@starci/hfs 4.2.13 → 4.2.15

package/scaffold/app.mjs

@@ -2,9 +2,10 @@
 // The selected edition owns the app root and its be/fe sides under knowledge/hfs/slots.yaml.
 //
 // The skeleton files are written once from templates/<app|be|fe>/skeleton ({{project}}, {{app}} and {{appPascal}} filled). Path
-// variables: a `__app__` folder is written once per app of the side, named after it; an fe `apps/<name>/` folder is the skeleton of
-// the declared fe app <name> alone (landing and app differ); `__project__` in a path is the project name (packages/__project__-ui is
-// packages/<name>-ui). The workspace manifests and every tsconfig.json are written from code, never kept as template files (a
+// variables: a `__app__` folder is written once per app of the side, named after it (on the fe side: once per product app, every
+// declared Next app but the marketing landing, which calls no back end: the shared app core of both editions, modules/api, auth,
+// toast, redux, the providers and the hooks); an fe `apps/<name>/` folder is the skeleton of the declared fe app <name> alone
+// (landing and app differ); `__project__` in a path is the project name (packages/__project__-ui is packages/<name>-ui). The workspace manifests and every tsconfig.json are written from code, never kept as template files (a
 // tsconfig.json under templates/ would be a TypeScript project of this repository); the managed files are the render of `starci app sync` (sync/index.mjs), so a fresh app
 // is in sync by construction. The lockfile is never written by hand: once the files are written, npm resolves the real one
 // (`npm install --package-lock-only`, no node_modules, no scripts), so `npm ci` installs the new app as it is. When npm cannot
@@ -33,9 +34,58 @@ const APP_DIR = '__app__';
 const PROJECT_DIR = '__project__';
 const TIMESTAMP = '__timestamp__';
 const PINS_FILE = path.join(import.meta.dirname, '..', 'runtime', 'knowledge', 'hfs', 'canon-pins.yaml');
+/**
+ * The front-end stack catalog (knowledge/hfs/fe-stack.yaml): the bundled runtime copy, else the runtime checkout's own file (the
+ * package inside the StarCi repository before the runtime copy carries it).
+ */
+const FE_STACK_FILES = [
+  path.join(import.meta.dirname, '..', 'runtime', 'knowledge', 'hfs', 'fe-stack.yaml'),
+  path.join(import.meta.dirname, '..', '..', '..', 'knowledge', 'hfs', 'fe-stack.yaml'),
+];
 const SONAR_GATE_FILE = path.join(import.meta.dirname, '..', 'runtime', 'knowledge', 'sonar-gate.yaml');
+/** The runtime-peer catalog (knowledge/hfs/peer-integrations.yaml, R111) the package carries. */
+const PEERS_FILE = path.join(import.meta.dirname, '..', 'runtime', 'knowledge', 'hfs', 'peer-integrations.yaml');
 const pascal = name => name.split('-').map(part => part[0].toUpperCase() + part.slice(1)).join('');
-const bundledPins = () => parseYaml(fs.readFileSync(PINS_FILE, 'utf8')).pins;
+/** The canon pins (knowledge/hfs/canon-pins.yaml) the package carries. */
+export const bundledPins = () => parseYaml(fs.readFileSync(PINS_FILE, 'utf8')).pins;
+
+/** The parsed front-end stack catalog; a package without it cannot know what every front end installs. */
+function bundledFeStack() {
+  const file = FE_STACK_FILES.find(candidate => fs.existsSync(candidate));
+  if (!file) throw new ScaffoldError('HFS_SCAFFOLD_STACK_MISSING', 'knowledge/hfs/fe-stack.yaml is not carried by this package; regenerate the runtime copy');
+  return parseYaml(fs.readFileSync(file, 'utf8'));
+}
+
+/**
+ * The marketing fe app of the full starter: it calls no back end, so the shared app core (`apps/__app__/`) is not written into
+ * it and the repository keeps one transport client folder (FE_TRANSPORT_OWNER).
+ */
+const MARKETING_FE_APPS = Object.freeze(new Set(['landing']));
+/** The fe apps that carry the shared app core: every declared Next app but the marketing one. */
+export const coreFeApps = apps => apps.filter(entry => entry.kind === 'next' && !MARKETING_FE_APPS.has(entry.name));
+
+/**
+ * The tool packages of the fe stack, installed once at the app root (devDependencies) and never in an fe workspace: the
+ * concerns whose packages only the root scripts run (the GraphQL codegen, lint and format), plus the compiler and the CSS engine.
+ */
+const FE_ROOT_TOOL_CONCERNS = Object.freeze(new Set(['codegen', 'lint']));
+const FE_ROOT_TOOL_PACKAGES = Object.freeze(new Set(['typescript', 'tailwindcss']));
+
+/**
+ * The `tier: core` packages of the fe stack every scaffold installs, read from fe-stack.yaml (never listed here), split into
+ * `app` (the runtime imports of each product fe app workspace) and `root` (the tools at the app root). Both editions alike.
+ */
+export function coreFeStackPackages(stack = bundledFeStack()) {
+  const app = new Set();
+  const root = new Set();
+  for (const concern of stack.concerns ?? []) {
+    if (concern.tier !== 'core') continue;
+    for (const name of concern.packages ?? []) {
+      (FE_ROOT_TOOL_CONCERNS.has(concern.id) || FE_ROOT_TOOL_PACKAGES.has(name) ? root : app).add(name);
+    }
+  }
+  return { app: [...app].sort(byCodeUnit), root: [...root].sort(byCodeUnit) };
+}
 
 /**
  * A JSON file as prettier prints it (the app's format check judges every file the scaffold writes): an object one key per line, an
@@ -87,7 +137,7 @@ const LITE_STARTER_SUPABASE = Object.freeze({
   enableSignup: false,
   jwtExpiry: 3600,
   siteUrl: 'http://127.0.0.1:3000',
-  redirectUrls: ['http://127.0.0.1:3000/auth/callback'],
+  redirectUrls: ['http://127.0.0.1:3000/'],
 });
 
 /**
@@ -97,8 +147,8 @@ const LITE_STARTER_SUPABASE = Object.freeze({
  */
 const STARTER_DEPENDENCIES = Object.freeze({
   dependencies: {
-    '@nestjs/common': null, '@nestjs/core': null, '@nestjs/cqrs': null,
-    '@nestjs/platform-express': null, '@nestjs/typeorm': null, 'nest-commander': null, pg: null,
+    '@apollo/server': null, '@nestjs/apollo': null, '@nestjs/common': null, '@nestjs/core': null, '@nestjs/cqrs': null, '@nestjs/graphql': null,
+    '@nestjs/platform-express': null, '@nestjs/typeorm': null, 'nest-commander': null, pg: null, graphql: null,
     'class-transformer': null, 'class-validator': null, 'reflect-metadata': null, rxjs: null, tslib: null, typeorm: null,
   },
   devDependencies: {
@@ -110,37 +160,45 @@ const STARTER_DEPENDENCIES = Object.freeze({
   },
 });
 
-/** Lite keeps the production stack and canon tools, but has no test runtime or test types. */
+/**
+ * Lite keeps the production stack, the canon tools and the back end's unit run (owner ruling 2026-10-12); it runs no test world of
+ * its own (no @starci/test-world). Both editions serve GraphQL from the api app (@nestjs/graphql over Apollo, owner ruling
+ * 2026-10-13); the fe stack's root tools are added from fe-stack.yaml by packageManifest.
+ */
 const LITE_STARTER_DEPENDENCIES = Object.freeze({
   dependencies: {
-    '@nestjs/common': null, '@nestjs/core': null, '@nestjs/cqrs': null,
+    '@apollo/server': null, '@nestjs/apollo': null, '@nestjs/common': null, '@nestjs/core': null, '@nestjs/cqrs': null, '@nestjs/graphql': null,
     '@nestjs/platform-express': null, '@nestjs/typeorm': null, '@supabase/supabase-js': null,
-    'class-transformer': null, 'class-validator': null, jose: null, pg: null,
+    'class-transformer': null, 'class-validator': null, graphql: null, jose: null, pg: null,
     'reflect-metadata': null, rxjs: null, tslib: null, typeorm: null,
   },
   devDependencies: {
-    turbo: null, '@starci/eslint-canon-be': null, '@starci/eslint-canon-fe': null, '@starci/cli': null,
-    '@starci/prettier-config': null, '@starci/stylelint-canon': null, '@starci/tsconfig': null, '@tailwindcss/postcss': null,
-    '@types/express': null, '@types/node': null, '@types/react': null, '@types/react-dom': null,
-    eslint: null, 'eslint-plugin-react-hooks': null, husky: null, 'postcss-value-parser': null, prettier: null,
-    stylelint: null, supabase: null, tailwindcss: null, 'ts-node-dev': null, 'tsc-alias': null,
+    turbo: null, '@nestjs/testing': null, '@starci/eslint-canon-be': null, '@starci/eslint-canon-fe': null, '@starci/cli': null,
+    '@starci/jest-preset': null, '@starci/prettier-config': null, '@starci/stylelint-canon': null, '@starci/tsconfig': null, '@tailwindcss/postcss': null,
+    '@types/express': null, '@types/jest': null, '@types/node': null, '@types/react': null, '@types/react-dom': null,
+    eslint: null, 'eslint-plugin-react-hooks': null, husky: null, jest: null, 'postcss-value-parser': null, prettier: null,
+    stylelint: null, supabase: null, tailwindcss: null, 'ts-jest': null, 'ts-node-dev': null, 'tsc-alias': null,
     'tsconfig-paths': null, typescript: null,
   },
 });
 
 /**
- * The runtime dependencies of every fe app workspace of the starter: what its skeleton imports (the two workspace packages at "*",
- * next with next-intl, react, the grammar and the HeroUI styles of its globals.css), @heroui/react and @xyflow/react
- * (the grammar's required peers, which every consumer declares: the grammar contract) and react-dom (next's peer). `@<project>/<pkg>` names are filled with the project.
+ * The runtime dependencies of every fe app workspace of the starter beyond the fe stack's core packages (fe-stack.yaml, added by
+ * feAppManifest for a product app): the two workspace packages at "*", the grammar and its required peers (@heroui/react,
+ * @xyflow/react: the grammar contract), next with next-intl, react and react-dom (next's peer). `@<project>/<pkg>` names are
+ * filled with the project. The marketing landing takes exactly these.
  */
 const FE_APP_DEPENDENCIES = Object.freeze({
   '@<project>/i18n': '*', '@<project>/ui': '*',
   '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@xyflow/react': null, next: null, 'next-intl': null, react: null, 'react-dom': null,
 });
 
-/** The sole lite FE workspace owns its Supabase clients directly; no shared FE package is emitted. */
+/**
+ * The lite fe workspace: the same base without the shared packages, plus its infra adapter (owner ruling 2026-10-13: Supabase on
+ * the front end is the Auth client of modules/auth only) and server-only for its own next-intl request config.
+ */
 const LITE_FE_APP_DEPENDENCIES = Object.freeze({
-  '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@xyflow/react': null, '@supabase/ssr': null,
+  '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@xyflow/react': null,
   '@supabase/supabase-js': null, next: null, 'next-intl': null, react: null, 'react-dom': null, 'server-only': null,
 });
 
@@ -178,18 +236,51 @@ function pinnedSection(entries, pins) {
   return Object.fromEntries(Object.entries(entries).sort(([a], [b]) => a.localeCompare(b)).map(([dependency, range]) => [dependency, pinned(dependency, range)]));
 }
 
-/** The root package.json of a new app, the monorepo root: name, workspaces, npm and its edition's dependencies at canon pins. */
-function packageManifest(name, pins, edition) {
+/**
+ * The runtime peers (R111, knowledge/hfs/peer-integrations.yaml) a root package.json needs and does not declare in its
+ * dependencies: the `requires` of every pair whose `when` packages it declares (at the named major, read from the declared
+ * exact pin), each at its canon pin. Both editions alike: @nestjs/apollo on @nestjs/platform-express 11 needs
+ * @as-integrations/express5.
+ */
+export function peerDependencies(pkg, pins, pairs = parseYaml(fs.readFileSync(PEERS_FILE, 'utf8')).pairs) {
+  const runtime = pkg.dependencies ?? {};
+  const declared = { ...pkg.devDependencies, ...runtime };
+  const major = version => Number(/^\D*(\d+)/.exec(String(version))?.[1]);
+  const needed = pairs.filter(pair => typeof runtime[pair.requires] !== 'string'
+    && pair.when.every(entry => typeof declared[entry.package] === 'string' && (entry.major === undefined || major(declared[entry.package]) === entry.major)));
+  return pinnedSection(Object.fromEntries(needed.map(pair => [pair.requires, null])), pins);
+}
+
+/**
+ * The fe-stack core packages one version of which the whole install resolves (npm `overrides`, at their canon pins): a
+ * transitive dependency otherwise brings its own (zustand 4 under @xyflow/react, dayjs under typeorm, a hoisted newer zod
+ * that breaks the zodResolver types), and @xyflow/react itself stays the grammar's one version.
+ */
+const ROOT_OVERRIDES = Object.freeze(['@xyflow/react', 'dayjs', 'zod', 'zustand']);
+
+/**
+ * The root package.json of a new app, the monorepo root: name, workspaces, npm, its edition's dependencies with their runtime
+ * peers, the fe stack's root tools and the one-version overrides, at canon pins.
+ */
+function packageManifest(name, pins, edition, stack = coreFeStackPackages()) {
   const dependencies = edition === 'lite' ? LITE_STARTER_DEPENDENCIES : STARTER_DEPENDENCIES;
-  return { name, version: '0.0.0', private: true, packageManager: PACKAGE_MANAGER, workspaces: [...WORKSPACES], dependencies: pinnedSection(dependencies.dependencies, pins), devDependencies: pinnedSection(dependencies.devDependencies, pins) };
+  const devDependencies = { ...dependencies.devDependencies, ...Object.fromEntries(stack.root.map(dependency => [dependency, null])) };
+  const pkg = { name, version: '0.0.0', private: true, packageManager: PACKAGE_MANAGER, workspaces: [...WORKSPACES], dependencies: pinnedSection(dependencies.dependencies, pins), devDependencies: pinnedSection(devDependencies, pins) };
+  pkg.dependencies = pinnedSection({ ...pkg.dependencies, ...peerDependencies(pkg, pins) }, pins);
+  pkg.overrides = pinnedSection(Object.fromEntries(ROOT_OVERRIDES.map(dependency => [dependency, null])), pins);
+  return pkg;
 }
 
 /** A dependency section of an fe workspace with `@<project>/` names filled and the canon pins taken. */
 const workspaceSection = (entries, project, pins) => pinnedSection(Object.fromEntries(Object.entries(entries).map(([name, range]) => [name.replace('@<project>/', `@${project}/`), range])), pins);
 
-/** The package.json of the fe app workspace `app` of the app `project`: @<project>/<app>, private, the workspace scripts, its own dependencies. */
-function feAppManifest(project, app, pins, edition) {
-  const dependencies = edition === 'lite' ? LITE_FE_APP_DEPENDENCIES : FE_APP_DEPENDENCIES;
+/**
+ * The package.json of the fe app workspace `app` of the app `project`: @<project>/<app>, private, the workspace scripts, its own
+ * dependencies. A product app (`core`, it carries the shared app core) also takes every core runtime package of the fe stack.
+ */
+function feAppManifest(project, app, pins, edition, { core = true, stack = coreFeStackPackages() } = {}) {
+  const base = edition === 'lite' ? LITE_FE_APP_DEPENDENCIES : FE_APP_DEPENDENCIES;
+  const dependencies = { ...base, ...(core ? Object.fromEntries(stack.app.filter(name => !Object.hasOwn(base, name)).map(name => [name, null])) : {}) };
   return { name: feAppPackageName(project, app), version: '0.0.0', private: true, scripts: { ...FE_APP_SCRIPTS }, dependencies: workspaceSection(dependencies, project, pins) };
 }
 
@@ -253,7 +344,7 @@ function fill(source, vars, file) {
 }
 
 /** Let sync's renderer expand partials first while leaving every source placeholder for `fill` to validate or preserve. */
-const PARTIAL_VARIABLES = new Proxy(Object.create(null), {
+export const PARTIAL_VARIABLES = new Proxy(Object.create(null), {
   get: (_target, key) => `{{${String(key)}}}`,
   getOwnPropertyDescriptor: (_target, key) => ({ configurable: true, value: `{{${String(key)}}}` }),
 });
@@ -269,10 +360,7 @@ const LITE_DEFERRED_GENERATOR_FILES = new Set([
   'src/modules/platform/database/migration-runner.service.ts',
   'src/modules/platform/database/seed-runner.service.ts',
 ]);
-const liteBaseFile = (scope, rel) => {
-  if (scope === 'app') return LITE_APP_REUSED.has(rel);
-  if (scope === 'fe') return false;
-  return !rel.startsWith('apps/cli/')
+const liteBaseSource = (rel) => !rel.startsWith('apps/cli/')
     && !rel.startsWith('src/features/cli/')
     && !rel.startsWith('src/modules/domain/note/')
     && rel !== 'src/modules/platform/database/connection-source.client.ts'
@@ -280,8 +368,23 @@ const liteBaseFile = (scope, rel) => {
     && rel !== 'src/modules/platform/database/seed-connections.client.ts'
     && rel !== 'src/modules/platform/primitives/sequence.policy.ts'
     && !LITE_DEFERRED_GENERATOR_FILES.has(rel)
-    && !rel.startsWith('src/tests/')
-    && !rel.endsWith('.spec.ts');
+    && !rel.startsWith('src/tests/');
+/** The be files the lite overlay replaces: a base unit spec of such a file tests the full variant, so lite carries its own. */
+const liteOverlaid = (() => {
+  let set = null;
+  return () => (set ??= new Set(listFiles(path.join(TEMPLATES_DIR, 'be', 'skeleton-lite'))));
+})();
+/**
+ * A base be file lite reuses: a source file of the shared shape, and the unit spec beside a reused source file that the lite overlay
+ * does not replace (owner ruling 2026-10-12: a lite back end keeps full's unit specs).
+ */
+const liteBaseFile = (scope, rel) => {
+  if (scope === 'app') return LITE_APP_REUSED.has(rel);
+  // The shared fe app core (apps/__app__/) is one tree for both editions; the lite overlay replaces only modules/auth/client.ts.
+  if (scope === 'fe') return rel.startsWith(`apps/${APP_DIR}/`);
+  if (!rel.endsWith('.spec.ts')) return liteBaseSource(rel);
+  const subject = rel.replace(/\.spec\.ts$/, '.ts');
+  return liteBaseSource(subject) && !liteOverlaid().has(subject);
 };
 const liteOverlayFile = (scope, rel) => scope !== 'be' || !LITE_DEFERRED_GENERATOR_FILES.has(rel);
 
@@ -290,6 +393,7 @@ function skeletonDirectory(scope, directory, app, vars, include = () => true) {
   const dir = path.join(TEMPLATES_DIR, scope, directory);
   if (!fs.existsSync(dir)) throw new ScaffoldError('HFS_SCAFFOLD_SKELETON_MISSING', `no skeleton templates in templates/${scope}/${directory}`);
   const apps = scope === 'app' ? [] : app.sides[scope].apps.filter(entry => scope === 'fe' || entry.kind === 'api');
+  const appsOf = rel => (scope === 'fe' && rel.includes(APP_DIR) ? coreFeApps(apps) : apps);
   const prefix = scope === 'app' ? '' : `${scope}/`;
   const files = [];
   for (const rel of listFiles(dir).filter(include)) {
@@ -304,7 +408,7 @@ function skeletonDirectory(scope, directory, app, vars, include = () => true) {
       files.push({ path: `${prefix}${output(rel)}`, content: fill(source, { ...once, ...appVars }, `${directory}/${rel}`) });
       continue;
     }
-    for (const entry of apps) files.push({ path: `${prefix}${output(rel.split(APP_DIR).join(entry.name))}`, content: fill(source, { ...once, app: entry.name, appPascal: pascal(entry.name) }, `${directory}/${rel}`) });
+    for (const entry of appsOf(rel)) files.push({ path: `${prefix}${output(rel.split(APP_DIR).join(entry.name))}`, content: fill(source, { ...once, app: entry.name, appPascal: pascal(entry.name) }, `${directory}/${rel}`) });
   }
   return files;
 }
@@ -317,7 +421,7 @@ export function scaffoldWorkSeeds(project) {
 
 /**
  * The skeleton files of one scope (app root, be, fe): [{ path, content }], app-relative; a `__app__` file once per api app of the
- * be side (once per app of the fe side), the be `apps/cli/` folder once when the cli app is declared, an fe `apps/<name>/` folder
+ * be side (once per product app of the fe side, coreFeApps), the be `apps/cli/` folder once when the cli app is declared, an fe `apps/<name>/` folder
  * once for the declared fe app <name> (none other), `__project__` in a path replaced by the project name.
  */
 function skeletonOf(scope, app, vars) {
@@ -465,7 +569,7 @@ export function scaffoldApp({ name, into, presets, edition = 'full', manifest =
       path: `fe/apps/${entry.name}/src/modules/types/ambient/styles.d.ts`,
       content: '/** Declares stylesheets loaded by the Next bundler; non-CSS side-effect imports remain checked. */\ndeclare module "*.css" {}\n',
     })),
-    ...app.sides.fe.apps.map(entry => ({ path: `fe/apps/${entry.name}/package.json`, content: packageJsonText(feAppManifest(name, entry.name, pins, app.edition)) })),
+    ...app.sides.fe.apps.map(entry => ({ path: `fe/apps/${entry.name}/package.json`, content: packageJsonText(feAppManifest(name, entry.name, pins, app.edition, { core: coreFeApps([entry]).length === 1 })) })),
     ...imageFiles(app),
     ...(app.edition === 'lite' ? [] : Object.keys(FE_PACKAGES).flatMap(pkg => [
       { path: `fe/packages/${name}-${pkg}/package.json`, content: packageJsonText(fePackageManifest(name, pkg, pins)) },

package/scaffold/edition-gate.mjs

@@ -7,12 +7,31 @@
 
 /** The refusal of a verb a non-full edition does not carry: printed verbatim by the CLI, exit 2, nothing written. */
 export class EditionRefusal extends Error {
-  constructor(command) {
-    super(`${command}: full edition only; run starci app upgrade --edition full`);
+  constructor(command, message = `${command}: full edition only; run starci app upgrade --edition full`) {
+    super(message);
     this.name = 'EditionRefusal';
   }
 }
 
+/**
+ * The refusal of a pattern noun in a lite app whose topic carries a `liteAdapter` (owner ruling 2026-10-12): lite HAS the pattern,
+ * but the package's templates are the full adapter (BullMQ, Kafka, sockets, TypeORM entities, e2e proofs), so generating them would
+ * write what lite forbids. The pattern is written by hand on its Supabase adapter until the package carries a lite template.
+ */
+export class LiteAdapterRefusal extends EditionRefusal {
+  constructor(command, topics) {
+    super(command, `${command}: the package carries only the full adapter of ${topics.join(', ')}; in a lite app write it on its Supabase adapter (knowledge/patterns/be/${topics[0]}.yaml liteAdapter, knowledge/patterns/be/supabase-queues.yaml)`);
+    this.name = 'LiteAdapterRefusal';
+  }
+}
+
+/** Refuses `command` in a lite app when one of `topics` (pattern topic ids with their parsed documents) carries a `liteAdapter`. */
+export function refuseFullAdapterInLite({ edition, topics, command }) {
+  if (edition !== 'lite') return;
+  const adapted = topics.filter(({ doc }) => doc?.liteAdapter !== undefined).map(({ id }) => id).sort();
+  if (adapted.length) throw new LiteAdapterRefusal(command, adapted);
+}
+
 /**
  * Refuses `command` (`add <noun>`, `new <noun>`) when one of `slotIds` - the slots the verb writes into - does not
  * exist for the edition of `resolver`'s repository or is forbidden under it. `resolver` is the

package/scaffold/lite-exports.mjs

@@ -43,9 +43,10 @@ const REGISTRATIONS = Object.freeze({
       beforeSource: "./errors/database.error",
     },
     {
+      // PRIMARY_ENTITY_MANAGER: the token the inbox service's unit spec provides its EntityManager double under.
       file: "be/src/modules/platform/database/index.ts",
       source: "./primary.decorators",
-      names: ["InjectPrimaryEntityManager"],
+      names: ["InjectPrimaryEntityManager", "PRIMARY_ENTITY_MANAGER"],
     },
     {
       file: "be/src/modules/platform/http-security/index.ts",
@@ -90,6 +91,31 @@ const REGISTRATIONS = Object.freeze({
       names: ["WebhookSignatureService"],
     },
   ],
+  // The GraphQL server capability (be/src/modules/platform/graphql, written by the first GraphQL feature): the errors service and
+  // the request locale it formats and localizes errors with.
+  graphql: [
+    {
+      file: "be/src/modules/platform/errors/index.ts",
+      source: "./errors.decorators",
+      names: ["ERRORS_SERVICE"],
+    },
+    {
+      file: "be/src/modules/platform/errors/index.ts",
+      source: "./graphql-error.mapper",
+      names: ["formatGraphqlError"],
+    },
+    {
+      file: "be/src/modules/platform/errors/index.ts",
+      source: "./errors.service",
+      names: ["ErrorsService"],
+      type: true,
+    },
+    {
+      file: "be/src/modules/platform/i18n/index.ts",
+      source: "./i18n.decorators",
+      names: ["REQUEST_LOCALE"],
+    },
+  ],
   cli: [
     {
       file: "be/src/modules/platform/database/index.ts",
@@ -138,6 +164,9 @@ function addExport(text, registration) {
   return `${text.replace(/\n+$/, "")}\n${added}\n`
 }
 
+/** The app-relative barrels one generator's registrations edit (a caller snapshots them before registerLiteExports). */
+export const registrationFiles = (generator) => [...new Set((REGISTRATIONS[generator] ?? []).map((registration) => registration.file))]
+
 /** Adds only the barrel exports first consumed by one generator; full webhooks share the same optional platform API. */
 export function registerLiteExports({ root, generator }) {
   const registrations = REGISTRATIONS[generator]

package/scaffold/service.mjs

@@ -15,8 +15,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
 import { explainPath } from '../runtime/scripts/hfs/check.mjs';
-import { createSlotResolver, loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
-import { refuseInEdition } from './edition-gate.mjs';
+import { loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 import { byCodeUnit } from '../report/order.mjs';
 
 export class ScaffoldError extends Error {
@@ -320,9 +319,8 @@ const writeNew = (repoRoot, relative, text) => {
 
 /** `starci app new spec be/<file>.service.ts` at the app root: writes the spec skeleton of an existing service; returns the created app-relative paths. */
 export function newSpec({ repoRoot: appRoot, file, ts, manifest = loadSlotManifest() }) {
-  const { repo, beRoot: repoRoot } = backEndOf(appRoot, manifest);
-  // `new spec` writes a unit spec: the test world it belongs to (be.tests.*) is a full-edition capability.
-  refuseInEdition({ resolver: createSlotResolver(manifest, repo), slotIds: ['be.tests.world'], command: 'new spec' });
+  // A unit spec belongs to both editions (owner ruling 2026-10-12): a lite back end keeps full's unit specs.
+  const { beRoot: repoRoot } = backEndOf(appRoot, manifest);
   const relative = belowBackEnd(file);
   if (!relative.endsWith('.service.ts')) throw new ScaffoldError('HFS_NEW_NOT_A_SERVICE', `${relative} is not a *.service.ts file: only services have a unit spec`);
   const absolute = path.join(repoRoot, relative);
@@ -335,9 +333,8 @@ export function newSpec({ repoRoot: appRoot, file, ts, manifest = loadSlotManife
 
 /** `starci app new service be/<dir> <name> [--inject ...]` at the app root: writes the service and its spec skeleton; returns the created app-relative paths. */
 export function newService({ repoRoot: appRoot, dir, name, inject = [], ts, manifest = loadSlotManifest() }) {
-  const { repo, beRoot: repoRoot } = backEndOf(appRoot, manifest);
-  // `new service` writes the service and its unit spec: the test world (be.tests.*) is a full-edition capability.
-  refuseInEdition({ resolver: createSlotResolver(manifest, repo), slotIds: ['be.tests.world'], command: 'new service' });
+  // The service and its unit spec belong to both editions (owner ruling 2026-10-12).
+  const { beRoot: repoRoot } = backEndOf(appRoot, manifest);
   if (!SERVICE_NAME.test(name)) throw new ScaffoldError('HFS_NEW_NAME_INVALID', `the service name ${name} must be kebab-case (member-profile), without the .service suffix`);
   const relative = path.posix.join(belowBackEnd(dir), `${name}.service.ts`);
   requireSlot(repoRoot, relative);

package/src/main.mjs

@@ -33,7 +33,7 @@
 //                                            a back-end `<name>.service.ts` and its `<name>.service.spec.ts` skeleton (scaffold/service.mjs; <dir> is
 //                                            relative to be/): the spec is built
 //                                            with Test.createTestingModule, one provider per constructor dependency (kit doubles from @starci/jest-preset),
-//                                            one placeholder it per public method. Never overwrites a file. In a lite app `new service` and `new spec` refuse (full edition only: the unit spec they write has no test world).
+//                                            one placeholder it per public method. Never overwrites a file. Both editions: a lite back end keeps full's unit specs (owner ruling 2026-10-12).
 //   starci app new image [--cwd <dir>]                  the Dockerfile of every declared app that has none, from the image canon (scaffold/image.mjs); never overwrites
 //   starci app new spec <file>.service.ts [--cwd <dir>]  the spec skeleton of an existing service, read from its constructor with the repository's TypeScript
 //   starci app secret list | show <slug> | set <slug> | gen <slug> [--key NAME] [--env NAME] [--age RECIPIENT] [--bytes N] [--cwd DIR]
@@ -309,7 +309,7 @@ export async function main(argv, {
       const [name, ...extra] = opts.positional;
       if (!name || extra.length) throw new Error('starci app scaffold takes `<name> [--into <dir>] [--edition full|lite]`');
       const edition = global.edition ?? 'full';
-      const { root: created, files } = scaffoldApp({ name, into: path.resolve(global.cwd, opts.into ?? '.'), edition, presets: presets ?? (edition === 'lite' ? undefined : await scaffoldPresets()), ...(lock ? { lock } : {}) });
+      const { root: created, files } = scaffoldApp({ name, into: path.resolve(global.cwd, opts.into ?? '.'), edition, presets: presets ?? await scaffoldPresets(), ...(lock ? { lock } : {}) });
       out(`starci app scaffold: created ${created} (${files.length} files); next: npm ci, then starci app lint\n`);
       return 0;
     }

package/sync/index.mjs

@@ -106,18 +106,20 @@ function readBundled(name) {
   return lf(fs.readFileSync(path.join(TEMPLATES_DIR, name), 'utf8'));
 }
 
-/** Fill `{{name}}` from vars and expand `{{> partial}}` lines. An unknown name is an error, never an empty string. */
+/**
+ * Fill `{{name}}` from vars and expand `{{> partial}}` lines. A partial line may be written as a line comment (`// {{> partial}}`)
+ * so a JavaScript template stays valid source before rendering. An unknown name is an error, never an empty string.
+ */
 export function render(text, vars, readTemplate = readBundled) {
-  const withPartials = text.replace(/^\{\{> ([\w./-]+)\}\}\n/gm, (_, name) => render(readTemplate(name), vars, readTemplate).replace(/\n*$/, '\n'));
+  const withPartials = text.replace(/^(?:\/\/ )?\{\{> ([\w./-]+)\}\}\n/gm, (_, name) => render(readTemplate(name), vars, readTemplate).replace(/\n*$/, '\n'));
   return withPartials.replace(/\{\{([A-Za-z]\w*)\}\}/g, (_, key) => {
     if (!Object.hasOwn(vars, key)) throw new SyncError('HFS_SYNC_TEMPLATE_VARIABLE', `template names {{${key}}}, which sync does not provide`);
     return vars[key];
   });
 }
 
-/** What the app's sync reads from the jest preset it installs for its be side: the Sonar exclusions ({ sonarExclusions }); a lite app installs none. */
-export async function loadPresets(root, edition = 'full') {
-  if (edition === 'lite') return {};
+/** What the app's sync reads from the jest preset it installs for its be side: the Sonar exclusions ({ sonarExclusions }); both editions install it (a lite back end keeps full's unit run, owner ruling 2026-10-12). */
+export async function loadPresets(root) {
   const name = '@starci/jest-preset';
   const require = createRequire(path.join(root, 'package.json'));
   let resolved;
@@ -190,7 +192,8 @@ export function appScripts(app) {
   const watch = entry => `cd be && ts-node-dev --respawn -r tsconfig-paths/register apps/${entry.name}/src/main.ts`;
   const built = entry => `node be/dist/apps/${entry.name}/src/main.js`;
   const workspace = entry => feAppPackageName(app.project, entry.name);
-  const dev = entry => `${app.edition === 'lite' ? '' : 'npm run codegen --silent && '}turbo run dev --filter=${workspace(entry)}`;
+  // Both editions generate before they run (owner ruling 2026-10-13): the fe's GraphQL wire types, and under lite the Supabase types check.
+  const dev = entry => `npm run codegen --silent && turbo run dev --filter=${workspace(entry)}`;
   const images = imageEntries(app);
   const imageCommand = ({ side, entry }) => `docker build -f ${dockerfilePath(side, entry.name)} -t ${app.project}/${entry.name}:dev .`;
   return [
@@ -264,19 +267,20 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     appBinary: APP_BINARY,
     appScripts: appScripts(app),
     // turbo builds every fe app workspace; ^build (turbo.json) builds the packages each app imports first, and caches both.
-    buildFe: `${lite ? '' : 'npm run codegen --silent && '}turbo run build --filter=./fe/apps/*`,
+    buildFe: 'npm run codegen --silent && turbo run build --filter=./fe/apps/*',
     // The be side with its tsc; every fe workspace with its own typecheck script through turbo (the packages are built first: ^build).
-    typecheck: `${lite ? '' : 'npm run codegen --silent && '}tsc -p be/tsconfig.json && turbo run typecheck`,
-    lintPrefix: lite ? '' : 'npm run codegen --silent && ',
+    typecheck: 'npm run codegen --silent && tsc -p be/tsconfig.json && turbo run typecheck',
+    lintPrefix: 'npm run codegen --silent && ',
     nodeMajor: String(NODE_MAJOR),
     sonarKey: sonarKey ?? app.project,
-    sonarExclusions: (lite ? ['**/.next/**', '**/node_modules/**', '**/src/messages/**', 'supabase/types/**'] : [presets?.sonarExclusions, '**/.next/**', '**/node_modules/**', '**/src/messages/**']).filter(Boolean).join(','),
+    sonarExclusions: [presets?.sonarExclusions, '**/.next/**', '**/node_modules/**', '**/src/messages/**', ...(lite ? ['supabase/types/**'] : [])].filter(Boolean).join(','),
     sonarSources: ['be/apps', 'be/src', 'fe/apps', ...(packages ? ['fe/packages'] : [])].join(','),
     lcovReport: LCOV_REPORT,
-    jestCoverage: !lite && scope === 'be' ? jestCoverageSource(jestCoverage(manifest, providers)) : '',
-    coverageExclusions: !lite && scope === APP_SCOPE ? sonarCoverageExclusions(manifest, providers).join(',') : '',
-    codecovPaths: !lite && scope === APP_SCOPE ? codecovPaths(manifest, providers).map(glob => `          - ${JSON.stringify(glob)}`).join('\n') : '',
-    codecovComponents: !lite && scope === APP_SCOPE ? componentsYaml(coverageComponents(manifest, { ...source, apps: app.sides.be.apps, providers })) : '',
+    // The coverage scope is the same in both editions: lite measures exactly what full measures (owner ruling 2026-10-12).
+    jestCoverage: scope === 'be' ? jestCoverageSource(jestCoverage(manifest, providers)) : '',
+    coverageExclusions: scope === APP_SCOPE ? sonarCoverageExclusions(manifest, providers).join(',') : '',
+    codecovPaths: scope === APP_SCOPE ? codecovPaths(manifest, providers).map(glob => `          - ${JSON.stringify(glob)}`).join('\n') : '',
+    codecovComponents: scope === APP_SCOPE ? componentsYaml(coverageComponents(manifest, { ...source, apps: app.sides.be.apps, providers })) : '',
     tsconfigPaths: ['be/tsconfig.json', ...fe.apps.map(entry => `fe/apps/${entry.name}/tsconfig.json`), ...(packages ? ['fe/packages/*/tsconfig.json'] : [])].join(','),
     styleGlob: STYLE_GLOB,
     imageMatrix: imageMatrix(app),
@@ -400,7 +404,7 @@ export function loadHfs(root, manifest = loadSlotManifest()) {
 export async function renderRepo(root, { presets, parseYaml, manifest = loadSlotManifest() } = {}) {
   const hfs = loadHfs(root, manifest);
   const sonarKey = await readDeclaredSonarKey(root, { parseYaml, fail: message => { throw new SyncError('HFS_SYNC_SONAR_KEY', message); } });
-  return { hfs, targets: renderTargets(hfs, presets ?? await loadPresets(root, hfs.edition), { sonarKey, manifest, source: appSource(root) }) };
+  return { hfs, targets: renderTargets(hfs, presets ?? await loadPresets(root), { sonarKey, manifest, source: appSource(root) }) };
 }
 
 /** `starci app sync --check | --write [--cwd <dir>]` at the app root; returns 0 clean, 1 drift, 2 usage. */

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -17,6 +17,10 @@ concurrency:
 jobs:
   ci:
     runs-on: ubuntu-latest
+    # id-token: write lets the Codecov upload authenticate with GitHub's OIDC token: no repository secret, no silent skip.
+    permissions:
+      contents: read
+      id-token: write
     env:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     steps:
@@ -36,6 +40,16 @@ jobs:
         run: npm run format:check
       - name: typecheck
         run: npm run typecheck
+      - name: unit
+        run: npm test -- --ci
+      - name: coverage upload
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        if: ${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') }}
+        with:
+          use_oidc: true
+          files: {{lcovReport}}
+          disable_search: true
+          fail_ci_if_error: true
       - name: build be
         run: npm run build:be
       - name: build fe

package/templates/app/codegen-graphql.mjs.partial

@@ -0,0 +1,34 @@
+// GraphQL wire types, the same in both editions (owner ruling 2026-10-13): every fe app with operations under
+// src/modules/api/graphql/{queries,mutations} gets its typed documents generated from the contract snapshots the back end emits
+// (be/contracts/<app>/schema.graphql, `npm run contract:emit`) into the gitignored src/modules/api/graphql/__generated__/.
+// Nothing to generate (no snapshot yet, or no fe app with a modules/api/graphql folder) is not an error.
+const CONTRACTS = path.join("be", "contracts")
+const FE_APPS = path.join("fe", "apps")
+const posix = (file) => file.split(path.sep).join("/")
+const schemas = (fs.existsSync(CONTRACTS) ? fs.readdirSync(CONTRACTS) : [])
+    .map((app) => path.join(CONTRACTS, app, "schema.graphql"))
+    .filter((file) => fs.existsSync(file))
+    .sort()
+    .map(posix)
+const operationRoots = (fs.existsSync(FE_APPS) ? fs.readdirSync(FE_APPS) : [])
+    .map((app) => path.join(FE_APPS, app, "src", "modules", "api", "graphql"))
+    .filter((dir) => fs.existsSync(dir))
+    .sort()
+    .map(posix)
+if (schemas.length === 0 || operationRoots.length === 0) {
+    process.stdout.write("codegen: no GraphQL contract under be/contracts yet\n")
+} else {
+    const { generate } = await import("@graphql-codegen/cli")
+    const generates = Object.fromEntries(
+        operationRoots.map((root) => [
+            `${root}/__generated__/`,
+            {
+                preset: "client",
+                documents: [`${root}/queries/*.ts`, `${root}/mutations/*.ts`],
+                presetConfig: { fragmentMasking: false },
+                config: { useTypeImports: true, enumsAsTypes: true, avoidOptionals: true },
+            },
+        ]),
+    )
+    await generate({ schema: schemas, generates, ignoreNoDocuments: true, silent: true }, true)
+}

package/templates/app/codegen-lite/scripts/codegen.mjs

@@ -2,6 +2,7 @@
 // Database types hook, offline: the app compiles against the committed supabase/types/database.types.ts, which `npm run contract:emit`
 // regenerates from the local stack and stamps with the digest of the migrations it was generated from. This refuses a missing or
 // stale file, so lint, typecheck, dev and build never run against types older than the migrations; it starts nothing and needs no stack.
+// `--graphql` runs only the GraphQL wire types below (`npm run codegen:graphql`).
 import { createHash } from "node:crypto"
 import fs from "node:fs"
 import path from "node:path"
@@ -15,18 +16,22 @@ const fail = (message) => {
     process.exit(1)
 }
 
-const hash = createHash("sha256")
-for (const name of (fs.existsSync(MIGRATIONS) ? fs.readdirSync(MIGRATIONS) : [])
-    .filter((file) => file.endsWith(".sql"))
-    .sort()) {
-    hash.update(`${name}\0${fs.readFileSync(path.join(MIGRATIONS, name), "utf8").replace(/\r\n/g, "\n")}\0`)
+if (!process.argv.includes("--graphql")) {
+    const hash = createHash("sha256")
+    for (const name of (fs.existsSync(MIGRATIONS) ? fs.readdirSync(MIGRATIONS) : [])
+        .filter((file) => file.endsWith(".sql"))
+        .sort()) {
+        hash.update(`${name}\0${fs.readFileSync(path.join(MIGRATIONS, name), "utf8").replace(/\r\n/g, "\n")}\0`)
+    }
+    const digest = hash.digest("hex")
+
+    if (!fs.existsSync(TYPES))
+        fail(`${TYPES} is missing; start the local stack and run \`npm run contract:emit\`, then commit it`)
+    const stamped = STAMP.exec(fs.readFileSync(TYPES, "utf8").split(/\r?\n/, 1)[0])?.[1]
+    if (stamped !== digest)
+        fail(
+            `${TYPES} is ${stamped === undefined ? "not stamped" : "older than the migrations"}; run \`npm run contract:emit\` and commit the regenerated types`,
+        )
 }
-const digest = hash.digest("hex")
 
-if (!fs.existsSync(TYPES))
-    fail(`${TYPES} is missing; start the local stack and run \`npm run contract:emit\`, then commit it`)
-const stamped = STAMP.exec(fs.readFileSync(TYPES, "utf8").split(/\r?\n/, 1)[0])?.[1]
-if (stamped !== digest)
-    fail(
-        `${TYPES} is ${stamped === undefined ? "not stamped" : "older than the migrations"}; run \`npm run contract:emit\` and commit the regenerated types`,
-    )
+// {{> app/codegen-graphql.mjs.partial}}