@starci/hfs 4.7.37 → 4.7.39

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 4.7.39 - 2026-10-26
+- Added: R258 follows the active cron schedule and accepts a declared outbox (`sides.be.queueOutbox`), and the optional slot `app.scripts.integration` carries integration scripts.
+- Fixed: the lite scaffold templates, barrels and dev README follow the lite scaffold end-to-end fixes.
+
+## 4.7.38 - 2026-10-26
+- Changed: the bundled canon pins select @starci/stylelint-canon 2.0.13, @starci/eslint-canon-be 3.4.46, @starci/eslint-canon-fe 9.1.1, the Grammar lint families 0.12.5 and @starci/grammar 0.12.5.
+- Fixed: the full and lite scaffold templates, skeletons and specs follow the scaffold end-to-end and repaint fixes made after 4.7.37.
+
 ## 4.7.37 - 2026-10-26
 - Fixed: the scaffold SiteShell declares viewport=flow so Grammar lint reads it as site chrome, the hygiene sync follows the scaffold end-to-end fixes, and the scaffold json-logger spec expects the logger field order.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.37",
+  "version": "4.7.39",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/grammars/index.yaml

@@ -77,7 +77,7 @@ families:
       package: '@starci/grammar'
       entry: '@starci/grammar/common'
       styleEntry: '@starci/grammar/common.css'
-      peers: [react, '@heroui/react', '@xyflow/react']
+      peers: [react, '@heroui/react', '@xyflow/react', react-aria-components]
     packageSnapshot: common/DNA.yaml
     scope: |
       DNA snapshot only. This catalog carries no Common-side family boundary, idiom set or composition

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -23,42 +23,42 @@ pins:
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
-    version: 0.12.4
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.45
+    version: 3.4.47
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.0
+    version: 9.1.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.4
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.4
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.0.12
+    version: 2.0.13
     group: starci
     install: registry
     side: fe
@@ -91,14 +91,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.37
+    version: 1.7.39
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.37
+    version: 4.7.39
     group: starci
     install: registry
     side: both
@@ -299,6 +299,11 @@ pins:
     group: ui
     side: fe
     why: 'Grammar FlowGraph imports React Flow from @xyflow/react; every Grammar consumer declares this required peer at the version used by the Grammar package.'
+  react-aria-components:
+    version: 1.21.1
+    group: ui
+    side: fe
+    why: 'Grammar imports React Aria Components directly (Sidebar, Field); every Grammar consumer declares this required peer at the version HeroUI resolves.'
   '@heroui/react':
     version: 3.2.6
     group: ui

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -99,7 +99,7 @@ concerns:
     why: useTranslations for copy and the next-intl formatter for numbers, fixed dates and currency; FE-DATE owns live time display.
   - id: ui
     tier: core
-    packages: ['@heroui/react', '@heroui/styles', tailwindcss, '@starci/grammar']
+    packages: ['@heroui/react', '@heroui/styles', tailwindcss, '@starci/grammar', react-aria-components]
     home: [fe.components, fe.feature]
     pattern: FE-UI
     forbids: ['@mantine/core', '@mui/material', '@chakra-ui/react', antd, styled-components, '@emotion/react', '@emotion/styled']

package/runtime/knowledge/hfs/rules.yaml

@@ -4405,7 +4405,7 @@ rules:
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing and ruling:R212/case-10 moves the lite queue to Redis; the pgmq retirement and pg_cron ownership requirements apply to that backing."
     docs: [docs/microservices.md#r258]
     templateNa: "Queue declarations and enqueue-only cron commands depend on product-owned work and are authored in its Supabase migrations."
-    law: "DB_QUEUE_CRON: the queue is BullMQ on Redis (ruling:R212/case-10), so the active migrations leave no pgmq queue named by a queue constant under modules/queues; a pgmq queue a migration created for one is dropped by a later migration. Every pgmq queue the active migrations leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under platform/event-bus, every such constant has its pgmq queue, and pgmq objects are granted only to the application role while they exist. A uniquely named pg_cron job belongs to a migration and only enqueues: its command, directly or through one enqueue-only *_tick function, inserts one row of a literal queue constant into the queue outbox table of ruleParams.db.queueOutbox, writing only its declared columns (the relay hands it to BullMQ); it executes no business DML or HTTP request and shares no tick with an app scheduler. A pgmq.send validates only in the original body of a job an older migration scheduled while that queue existed; the live job and its current tick never enqueue that way. Removing a tick unschedules its job."
+    law: "DB_QUEUE_CRON: the queue is BullMQ on Redis (ruling:R212/case-10), so the active migrations leave no pgmq queue named by a queue constant under modules/queues; a pgmq queue a migration created for one is dropped by a later migration. Every pgmq queue the active migrations leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under platform/event-bus, every such constant has its pgmq queue, and pgmq objects are granted only to the application role while they exist. A pg_cron job belongs to a migration and only enqueues; its name is scheduled once while it is active, so a later migration schedules it again only after its own cron.unschedule of that name, and one tick function has one live job at a time. Its command, directly or through one enqueue-only *_tick function, inserts one row of a literal queue constant into the queue outbox table of ruleParams.db.queueOutbox, writing only its declared columns (the relay hands it to BullMQ). An app whose hfs.json sides.be.backing declares redis may declare its own outbox in sides.be.queueOutbox ({table, enqueue, queueParameter}); the command, or the tick, then calls the declared enqueue function with a literal queue constant for the declared parameter and pure other arguments, while the active definition of that function only inserts one row into the declared table with its queue column bound to that parameter (an ON CONFLICT DO NOTHING, a read of the declared table and pure expressions are the only other work). A direct insert into the app's outbox table, or any other function, stays refused. The job executes no business DML or HTTP request and shares no tick with an app scheduler. A pgmq.send validates only in the original body of a job an older migration scheduled while that queue existed; the live job and its current tick never enqueue that way. Removing a tick unschedules its job."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_PGMQ_DECLARED", "DB_CRON_OWNED"]
@@ -4413,6 +4413,7 @@ rules:
       - {kind: hfs, id: db-queue-cron, at: scripts/hfs/rules/database-queues.mjs}
     proves:
       - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
+      - {path: packages/hfs/src/hfs-queue-outbox-declaration.spec.mjs, edition: lite, codes: [DB_CRON_OWNED]}
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
     witness:

package/runtime/knowledge/hfs/slots.yaml

@@ -43,7 +43,7 @@ versioning:
 # journey (enabled with app.browser by `browser: true`).
 # 3.6.0 is a minor (alpha.30): it ADDS the opt-in be.feature.realtime.sse slot, the server-sent-events door of the realtime kind (owner decision
 # 2026-10-24: lite may serve SSE, and SSE is the default door for one-way push), and lets fe.modules.api hold the SSE stream operations (sse/).
-# 3.7.0 is a minor (alpha.31): it ADDS the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
+# 3.7.0 is a minor (alpha.31): it ADDS the optional app.scripts.integration slot (scripts/integration/*.mjs, the product test-support scripts that only the integration harness runs) and the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
 # transport client layer), and lets fe.hooks.swr hold the SWR subscription hooks (api/sse/subscriptions/useSubscribe<X>Swr.ts, one useSWRSubscription per stream operation).
 
 # Field meaning, per slot.
@@ -727,6 +727,24 @@ slots:
     rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, edition: lite}
+  - id: app.scripts.integration
+    since: 3.7.0
+    profiles: [app]
+    editionWhy: "Lite and full share the slot: a product's integration proof that needs a throwaway, unmigrated database has the same need in both editions, and lite's generic scripts path is closed to anything but codegen and delivery tooling."
+    # Product test-support scripts, run only by the integration harness (the integration suites call them; no package script, workflow, hook
+    # or deploy step does). A proof that must create a throwaway database that no migration has touched and run DDL on it keeps that work here,
+    # because the back-end lint refuses runtime DDL and raw query text in test sources. The folder is `integration`, not `test`:
+    # R252's script scan skips test folders, and a support script that creates databases must stay inside it. A spec or test is not a script
+    # (BE_SPEC_PLACEMENT), a check or lint source has no place (HFS_REPO_LOCAL_CHECK), and a script that reaches a host other than the private
+    # test stack is refused by its own connection guard, which the integration spec of the product proves.
+    path: "scripts/integration/*.mjs"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, editions: [lite, full]}
   - id: app.sides
     since: 3.1.0
     profiles: [app]

package/runtime/knowledge/patterns/be/queues.yaml

@@ -85,7 +85,7 @@ rules:
       A recurring task is a job scheduler (`upsertJobScheduler`) that the queue module declares in its `schedulers` list and
       `platform/queue` registers at boot, or, in an app on Supabase, a uniquely named pg_cron job of a migration whose command
       (directly or through one `*_tick` function) only inserts one row of a queue constant into the queue outbox table of
-      `ruleParams.db.queueOutbox` (`public.queue`), which the relay hands to BullMQ; a tick has exactly one of the two owners. Its job is processed by the same
+      `ruleParams.db.queueOutbox` (`public.queue`), which the relay hands to BullMQ, or by calling the enqueue function that the app declares with its own outbox table in `hfs.json` `sides.be.queueOutbox` (redis declared in `sides.be.backing`; the function's active definition only inserts into that table); a tick has exactly one of the two owners. A job name is scheduled once while it is active: a later migration that replaces a tick's command calls `cron.unschedule` of the name first. Its job is processed by the same
       `features/jobs/<job>/<job>.processor.ts` as any enqueued job. `@nestjs/schedule`, `@Cron`, `@Interval`, `@Timeout` and
       `setInterval` for work are not used anywhere.
     rationale: |-

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -73,6 +73,18 @@ function extraPackageProblems(side, entries) {
   return [];
 }
 
+/** `sides.be.queueOutbox`: the app's own queue outbox ({table, enqueue, queueParameter}), which a pg_cron tick may enqueue through (R258); it needs the redis backing the relay hands rows to. */
+function queueOutboxProblems(side, value) {
+  const declared = value.queueOutbox;
+  if (declared === undefined) return [];
+  if (side !== 'be') return ['queueOutbox belongs to the be side'];
+  const name = (item) => typeof item === 'string' && /^[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*$/.test(item);
+  const bad = [];
+  if (!isPlainObject(declared) || Object.keys(declared).sort().join() !== 'enqueue,queueParameter,table' || !name(declared.table) || !name(declared.enqueue) || !/^[a-z_][a-z0-9_]*$/.test(String(declared.queueParameter))) bad.push('sides.be.queueOutbox must be {table: <schema>.<table>, enqueue: <schema>.<function>, queueParameter: <parameter name>}');
+  if (!(value.backing ?? []).includes('redis')) bad.push('sides.be.queueOutbox needs sides.be.backing to declare redis, which the relay hands its rows to');
+  return bad;
+}
+
 function grammarProblems(side, grammar) {
   if (grammar === undefined) return [];
   if (side !== 'fe') return ['grammar belongs to the fe side'];
@@ -83,7 +95,7 @@ function declarationSideProblems(side, value, names) {
   const bad = [];
   const at = `sides.${side}`;
   if (!isPlainObject(value)) return [`${at} must be an object`];
-  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing', 'queueOutbox'].includes(key)) bad.push(`${at} has unknown key ${key}`);
   bad.push(...appShapeProblems(value.apps, at, side, names));
   if (isBadUniqueList(value.optionalSlots, (slot) => SLOT_ID.test(String(slot)))) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
   if (value.backing !== undefined && side !== 'be') bad.push('backing belongs to the be side');
@@ -91,7 +103,7 @@ function declarationSideProblems(side, value, names) {
   bad.push(...patternShapeProblems(value, at, NAME), ...kindShapeProblems(value, at, NAME));
   if (isBadUniqueList(value.reads, (read) => typeof read === 'string' && read.length > 0)) bad.push(`${at}.reads must be a unique list of paths`);
   if (value.connections !== undefined) bad.push(...connectionProblems(side, value));
-  bad.push(...extraPackageProblems(side, value.extraPackages), ...grammarProblems(side, value.grammar));
+  bad.push(...extraPackageProblems(side, value.extraPackages), ...grammarProblems(side, value.grammar), ...queueOutboxProblems(side, value));
   return bad;
 }
 

package/runtime/scripts/hfs/rules/database-queue-outbox.mjs

@@ -0,0 +1,102 @@
+// R258: an app whose queue is BullMQ on a declared Redis may keep its own outbox beside the canon `ruleParams.db.queueOutbox` table. The
+// app declares it in hfs.json `sides.be.queueOutbox` ({table, enqueue, queueParameter}), and a pg_cron tick enqueues through the declared
+// `enqueue` function only while that function's active definition does nothing but write the declared table with its queue column bound
+// to the declared parameter. The checker reads the declaration and the function body; it names no app table or function.
+import pg from 'libpg-query';
+import { sqlStringParts as strings, walkSqlAst as walk, sqlParser } from '../../lib/sql-ast.mjs';
+
+await pg.loadModule();
+
+const sqlTree = sqlParser(pg);
+const STATEMENTS = new Set(['PLpgSQL_stmt_block', 'PLpgSQL_stmt_execsql', 'PLpgSQL_stmt_if', 'PLpgSQL_stmt_assign', 'PLpgSQL_stmt_return']);
+const OTHER_DML = ['UpdateStmt', 'DeleteStmt', 'MergeStmt'];
+const qualified = (name) => name.includes('.') ? name : `public.${name}`;
+
+/** The outbox an app declares, or null: it counts only while the back end declares the redis backing the relay hands rows to. */
+export function queueOutboxDeclaration(declaration) {
+  const be = declaration?.sides?.be;
+  const declared = be?.queueOutbox;
+  if (!declared || !(be.backing ?? []).includes('redis')) return null;
+  return { table: qualified(declared.table), enqueue: qualified(declared.enqueue), parameter: declared.queueParameter };
+}
+
+function plpgsqlStatements(fn, body) {
+  const parameters = (fn.parameters ?? []).map((item) => item.FunctionParameter?.name).filter(Boolean).map((name) => `"${name.replaceAll('"', '""')}" text`).join(',');
+  let tag = '$hfs_outbox$';
+  while (body.includes(tag)) tag = `${tag.slice(0, -1)}_$`;
+  let tree;
+  try { tree = pg.parsePlPgSQLSync(`create function hfs_probe(${parameters}) returns text language plpgsql as ${tag}${body}${tag};`); } catch { return null; }
+  const trees = [];
+  let safe = true;
+  walk(tree, (node) => {
+    for (const key of Object.keys(node)) if (key.startsWith('PLpgSQL_stmt_') && !STATEMENTS.has(key)) safe = false;
+    const expr = node.PLpgSQL_expr;
+    if (expr) trees.push(sqlTree(expr.parseMode === 0 ? expr.query : `select ${expr.query}`));
+  });
+  return safe ? trees : null;
+}
+
+function bodyStatements(fn) {
+  const option = (name) => (fn.options ?? []).find((item) => item.DefElem?.defname === name)?.DefElem?.arg;
+  const language = option('language')?.String?.sval ?? 'sql';
+  const body = strings(option('as')?.List?.items).join('');
+  if (language === 'plpgsql') return plpgsqlStatements(fn, body);
+  if (language !== 'sql') return null;
+  if (fn.sql_body) return (fn.sql_body.List ? fn.sql_body.List.items : [fn.sql_body]).map((stmt) => ({ stmts: [{ stmt }] }));
+  return sqlTree(body)?.stmts?.map((entry) => ({ stmts: [entry] })) ?? null;
+}
+
+/** True when the nodes hold no sub-select or other statement and call only functions `pureCall` admits. */
+function pureNodes(nodes, pureCall) {
+  let ok = true;
+  walk(nodes, (node) => {
+    if (node.SubLink || node.SelectStmt || node.InsertStmt || OTHER_DML.some((key) => node[key])) ok = false;
+    if (node.FuncCall && !pureCall(node.FuncCall)) ok = false;
+  });
+  return ok;
+}
+
+/** `insert into <table> (..., queue, ...) values (..., <parameter>, ...) [on conflict .. do nothing] [returning ..]` with pure other values. */
+function insertOk(declared, insert, pureCall) {
+  if (insert.withClause || `${insert.relation?.schemaname || 'public'}.${insert.relation?.relname}` !== declared.table) return false;
+  if (insert.onConflictClause && insert.onConflictClause.action !== 'ONCONFLICT_NOTHING') return false;
+  const columns = (insert.cols ?? []).map((item) => item.ResTarget?.name);
+  const rows = insert.selectStmt?.SelectStmt?.valuesLists ?? [];
+  const values = rows.length === 1 ? rows[0].List?.items ?? [] : [];
+  const at = columns.indexOf('queue');
+  if (at < 0 || new Set(columns).size !== columns.length || values.length !== columns.length) return false;
+  const bound = values[at].ColumnRef?.fields;
+  if (!bound || strings(bound).join('.') !== declared.parameter || bound.length !== 1) return false;
+  return pureNodes(values.filter((_, index) => index !== at), pureCall);
+}
+
+/** A read of the declared table with pure expressions, or an expression over variables alone. */
+function readOk(declared, tree, pureCall) {
+  let ok = true;
+  walk(tree, (node) => {
+    if (OTHER_DML.some((key) => node[key]) || node.InsertStmt || node.SelectStmt?.intoClause) ok = false;
+    if (node.FuncCall && !pureCall(node.FuncCall)) ok = false;
+    if (node.RangeVar && `${node.RangeVar.schemaname || 'public'}.${node.RangeVar.relname}` !== declared.table) ok = false;
+  });
+  return ok;
+}
+
+function statementOk(declared, tree, pureCall) {
+  const stmt = tree?.stmts?.length === 1 ? tree.stmts[0].stmt : null;
+  if (stmt?.InsertStmt) return insertOk(declared, stmt.InsertStmt, pureCall);
+  return Boolean(stmt?.SelectStmt) && readOk(declared, tree, pureCall);
+}
+
+/**
+ * The position of the queue parameter when the active definition of the declared enqueue function only writes the declared outbox
+ * (inserts, reads of that table and pure expressions), or -1. `pureCall` admits a function call that does no work.
+ */
+export function outboxEnqueueQueueIndex(declared, entry, pureCall) {
+  const fn = entry?.node;
+  if (!fn) return -1;
+  const index = (fn.parameters ?? []).findIndex((item) => item.FunctionParameter?.name === declared.parameter);
+  const trees = bodyStatements(fn);
+  if (index < 0 || !trees?.length || !trees.every((tree) => statementOk(declared, tree, pureCall))) return -1;
+  const inserts = trees.filter((tree) => tree?.stmts?.[0]?.stmt?.InsertStmt).length;
+  return inserts === 1 ? index : -1;
+}

package/runtime/scripts/hfs/rules/database-queues.mjs

@@ -11,10 +11,11 @@ import { queueSourceFacts, queueSchedulers, queueProblem as problem } from './da
 import { readJson, readText } from './read.mjs';
 import { DB_CRON_OWNED, DB_PGMQ_DECLARED, isActiveMigration } from './database-constants.mjs';
 import { loadSlotManifest } from '../slots.mjs';
+import { queueOutboxDeclaration, outboxEnqueueQueueIndex } from './database-queue-outbox.mjs';
 
 await pg.loadModule();
 
-const PURE_CALLS = new Set(['jsonb_build_object', 'json_build_object', 'jsonb_build_array', 'json_build_array', 'to_jsonb', 'now', 'clock_timestamp']);
+const PURE_CALLS = new Set(['jsonb_build_object', 'json_build_object', 'jsonb_build_array', 'json_build_array', 'to_jsonb', 'now', 'clock_timestamp', 'date_trunc']);
 const TABLE_PRIVILEGES = ['select', 'insert', 'update', 'delete', 'truncate', 'references', 'trigger', 'maintain'];
 const sqlName = (nodes) => strings(nodes).join('.');
 const callName = (call) => sqlName(call.funcname);
@@ -54,9 +55,11 @@ function inspectQueueCall(state, call, file, migration) {
 }
 
 function recordSchedule(state, call, file) {
-  const entry = { call, file, created: new Map(state.created), functions: new Map(state.functions) };
-  state.schedules.push(entry);
   const job = sqlLiteral(argument(call, 0, ['job_name']));
+  // The names scheduled and not unscheduled since, in migration order: a name is a duplicate only while it is still scheduled.
+  const entry = { call, file, created: new Map(state.created), functions: new Map(state.functions), active: new Set(state.scheduledNames) };
+  state.schedules.push(entry);
+  if (job !== null) state.scheduledNames.add(job);
   const schedule = sqlLiteral(argument(call, 1, ['schedule']));
   const command = sqlLiteral(argument(call, 2, ['command']));
   if (job !== null && schedule !== null && command !== null) {
@@ -77,6 +80,7 @@ function inspectCronCall(state, call, file, migration) {
   if (job !== null) {
     state.unschedules.push({ name: job, file });
     state.activeCron.delete(job);
+    state.scheduledNames.delete(job);
     state.liveSchedules.delete(job);
   }
   else problem(state, DB_CRON_OWNED, file, 'cron.unschedule must identify the migration-owned job by literal name');
@@ -205,12 +209,16 @@ function enqueue(state, call) {
   return queue !== null && state.created.has(queue) && safe ? queue : null;
 }
 
+function pureCall(call) {
+  return uuidConstructor(call) || PURE_CALLS.has(callName(call).replace(/^pg_catalog\./, ''));
+}
+
 function pureArguments(call) {
   return pureExpressions(call.args);
 }
 
 function pureExpressions(nodes) {
-  let safe = callsOf(nodes).every((nested) => uuidConstructor(nested) || PURE_CALLS.has(callName(nested).replace(/^pg_catalog\./, '')));
+  let safe = callsOf(nodes).every(pureCall);
   walk(nodes, (node) => {
     if (['SubLink', 'SelectStmt', 'InsertStmt', 'UpdateStmt', 'DeleteStmt', 'MergeStmt'].some((key) => node[key])) safe = false;
   });
@@ -223,6 +231,15 @@ function queueOutbox(manifest) {
   return declared ? { table: declared.table, columns: new Set(declared.columns) } : null;
 }
 
+/** The queue constant a call of the app's declared outbox enqueue function enqueues (hfs.json sides.be.queueOutbox), or null. */
+function declaredEnqueue(state, call) {
+  const declared = state.declaredOutbox;
+  if (!declared || qualified(callName(call)) !== declared.enqueue) return null;
+  const index = outboxEnqueueQueueIndex(declared, state.functions.get(declared.enqueue), pureCall);
+  const queue = index < 0 ? null : sqlLiteral(argument(call, index, [declared.parameter]));
+  return queue !== null && state.constants.has(queue) && pureArguments(call) ? queue : null;
+}
+
 /** The queue constant one outbox row enqueues: `insert into <outbox> (queue, ...) values ('<queue constant>', ...)` with pure values. */
 function outboxEnqueue(state, insert) {
   if (!state.outbox || insert.returningClause || insert.returningList || insert.onConflictClause || insert.withClause) return null;
@@ -242,7 +259,8 @@ function singleEnqueue(state, tree, legacy) {
   const insert = tree?.stmts?.length === 1 ? tree.stmts[0].stmt?.InsertStmt : undefined;
   if (insert) return outboxEnqueue(state, insert);
   const call = singleCall(tree);
-  return legacy && call ? enqueue(state, call) : null;
+  if (!call) return null;
+  return declaredEnqueue(state, call) ?? (legacy ? enqueue(state, call) : null);
 }
 
 /** PostgreSQL's catalog-owned scalar UUID constructor adds an envelope identity without doing work in the tick. */
@@ -311,7 +329,7 @@ function scheduleTarget(state, command, legacy) {
   const tree = sqlTree(command);
   const target = singleCall(tree);
   if (!target) return { tick: null, queues: singleEnqueue(state, tree, legacy) };
-  if (!callName(target).endsWith('_tick')) return { tick: null, queues: legacy ? enqueue(state, target) : null };
+  if (!callName(target).endsWith('_tick')) return { tick: null, queues: declaredEnqueue(state, target) ?? (legacy ? enqueue(state, target) : null) };
   const tick = qualified(callName(target));
   const fn = state.functions.get(tick);
   const queues = fn && pureArguments(target) && tickQueues(state, fn, legacy);
@@ -325,7 +343,7 @@ function tickRemoval(state, tick, name) {
   }
 }
 
-function scheduleCheck(state, schedule, names, schedulers, ticks) {
+function scheduleCheck(state, schedule, schedulers, ticks) {
   const { call, file } = schedule;
   const name = sqlLiteral(argument(call, 0, ['job_name']));
   const command = sqlLiteral(argument(call, 2, ['command']));
@@ -333,22 +351,23 @@ function scheduleCheck(state, schedule, names, schedulers, ticks) {
     problem(state, DB_CRON_OWNED, file, 'cron.schedule requires literal job name, cadence and command for migration ownership');
     return;
   }
-  if (names.has(name)) problem(state, DB_CRON_OWNED, file, 'cron job names must be unique across active migrations');
-  names.add(name);
+  if (schedule.active.has(name)) problem(state, DB_CRON_OWNED, file, 'a cron job name is scheduled once while it is active: cron.unschedule it before a later migration schedules it again');
   const historical = { ...state, created: schedule.created, functions: schedule.functions };
   const { tick, queues } = scheduleTarget(historical, command, true);
   if (!queues) problem(state, DB_CRON_OWNED, file, 'a cron command inserts one row of a queue constant into the queue outbox, directly or through one existing *_tick function that only does that; business DML, dynamic SQL and network calls are refused');
   if (state.liveSchedules.get(name) === schedule && !scheduleTarget(state, command, false).queues) problem(state, DB_CRON_OWNED, file, 'the live cron job must insert one outbox row of a queue constant (ruling:R212/case-10): it targets a missing queue or tick, still enqueues with pgmq.send, or its current tick no longer only does that');
-  tickOwner(state, tick, file, ticks);
+  tickOwner(state, tick, name, schedule, ticks);
   const owners = [name, ...(tick ? [tick, tick.split('.').at(-1)] : []), ...[queues ?? []].flat()];
   if (owners.some((owner) => schedulers.has(owner))) problem(state, DB_CRON_OWNED, file, 'the tick is also declared in an application scheduler list; give it one owner');
   tickRemoval(state, tick, name);
 }
 
-function tickOwner(state, tick, file, ticks) {
+/** One tick function has one cron owner at a time: an earlier job of the tick that is still scheduled is a second owner. */
+function tickOwner(state, tick, name, schedule, ticks) {
   if (!tick) return;
-  if (ticks.has(tick)) problem(state, DB_CRON_OWNED, file, 'a tick function has more than one cron owner');
-  ticks.add(tick);
+  const owners = ticks.get(tick) ?? [];
+  if (owners.some((owner) => schedule.active.has(owner))) problem(state, DB_CRON_OWNED, schedule.file, 'a tick function has more than one cron owner');
+  ticks.set(tick, [...owners, name]);
 }
 
 function queueState({ repoRoot, files = [], all = files, repo = {}, manifest }) {
@@ -356,7 +375,7 @@ function queueState({ repoRoot, files = [], all = files, repo = {}, manifest })
   const declaration = readJson(repoRoot, 'hfs.json') ?? repo;
   const connected = ['be', 'fe'].some((side) => (declaration.sides?.[side]?.connections ?? []).some((item) => item.provider === 'supabase'));
   if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !declaration.supabase && !connected && !paths.some((file) => file.startsWith('supabase/'))) return null;
-  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
+  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), declaredOutbox: queueOutboxDeclaration(declaration), scheduledNames: new Set(), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
   state.sources = queueSourceFacts(state, paths, inspectCalls);
   migrationFacts(state, paths);
   return state;
@@ -369,10 +388,9 @@ function validateQueues(state, inScope) {
   }
   for (const [topic, file] of state.topics) if (!state.created.has(topic)) problem(state, DB_PGMQ_DECLARED, file, `event-bus topic queue ${topic} has no pgmq.create in an active migration`);
   for (const { node, file, created, executed } of state.grants) grantCheck({ ...state, created: executed ? created : state.created }, node, file);
-  const names = new Set();
-  const ticks = new Set();
+  const ticks = new Map();
   const schedulers = queueSchedulers(state.sources);
-  for (const schedule of state.schedules) scheduleCheck(state, schedule, names, schedulers, ticks);
+  for (const schedule of state.schedules) scheduleCheck(state, schedule, schedulers, ticks);
   return state.findings.filter((finding) => inScope(finding.path));
 }
 

package/scaffold/add-queue-lite.mjs

@@ -65,9 +65,11 @@ const DATABASE_ERROR = 'be/src/modules/platform/database/errors/database.error.t
 /** Skeleton files the lite starter leaves out and the queue capabilities use, each from its skeleton template. */
 const SKELETON_FILES = Object.freeze([
   ['be/src/modules/platform/database/database.sql.ts', 'skeleton-lite/src/modules/platform/database/database.sql.ts'],
+  ['be/src/modules/platform/primitives/sequence.policy.ts', 'skeleton/src/modules/platform/primitives/sequence.policy.ts'],
+  ['be/src/modules/platform/primitives/sequence.policy.spec.ts', 'skeleton/src/modules/platform/primitives/sequence.policy.spec.ts'],
 ]);
 
-/** The sql tag of the outbox and claim statements (with its identifier error) and the in-order relay of lite's starter platform. */
+/** The sql tag of the outbox and claim statements (with its identifier error) and the in-order relay the queue adapters walk their rows with. */
 function skeletonFiles(repoRoot) {
   const created = SKELETON_FILES.filter(([relative]) => !fs.existsSync(path.join(repoRoot, ...relative.split('/'))))
     .map(([relative, source]) => ({ relative, text: render(template(`be/${source}`), {}) }));

package/scaffold/app.mjs

@@ -199,7 +199,7 @@ const LITE_STARTER_DEPENDENCIES = Object.freeze({
  */
 const FE_APP_DEPENDENCIES = Object.freeze({
   '@<project>/i18n': '*', '@<project>/ui': '*',
-  '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@xyflow/react': null, next: null, 'next-intl': null, react: null, 'react-dom': null,
+  '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@xyflow/react': null, 'react-aria-components': null, next: null, 'next-intl': null, react: null, 'react-dom': null,
 });
 
 /**
@@ -207,7 +207,7 @@ const FE_APP_DEPENDENCIES = Object.freeze({
  * the front end is the Auth client of modules/auth only) and server-only for its own next-intl request config.
  */
 const LITE_FE_APP_DEPENDENCIES = Object.freeze({
-  '@heroicons/react': null, '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@starci/heroicons': null, '@xyflow/react': null,
+  '@heroicons/react': null, '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@starci/heroicons': null, '@xyflow/react': null, 'react-aria-components': null,
   '@supabase/supabase-js': null, next: null, 'next-intl': null, react: null, 'react-dom': null, 'server-only': null,
 });
 
@@ -218,7 +218,7 @@ const LITE_FE_APP_DEPENDENCIES = Object.freeze({
  * ./routing, client-safe: the default locale a client boundary reads).
  */
 const FE_PACKAGES = Object.freeze({
-  ui: { exports: ['.'], dependencies: { '@heroui/react': null, '@starci/grammar': null, '@starci/heroicons': null, '@xyflow/react': null, 'next-intl': null, react: null, 'react-dom': null } },
+  ui: { exports: ['.'], dependencies: { '@heroui/react': null, '@starci/grammar': null, '@starci/heroicons': null, '@xyflow/react': null, 'react-aria-components': null, 'next-intl': null, react: null, 'react-dom': null } },
   i18n: { exports: ['.', './proxy', './routing'], dependencies: { next: null, 'next-intl': null, 'server-only': null } },
 });
 
@@ -304,11 +304,11 @@ export function peerDependencies(pkg, pins, pairs = parseYaml(fs.readFileSync(PE
 /**
  * The fe-stack core packages one version of which the whole install resolves (npm `overrides`, at their canon pins): a
  * transitive dependency otherwise brings its own (zustand 4 under @xyflow/react, dayjs under typeorm, a hoisted newer zod
- * that breaks the zodResolver types), and @xyflow/react itself stays the grammar's one version. Two are security overrides, each dropped when
+ * that breaks the zodResolver types), and @xyflow/react and react-aria-components stay the grammar's one version. Two are security overrides, each dropped when
  * upstream ships the fix (canon-pins.yaml says why): @graphql-tools/utils (@nestjs/graphql 13.x pulls <=12.0.0, GHSA-7mx3-vvmw-hjmv) and multer
  * (@nestjs/platform-express depends on exactly 2.4.0, GHSA-q7qp-rjg7-q26m).
  */
-const ROOT_OVERRIDES = Object.freeze(['@graphql-tools/utils', '@xyflow/react', 'dayjs', 'multer', 'zod', 'zustand']);
+const ROOT_OVERRIDES = Object.freeze(['@graphql-tools/utils', '@xyflow/react', 'dayjs', 'multer', 'react-aria-components', 'zod', 'zustand']);
 
 /**
  * The root package.json of a new app, the monorepo root: name, workspaces, npm, its edition's dependencies with their runtime
@@ -412,6 +412,7 @@ const LITE_DEFERRED_GENERATOR_FILES = new Set([
   'src/modules/platform/database/database.sql.ts',
   'src/modules/platform/database/migration-runner.service.ts',
   'src/modules/platform/database/seed-runner.service.ts',
+  'src/modules/platform/primitives/sequence.policy.ts',
 ]);
 const liteBaseSource = (rel) => !rel.startsWith('apps/cli/')
     && !rel.startsWith('src/features/cli/')

package/scaffold/lite-exports.mjs

@@ -36,9 +36,15 @@ const REGISTRATIONS = Object.freeze({
       names: ["InjectPrimaryEntityManager", "PRIMARY_ENTITY_MANAGER"],
     },
   ],
-  // The queue and jobs capabilities state their outbox and claim statements with the sql tag (the lite starter already carries the
-  // in-order relay and the record guard the BullMQ client reads stored jobs with).
+  // The queue and jobs capabilities state their outbox and claim statements with the sql tag and walk rows with the in-order relay
+  // (the lite starter already carries the record guard the BullMQ client reads stored jobs with).
   queue: [
+    {
+      file: "be/src/modules/platform/primitives/index.ts",
+      source: "./sequence.policy",
+      names: ["eachInOrder"],
+      beforeSource: "./record.policy",
+    },
     {
       file: "be/src/modules/platform/database/index.ts",
       source: "./database.sql",
@@ -50,7 +56,7 @@ const REGISTRATIONS = Object.freeze({
     {
       file: "be/src/modules/platform/database/index.ts",
       source: "./database.sql",
-      names: ["sql"],
+      names: ["BATCH_ROWS", "sql"],
       beforeSource: "./errors/database.error",
     },
     {

package/templates/app/skeleton/.starcistacks/production/README.md

@@ -1,6 +1,6 @@
 # Production stack
 
-The app and its dependencies run on Docker Swarm; Supabase, when declared, is a hosted service. The tracked model declares the application services, one digest-pinned Caddy ingress and one digest-pinned PostgreSQL service on an internal backing network, with its data on a named persistent volume and credentials supplied through mounted secrets. On the first boot of an empty data volume, PostgreSQL runs the mounted `postgres-init.sh` config to create the `app_be` role with access to this app's database and schema, without superuser, database-creation, role-creation, replication or RLS-bypass privileges. Existing data volumes skip initialization and retain their roles and credentials.
+The app and its dependencies run on Docker Swarm; Supabase, when declared, is a hosted service. The tracked model declares the application services, one digest-pinned Caddy ingress and one digest-pinned PostgreSQL service on an internal backing network, with its data on a named persistent volume and credentials supplied through mounted secrets. On the first boot of an empty data volume, PostgreSQL runs the mounted `.starcistacks/production/infra/swarm/postgres-init.sh` config to create the `app_be` role with access to this app's database and schema, without superuser, database-creation, role-creation, replication or RLS-bypass privileges. Existing data volumes skip initialization and retain their roles and credentials.
 The model is a deployment declaration. It contains no owner credentials, real DNS receipt, completed release or restore proof. The public records under `.starcistacks/production/infra/swarm/` mark those owner-run operations as pending. Its all-zero application image digests are illustrative and must be replaced before deployment.
 
 The runtime template tracks no encrypted members. Scaffolding generates the declared database connection, application password and PostgreSQL administrator password members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace them with `starci app secret set production` using the matching host age identity in untracked local custody. The sealed connection uses role `app_be`, database `{{project}}` and internal endpoint `postgres:5432`; its URI-encoded password matches the separate `primary-db-password` member. The administrator password is distinct. The API receives only its least-privilege connection; only PostgreSQL receives the two password files for initialization. The non-empty application password contains no line breaks. The service has no TTY: initialization creates the role without a password, then feeds the two `psql` `\password` prompts through stdin using Bash's builtin `printf`, so psql encrypts it before sending SQL. No password travels in an initialization command argument or a plaintext SQL statement.
@@ -27,7 +27,7 @@ Every item is pending. Swarm initialization, provider URIs, DNS changes and key
 | DNS | Replace the reserved `example.invalid` hosts consistently in the manifest, Caddyfile and public configuration; publish address records for the product, API and landing hosts and retain a provider receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
 | TLS | Caddy issues certificates after real DNS resolves. Provision `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data` on the selected node; retain an issuance and renewal receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
 | Database | Prepare creates `{{project}}-production-postgres-data` on the declared stateful node; the normal up path starts PostgreSQL and initializes `app_be` on its first empty-volume boot. Seal the matching role, database and password described above before up. Existing databases retain their current roles and credentials; initialization never rewrites them. Record the recovery owner without copying credentials here. |
-| Secret custody | Replace generated placeholders in `.starcistacks/production/secrets/primary-db-url.enc`, `primary-db-password.enc` and `postgres-password.enc` with the matching application connection/password and distinct administrator password; record their key names in the environment roster. The age identity stays only in the host's untracked `.claude/secret.env`. |
+| Secret custody | Replace generated placeholders in `.starcistacks/production/secrets/primary-db-url.enc`, `.starcistacks/production/secrets/primary-db-password.enc` and `.starcistacks/production/secrets/postgres-password.enc` with the matching application connection/password and distinct administrator password; record their key names in the environment roster. The age identity stays only in the host's untracked `.claude/secret.env`. |
 | External secrets | Materialize the sealed members in owner custody and create `{{project}}-production-primary-db-url-v1`, `{{project}}-production-primary-db-password-v1` and `{{project}}-production-postgres-password-v1`. The API and PostgreSQL read their separately granted mounted files. A later credential rotation updates the actual database role under owner authority and rotates matching immutable secrets; changing a mounted file does not rerun first-boot initialization. |
 | Public build configuration | Build the front end with its declared public site and GraphQL URLs. Public browser values stay outside sealed secret custody. |
 | Immutable release | Replace the illustrative all-zero application digests in the manifest, model and `.starcistacks/production/infra/swarm/releases/images.lock.yaml` with the verified release digests. Store each rendered release under `/srv/{{project}}/releases/<digest>`. Retain the last accepted record in `.starcistacks/production/infra/swarm/releases/previous.yaml`, then move the pointer and update `.starcistacks/production/infra/swarm/releases/current.yaml` after verification. |

package/templates/app/skeleton-lite/.starcistacks/dev/README.md

@@ -7,7 +7,7 @@ The runtime template tracks no encrypted members. Scaffolding generates the two
 
 | Command | Operation |
 | --- | --- |
-| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. For a declared Redis, run `npm run redis:create` once, then `npm run redis:start` when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
+| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. For a declared Redis (its `redis:create`, `redis:start` and `redis:stop` scripts arrive in package.json with the first queue or job), run the create script once, then the start script when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
 | doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
 | up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
 | status | Run `docker stack services {{project}}-dev`. |

package/templates/be/skeleton/apps/__app__/src/main.ts

@@ -12,7 +12,10 @@ const bootstrap = async (): Promise<void> => {
     const env = EnvSource.fromProcess()
     const options = read{{appPascal}}Env(env)
     const logger = createJsonLogger(new SystemClockService(), new SystemIds())
-    const app = await NestFactory.create(AppModule.register(options), { rawBody: true, logger: createNestLogger(logger) })
+    const app = await NestFactory.create(AppModule.register(options), {
+        rawBody: true,
+        logger: createNestLogger(logger),
+    })
     applyCorrelation(app)
     applyHttpSecurity(app, options.httpSecurity, { trustProxy: 1 })
     app.enableShutdownHooks()
@@ -24,6 +27,8 @@ const bootstrap = async (): Promise<void> => {
 }
 
 bootstrap().catch((error: unknown) => {
-    createJsonLogger(new SystemClockService(), new SystemIds()).error(LoggingLogEvent.StartupFailed, error, { service: "{{app}}" })
+    createJsonLogger(new SystemClockService(), new SystemIds()).error(LoggingLogEvent.StartupFailed, error, {
+        service: "{{app}}",
+    })
     process.exitCode = 1
 })

package/templates/be/skeleton/apps/cli/src/compose/platform.ts

@@ -4,7 +4,7 @@ import { ClockModule } from "@modules/platform/clock"
 import { DatabaseModule } from "@modules/platform/database"
 import type { DatabaseConnectionConfig, DatabaseConnectionOptions } from "@modules/platform/database"
 import { IdsModule } from "@modules/platform/ids"
-import { HTTP_ERROR_KINDS, HTTP_MESSAGES, HttpModule } from "@modules/platform/http"
+import { HttpModule } from "@modules/platform/http"
 import { LoggingModule } from "@modules/platform/logging"
 import type { CliAppOptions } from "../cli.options"
 

package/templates/be/skeleton/src/modules/platform/database/index.ts

@@ -5,7 +5,7 @@ export { MigrationRunnerService } from "./migration-runner.service"
 export { DEFAULT_SEED_ENV } from "./seed-connections.client"
 export { SeedRunnerService } from "./seed-runner.service"
 export type { DatabaseConnectionConfig, DatabaseConnectionOptions } from "./database.options"
-export { BATCH_ROWS, LIST_ROWS_MAX, sql } from "./database.sql"
+export { LIST_ROWS_MAX, sql } from "./database.sql"
 export { DATABASE_ERROR_KINDS } from "./errors/database.error"
 export { parsePrimaryDatabaseConfig } from "./primary.config"
 export { InjectPrimaryEntityManager, PRIMARY_ENTITY_MANAGER } from "./primary.decorators"

package/templates/be/skeleton/src/modules/platform/http/index.ts

@@ -1,7 +1,3 @@
-export { HTTP_ERROR_KINDS, HttpError, HttpErrorCode } from "./errors/http.error"
+export { HTTP_ERROR_KINDS } from "./errors/http.error"
 export { HTTP_MESSAGES } from "./messages/http.messages"
-export { callGraphql } from "./graphql-call.mapper"
-export type { GraphqlAnswer } from "./graphql-call.mapper"
-export { HTTP_CLIENT, InjectHttpClient } from "./http.decorators"
 export { HttpModule } from "./http.module"
-export type { HttpClient } from "./http.port"

package/templates/be/skeleton/src/modules/platform/logging/correlation.service.spec.ts

@@ -15,7 +15,9 @@ describe("CorrelationService", () => {
         expect(service.fromHeaders({ "x-request-id": "request-1" })).toBe("request-1")
         expect(service.fromHeaders({})).toBe("00000000-0000-4000-8000-000000000001")
         expect(service.create()).toBe("00000000-0000-4000-8000-000000000002")
-        expect(service.run("explicit-id", () => stampLogFields({}, "root-id"))).toEqual({ correlationId: "explicit-id" })
+        expect(service.run("explicit-id", () => stampLogFields({}, "root-id"))).toEqual({
+            correlationId: "explicit-id",
+        })
         expect(createCorrelationRunner(ids).run("bootstrap-id", () => stampLogFields({}, "root-id"))).toEqual({
             correlationId: "bootstrap-id",
         })

package/templates/be/skeleton/src/modules/platform/logging/index.ts

@@ -1,17 +1,6 @@
 export { createJsonLogger } from "./json-logger.service"
-export {
-    InjectLogger,
-    LOGGER,
-    CORRELATION_IDS,
-    CORRELATION_RUNNER,
-    InjectCorrelationIds,
-    InjectCorrelationRunner,
-} from "./logging.decorators"
-export { applyCorrelation, correlationMiddleware } from "./correlation-request.policy"
-export type { CorrelationIds, CorrelationRunner } from "./correlation.port"
-export type { CorrelationHeaders, CorrelationRequest } from "./correlation.contracts"
-export { createCorrelationRunner } from "./correlation.service"
-export { isCorrelationId } from "./correlation.policy"
+export { InjectLogger, LOGGER } from "./logging.decorators"
+export { applyCorrelation } from "./correlation-request.policy"
 export { LoggingLogEvent } from "./logging.log-events"
 export { LoggingModule } from "./logging.module"
 export type { Logger } from "./logging.port"

package/templates/be/skeleton/src/modules/platform/primitives/record.policy.spec.ts

@@ -1,12 +1,24 @@
+import { Test } from "@nestjs/testing"
 import { isRecord } from "./record.policy"
 
+const RECORD_POLICY: unique symbol = Symbol("primitives.record")
+
 describe("isRecord", () => {
+    let subject: typeof isRecord
+
+    beforeEach(async () => {
+        const moduleRef = await Test.createTestingModule({
+            providers: [{ provide: RECORD_POLICY, useFactory: () => isRecord }],
+        }).compile()
+        subject = moduleRef.get<typeof isRecord>(RECORD_POLICY)
+    })
+
     it("narrows non-null objects before provider fields are read", () => {
-        expect(isRecord({ status: 200 })).toBe(true)
-        expect(isRecord([])).toBe(true)
-        expect(isRecord(null)).toBe(false)
-        expect(isRecord(undefined)).toBe(false)
-        expect(isRecord("response")).toBe(false)
-        expect(isRecord(200)).toBe(false)
+        expect(subject({ status: 200 })).toBe(true)
+        expect(subject([])).toBe(true)
+        expect(subject(null)).toBe(false)
+        expect(subject(undefined)).toBe(false)
+        expect(subject("response")).toBe(false)
+        expect(subject(200)).toBe(false)
     })
 })

package/templates/be/skeleton-lite/src/modules/platform/database/index.ts

@@ -5,4 +5,3 @@ export type { DatabaseConnectionOptions } from "./database.options"
 export { PRIMARY_DATA_SOURCE } from "./database.port"
 export { DATABASE_ERROR_KINDS } from "./errors/database.error"
 export { parsePrimaryDatabaseConfig } from "./primary.config"
-export { BATCH_ROWS } from "./database.sql"

package/templates/be/skeleton-lite/src/modules/platform/logging/index.ts

@@ -1,17 +1,6 @@
 export { createJsonLogger } from "./json-logger.service"
-export {
-    InjectLogger,
-    LOGGER,
-    CORRELATION_IDS,
-    CORRELATION_RUNNER,
-    InjectCorrelationIds,
-    InjectCorrelationRunner,
-} from "./logging.decorators"
-export { applyCorrelation, correlationMiddleware } from "./correlation-request.policy"
-export type { CorrelationIds, CorrelationRunner } from "./correlation.port"
-export type { CorrelationHeaders, CorrelationRequest } from "./correlation.contracts"
-export { createCorrelationRunner } from "./correlation.service"
-export { isCorrelationId } from "./correlation.policy"
+export { InjectLogger, LOGGER } from "./logging.decorators"
+export { applyCorrelation } from "./correlation-request.policy"
 export { LoggingLogEvent } from "./logging.log-events"
 export { LoggingModule } from "./logging.module"
 export type { Logger } from "./logging.port"

package/templates/be/skeleton-lite/src/modules/platform/primitives/index.ts

@@ -1,4 +1,3 @@
 export type { Outcome } from "./outcome.contracts"
 export { ok, refused, unwrapOutcome } from "./outcome.mapper"
-export { eachInOrder } from "./sequence.policy"
 export { isRecord } from "./record.policy"

package/templates/fe/skeleton/apps/__app__/src/components/blocks/SignInForm/component.tsx

@@ -21,7 +21,7 @@ export const SignInFormBase = (props: SignInFormBaseProps) => (
             <Input id="sign-in-email" name="email" label={props.props.emailLabel} kind="email" isRequired />
             <Input id="sign-in-password" name="password" label={props.props.passwordLabel} kind="password" isRequired />
             {props.props.failure === undefined ? null : <Text live="assertive">{props.props.failure}</Text>}
-            <Button type="submit" variant="primary" isPending={props.state === "working"}>
+            <Button type="submit" intent="commit" isPending={props.state === "working"}>
                 {props.props.submitLabel}
             </Button>
         </Form>

package/templates/fe/skeleton/apps/__app__/src/components/blocks/SignOutButton/component.tsx

@@ -14,7 +14,7 @@ export interface SignOutButtonBaseProps {
 export const SignOutButtonBase = (props: SignOutButtonBaseProps) => (
     <>
         <Text>{props.props.principal}</Text>
-        <Button variant="secondary" isPending={props.props.pending} onPress={props.on.press}>
+        <Button intent="neutral" isPending={props.props.pending} onPress={props.on.press}>
             {props.props.label}
         </Button>
     </>

package/templates/fe/skeleton/apps/__app__/src/features/overlays/AppGuideOverlay/component.tsx

@@ -21,7 +21,7 @@ export const AppGuideOverlayBase = (props: AppGuideOverlayBaseProps) => (
         title={props.props.title}
         closeLabel={props.props.closeLabel}
         trigger={
-            <Button variant="secondary" startContent={<Icon />}>
+            <Button intent="neutral" startContent={<Icon />}>
                 {props.props.triggerLabel}
             </Button>
         }

package/templates/fe/skeleton/apps/__app__/src/modules/toast/toast.tsx

@@ -10,12 +10,12 @@ import type { ReactNode } from "react"
 /** The options a status toast takes: HeroUI's, minus the variant the status already names. */
 type StatusToastOptions = Parameters<typeof heroToast.success>[1]
 
-/** The one indicator of each status, from the app's one icon set. */
+/** The one indicator of each status, from the app's one icon set; HeroUI's toast variant colours it through currentColor. */
 const INDICATOR: Record<"success" | "danger" | "warning" | "info", ReactNode> = {
-    success: <CheckCircleIcon className="size-6 text-success-soft-foreground" />,
-    danger: <XCircleIcon className="size-6 text-danger-soft-foreground" />,
-    warning: <ExclamationTriangleIcon className="size-6 text-warning-soft-foreground" />,
-    info: <InformationCircleIcon className="size-6 text-accent" />,
+    success: <CheckCircleIcon className="size-6" />,
+    danger: <XCircleIcon className="size-6" />,
+    warning: <ExclamationTriangleIcon className="size-6" />,
+    info: <InformationCircleIcon className="size-6" />,
 }
 
 /** The app's toast: HeroUI's imperative toast with the status indicator injected; the region is mounted by the providers. */

package/templates/fe/skeleton/apps/landing/src/features/pages/LandingPage/component.tsx

@@ -17,7 +17,7 @@ export const LandingPageBase = (props: LandingPageBaseProps) => (
     <>
         <Heading level={1}>{props.props.title}</Heading>
         <Text tone="muted">{props.props.lede}</Text>
-        <Button href={props.props.appHref} variant="primary">
+        <Button href={props.props.appHref} intent="commit">
             {props.props.openApp}
         </Button>
     </>

package/templates/fe/skeleton/packages/__project__-ui/src/composites/SiteShell/classNames.ts

@@ -1,4 +1,4 @@
-/** The shell's frame: a full-height column on the theme's page colours. */
+/** The shell's frame: a full-height column; colours come from Grammar's root. */
 export const siteShellClassNames = {
-    frame: "flex min-h-screen flex-col bg-background text-foreground",
+    frame: "flex min-h-screen flex-col",
 } as const

package/templates/fe/skeleton/packages/__project__-ui/src/composites/SiteShell/index.tsx

@@ -14,6 +14,6 @@ type SiteShellProps = {
 
 /**
  * The document chrome both apps share: Grammar's Common boundary, the brand header (the top bar carrying the wordmark that links
- * home), then the routed body in the shell's main landmark at reading measure. Colours are the theme's semantic tokens.
+ * home), then the routed body in the shell's main landmark at reading measure.
  */
 {{> fe/common/site-shell.tsx.partial}}

package/templates/fe/skeleton-lite/apps/web/src/components/composites/SiteShell/classNames.ts

@@ -1,4 +1,4 @@
-/** The shell's frame: a full-height column on the theme's page colours. */
+/** The shell's frame: a full-height column; colours come from Grammar's root. */
 export const siteShellClassNames = {
-    frame: "flex min-h-screen flex-col bg-background text-foreground",
+    frame: "flex min-h-screen flex-col",
 } as const

package/templates/be/skeleton/src/modules/platform/http/graphql-call.mapper.spec.ts

@@ -1,92 +0,0 @@
-import { Test } from "@nestjs/testing"
-import { mock } from "@starci/jest-preset"
-import type { HttpClient } from "./http.port"
-import { callGraphql } from "./graphql-call.mapper"
-
-const SUBJECT: unique symbol = Symbol("http/graphql-call.mapper")
-const subjectFunctions = () => ({ callGraphql })
-
-const build = async () => {
-    const moduleRef = await Test.createTestingModule({
-        providers: [{ provide: SUBJECT, useFactory: subjectFunctions }],
-    }).compile()
-    return moduleRef.get<ReturnType<typeof subjectFunctions>>(SUBJECT)
-}
-
-describe("callGraphql", () => {
-    it("sends the operation and reads its data and string error codes", async () => {
-        const subject = await build()
-
-        const http = mock<HttpClient>()
-        http.request.mockResolvedValue({
-            status: 200,
-            body: {
-                data: { order: { id: "order-1" } },
-                errors: [
-                    { extensions: { code: "ORDER_STALE" } },
-                    { extensions: { code: 7 } },
-                    { extensions: null },
-                    "malformed",
-                ],
-            },
-        })
-
-        await expect(
-            subject.callGraphql(http, {
-                correlationId: "request-1",
-                url: "https://order.test/graphql",
-                query: "query Order($id: ID!) { order(id: $id) { id } }",
-                variables: { id: "order-1" },
-                headers: { authorization: "Bearer token" },
-                timeoutMs: 2500,
-            }),
-        ).resolves.toEqual({ data: { order: { id: "order-1" } }, errorCodes: ["ORDER_STALE"] })
-
-        expect(http.request).toHaveBeenCalledWith({
-            correlationId: "request-1",
-            method: "POST",
-            url: "https://order.test/graphql",
-            headers: { authorization: "Bearer token" },
-            body: {
-                query: "query Order($id: ID!) { order(id: $id) { id } }",
-                variables: { id: "order-1" },
-            },
-            timeoutMs: 2500,
-        })
-    })
-
-    it("returns an empty answer when data and errors do not have GraphQL shapes", async () => {
-        const subject = await build()
-
-        const http = mock<HttpClient>()
-        http.request.mockResolvedValue({ status: 200, body: { data: "malformed", errors: {} } })
-
-        await expect(
-            subject.callGraphql(http, {
-                correlationId: "request-1",
-                url: "https://order.test/graphql",
-                query: "query Health { health }",
-                timeoutMs: 1000,
-            }),
-        ).resolves.toEqual({ data: undefined, errorCodes: [] })
-    })
-
-    it.each([undefined, null, "not a response"])(
-        "returns null when the response body is not an object (%p)",
-        async (body) => {
-            const subject = await build()
-
-            const http = mock<HttpClient>()
-            http.request.mockResolvedValue({ status: 502, body })
-
-            await expect(
-                subject.callGraphql(http, {
-                    correlationId: "request-1",
-                    url: "https://order.test/graphql",
-                    query: "query Health { health }",
-                    timeoutMs: 1000,
-                }),
-            ).resolves.toBeNull()
-        },
-    )
-})

package/templates/be/skeleton/src/modules/platform/http/graphql-call.mapper.ts

@@ -1,52 +0,0 @@
-import { isRecord } from "@modules/platform/primitives"
-import type { HttpClient } from "./http.port"
-
-/** One GraphQL operation sent to another service. */
-export interface GraphqlCall {
-    /** The correlation id of the request or delivery causing this operation. */
-    readonly correlationId: string
-    /** The GraphQL endpoint URL. */
-    readonly url: string
-    /** The operation text. */
-    readonly query: string
-    /** The operation variables. */
-    readonly variables?: Readonly<Record<string, unknown>>
-    /** Extra request headers, such as the bearer token to forward. */
-    readonly headers?: Readonly<Record<string, string>>
-    /** How long to wait for the answer. */
-    readonly timeoutMs: number
-}
-
-/** What a GraphQL service answered: the data object and the codes of the errors it reported. */
-export interface GraphqlAnswer {
-    /** The `data` object, undefined when the operation failed before producing one. */
-    readonly data: Readonly<Record<string, unknown>> | undefined
-    /** The `extensions.code` of every reported error. */
-    readonly errorCodes: ReadonlyArray<string>
-}
-
-/** What a GraphQL call yields: the answer, or null when the body is not a GraphQL response at all. */
-export type GraphqlCallResult = GraphqlAnswer | null
-
-const codesOf = (errors: unknown): Array<string> =>
-    Array.isArray(errors)
-        ? errors.flatMap((error): Array<string> => {
-              const code: unknown = isRecord(error) && isRecord(error.extensions) ? error.extensions.code : undefined
-              return typeof code === "string" ? [code] : []
-          })
-        : []
-
-/** Sends a GraphQL operation and reads the answer; null when the body is not a GraphQL response at all. */
-export const callGraphql = async (http: HttpClient, call: GraphqlCall): Promise<GraphqlCallResult> => {
-    const response = await http.request({
-        correlationId: call.correlationId,
-        method: "POST",
-        url: call.url,
-        ...(call.headers === undefined ? {} : { headers: call.headers }),
-        body: { query: call.query, variables: call.variables },
-        timeoutMs: call.timeoutMs,
-    })
-    const body = response.body
-    if (!isRecord(body)) return null
-    return { data: isRecord(body.data) ? body.data : undefined, errorCodes: codesOf(body.errors) }
-}