@starci/hfs 4.2.12 → 4.2.14

package/runtime/scripts/hfs/rules/edition.mjs

@@ -1,22 +1,27 @@
 // edition.mjs - L01, the edition rule. An hfs.json edition is `full` or `lite` (absent means full); under lite the standard is a
-// filter plus a few additions over the same manifest, never a second engine. The slot layer already answers the paths lite
-// removed (slots lite excludes, or whose litePresence is forbidden, come back HFS_FORBIDDEN_PRESENT with their goesTo); this
-// rule reports what no path can state:
-//   - inside a package.json: a test script (`test`, `test:*`, `typecheck:tests`, a jest/vitest/playwright/mocha/cypress or
-//     `node --test` command) or a jest/vitest/playwright dependency - the same vocabulary FE_NO_TESTS scans on the fe side;
-//   - a test-tool configuration file no more specific slot already forbids;
-//   - a declaration of what lite does not have: a worker app, an event pattern (event-bus, queue, fenced-job, projection,
-//     saga) or its trigger kinds (saga, reactors, jobs, realtime). The forbidden names are DERIVED - a pattern, trigger or
-//     app kind is gone under lite exactly when every slot that carries it is litePresence: forbidden - so adding or
-//     restoring a kind is a manifest edit, not an edit here.
-// The edition is never tested here: a full app's view forbids none of these names and keeps its tests, so the rule answers [].
+// filter plus a few additions over the same manifest, never a second engine. Lite is the full architecture deployed without
+// self-hosted infrastructure (owner ruling 2026-10-12): the same slots, patterns and unit specs, Supabase adapters behind the same
+// ports, and no e2e or contract world. The slot layer already answers the paths lite removed (slots lite excludes, or whose
+// litePresence is forbidden, come back HFS_FORBIDDEN_PRESENT with their goesTo); this rule reports what no path can state:
+//   - inside a package.json: an e2e, contract, stack or browser script (`test:e2e`, `test:contract`, `test:stack`, `test:browser`,
+//     with a pre/post prefix too) or a dependency of the infrastructure lite does not run - a test-world container or proxy
+//     (testcontainers, toxiproxy) or a browser runner (playwright, cypress), and every library the lite infraOwners own nowhere
+//     while full owns them (BullMQ, Kafka, Redis: lite runs pgmq and Postgres locks instead);
+//   - a declaration of what lite does not have: an app kind, pattern or trigger kind every slot of which is forbidden under
+//     lite. The forbidden names are DERIVED from the manifest, so adding or restoring a kind is a manifest edit, not an edit here
+//     (under the 2026-10-12 ruling no pattern, trigger or app kind is gone).
+// A full app answers []: the rule tests the edition once and a full view forbids none of these names.
 import { found, readJson } from './read.mjs';
-import { DEPENDENCY_SECTIONS, TEST_DEPENDENCY, TEST_RUNNER_COMMAND, TEST_SCRIPT_NAME, TEST_TOOL_FILE } from './fe-no-tests.mjs';
+import { DEPENDENCY_SECTIONS } from './fe-no-tests.mjs';
+import { editionRuleParams } from '../edition-slots.mjs';
 
 export const HFS_EDITION_FORBIDDEN_PRESENT = 'HFS_EDITION_FORBIDDEN_PRESENT';
 
 const PACKAGE_JSON = /(?:^|\/)package\.json$/;
-const TYPECHECK_TESTS = /^(?:pre|post)?typecheck:tests$/;
+/** The scripts of a world lite does not have: the e2e and contract layers, the self-hosted stack and the browser journey. */
+const LITE_FORBIDDEN_SCRIPT = /^(?:pre|post)?test:(?:e2e|contract|stack|browser)$/;
+/** The dependencies of a test infrastructure lite does not run: containers, fault proxies and browser runners. */
+const LITE_FORBIDDEN_TEST_INFRA = /^(?:testcontainers|@testcontainers\/.+|toxiproxy-node-client|playwright|playwright-core|@playwright\/.+|cypress)$/;
 
 /**
  * The names the edition cannot declare: for each of `pattern`, `trigger` and `appKind`, the value is gone when every slot of
@@ -47,32 +52,43 @@ function editionGone(resolver) {
 
 const isPlainObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 
-function testScriptFindings(rel, pkg) {
+/**
+ * The specifiers a lite back end may import nowhere although full gives them an owner: the self-hosted infrastructure libraries
+ * the lite infraOwners override removes (bullmq, kafkajs, ioredis, ...). Read from the two rule-parameter views, never listed here.
+ */
+function liteRemovedLibraries(manifest) {
+  const be = manifest?.ruleParams?.be;
+  if (!be) return new Set();
+  const lite = editionRuleParams(be, 'lite').infraOwners ?? {};
+  const full = editionRuleParams(be, 'full').infraOwners ?? {};
+  return new Set(Object.keys(lite).filter((name) => lite[name].length === 0 && (full[name]?.length ?? 0) > 0));
+}
+
+function scriptFindings(rel, pkg) {
   const scripts = isPlainObject(pkg.scripts) ? pkg.scripts : {};
-  return Object.entries(scripts)
-    .filter(([name, command]) => TEST_SCRIPT_NAME.test(name) || TYPECHECK_TESTS.test(name) || TEST_RUNNER_COMMAND.test(String(command)))
-    .map(([name]) => found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} has script ${JSON.stringify(name)}: the lite edition has no tests - a lite app does not typecheck or run a test world`, { name }));
+  return Object.keys(scripts)
+    .filter((name) => LITE_FORBIDDEN_SCRIPT.test(name))
+    .map((name) => found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} has script ${JSON.stringify(name)}: a lite app has unit specs and optional integration specs on the local Supabase stack, never an e2e, contract, stack or browser run`, { name }));
 }
 
-function testDependencyFindings(rel, pkg) {
+function dependencyFindings(rel, pkg, removed) {
   const findings = [];
   for (const section of DEPENDENCY_SECTIONS) {
     const deps = pkg[section];
     if (!isPlainObject(deps)) continue;
     for (const name of Object.keys(deps)) {
-      if (TEST_DEPENDENCY.test(name)) {
-        findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} ${section} has ${name}: the lite edition has no tests - the dependency belongs to the full edition`, { section, name }));
-      }
+      if (LITE_FORBIDDEN_TEST_INFRA.test(name)) findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} ${section} has ${name}: a lite app runs no test containers, fault proxy or browser journey - its integration specs run against \`supabase start\``, { section, name }));
+      else if (removed.has(name)) findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} ${section} has ${name}: lite runs no self-hosted infrastructure - the pattern's port is implemented on Supabase (pgmq, Postgres locks)`, { section, name }));
     }
   }
   return findings;
 }
 
 /** The findings one package.json's scripts and dependencies produce under lite. */
-function packageFindings(repoRoot, rel) {
+function packageFindings(repoRoot, rel, removed) {
   const pkg = readJson(repoRoot, rel);
   if (!isPlainObject(pkg)) return [];
-  return [...testScriptFindings(rel, pkg), ...testDependencyFindings(rel, pkg)];
+  return [...scriptFindings(rel, pkg), ...dependencyFindings(rel, pkg, removed)];
 }
 
 const goneAppFindings = (repo, gone) => (repo.apps ?? [])
@@ -93,26 +109,22 @@ function declarationFindings(repo, gone) {
 }
 
 /**
- * L01 for one scope (the app root or one side), over `files` (scope-relative). Both questions are answered by the
- * resolver's view of the edition: the names gone from it, and whether any slot of it still has tests. The declaration
- * findings are judged from the be side (its apps, patterns and kinds): the root scope looks at sides.be, a standalone
- * be-side check at its own view. `withDeclaration: false` (a side scope of a whole-app check) skips them: the root scope
- * already reported them on hfs.json, and the side scope would only repeat them on a path that is not this side's.
+ * L01 for one scope (the app root or one side), over `files` (scope-relative). The declaration findings are judged from the be
+ * side (its apps, patterns and kinds): the root scope looks at sides.be, a standalone be-side check at its own view.
+ * `withDeclaration: false` (a side scope of a whole-app check) skips them: the root scope already reported them on hfs.json.
+ * The package findings read every package.json of the scope under lite.
  */
-export function editionFindings({ repoRoot, files, repo, resolver, withDeclaration = true }) {
+export function editionFindings({ repoRoot, files, repo, resolver, manifest, withDeclaration = true }) {
+  if ((repo.edition ?? 'full') !== 'lite') return [];
   const gone = editionGone(resolver);
-  const noTestWorld = resolver.slots().every((slot) => slot.tests === 'none');
   let beView = null;
   if (withDeclaration && repo.profile === 'app') beView = repo.sides?.be;
   else if (withDeclaration && repo.profile === 'be') beView = repo;
   const findings = beView ? declarationFindings(beView, gone) : [];
-  for (const file of noTestWorld ? files : []) {
-    if (file.includes('node_modules/')) continue;
-    if (PACKAGE_JSON.test(file)) {
-      findings.push(...packageFindings(repoRoot, file));
-    } else if (TEST_TOOL_FILE.test(file) && resolver.classifyPath(file).status !== 'forbidden') {
-      findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, file, `${file} is test tooling: the lite edition has no tests - the file belongs to the full edition`));
-    }
+  const removed = liteRemovedLibraries(manifest);
+  for (const file of files) {
+    if (file.includes('node_modules/') || !PACKAGE_JSON.test(file)) continue;
+    findings.push(...packageFindings(repoRoot, file, removed));
   }
   return findings;
 }

package/runtime/scripts/hfs/rules/fe-no-tests.mjs

@@ -12,13 +12,12 @@ import { found, readJson } from './read.mjs';
 export const FE_NO_TESTS = 'FE_NO_TESTS';
 const SPEC_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/;
 const TEST_DIRECTORY = /(?:^|\/)(?:e2e|__tests__|__mocks__|test-support)\//;
-export const TEST_TOOL_FILE = /(?:^|\/)(?:(?:vitest|jest|playwright)\.[^/]+|cypress\.config\.[^/]+|tsconfig\.e2e\.json|e2e\.ya?ml)$/;
-// The edition rule (rules/edition.mjs, L01) applies the same lists to the whole app tree in lite: they are the test vocabulary.
-export const TEST_SCRIPT_NAME = /^(?:pre|post)?test(?::|$)/;
+const TEST_TOOL_FILE = /(?:^|\/)(?:(?:vitest|jest|playwright)\.[^/]+|cypress\.config\.[^/]+|tsconfig\.e2e\.json|e2e\.ya?ml)$/;
+const TEST_SCRIPT_NAME = /^(?:pre|post)?test(?::|$)/;
 const TEST_RUNNER_COMMAND_SOURCE = String.raw`(?:^|[\s&|;(])(?:npx\s+)?(?:vitest|jest|playwright|cypress|mocha)(?=$|[\s&|;)])|\bnode\s+(?:--\S+\s+)*--test\b`;
-export const TEST_RUNNER_COMMAND = new RegExp(TEST_RUNNER_COMMAND_SOURCE);
+const TEST_RUNNER_COMMAND = new RegExp(TEST_RUNNER_COMMAND_SOURCE);
 const TEST_DEPENDENCY_SOURCE = String.raw`^(?:vitest|@vitest\/.+|playwright|playwright-core|@playwright\/.+|jest|@jest\/.+|ts-jest|babel-jest|@types\/jest|jest-[\w-]+|mocha|@types\/mocha|cypress|@testing-library\/.+|jsdom|@types\/jsdom|happy-dom|axe-core|@axe-core\/.+|vitest-axe|@starci\/(?:vitest|jest|playwright)-preset)$`;
-export const TEST_DEPENDENCY = new RegExp(TEST_DEPENDENCY_SOURCE);
+const TEST_DEPENDENCY = new RegExp(TEST_DEPENDENCY_SOURCE);
 export const DEPENDENCY_SECTIONS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
 
 /** True for a path FE_NO_TESTS owns: a spec file, a test directory or a test-tool file. */

package/runtime/scripts/hfs/rules/fe-stack.mjs

@@ -0,0 +1,71 @@
+// fe-stack.mjs - FE_STACK_FORBIDDEN: a front end depends only on the canonical library of each front-end concern (owner ruling
+// 2026-10-13, lite = full). The catalog knowledge/hfs/fe-stack.yaml lists, per concern, the canonical packages and the alternatives
+// it `forbids`; a manifest that declares a forbidden package is a finding naming the concern and its canonical packages.
+//   - the fe side: every package.json of the side (the apps' and the packages' manifests), every dependency section;
+//   - the app root: the one package.json carries both sides, so a forbidden package there is a finding unless the back end owns it
+//     (a key of the be `infraOwners` rule parameter with an owner, e.g. graphql-ws or moment for platform/realtime and
+//     platform/clock): a back-end library is not a front-end dependency.
+// The import-level half (a forbidden package imported by a front-end source file) is the eslint canon's.
+import fs from 'node:fs';
+import { parseYaml } from '../../../engine/yaml.mjs';
+import { found, readJson } from './read.mjs';
+import { DEPENDENCY_SECTIONS } from './fe-no-tests.mjs';
+import { editionRuleParams } from '../edition-slots.mjs';
+
+export const FE_STACK_FORBIDDEN = 'FE_STACK_FORBIDDEN';
+const CATALOG_FILE = new URL('../../../knowledge/hfs/fe-stack.yaml', import.meta.url);
+const PACKAGE_JSON = /(?:^|\/)package\.json$/;
+const APP_ROOT_MANIFEST = 'package.json';
+
+let forbidden = null;
+
+/** name -> {concern, canonical} for every package a concern of the catalog forbids, read once. */
+function forbiddenPackages() {
+  if (forbidden) return forbidden;
+  const catalog = parseYaml(fs.readFileSync(CATALOG_FILE, 'utf8'));
+  if (catalog?.schema !== 'starci/fe-stack@1' || !Array.isArray(catalog.concerns)) throw new Error('knowledge/hfs/fe-stack.yaml is not a starci/fe-stack@1 catalog');
+  forbidden = new Map();
+  for (const concern of catalog.concerns) {
+    for (const name of concern.forbids ?? []) forbidden.set(name, { concern: concern.id, canonical: concern.packages ?? [] });
+  }
+  return forbidden;
+}
+
+/**
+ * The packages the back end owns (be infraOwners with at least one owner, full's view: a library lite removes is the edition rule's
+ * finding, not a front-end one): a root dependency of the back end.
+ */
+function backendOwned(manifest) {
+  const be = manifest?.ruleParams?.be;
+  if (!be) return new Set();
+  const owners = editionRuleParams(be, 'full').infraOwners ?? {};
+  return new Set(Object.keys(owners).filter((name) => Array.isArray(owners[name]) && owners[name].length > 0));
+}
+
+function manifestFindings(repoRoot, rel, skip) {
+  const pkg = readJson(repoRoot, rel);
+  if (!pkg || typeof pkg !== 'object') return [];
+  const catalog = forbiddenPackages();
+  const findings = [];
+  for (const section of DEPENDENCY_SECTIONS) {
+    for (const name of Object.keys(pkg[section] ?? {})) {
+      const entry = catalog.get(name);
+      if (!entry || skip.has(name)) continue;
+      const canonical = entry.canonical.length ? entry.canonical.join(', ') : 'the canonical library of the concern';
+      findings.push(found(FE_STACK_FORBIDDEN, rel, `${rel} ${section} declares ${name}, which the front-end stack forbids for the ${entry.concern} concern (knowledge/hfs/fe-stack.yaml); use ${canonical} and delete ${name}`, { section, dependency: name, concern: entry.concern }));
+    }
+  }
+  return findings;
+}
+
+/**
+ * FE_STACK_FORBIDDEN over the tracked paths `files` of one scope: every package.json of the fe side, or the app root's one
+ * package.json minus what the back end owns. A be side has no front-end manifest and answers [].
+ */
+export function feStackFindings({ repoRoot, files, repo, manifest }) {
+  if (repo.profile === 'be') return [];
+  const atRoot = repo.profile !== 'fe';
+  const skip = atRoot ? backendOwned(manifest) : new Set();
+  const manifests = files.filter((file) => !file.includes('node_modules/') && (atRoot ? file === APP_ROOT_MANIFEST : PACKAGE_JSON.test(file)));
+  return manifests.flatMap((rel) => manifestFindings(repoRoot, rel, skip));
+}

package/scaffold/add-app.mjs

@@ -5,9 +5,15 @@ import {
   readRepoDeclaration,
   resolveRepoDeclaration,
 } from "../runtime/scripts/hfs/slots.mjs";
-import { imageFiles, TEMPLATES_DIR } from "../sync/index.mjs";
+import { imageFiles, render, TEMPLATES_DIR } from "../sync/index.mjs";
 import { ScaffoldError, pascalOf } from "./service.mjs";
-import { jsonText, packageJsonText } from "./app.mjs";
+import { PARTIAL_VARIABLES, coreFeApps, jsonText, packageJsonText } from "./app.mjs";
+
+/** The shared fe app core (modules/api, auth, toast, redux, the providers, the hooks): the base tree, then the edition overlay. */
+const CORE_DIRS = Object.freeze({
+  full: ["skeleton/apps/__app__"],
+  lite: ["skeleton/apps/__app__", "skeleton-lite/apps/__app__"],
+});
 
 const NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 
@@ -30,8 +36,9 @@ const fill = (text, values, file) =>
   });
 
 /**
- * Adds one Next workspace from the edition's canonical app skeleton, then registers it in hfs.json.
- * The root workspace glob is added only when an older app manifest does not already carry it.
+ * Adds one Next workspace from the edition's canonical app skeleton and the shared app core (both editions, owner ruling
+ * 2026-10-13: lite and full have one fe structure), then registers it in hfs.json. The root workspace glob is added only when an
+ * older app manifest does not already carry it.
  */
 export function addApp({ root, name }) {
   if (!NAME.test(String(name)))
@@ -53,11 +60,6 @@ export function addApp({ root, name }) {
       "HFS_ADD_NO_FRONT_END",
       "this app has no front-end side",
     );
-  if (repo.edition === "lite")
-    throw new ScaffoldError(
-      "HFS_ADD_LITE_SINGLE_APP",
-      "a lite app has one front-end app; a second app needs the shared <project>-ui and <project>-i18n packages: run starci app upgrade --edition full",
-    );
   if (repo.sides.fe.apps.some((app) => app.name === name))
     throw new ScaffoldError(
       "HFS_ADD_EXISTS",
@@ -80,18 +82,22 @@ export function addApp({ root, name }) {
     appPascal: pascalOf(name),
   };
   const targetBase = `fe/apps/${name}`;
-  const planned = listFiles(source).map((relative) => ({
-    relative: `${targetBase}/${relative}`,
-    body: fill(
-      fs
-        .readFileSync(path.join(source, ...relative.split("/")), "utf8")
-        .replace(/\r\n/g, "\n"),
+  const readTemplate = (dir, relative) =>
+    fill(
+      render(fs.readFileSync(path.join(dir, ...relative.split("/")), "utf8").replace(/\r\n/g, "\n"), PARTIAL_VARIABLES),
       values,
       relative,
-    ),
-  }));
+    );
+  // The app skeleton, then the shared core, then the edition overlay: a later tree replaces an earlier file of the same path.
+  const byPath = new Map();
+  for (const dir of [source, ...CORE_DIRS[repo.edition === "lite" ? "lite" : "full"].map((core) => path.join(TEMPLATES_DIR, "fe", ...core.split("/")))]) {
+    if (!fs.existsSync(dir)) continue;
+    for (const relative of listFiles(dir)) byPath.set(relative, { relative: `${targetBase}/${relative}`, body: readTemplate(dir, relative) });
+  }
+  const planned = [...byPath.values()];
 
-  const firstApp = repo.sides.fe.apps.find((app) => app.kind === "next");
+  // The dependency source is a product app (it carries the core's fe-stack packages), else the first Next app.
+  const firstApp = coreFeApps(repo.sides.fe.apps)[0] ?? repo.sides.fe.apps.find((app) => app.kind === "next");
   const firstPackage = firstApp
     ? path.join(root, "fe", "apps", firstApp.name, "package.json")
     : null;

package/scaffold/add-cli-lite.mjs

@@ -14,9 +14,6 @@ const read = (relative) =>
     .replace(/\r\n/g, "\n");
 const PINS_FILE = path.join(import.meta.dirname, "..", "runtime", "knowledge", "hfs", "canon-pins.yaml");
 
-/** Lite has no test world, so the existing cli tree is selected without its colocated full-edition specs. */
-export const selectLiteCliEntries = (entries) =>
-  entries.filter((entry) => !entry.path.endsWith(".spec.ts"));
 
 const managedScripts = (repo) => {
   const fragment = appScripts(repo).replace(/,\s*$/, "");
@@ -73,6 +70,25 @@ export class RunSeedsCli extends CommandRunner {
 }
 `;
 
+const SEED_RUN_SPEC = `import { mock } from "@starci/jest-preset"
+import { Test } from "@nestjs/testing"
+import { SeedRunnerService } from "@modules/platform/database"
+import { RunSeedsCli } from "./run.cli"
+
+describe("RunSeedsCli", () => {
+    it("delegates the tracked seed run to the seed runner once", async () => {
+        const seeds = mock<SeedRunnerService>()
+        const moduleRef = await Test.createTestingModule({
+            providers: [RunSeedsCli, { provide: SeedRunnerService, useValue: seeds }],
+        }).compile()
+
+        await expect(moduleRef.get(RunSeedsCli).run()).resolves.toBeUndefined()
+
+        expect(seeds.run).toHaveBeenCalledTimes(1)
+    })
+})
+`;
+
 const SEED_MODULE = `import { Module } from "@nestjs/common"
 import { SeedCli } from "./seed.cli"
 import { RunSeedsCli } from "./subs/run.cli"
@@ -188,6 +204,15 @@ export function ensureLiteCli({ root, manifest, repo }) {
       read("be/skeleton-lite/src/modules/platform/database/migration-runner.service.ts"),
     ],
     ["be/src/features/cli/migrate/subs/run.cli.ts", MIGRATE_RUN],
+    // Owner ruling 2026-10-12: each cli command of a lite back end owes its unit spec, as in full (ruleParams.be.unitRoles).
+    [
+      "be/src/features/cli/migrate/migrate.cli.spec.ts",
+      read("be/skeleton/src/features/cli/migrate/migrate.cli.spec.ts"),
+    ],
+    [
+      "be/src/features/cli/migrate/subs/run.cli.spec.ts",
+      read("be/skeleton/src/features/cli/migrate/subs/run.cli.spec.ts"),
+    ],
     [
       "be/src/features/cli/seed/seed.cli.ts",
       read("be/skeleton/src/features/cli/seed/seed.cli.ts"),
@@ -201,6 +226,11 @@ export function ensureLiteCli({ root, manifest, repo }) {
       read("be/skeleton-lite/src/modules/platform/database/seed-runner.service.ts"),
     ],
     ["be/src/features/cli/seed/subs/run.cli.ts", SEED_RUN],
+    [
+      "be/src/features/cli/seed/seed.cli.spec.ts",
+      read("be/skeleton/src/features/cli/seed/seed.cli.spec.ts"),
+    ],
+    ["be/src/features/cli/seed/subs/run.cli.spec.ts", SEED_RUN_SPEC],
   ];
   declaration.sides.be.apps.push({ name: "cli", kind: "cli" });
   declaration.sides.be.kinds = [

package/scaffold/add-inbox-lite.mjs

@@ -25,12 +25,18 @@ const template = (relative, values) => {
   });
 };
 
-/** Lite replaces only the webhook door; the full-edition pattern remains byte-identical. */
+/** The lite templates of the webhook door and its unit spec: the door hands the delivery id to the provider inbox. */
+const LITE_WEBHOOK_TEMPLATES = Object.freeze({
+  "webhooks/webhook.door.ts.tpl": "../inbox/webhook-door.ts.tpl",
+  "webhooks/webhook.door.spec.ts.tpl": "../inbox/webhook-door.spec.ts.tpl",
+});
+
+/** Lite replaces only the webhook door and its spec; the full-edition pattern remains byte-identical. */
 export const selectLiteWebhookEntries = (entries) =>
   entries.map((entry) =>
-    entry.template === "webhooks/webhook.door.ts.tpl"
-      ? { ...entry, template: "../inbox/webhook-door.ts.tpl" }
-      : entry,
+    LITE_WEBHOOK_TEMPLATES[entry.template] === undefined
+      ? entry
+      : { ...entry, template: LITE_WEBHOOK_TEMPLATES[entry.template] },
   );
 
 const matchingBrace = (text, open) => {
@@ -252,6 +258,10 @@ export function addLiteWebhookInbox({
       relative: `${base}/${provider}-inbox.service.ts`,
       text: template("service.ts.tpl", renderValues),
     },
+    {
+      relative: `${base}/${provider}-inbox.service.spec.ts`,
+      text: template("service.spec.ts.tpl", renderValues),
+    },
     {
       relative: `${base}/persistence/${provider}-inbox.sql.ts`,
       text: template("sql.ts.tpl", renderValues),
@@ -280,10 +290,16 @@ export function addLiteWebhookInbox({
     "webhook-inbox.client.ts",
   );
   if (!fs.existsSync(databaseClient))
-    planned.push({
-      relative: "be/src/modules/platform/database/webhook-inbox.client.ts",
-      text: template("database-client.ts.tpl", renderValues),
-    });
+    planned.push(
+      {
+        relative: "be/src/modules/platform/database/webhook-inbox.client.ts",
+        text: template("database-client.ts.tpl", renderValues),
+      },
+      {
+        relative: "be/src/modules/platform/database/webhook-inbox.client.spec.ts",
+        text: template("database-client.spec.ts.tpl", renderValues),
+      },
+    );
   const clashes = planned
     .filter((entry) => fs.existsSync(path.join(root, ...entry.relative.split("/"))))
     .map((entry) => entry.relative);