@starci/hfs 4.7.32 → 4.7.33

package/runtime/scripts/lib/gate-loosening.mjs

@@ -1,292 +0,0 @@
-// gate-loosening.mjs — what "loosens a gate" means, mechanically (modules/kernel/gate-loosening.yaml), over the unified diff of one change.
-// A loosening is one of:
-//   check-removed      a list item removed from a gate file and not added back in the same file (an item that carries an id is the
-//                      same item while an added item carries that id: a row whose fields change stays a check)
-//   check-narrowed     an enforcer row `{kind, id, editions}` that keeps its kind and id but now runs in fewer editions (a lost restriction or
-//                      a superset of editions is a widening, never a loosening)
-//   threshold-lowered  a number of a gate file moved the loose way: a floor lowered, a ceiling raised
-//   allowlist-added    a list item added to an allowlist file
-//   spec-deleted       a spec file deleted in a change that also changes product code
-//   assertion-weakened a spec that loses more assertions than it gains in a change that also changes product code
-//   spec-skipped       a skip marker added to a spec in a change that also changes product code
-//   bypass-added, check-weakened, scope-widened (and check-removed over code): the code of a check is a gate too. A check script, rule module,
-//                      canon template, lint package, workflow or hook (modules/kernel/gate-loosening.yaml checkCode) that gains a bypass marker,
-//                      loses enforcement lines or ban-list rows, or gains an exemption is judged by scripts/lib/check-code-loosening.mjs
-// A change that renames paths (a git rename, `git diff -M`) may MOVE the entries that name them: a removed line and an added line of the
-// same file that are equal once every renamed prefix of the removed line is rewritten to its new name are one entry moved, not a check
-// removed and an exception added (renamedPrefixesOf, movedLinesOf). A moved entry that also changes in any other way (a widened glob, an
-// extra path) is still judged as a removal and an addition.
-// The finding id is `<kind>:<file>:<detail>`. A loosening is always red (owner ruling loosening-always-red, 2026-10-22): there is no
-// approval that lets one through, so a change that loosens a gate is fixed by restoring the gate (looseningStep).
-// Only what a release shipped can be loosened (loosensReleased): a check, a spec or an assertion added after the release and folded
-// away before the next one never was a gate of a release.
-import { byCodeUnit } from './list.mjs';
-import { checkCodeFindings, isCheckCode } from './check-code-loosening.mjs';
-
-const LIST_ITEM = /^\s*-\s+\S/;
-const NUMBER_LINE = /^\s*(?:-\s+)?([A-Za-z][\w.-]*):\s*(-?\d+(?:\.\d+)?)\s*(?:#.*)?$/;
-/** A line of a JSON or JavaScript config as the YAML number line above reads it: no quotes around the key, no trailing comma or line comment. */
-function plainNumberLine(line) {
-  const comment = line.indexOf('//');
-  const code = (comment < 0 ? line : line.slice(0, comment)).trimEnd();
-  return (code.endsWith(',') ? code.slice(0, -1) : code).replace(/^(\s*(?:-\s+)?)["']([^"']+)["']:/, '$1$2:');
-}
-
-const concatenates = (line) => typeof line === 'string' && line.trimEnd().endsWith('+');
-
-/** Records one changed line of `current`; returns the removed text (the next line's `above`), or null. */
-function recordLine(current, line, section, above) {
-  if (line.startsWith('deleted file mode')) { current.deleted = true; return null; }
-  if (line.startsWith('+') && !line.startsWith('+++')) {
-    const text = line.slice(1);
-    current.added.push(text);
-    current.under.set(text, [...(current.under.get(text) ?? []), section]);
-    return null;
-  }
-  if (!line.startsWith('-') || line.startsWith('---')) return null;
-  const text = line.slice(1);
-  current.removed.push(text);
-  if (concatenates(above) || concatenates(text)) current.operands.add(text);
-  return text;
-}
-
-/**
- * The files of a unified diff: [{file, deleted, added[], removed[], under}] (changed lines without their marker). `under` maps an added line to the
- * hunk headers it was added under (git prints the nearest line above the hunk that starts a word, so the key a YAML list item sits in).
- * `operands` holds the removed lines that are an operand of a string concatenation: a line that ends in `+`, or one whose removed line just
- * above it in the same hunk ends in `+` (a message being printed, never a row of a ban list).
- */
-export function parseDiff(text) {
-  const files = [];
-  let current = null;
-  let section = '';
-  let above = null;
-  for (const line of String(text ?? '').split(/\r?\n/)) {
-    const header = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
-    if (header) { current = { file: header[2], deleted: false, added: [], removed: [], operands: new Set(), under: new Map() }; files.push(current); above = null; continue; }
-    if (!current) continue;
-    const hunk = /^@@ .*? @@ ?(.*)$/.exec(line);
-    if (hunk) { section = hunk[1]; above = null; continue; }
-    above = recordLine(current, line, section, above);
-  }
-  return files;
-}
-
-/** The rename lines `R<score> <old> <new>` (tab separated) of `git diff --name-status -M`: [{from, to}]. */
-const renamesOf = (nameStatus) => String(nameStatus ?? '').split(/\r?\n/).map((line) => line.split('\t'))
-  .filter((fields) => /^R\d*$/.test(fields[0] ?? '') && fields.length === 3).map(([, from, to]) => ({ from, to }));
-
-/** The moved prefix of one renamed file: its old and new path without the trailing segments they share. */
-function movedPrefixOf({ from, to }) {
-  const before = from.split('/');
-  const after = to.split('/');
-  while (before.length > 1 && after.length > 1 && before.at(-1) === after.at(-1)) { before.pop(); after.pop(); }
-  return { from: before.join('/'), to: after.join('/') };
-}
-
-/**
- * The path prefixes a change renamed, from its `git diff --name-status -M` output: [{from, to}], longest `from` first. A prefix is kept only
- * when every renamed file under it moved to the same new prefix; an old prefix that went two ways names no single move and is dropped.
- */
-export function renamedPrefixesOf(nameStatus) {
-  const targets = new Map();
-  for (const { from, to } of renamesOf(nameStatus).map(movedPrefixOf)) {
-    if (from === to) continue;
-    if (!targets.has(from)) targets.set(from, new Set());
-    targets.get(from).add(to);
-  }
-  return [...targets].filter(([, to]) => to.size === 1).map(([from, to]) => ({ from, to: [...to][0] }))
-    .sort((a, b) => b.from.length - a.from.length || byCodeUnit(a.from, b.from));
-}
-
-const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-
-/** `line` with every renamed prefix rewritten to its new name; a prefix matches only as a whole path (not inside a longer name). */
-function renamedLine(line, prefixes) {
-  return prefixes.reduce((text, { from, to }) => text.replace(new RegExp(String.raw`(?<![\w./-])${escapeRegExp(from)}(?![\w.-])`, 'g'), to), line);
-}
-
-/**
- * One file of a change without its moved entries: each removed line whose renamed form is exactly an added line is paired with it, and
- * both are left out. A line the rename does not touch is never paired, so an entry merely removed or added stays.
- */
-export function movedLinesOf(entry, prefixes) {
-  if (!prefixes.length) return entry;
-  const unpaired = new Map();
-  for (const line of entry.added) unpaired.set(line, (unpaired.get(line) ?? 0) + 1);
-  const paired = new Map();
-  const removed = entry.removed.filter((line) => {
-    const moved = renamedLine(line, prefixes);
-    if (moved === line || (unpaired.get(moved) ?? 0) <= 0) return true;
-    unpaired.set(moved, unpaired.get(moved) - 1);
-    paired.set(moved, (paired.get(moved) ?? 0) + 1);
-    return false;
-  });
-  const added = entry.added.filter((line) => {
-    if ((paired.get(line) ?? 0) <= 0) return true;
-    paired.set(line, paired.get(line) - 1);
-    return false;
-  });
-  return { ...entry, added, removed };
-}
-
-const keyWords = (key) => key.replace(/([a-z])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
-const trimmed = (line) => line.trim();
-const clip = (text) => (text.length > 90 ? `${text.slice(0, 89)}…` : text);
-
-/** What makes a list item the same item: its id when it carries one, else its text. */
-function identityOf(line) {
-  const item = trimmed(line).slice(1).trimStart();
-  const body = (item.startsWith('{') ? item.slice(1) : item).trimStart();
-  if (!body.startsWith('id:')) return trimmed(line);
-  const id = body.slice(3).trimStart().split(/[,}\s]/)[0];
-  return id ? `id:${id}` : trimmed(line);
-}
-
-/** Splits `a: 1, b: [x, y]` at the commas outside square brackets. */
-function splitTopLevel(text) {
-  const parts = [];
-  let depth = 0;
-  let from = 0;
-  for (let at = 0; at < text.length; at += 1) {
-    if (text[at] === '[') depth += 1;
-    else if (text[at] === ']') depth -= 1;
-    else if (text[at] === ',' && depth === 0) { parts.push(text.slice(from, at)); from = at + 1; }
-  }
-  parts.push(text.slice(from));
-  return parts;
-}
-
-/** The flow-mapping enforcer row `- {kind: k, id: i, editions: [a, b]}`: {kind, id, editions} (editions null = every edition), or null. */
-function flowRow(line) {
-  const text = line.trim();
-  if (!text.startsWith('-')) return null;
-  const open = text.indexOf('{');
-  const close = text.lastIndexOf('}');
-  if (open < 1 || close < open || text.slice(1, open).trim() !== '') return null;
-  const fields = new Map();
-  for (const part of splitTopLevel(text.slice(open + 1, close))) {
-    const at = part.indexOf(':');
-    if (at > 0) fields.set(part.slice(0, at).trim(), part.slice(at + 1).trim());
-  }
-  if (!fields.has('kind') || !fields.has('id')) return null;
-  const editions = fields.get('editions');
-  const list = editions === undefined ? null : editions.replace('[', '').replace(']', '').split(',').map((value) => value.trim()).filter(Boolean);
-  return { kind: fields.get('kind'), id: fields.get('id'), editions: list };
-}
-
-/** Whether row `after` still runs everywhere row `before` ran: a lost restriction or a superset of editions widens, a subset narrows. */
-const coversEditions = (before, after) => after.editions === null || (before.editions !== null && before.editions.every((edition) => after.editions.includes(edition)));
-
-/** The removed list items of a gate file that no added line restores; an enforcer row that keeps its kind and id may only widen its editions. */
-function checksRemoved(entry) {
-  const back = new Map();
-  for (const line of entry.added.filter((value) => LIST_ITEM.test(value))) back.set(identityOf(line), (back.get(identityOf(line)) ?? 0) + 1);
-  const addedRows = entry.added.map(flowRow).filter(Boolean);
-  return entry.removed.filter((value) => LIST_ITEM.test(value)).flatMap((value) => {
-    const row = flowRow(value);
-    if (row) {
-      const same = addedRows.filter((candidate) => candidate.kind === row.kind && candidate.id === row.id);
-      if (same.length) {
-        if (same.some((candidate) => coversEditions(row, candidate))) return [];
-        return [{ kind: 'check-narrowed', file: entry.file, detail: clip(trimmed(value)) }];
-      }
-    }
-    const left = back.get(identityOf(value)) ?? 0;
-    if (left > 0) { back.set(identityOf(value), left - 1); return []; }
-    return [{ kind: 'check-removed', file: entry.file, detail: clip(trimmed(value)) }];
-  });
-}
-
-const numbersOf = (lines) => lines.map((line) => NUMBER_LINE.exec(plainNumberLine(line))).filter(Boolean).map((match) => ({ key: match[1], value: Number(match[2]) }));
-
-/** The thresholds of a gate file moved the loose way. */
-function thresholdsLowered(entry, rules) {
-  const added = numbersOf(entry.added);
-  return numbersOf(entry.removed).flatMap((before) => {
-    const after = added.find((candidate) => candidate.key === before.key);
-    if (!after || after.value === before.value) return [];
-    const words = keyWords(before.key);
-    const lowered = words.some((word) => rules.thresholds.floors.includes(word)) && after.value < before.value;
-    const raised = words.some((word) => rules.thresholds.ceilings.includes(word)) && after.value > before.value;
-    return lowered || raised ? [{ kind: 'threshold-lowered', file: entry.file, detail: `${before.key} ${before.value} -> ${after.value}` }] : [];
-  });
-}
-
-const SPEC_NAME = /\.spec\.[cm]?[jt]sx?$/;
-const isSpec = (file, rules) => rules.specRoots.some((root) => file.startsWith(root)) && SPEC_NAME.test(file);
-const countOf = (lines, markers) => lines.filter((line) => markers.some((marker) => line.includes(marker))).length;
-
-const baseName = (file) => file.slice(file.lastIndexOf('/') + 1);
-
-/** Whether a spec of the same name is written elsewhere in the change: a moved spec is not a deleted one. */
-const movedSpec = (entry, files, rules) => files.some((other) => other !== entry && !other.deleted && isSpec(other.file, rules) && baseName(other.file) === baseName(entry.file));
-
-/** The spec findings of one file of a change that also changes product code. */
-function specFindings(entry, files, rules) {
-  if (entry.deleted) return movedSpec(entry, files, rules) ? [] : [{ kind: 'spec-deleted', file: entry.file, detail: 'deleted' }];
-  const weaker = countOf(entry.removed, rules.assertionMarkers) - countOf(entry.added, rules.assertionMarkers);
-  const skipped = countOf(entry.added, rules.skipMarkers) - countOf(entry.removed, rules.skipMarkers);
-  return [...(weaker > 0 ? [{ kind: 'assertion-weakened', file: entry.file, detail: `${weaker} assertion(s) fewer` }] : []),
-    ...(skipped > 0 ? [{ kind: 'spec-skipped', file: entry.file, detail: `${skipped} skip marker(s) added` }] : [])];
-}
-
-const changesProduct = (files, rules) => files.some((entry) => !isSpec(entry.file, rules) && rules.productPrefixes.some((prefix) => entry.file.startsWith(prefix)));
-
-/** The findings of one file that is a gate file (its lists and numbers) or the code of a check (its numbers; its bypasses are checkCodeFindings'). */
-function gateFindings(entry, rules) {
-  if (rules.gateFiles.includes(entry.file)) return [...checksRemoved(entry), ...thresholdsLowered(entry, rules)];
-  return isCheckCode(entry.file, rules) ? thresholdsLowered(entry, rules) : [];
-}
-
-/**
- * Every loosening of the change `diffText`, sorted: [{id, kind, file, detail}]. `rules` is modules/kernel/gate-loosening.yaml; `renamed`
- * is the change's renamed prefixes (renamedPrefixesOf), whose moved entries are no loosening.
- */
-export function looseningsOf(diffText, rules, { renamed = [] } = {}) {
-  const files = parseDiff(diffText).map((entry) => movedLinesOf(entry, renamed));
-  const product = changesProduct(files, rules);
-  const found = files.flatMap((entry) => [
-    ...gateFindings(entry, rules),
-    ...(rules.allowlistFiles.includes(entry.file) ? entry.added.filter((value) => LIST_ITEM.test(value)).map((value) => ({ kind: 'allowlist-added', file: entry.file, detail: clip(trimmed(value)) })) : []),
-    ...(product && isSpec(entry.file, rules) ? specFindings(entry, files, rules) : []),
-  ]).concat(checkCodeFindings(files, rules));
-  return found.map((finding) => ({ ...finding, id: `${finding.kind}:${finding.file}:${finding.detail}` })).sort((a, b) => byCodeUnit(a.id, b.id));
-}
-
-/** One finding as the land gate and the self-check print it. */
-export const looseningLine = (finding) => `${finding.kind} ${finding.file}: ${finding.detail}`;
-
-/**
- * The land gate's step for a change that loosens a gate: always red, with the way out that exists, restoring the gate. There is no
- * approval: a loosening never lands (owner ruling loosening-always-red).
- */
-export const looseningStep = (findings) => ({
-  name: 'gate-loosening', ok: false, findings, output: findings.map(looseningLine).join('\n'),
-  hint: 'a change that loosens a gate never lands (owner ruling loosening-always-red): restore every gate listed above',
-});
-
-const assertionsIn = (text, markers) => String(text ?? '').split('\n').filter((line) => markers.some((marker) => line.includes(marker))).length;
-
-/** The detail of a check-removed finding without its clipping mark: the start of the removed line. */
-const shownDetail = (detail) => (detail.endsWith('…') ? detail.slice(0, -1) : detail);
-
-/**
- * Whether `finding` loosens the state released at `base`, read through `read(rev, file)` (text, or null when the revision holds no such
- * file); `rules` gives the assertion markers. A finding stays only when
- *   bypass-added        the added line is still in the file at HEAD (a bypass folded away before the next release never shipped)
- *   check-removed       the removed list item is an item of that gate file at the release commit
- *   spec-deleted        the spec exists at the release commit
- *   spec-skipped        the spec exists at the release commit
- *   assertion-weakened  the spec exists at the release commit and holds fewer assertion lines now than it held there
- * (every other kind loosens whenever its file existed at the release).
- */
-export function loosensReleased(finding, { base, read, rules }) {
-  // A bypass is judged by whether it still stands: one added and folded away before the next release never shipped.
-  if (finding.kind === 'bypass-added') return String(read('HEAD', finding.file) ?? '').split('\n').some((line) => line.trim() === finding.text);
-  const before = read(base, finding.file);
-  if (before === null) return false;
-  if (finding.kind === 'check-removed') return before.split('\n').some((line) => line.trim().startsWith(shownDetail(finding.detail)));
-  if (finding.kind !== 'assertion-weakened') return true;
-  return assertionsIn(read('HEAD', finding.file), rules.assertionMarkers) < assertionsIn(before, rules.assertionMarkers);
-}

package/templates/app/upgrade-full/.starcistacks/application-stacks.yaml

@@ -1,89 +0,0 @@
-schema: starci/application-stacks@1
-# To render README badges, declare ci.github: {repository: owner/repo, defaultBranch: main}.
-# A GitHub package.json repository URL also enables the managed block.
-sources:
-  - repository: "{{project}}"
-components:
-  supabase-postgres:
-    image: postgres:16@sha256:1a6ab3f5345eb6dbe04a1349529caabdb0ab09293a09590fad07b2246bfa4b54
-    role: stateful
-    compose: infra/compose/postgres.yaml
-    purpose: The pinned PostgreSQL-compatible database behind the Supabase project.
-    required: true
-  api:
-    image: "{{project}}/api:0.0.0"
-    role: service
-    compose: infra/compose/api.yaml
-    purpose: The Nest API that owns privileged and cross-tenant operations.
-    required: true
-environments:
-  dev:
-    status: supported
-    runtime: docker-compose
-    composeFiles:
-      - infra/compose/compose.yaml
-    components:
-      supabase-postgres: { port: 5432 }
-      api: { port: 3001 }
-    runbook: README.md
-    secrets: []
-k8s:
-  status: deferred
-  reason: The upgrade establishes the full local stack first; deployment topology is selected separately.
-ci:
-  secrets:
-    - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app}
-    - {name: SOPS_AGE_KEY, scope: repository, purpose: Decrypt app members during deployment, optional: true}
-    - {name: VPS_SSH_KEY, scope: repository, purpose: Deployment SSH key, optional: true}
-    - {name: VPS_KNOWN_HOSTS, scope: repository, purpose: Pinned deployment SSH host keys, optional: true}
-  vars:
-    - {name: SONAR_HOST_URL, scope: repository, value: "https://sonar.{{project}}.example.invalid", purpose: Documentation endpoint to replace with this app's public Sonar host}
-    - {name: VPS_HOST, scope: repository, value: 203.0.113.10, purpose: Documentation deployment address to replace before use, optional: true}
-    - {name: VPS_USER, scope: repository, value: deploy, purpose: Documentation deployment user to replace before use, optional: true}
-services:
-  sonar:
-    provider: sonarqube
-    mode: disabled
-    reason: Enable the repository's Sonar service when a host and project token are provisioned.
-    qualityGate: starci-quality
-    credentials: []
-    projects: [{repository: "{{project}}", key: "{{project}}"}]
-    ci: {wiring: required, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
-    ownerAction: none
-  codecov:
-    provider: codecov
-    mode: hosted
-    purpose: Report application coverage through GitHub OIDC.
-    auth: oidc
-    target: 100
-    components: auto
-    required: true
-    ci: {wiring: required, workflow: .github/workflows/ci.yml}
-    ownerAction: none
-  dependabot:
-    provider: github
-    mode: hosted
-    purpose: Keep application dependencies and workflow actions current.
-    ecosystems: [npm, docker, github-actions]
-    schedule: {interval: weekly}
-    groups: {minorPatch: grouped, major: per-package}
-    ignore: ['@starci/*']
-    security: immediate
-    ownerAction: none
-  audit:
-    provider: npm
-    mode: local
-    purpose: Refuse high severity production dependency vulnerabilities.
-    level: high
-    omitDev: true
-    in: [release-gate, ci]
-    ownerAction: none
-  container-registry:
-    provider: ghcr
-    mode: hosted
-    purpose: Publish this app's deployment images with the workflow GitHub token.
-    host: {public: https://ghcr.io}
-    auth: github-token
-    projects: [{repository: "{{project}}", key: "{{project}}"}]
-    ci: {wiring: required}
-    ownerAction: none

package/templates/app/upgrade-full/.starcistacks/dev/README.md

@@ -1,16 +0,0 @@
-# Development stack
-
-The app services may run in a local Docker Swarm; local Supabase is started separately with its CLI and supplies the database and broker. The tracked model contains no self-hosted database.
-Starter release images and external secrets must be prepared before starting the container model. Replace its starter `SUPABASE_URL` with the local Supabase endpoint reachable from the Swarm node, and seal that local database connection and integration credential; a container cannot use the host's loopback address without owner-configured networking. Local source development remains available through the app scripts.
-
-| Command | Operation |
-| --- | --- |
-| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes. Create the external development secrets named in the model from real sealed members. |
-| doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
-| up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
-| status | Run `docker stack services {{project}}-dev`. |
-| logs | Run `docker service logs {{project}}-dev_api`; never print mounted credentials. |
-| down | Run `docker stack rm {{project}}-dev`. |
-| verification | Confirm the API `/health/live` and `/health/ready` endpoints, then run `npm run lint` from the app root. |
-
-Keep real sealed members under `.starcistacks/dev/secrets/*.enc`, add them to the manifest after sealing and inventory their key names in the environment record. The scaffold creates no fake secret or successful proof.

package/templates/app/upgrade-full/.starcistacks/dev/infra/compose/api.yaml

@@ -1,13 +0,0 @@
-services:
-  api:
-    image: "{{project}}/api:0.0.0"
-    build:
-      context: ../../../..
-      dockerfile: be/apps/api/Dockerfile
-    environment:
-      PRIMARY_DB_URL: postgres://postgres@supabase-postgres:5432/postgres
-    ports:
-      - "3001:3000"
-    depends_on:
-      supabase-postgres:
-        condition: service_healthy

package/templates/app/upgrade-full/.starcistacks/dev/infra/compose/compose.yaml

@@ -1,3 +0,0 @@
-include:
-  - postgres.yaml
-  - api.yaml

package/templates/app/upgrade-full/.starcistacks/dev/infra/compose/postgres.yaml

@@ -1,12 +0,0 @@
-services:
-  supabase-postgres:
-    image: postgres:16@sha256:1a6ab3f5345eb6dbe04a1349529caabdb0ab09293a09590fad07b2246bfa4b54
-    environment:
-      POSTGRES_HOST_AUTH_METHOD: trust
-    ports:
-      - "5432:5432"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 5s
-      timeout: 5s
-      retries: 12

package/templates/app/upgrade-full/.starcistacks/dev/infra/metadata.json

@@ -1,7 +0,0 @@
-{
-  "project": "{{project}}",
-  "ports": {
-    "api": 3001,
-    "supabasePostgres": 5432
-  }
-}

package/templates/be/skeleton-lite/apps/api/src/main.ts

@@ -1,26 +0,0 @@
-import { NestFactory } from "@nestjs/core"
-import { SystemClockService } from "@modules/platform/clock"
-import { EnvSource } from "@modules/platform/config"
-import { applyHttpSecurity } from "@modules/platform/http-security"
-import { createJsonLogger, LoggingLogEvent } from "@modules/platform/logging"
-import { readApiEnv } from "./api.env"
-import { AppModule } from "./app.module"
-
-/** Reads the environment once, composes the API from parsed options and serves until a shutdown signal. */
-const bootstrap = async (): Promise<void> => {
-    const env = EnvSource.fromProcess()
-    const options = readApiEnv(env)
-    const app = await NestFactory.create(AppModule.register(options), { rawBody: true })
-    applyHttpSecurity(app, options.httpSecurity, { trustProxy: 1 })
-    app.enableShutdownHooks()
-    await app.listen(options.server.port)
-    createJsonLogger(new SystemClockService()).info(LoggingLogEvent.ServerStarted, {
-        service: "api",
-        port: options.server.port,
-    })
-}
-
-bootstrap().catch((error: unknown) => {
-    createJsonLogger(new SystemClockService()).error(LoggingLogEvent.StartupFailed, error, { service: "api" })
-    process.exitCode = 1
-})

package/templates/be/upgrade-full/apps/cli/src/app.module.ts

@@ -1,12 +0,0 @@
-import { Module } from "@nestjs/common";
-import { cliModules } from "./compose/cli";
-import { platformModules } from "./compose/platform";
-
-@Module({
-  imports: [
-    ...platformModules(),
-    ...cliModules(),
-  ],
-})
-/** The cli composition root; database schema changes remain delegated to the Supabase CLI. */
-export class AppModule {}

package/templates/be/upgrade-full/apps/cli/src/cli.env.ts

@@ -1,7 +0,0 @@
-import type { EnvSource } from "@modules/platform/config"
-
-/** This command app delegates migration configuration to the managed Supabase CLI. */
-export interface CliEnv {}
-
-/** Keeps the command app's environment boundary explicit while no command needs app configuration. */
-export const readCliEnv = (_env: EnvSource): CliEnv => ({})

package/templates/be/upgrade-full/apps/cli/src/compose/cli.ts

@@ -1,5 +0,0 @@
-import type { DynamicModule, Type } from "@nestjs/common"
-import { CliModule } from "@features/cli"
-
-/** The command groups of the upgraded CLI app. */
-export const cliModules = (): Array<Type<unknown> | DynamicModule> => [CliModule.register({})]

package/templates/be/upgrade-full/apps/cli/src/compose/platform.ts

@@ -1,9 +0,0 @@
-import type { DynamicModule } from "@nestjs/common"
-import { ClockModule } from "@modules/platform/clock"
-import { LoggingModule } from "@modules/platform/logging"
-
-/** The shared clock and logger; migrations retain their Supabase CLI authority. */
-export const platformModules = (): Array<DynamicModule> => [
-    ClockModule.register({ isGlobal: true }),
-    LoggingModule.register({ isGlobal: true }),
-]

package/templates/be/upgrade-full/apps/cli/src/main.ts

@@ -1,29 +0,0 @@
-import "reflect-metadata";
-import { CommandFactory } from "nest-commander";
-import { SystemClockService } from "@modules/platform/clock";
-import { EnvSource } from "@modules/platform/config";
-import { createJsonLogger, LoggingLogEvent } from "@modules/platform/logging";
-import { AppModule } from "./app.module";
-import { readCliEnv } from "./cli.env";
-
-/** The one-off command app. Its migrate command delegates schema authority to the Supabase CLI. */
-async function bootstrap(): Promise<void> {
-  readCliEnv(EnvSource.fromProcess());
-  const logger = createJsonLogger(new SystemClockService());
-  await CommandFactory.run(AppModule, {
-    logger: false,
-    errorHandler: (error: Error) => {
-      logger.error(LoggingLogEvent.StartupFailed, error, { service: "cli" });
-      process.exit(1);
-    },
-  });
-}
-
-bootstrap().catch((error: unknown) => {
-  createJsonLogger(new SystemClockService()).error(
-    LoggingLogEvent.StartupFailed,
-    error,
-    { service: "cli" },
-  );
-  process.exit(1);
-});

package/templates/be/upgrade-full/src/features/cli/cli.module.ts

@@ -1,7 +0,0 @@
-import { Module } from "@nestjs/common";
-import { ConfigurableModuleClass } from "./cli.module-definition";
-import { MigrateModule } from "./migrate/migrate.module";
-
-@Module({ imports: [MigrateModule.register({})] })
-/** The cli feature root of the upgraded app. */
-export class CliModule extends ConfigurableModuleClass {}

package/templates/be/upgrade-full/src/features/cli/migrate/subs/run.cli.ts

@@ -1,23 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { CommandRunner, SubCommand } from "nest-commander";
-
-@SubCommand({
-  name: "run",
-  description: "Apply the Supabase migrations",
-})
-/** `cli migrate run`: delegates the schema authority under supabase/migrations to the Supabase CLI. */
-export class RunCli extends CommandRunner {
-  /** Runs the installed Supabase CLI in the app root and preserves its exit result. */
-  async run(): Promise<void> {
-    const command = process.platform === "win32" ? "supabase.cmd" : "supabase";
-    const result = spawnSync(command, ["db", "push"], {
-      cwd: process.cwd(),
-      stdio: "inherit",
-    });
-    if (result.error !== undefined) throw result.error;
-    if (result.status !== 0)
-      throw new Error(
-        `supabase db push exited ${result.status ?? "without a status"}`,
-      );
-  }
-}