@starci/hfs 4.2.17 → 4.4.0

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/stack.yaml

@@ -0,0 +1,120 @@
+# Illustrative development model. Replace all-zero application digests with verified published release digests before use.
+version: "3.8"
+services:
+  api:
+    image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: development
+      PORT: "3001"
+      HTTP_SECURITY_ALLOWED_ORIGINS: http://dev.{{project}}.example.invalid
+      PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
+      PRIMARY_DB_SCHEMA: public
+      SUPABASE_URL: https://{{project}}.supabase.co
+      SUPABASE_SERVICE_ROLE_KEY_FILE: /run/secrets/supabase-service-role-key
+    secrets:
+      - source: primary-db-url
+        target: primary-db-url
+      - source: supabase-service-role-key
+        target: supabase-service-role-key
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == dev"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  web:
+    image: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: development
+      PORT: "3000"
+      HOSTNAME: 0.0.0.0
+      NEXT_PUBLIC_SITE_URL: http://dev.{{project}}.example.invalid
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == dev"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  ingress:
+    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
+    configs:
+      - source: ingress-config
+        target: /etc/caddy/Caddyfile
+    ports:
+      - { target: 80, published: 80, protocol: tcp, mode: ingress }
+    volumes:
+      - ingress-data:/data
+      - ingress-config-data:/config
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == dev"]
+      update_config:
+        parallelism: 1
+        order: stop-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+networks:
+  app:
+    driver: overlay
+secrets:
+  primary-db-url:
+    external: true
+    name: "{{project}}-dev-primary-db-url-v1"
+  supabase-service-role-key:
+    external: true
+    name: "{{project}}-dev-supabase-service-role-key-v1"
+configs:
+  ingress-config:
+    file: ./Caddyfile
+volumes:
+  ingress-data:
+    external: true
+    name: "{{project}}-dev-ingress-data"
+  ingress-config-data:
+    external: true
+    name: "{{project}}-dev-ingress-config-data"

package/templates/app/skeleton-lite/.starcistacks/dev/runtime/env/KEYS.md

@@ -0,0 +1,18 @@
+# Environment key roster
+
+This roster declares names only. Scaffolding generates the two declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set dev` before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Store product credential values in sealed custody and materialize private KEY files outside the repository.
+
+| Key | Consumer |
+| --- | --- |
+| `PORT` | API listener |
+| `HTTP_SECURITY_ALLOWED_ORIGINS` | API origin allowlist |
+| `PRIMARY_DB_URL` | API primary database connection; `.starcistacks/dev/secrets/primary-db-url.enc` maps to external `{{project}}-dev-primary-db-url-v1` and mounted `/run/secrets/primary-db-url` |
+| `PRIMARY_DB_SCHEMA` | API primary database schema |
+| `SUPABASE_URL` | API Auth and Storage integration |
+| `SUPABASE_SERVICE_ROLE_KEY` | API Auth and Storage integration; `.starcistacks/dev/secrets/supabase-service-role-key.enc` maps to external `{{project}}-dev-supabase-service-role-key-v1` and mounted `/run/secrets/supabase-service-role-key` |
+| `NEXT_PUBLIC_SITE_URL` | Front-end site URL |
+| `NEXT_PUBLIC_GRAPHQL_URL` | Front-end GraphQL transport |
+| `NEXT_PUBLIC_SUPABASE_URL` | Browser Auth client |
+| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Browser Auth client public key |
+
+Public front-end configuration is supplied at build time and stays outside sealed custody. Production database deployment consumes `SUPABASE_ACCESS_TOKEN`, `SUPABASE_DB_PASSWORD` and `SUPABASE_PROJECT_ID` from its environment's sealed custody; the GitHub secret store carries only the age identity.

package/templates/app/skeleton-lite/.starcistacks/production/README.md

@@ -0,0 +1,38 @@
+# Production stack
+
+The tracked model declares Docker Swarm application services and one digest-pinned Caddy ingress.
+Supabase supplies PostgreSQL, Auth and pgmq. This stack runs no PostgreSQL, Redis or MongoDB service.
+The model is a deployment declaration. It contains no owner credentials, real DNS receipt, completed release or restore proof. Public records under `.starcistacks/production/infra/swarm/` explicitly mark those owner-run operations as pending.
+Its application image references contain illustrative all-zero digests; they identify no published image and must be replaced before deployment.
+
+The runtime template tracks no encrypted members. Scaffolding generates the two declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set production` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
+
+| Command | Operation |
+| --- | --- |
+| prepare | Owner provisions the Swarm, node label, database, DNS and real sealed secret members, then runs `starci app stack prepare --env production --execute` to create the missing external volumes (the one-time swarm initialization stays an owner-approved step: `--init-swarm` with `--execute`, after the owner's explicit approval). Release images are built and pushed by the managed the managed stack-deploy workflow. |
+| doctor | Run `starci app stack doctor --env production` (read-only): docker, swarm, volumes, services, secrets, configs and the release pointers on the intended manager. |
+| up | After preparation and review, run the manual stack-deploy workflow (Actions, deploy stack) on a release tag; it builds the images and runs `starci app stack deploy --env production --image <service>=<repository>@sha256:<digest> --source-sha <sha> --execute`. A dry run is `starci app stack render` or `deploy` without `--execute`. |
+| status | Run `starci app stack doctor --env production`, or `starci app stack converge --env production --since <ISO time>` to inspect desired and running replicas plus update state. |
+| logs | Run `docker service logs {{project}}-production_api` on the manager; never include secret values in a receipt. |
+| down | After the owner's removal decision, run `docker stack rm {{project}}-production`; persistent external volumes remain in owner custody. |
+| verification | Run `starci app stack verify --env production` (the journeys declared in `deploy.verify`); also confirm public TLS and a signed-in GraphQL request before moving the release pointer. |
+
+## Owner actions before the first release
+
+Every item is pending. Swarm initialization, provider URIs, DNS changes and key rotation are owner-run steps.
+
+| Area | Required owner action and evidence |
+| --- | --- |
+| Swarm and placement | Initialize the intended manager; label the intended stateful node `{{project}}=production`. Only that node owns the external ingress volumes. |
+| DNS | Replace the reserved `example.invalid` hosts consistently in the manifest, Caddyfile and public configuration; publish address records for the web and API hosts and retain a provider receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
+| TLS | Caddy issues certificates after real DNS resolves. Provision `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data` on the selected node; retain an issuance and renewal receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
+| Database | Provision Supabase and the app_be connection; provider backups remain enabled. Record the provider URI and recovery owner without copying credentials here. |
+| Secret custody | Replace generated placeholder values with real values at the manifest's declared `.starcistacks/production/secrets/*.enc` paths; record their keys in `.starcistacks/production/runtime/env/KEYS.md`. The app's age identity stays only in the host's untracked `.claude/secret.env`. |
+| External secrets | Materialize the sealed members in owner custody and create `{{project}}-production-primary-db-url-v1` and `{{project}}-production-supabase-service-role-key-v1`. The API reads mounted files; rotation creates new versioned names before updating the model. |
+| Public build configuration | Build the front end with its declared public site and GraphQL URLs, the Supabase public URL and anonymous key. Public browser values stay outside sealed secret custody. |
+| Immutable release | Replace the illustrative all-zero application digests in the manifest, model and `.starcistacks/production/infra/swarm/releases/images.lock.yaml` with digests produced by the verified release. Store each rendered release under `/srv/{{project}}/releases/<digest>`. Retain the last accepted record in `.starcistacks/production/infra/swarm/releases/previous.yaml`, then move the current pointer and update `.starcistacks/production/infra/swarm/releases/current.yaml` after verification. |
+| Rollback | Retain the previous model and images, redeploy that model if convergence or health fails, and record the resulting convergence receipt. Database changes follow an expand/contract sequence. |
+| Backup | Provision the manifest's seven days of database PITR and thirty daily encrypted off-host database exports and ingress-volume snapshots. Record the actual destination and encryption custody in `.starcistacks/production/infra/swarm/recovery/restore-proof.md`; the production operator owns both components. |
+| Restore proof | Perform a restore into isolated infrastructure, verify the restored database and ingress state, and attach a dated receipt with artifact digests to `.starcistacks/production/infra/swarm/recovery/restore-proof.md`. Its initial record is pending; no restore has been run by scaffolding. |
+
+No host scheduler is installed. Scheduled application work belongs to the back-end scheduler or an explicitly declared replicated job.

package/templates/app/skeleton-lite/.starcistacks/production/environment.json

@@ -0,0 +1,6 @@
+{
+  "environment": "production",
+  "provider": "supabase",
+  "project": "{{project}}",
+  "runtime": "docker-swarm"
+}

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/Caddyfile

@@ -0,0 +1,11 @@
+{
+    admin 127.0.0.1:2019
+}
+
+{{project}}.example.invalid {
+    reverse_proxy web:3000
+}
+
+api.{{project}}.example.invalid {
+    reverse_proxy api:3001
+}

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/owner-actions.md

@@ -0,0 +1,11 @@
+# Production prerequisite record
+
+Status: pending owner execution. This record states intended configuration and contains no completed operational receipt.
+
+## DNS
+
+The production operator replaces `{{project}}.example.invalid` and `api.{{project}}.example.invalid` with owned public names, updates the manifest, Caddyfile and public configuration together, and publishes address records for the intended Swarm node. Record the provider, zone, actual hosts and dated DNS receipt here.
+
+## TLS
+
+The production operator provisions the external ingress volumes on the declared node and owns Caddy certificate issuance and renewal. After real DNS resolves, record a dated issuance receipt, persistent certificate custody and HTTPS verification for both public hosts here.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/recovery/restore-proof.md

@@ -0,0 +1,7 @@
+# Production recovery record
+
+Status: pending owner execution. No backup or restore has been run by scaffolding.
+
+The production operator owns recovery of the managed Supabase database and both external ingress volumes, `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data`. Provision seven days of provider PITR and thirty daily encrypted off-host database exports. Retain thirty daily encrypted off-host snapshots for both ingress volumes.
+
+Before relying on the backup policy, restore the provider database backup and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored TLS and ingress configuration. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/current.yaml

@@ -0,0 +1,6 @@
+schema: starci/release-pointer@1
+environment: production
+status: pending-owner-release
+release: null
+verification: null
+# Write a real /srv/{{project}}/releases/<digest> reference and dated health receipt only after verification.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/images.lock.yaml

@@ -0,0 +1,8 @@
+# Illustrative inventory only. Replace application digests with verified published images.
+schema: starci/images-lock@1
+environment: production
+status: pending-owner-release
+images:
+  api: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  web: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  ingress: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/previous.yaml

@@ -0,0 +1,6 @@
+schema: starci/release-pointer@1
+environment: production
+status: no-previous-release
+release: null
+verification: null
+# Before moving current, retain the last accepted release here for rollback.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/stack.yaml

@@ -0,0 +1,121 @@
+# Illustrative production model. Replace all-zero application digests with verified published release digests before use.
+version: "3.8"
+services:
+  api:
+    image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: production
+      PORT: "3001"
+      HTTP_SECURITY_ALLOWED_ORIGINS: https://{{project}}.example.invalid
+      PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
+      PRIMARY_DB_SCHEMA: public
+      SUPABASE_URL: https://{{project}}.supabase.co
+      SUPABASE_SERVICE_ROLE_KEY_FILE: /run/secrets/supabase-service-role-key
+    secrets:
+      - source: primary-db-url
+        target: primary-db-url
+      - source: supabase-service-role-key
+        target: supabase-service-role-key
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  web:
+    image: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: production
+      PORT: "3000"
+      HOSTNAME: 0.0.0.0
+      NEXT_PUBLIC_SITE_URL: https://{{project}}.example.invalid
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  ingress:
+    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
+    configs:
+      - source: ingress-config
+        target: /etc/caddy/Caddyfile
+    ports:
+      - { target: 80, published: 80, protocol: tcp, mode: ingress }
+      - { target: 443, published: 443, protocol: tcp, mode: ingress }
+    volumes:
+      - ingress-data:/data
+      - ingress-config-data:/config
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: stop-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+networks:
+  app:
+    driver: overlay
+secrets:
+  primary-db-url:
+    external: true
+    name: "{{project}}-production-primary-db-url-v1"
+  supabase-service-role-key:
+    external: true
+    name: "{{project}}-production-supabase-service-role-key-v1"
+configs:
+  ingress-config:
+    file: ./Caddyfile
+volumes:
+  ingress-data:
+    external: true
+    name: "{{project}}-production-ingress-data"
+  ingress-config-data:
+    external: true
+    name: "{{project}}-production-ingress-config-data"

package/templates/app/skeleton-lite/.starcistacks/production/runtime/env/KEYS.md

@@ -0,0 +1,21 @@
+# Production environment key roster
+
+This inventory declares names, consumers and mounted file paths. Scaffolding generates the two declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set production` after owner provisioning and before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Scaffolding supplies no deployment credential or successful deployment.
+
+| Key | Consumer |
+| --- | --- |
+| `PORT` | API listener |
+| `HTTP_SECURITY_ALLOWED_ORIGINS` | API origin allowlist |
+| `PRIMARY_DB_URL` | API least-privilege database connection; reads `PRIMARY_DB_URL_FILE` at `/run/secrets/primary-db-url` |
+| `PRIMARY_DB_SCHEMA` | API primary database schema |
+| `SUPABASE_URL` | API Auth and Storage integration |
+| `SUPABASE_SERVICE_ROLE_KEY` | API Auth and Storage integration; reads `SUPABASE_SERVICE_ROLE_KEY_FILE` at `/run/secrets/supabase-service-role-key` |
+| `NEXT_PUBLIC_SITE_URL` | Front-end site URL |
+| `NEXT_PUBLIC_GRAPHQL_URL` | Front-end GraphQL transport |
+| `NEXT_PUBLIC_SUPABASE_URL` | Browser Auth client |
+| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Browser Auth client public key |
+| `SUPABASE_ACCESS_TOKEN` | Production database deployment |
+| `SUPABASE_DB_PASSWORD` | Production database deployment |
+| `SUPABASE_PROJECT_ID` | Production database deployment |
+
+Public front-end configuration is supplied at build time and stays outside sealed custody. Set real values in `.starcistacks/production/secrets/primary-db-url.enc` and `.starcistacks/production/secrets/supabase-service-role-key.enc` at the declared paths. Versioned external application secrets are `{{project}}-production-primary-db-url-v1` and `{{project}}-production-supabase-service-role-key-v1`. Seal deployment-only credentials separately under `.starcistacks/production/secrets/*.enc`; they never enter an API container.

package/templates/app/skeleton-lite/.starciwork/brand/index.yaml

@@ -0,0 +1,12 @@
+schema: work/brand@1
+id: brand
+kind: brand
+state: todo
+rev: 1
+brand:
+  identity:
+    name: "{{project}}"
+review:
+  reviewer: the {{project}} owner
+  authority: "The lite scaffold seeds this record so the brand tree exists; the owner settles rev 1 of the brand before the first drawn surface."
+  reviewedAt: "2026-10-14T00:00:00Z"

package/templates/app/skeleton-lite/.starciwork/workspace.yaml

@@ -0,0 +1,9 @@
+schema: work/workspace@1
+id: {{project}}
+project: {{project}}
+description: The Work records of {{project}}, one StarCi app with its back end in be/ and its front end in fe/.
+repositories:
+  - role: be
+    name: be
+  - role: fe
+    name: fe

package/templates/app/skeleton-lite/README.md

@@ -4,7 +4,7 @@ One StarCi lite app: a Nest API in `be/`, one Next web app in `fe/`, and Supabas
 
 ## Overview
 
-The starter keeps one deployable API and one web app, with the same code structure as a full app: the web app calls the API over GraphQL (`src/modules/api`, SWR hooks under `src/hooks/swr`) and uses Supabase only for Auth in the browser (`src/modules/auth`); every data read and write goes through the API, which verifies the access token.
+The starter keeps one deployable API and one web app, with the same code structure as a full app: the web app calls the API over GraphQL (`fe/apps/web/src/modules/api`, SWR hooks under `fe/apps/web/src/hooks/swr`) and uses Supabase only for Auth in the browser (`fe/apps/web/src/modules/auth`); every data read and write goes through the API, which verifies the access token.
 
 ## Stack
 
@@ -14,9 +14,9 @@ TypeScript everywhere, NestJS in `be/`, Next.js with next-intl in `fe/`, Supabas
 
 - `supabase/`: local configuration, forward-only SQL migrations, seed data, and generated database types.
 - `be/`: the API, shared platform capabilities, verified identity admission, and privileged Supabase integrations.
-- `fe/`: the web app; the only Supabase client is the Auth client of `src/modules/auth`, data goes through `src/modules/api`.
+- `fe/`: the web app; the only Supabase client is the Auth client of `fe/apps/web/src/modules/auth`, data goes through `fe/apps/web/src/modules/api`.
 - `.starcistacks/`: value-free environment metadata and encrypted-secret custody.
-- `.starciwork/`: product workspace, brand, and shell records.
+- `.starciwork/`: `.gitignore`, `.starciwork/workspace.yaml` project metadata and repo roles, and optional brand drawing records, references, and assets.
 
 ## Development
 
@@ -34,10 +34,14 @@ The API reads `PORT`, `HTTP_SECURITY_ALLOWED_ORIGINS`, `PRIMARY_DB_URL`, `PRIMAR
 
 `npm test` runs the back end's unit specs with per-file coverage. Optional integration specs run with `npm run test:integration` against the local Supabase stack (`npm run db:start`); a lite app has no e2e world.
 
+The public runtime template tracks only sealed member names. Scaffolding creates this app's own age recipient and encrypts generated placeholder values into the declared `.starcistacks/<environment>/secrets/*.enc` members. Keep the matching host age identity in untracked local custody, then use `starci app secret set` to replace each placeholder with an actual value before deployment. Product apps retain sealed member custody. Runtime specs use disposable copies with ephemeral identities and remove them afterwards.
+
 ## Database changes
 
 Create a forward-only migration under `supabase/migrations`, keep each table's RLS policies and grants beside the table, and run `npm run contract:emit` to refresh `supabase/types/database.types.ts`. `starci app add table <name> --fe` adds the table with its GraphQL feature on the API and its operations and SWR hooks in the web app; `npm run codegen:graphql` regenerates the web app's wire types from `be/contracts/<app>/schema.graphql`.
 
 ## Work
 
-The product's Work records live in `.starciwork`.
+Brand records live in `.starciwork/brand/`. `.starciwork/workspace.yaml` supplies the project id and repo roles so Work tools
+can locate the app root and map brand records to the front end. Lite permits this metadata without brand records; the tree
+is required only when brand records exist, and workspace metadata remains optional.

package/templates/app/skeleton-lite/supabase/config.toml

@@ -3,7 +3,7 @@ project_id = "{{project}}"
 [api]
 enabled = true
 port = {{supabasePortApi}}
-schemas = ["public", "graphql_public"]
+schemas = []
 extra_search_path = ["public", "extensions"]
 max_rows = 1000
 
@@ -25,6 +25,13 @@ port = {{supabasePortInbucket}}
 [analytics]
 port = {{supabasePortAnalytics}}
 
+[edge_runtime]
+enabled = false
+
+[storage]
+enabled = true
+file_size_limit = "50MiB"
+
 [auth]
 enabled = true
 site_url = "http://127.0.0.1:3000"

package/templates/app/skeleton-lite/supabase/migrations/__timestamp___baseline.sql

@@ -1,5 +1,13 @@
-drop role if exists app_be;
-create role app_be login noinherit;
+do $$
+begin
+    if not exists (select 1 from pg_catalog.pg_roles where rolname = 'app_be') then
+        create role app_be login noinherit nosuperuser nobypassrls nocreatedb nocreaterole;
+    end if;
+end;
+$$;
+
+-- The attributes a Supabase migration role may change: SUPERUSER and BYPASSRLS stay as create role set them (the role migration owner is no superuser).
+alter role app_be login noinherit nocreatedb nocreaterole;
 
 create schema if not exists private;
 
@@ -24,6 +32,7 @@ create table public.profiles (
 );
 
 alter table public.profiles enable row level security;
+alter table public.profiles force row level security;
 
 create trigger profiles_set_updated_at
 before update on public.profiles
@@ -34,20 +43,20 @@ create policy profiles_app_be_select
 on public.profiles
 for select
 to app_be
-using (id is not null);
+using (current_user = 'app_be');
 
 create policy profiles_app_be_insert
 on public.profiles
 for insert
 to app_be
-with check (id is not null);
+with check (current_user = 'app_be');
 
 create policy profiles_app_be_update
 on public.profiles
 for update
 to app_be
-using (id is not null)
-with check (id is not null);
+using (current_user = 'app_be')
+with check (current_user = 'app_be');
 
 grant usage on schema public to app_be;
 revoke all on table public.profiles from public, anon, authenticated;

package/templates/app/starciwork.gitignore-lite

@@ -0,0 +1,6 @@
+# StarCi lite .starciwork holds only workspace.yaml and brand/ (plus .gitignore).
+# Runtime output lives in runtime.sqlite rows and blobs outside the repository.
+/*
+!/.gitignore
+!/workspace.yaml
+!/brand/

package/templates/app/upgrade-full/.starcistacks/dev/README.md

@@ -1,10 +1,16 @@
 # Development stack
 
-The full-edition development stack keeps PostgreSQL and the API in one declared Docker Compose project.
+The app services may run in a local Docker Swarm; local Supabase is started separately with its CLI and supplies the database and broker. The tracked model contains no self-hosted database.
+Starter release images and external secrets must be prepared before starting the container model. Replace its starter `SUPABASE_URL` with the local Supabase endpoint reachable from the Swarm node, and seal that local database connection and integration credential; a container cannot use the host's loopback address without owner-configured networking. Local source development remains available through the app scripts.
 
-- Prepare: provide `PRIMARY_DB_URL` to the API through the normal secret custody flow.
-- Up: `docker compose -f infra/compose/compose.yaml up -d`.
-- Status: `docker compose -f infra/compose/compose.yaml ps`.
-- Logs: `docker compose -f infra/compose/compose.yaml logs`.
-- Down: `docker compose -f infra/compose/compose.yaml down`.
-- Verify: call the API health endpoint and run `npm run lint`.
+| Command | Operation |
+| --- | --- |
+| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes. Create the external development secrets named in the model from real sealed members. |
+| doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
+| up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
+| status | Run `docker stack services {{project}}-dev`. |
+| logs | Run `docker service logs {{project}}-dev_api`; never print mounted credentials. |
+| down | Run `docker stack rm {{project}}-dev`. |
+| verification | Confirm the API `/health/live` and `/health/ready` endpoints, then run `npm run lint` from the app root. |
+
+Keep real sealed members under `.starcistacks/dev/secrets/*.enc`, add them to the manifest after sealing and inventory their key names in the environment record. The scaffold creates no fake secret or successful proof.

package/templates/be/image/worker/Dockerfile

@@ -32,5 +32,5 @@ RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
 COPY --from=build /app/be/dist be/dist
 
 USER node
-HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD pgrep -f "apps/{{app}}/src/main.js" > /dev/null || exit 1
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD ["node", "-e", "const fs=require('node:fs');const args=fs.readFileSync('/proc/1/cmdline','utf8').split(String.fromCharCode(0));process.exit(args.includes('be/dist/apps/{{app}}/src/main.js')?0:1)"]
 CMD ["node", "be/dist/apps/{{app}}/src/main.js"]