function validateQueues(state, inScope) {
   for (const [queue, file] of state.created) {
-    if (state.constants.has(queue)) problem(state, DB_PGMQ_DECLARED, file, `pgmq queue ${queue} is the queue constant of ${state.constants.get(queue)}, and the queue is BullMQ on Redis (ruling:R212/case-10): drop it with pgmq.drop_queue in a later migration`);
+    if (queue.endsWith(DEAD_SUFFIX) && state.topics.has(queue.slice(0, -DEAD_SUFFIX.length))) continue;
+    if (state.constants.has(queue)) problem(state, DB_PGMQ_DECLARED, file, `pgmq queue ${queue} is the queue constant of ${state.constants.get(queue)}, and jobs run on BullMQ (ruling:lite-pgmq-bus-bullmq-jobs): drop it with pgmq.drop_queue in a later migration`);
     else if (!state.topics.has(queue)) problem(state, DB_PGMQ_DECLARED, file, `pgmq queue ${queue} has no event-bus owner: name it in a literal *_TOPIC_QUEUE constant under platform/event-bus, or drop it with pgmq.drop_queue in a later migration`);
   }
-  for (const [topic, file] of state.topics) if (!state.created.has(topic)) problem(state, DB_PGMQ_DECLARED, file, `event-bus topic queue ${topic} has no pgmq.create in an active migration`);
+  for (const [topic, file] of state.topics) {
+    if (!state.created.has(topic)) problem(state, DB_PGMQ_DECLARED, file, `event-bus topic queue ${topic} has no pgmq.create in an active migration`);
+    else if (!state.created.has(`${topic}${DEAD_SUFFIX}`)) problem(state, DB_PGMQ_DECLARED, file, `event-bus topic queue ${topic} has no dead-letter queue: pgmq.create('${topic}${DEAD_SUFFIX}') in an active migration`);
+  }
   for (const { node, file, created, executed } of state.grants) grantCheck({ ...state, created: executed ? created : state.created }, node, file);
-  const ticks = new Map();
-  const schedulers = queueSchedulers(state.sources);
-  for (const schedule of state.schedules) scheduleCheck(state, schedule, schedulers, ticks);
   return state.findings.filter((finding) => inScope(finding.path));
 }
 

package/runtime/scripts/hfs/rules/database-sql.mjs

@@ -3,6 +3,7 @@
 import { found } from './read.mjs';
 import { parseSql } from '../sql/pg-parse.mjs';
 import { plpgsqlFindings } from './database-plpgsql.mjs';
+import { transactionControlFindings } from './database-transaction.mjs';
 import { DB_MIGRATION_SHAPE, DB_POLICY_SHAPE, DB_RLS_REQUIRED, DB_STORAGE_POLICY } from './database-constants.mjs';
 const POLICY_ACTIONS = ['select', 'insert', 'update', 'delete', 'all'];
 const WRITE_COMMANDS = new Set(['all', 'insert', 'update', 'delete']);
@@ -491,6 +492,7 @@ export async function sqlAnalysis({ file, text, exposed, forceRls }) {
   }
   const facts = factsOf(statementList(parsed.stmts, lineAt));
   return { facts, findings: [
+    ...transactionControlFindings(file, text, parsed.stmts, lineAt),
     ...rlsFindings(file, facts, exposed, forceRls),
     ...await plpgsqlFindings(file, facts, exposed),
     ...localPolicyFindings(file, facts),