@starci/hfs 4.9.11 → 4.10.0

package/scaffold/add-table.mjs

@@ -1,6 +1,5 @@
 import fs from "node:fs";
 import path from "node:path";
-import { emitDbTypes, dbTypesPath } from "../emit/db-types.mjs";
 import {
   loadSlotManifest,
   readRepoDeclaration,
@@ -288,7 +287,7 @@ const apiFeatureFiles = (values) => {
 /**
  * The fe data code of a table in one product app: one GraphQL operation file per operation (modules/api/graphql/{queries,
  * mutations}, its request/data types from the generated wire types) and one SWR hook per operation (hooks/swr/api/graphql).
- * Never a Server Action and never a Supabase reader: Supabase on the front end is the Auth client only.
+ * Never a Server Action and never a database reader: the front end reaches data only through the back end.
  */
 const feOperationFiles = (app, values) => {
   const api = `fe/apps/${app}/src/modules/api/graphql`;
@@ -326,9 +325,8 @@ const withExport = (text, line) => {
 };
 
 /**
- * Adds one Supabase table migration and its domain capability; with `fe`, the table's api feature over GraphQL (the GraphQL
+ * Adds one db table migration and its domain capability; with `fe`, the table's api feature over GraphQL (the GraphQL
  * server capability on first use) and, in every product Next app, its operation files and SWR hooks.
- * `emitTypes` returns the generated database.types.ts text; false is the explicit `--no-types` seam.
  */
 function tableContext({ root, name }) {
   const requestedName = String(name);
@@ -341,11 +339,11 @@ function tableContext({ root, name }) {
   const table = snakeOf(requestedName);
   const manifest = loadSlotManifest();
   const repo = readRepoDeclaration(manifest, root);
-  const connection = repo.sides?.be?.connections?.find((candidate) => candidate.provider === "supabase");
+  const connection = repo.sides?.be?.connections?.find((candidate) => candidate.provider === "postgres");
   if (!connection) {
     throw new ScaffoldError(
       "HFS_ADD_TABLE_PROVIDER",
-      "add table needs a back-end connection whose provider is supabase",
+      "add table needs a back-end connection whose provider is postgres",
     );
   }
 
@@ -353,7 +351,7 @@ function tableContext({ root, name }) {
 }
 
 function nextMigration({ root, feature, requestedName, now }) {
-  const migrationsDir = path.join(root, "supabase", "migrations");
+  const migrationsDir = path.join(root, "db", "migrations");
   const migrations = fs.existsSync(migrationsDir)
     ? fs
         .readdirSync(migrationsDir)
@@ -408,7 +406,7 @@ function tableFiles({ root, repo, feature, stamp, values, fe, apps }) {
   const domain = `be/src/modules/domain/${feature}`;
   const planned = [
     {
-      relative: `supabase/migrations/${stamp}_${feature}.sql`,
+      relative: `db/migrations/${stamp}_${feature}.sql`,
       body: template("be/table/migration.sql.tpl", values),
     },
     { relative: `${domain}/index.ts`, body: template("be/table/index.ts.tpl", values) },
@@ -417,16 +415,9 @@ function tableFiles({ root, repo, feature, stamp, values, fe, apps }) {
     { relative: `${domain}/${feature}.module-definition.ts`, body: template("be/table/module-definition.ts.tpl", values) },
     { relative: `${domain}/${feature}.options.ts`, body: template("be/table/options.ts.tpl", values) },
     { relative: `${domain}/${feature}.service.ts`, body: template(`be/table/service${api}.ts.tpl`, values) },
-    { relative: `${domain}/persistence/${feature}.rows.ts`, body: template("be/table/rows.ts.tpl", values) },
-    { relative: `${domain}/persistence/${feature}.sql.ts`, body: template(`be/table/sql${api}.ts.tpl`, values) },
+    { relative: `${domain}/persistence/entities/${feature}.entity.ts`, body: template("be/table/entity.ts.tpl", values) },
+    { relative: `${domain}/persistence/entities/index.ts`, body: template("be/table/entities.index.ts.tpl", values) },
   ];
-  const databaseSql = "be/src/modules/platform/database/database.sql.ts";
-  if (repo.edition === "lite" && !fs.existsSync(at(root, databaseSql))) {
-    planned.splice(1, 0, {
-      relative: databaseSql,
-      body: render(fs.readFileSync(path.join(TEMPLATES_DIR, "be", "skeleton-lite", "src", "modules", "platform", "database", "database.sql.ts"), "utf8"), {}),
-    });
-  }
   if (fe) {
     planned.push(...apiFeatureFiles(values));
     if (!fs.existsSync(at(root, `${GRAPHQL_PLATFORM}/index.ts`))) planned.push(...graphqlPlatformFiles());
@@ -450,7 +441,7 @@ function tableOwner({ root, repo, connection, name, requestedName, planned }) {
     );
   const owner = repo.sides.be.apps.find((app) => app.name === connection.owner && app.kind === "api");
   if (!owner)
-    throw new ScaffoldError("HFS_ADD_NO_API_OWNER", `add table needs the Supabase connection owner ${connection.owner} to be a declared api app`);
+    throw new ScaffoldError("HFS_ADD_NO_API_OWNER", `add table needs the database connection owner ${connection.owner} to be a declared api app`);
   const ownerRelative = `be/apps/${owner.name}/src/app.module.ts`;
   if (!fs.existsSync(at(root, ownerRelative)))
     throw new ScaffoldError("HFS_ADD_WIRE_MISSING", `add table registers ${name} in ${ownerRelative}, which does not exist`);
@@ -471,17 +462,13 @@ function tableEditor(root, touched) {
   return edit;
 }
 
-function writeTableFiles({ root, planned, emitTypes, edit }, created) {
+function writeTableFiles({ root, planned, edit }, created) {
   for (const file of planned) {
     const target = at(root, file.relative);
     fs.mkdirSync(path.dirname(target), { recursive: true });
     fs.writeFileSync(target, file.body);
     created.push(target);
   }
-  if (typeof emitTypes === "function") {
-    const generated = emitTypes({ root });
-    if (typeof generated === "string") edit(dbTypesPath, () => generated);
-  }
 
 }
 
@@ -504,8 +491,30 @@ function wireTableFrontends({ root, feature, values, apps, edit }) {
       }
 }
 
+/** The lite entity list: platform/database/entities.ts names the capability's `<c>Entities` in PRIMARY_ENTITIES (BE-PERSISTENCE-3). */
+const PRIMARY_ENTITIES_FILE = "be/src/modules/platform/database/entities.ts";
+const PRIMARY_ENTITIES = /(export const PRIMARY_ENTITIES[^=]*=\s*\[)([\s\S]*?)(\])/;
+
+/** `text` of entities.ts with `<c>Entities` imported from the capability barrel and spread into PRIMARY_ENTITIES, once. */
+function withPrimaryEntities(text, { feature, nameCamel }) {
+  const list = `${nameCamel}Entities`;
+  if (!PRIMARY_ENTITIES.test(text))
+    throw new ScaffoldError("HFS_ADD_WIRE_MISSING", `add table names ${list} in PRIMARY_ENTITIES of ${PRIMARY_ENTITIES_FILE}, which declares no PRIMARY_ENTITIES array`);
+  if (new RegExp(`\\.\\.\\.${list}\\b`).test(text)) return text;
+  const imported = `import { ${list} } from "@modules/domain/${feature}"\n`;
+  const withList = text.replace(PRIMARY_ENTITIES, (all, head, items, tail) => {
+    const entries = items.split(",").map((item) => item.trim()).filter(Boolean);
+    return `${head}${[...entries, `...${list}`].join(", ")}${tail}`;
+  });
+  const lines = withList.split("\n");
+  const lastImport = lines.reduce((at, line, index) => (line.startsWith("import ") ? index : at), -1);
+  if (lastImport >= 0) lines.splice(lastImport + 1, 0, imported.trimEnd());
+  return lastImport >= 0 ? lines.join("\n") : `${imported}${withList}`;
+}
+
 function wireTable({ root, repo, feature, values, ownerRelative, composition, fe, apps, edit }) {
     const kindsHome = kindsHomeOf(root, ownerRelative);
+    if (repo.edition === "lite") edit(PRIMARY_ENTITIES_FILE, (text) => withPrimaryEntities(text, { feature, nameCamel: values.nameCamel }));
     for (const patch of composition) edit(patch.relative, () => patch.text);
     edit(kindsHome, (text) => wireKinds(text, kindsHome, { kinds: `${snakeOf(feature).toUpperCase()}_ERROR_KINDS`, specifier: `@modules/domain/${feature}` }));
   tableRegistrations({ root, repo, fe, edit });
@@ -538,7 +547,7 @@ function applyTable(context) {
 }
 
 /** Adds one table through typed domain/API groups and restores every touched byte on failure. */
-export function addTable({ root, name, fe = false, emitTypes = emitDbTypes, now = Date.now }) {
+export function addTable({ root, name, fe = false, now = Date.now }) {
   const context = tableContext({ root, name });
   const stamp = nextMigration({ ...context, now });
   const values = tableValues(context);
@@ -546,9 +555,8 @@ export function addTable({ root, name, fe = false, emitTypes = emitDbTypes, now
   const planned = tableFiles({ ...context, stamp, values, apps, fe });
   const owner = tableOwner({ ...context, planned });
   const composition = tableComposition({ ...context, ...owner, fe });
-  applyTable({ ...context, ...owner, planned, composition, apps, values, fe, emitTypes });
+  applyTable({ ...context, ...owner, planned, composition, apps, values, fe });
   return {
     created: [...planned.map((file) => file.relative), ...composition.filter((patch) => patch.exists === false).map((patch) => patch.relative)],
-    types: typeof emitTypes === "function" ? dbTypesPath : "skipped",
   };
 }

package/scaffold/add.mjs

@@ -52,7 +52,7 @@ const FE_OWNERS = Object.freeze({
  */
 export function addKind({ repoRoot, noun, name, options = {}, now = Date.now }) {
   if (noun === 'table') {
-    const result = addTable({ root: repoRoot, name, fe: options.fe === true, emitTypes: options.noTypes === true ? false : options.emitTypes, now });
+    const result = addTable({ root: repoRoot, name, fe: options.fe === true, now });
     return { ...result, registered: { patterns: [], kinds: [] } };
   }
   if (noun === 'app') {
@@ -81,7 +81,7 @@ function registerFeatureExports({ repoRoot, repo, noun, values }) {
 
 function writeKind({ repoRoot, noun, name, now, options, manifest, repo, spec, declarationFile, values, forms, beRoot, patterns, planned }) {
   if (noun === 'api' || noun === 'webhook') preflightFeatureComposition({ repoRoot, repo, noun, name });
-  const liteQueue = planLiteQueue({ repoRoot, repo, noun, patterns, now, emitTypes: options.noTypes === true ? false : options.emitTypes });
+  const liteQueue = planLiteQueue({ repoRoot, repo, noun, patterns, now });
   const bootstrapCreated = noun === 'cli' && repo.edition === 'lite' ? ensureLiteCli({ root: repoRoot, manifest, repo }) : [];
   for (const file of planned) {
     fs.mkdirSync(path.dirname(file.absolute), { recursive: true });

package/scaffold/app.mjs

@@ -18,10 +18,8 @@ import { spawnSync } from 'node:child_process';
 import { loadSlotManifest, resolveRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 import { parseYaml } from '../runtime/engine/yaml.mjs';
 import { HARNESS_PACKAGE, canonPins } from '../runtime/scripts/hfs/canon-pins.mjs';
-import { dbTypesPath, generateDbTypes } from '../emit/db-types.mjs';
 import { TEMPLATES_DIR, appSource, imageFiles, render, renderTargets, writeTargets } from '../sync/index.mjs';
 import { ScaffoldError } from './service.mjs';
-import { SUPABASE_PORT_VARIABLES, supabasePortVars } from './supabase-ports.mjs';
 import { testWorldFiles } from './test-world.mjs';
 import { FE_APP_SCRIPTS, PACKAGE_MANAGER, WORKSPACES, WORKSPACE_LINT, feAppPackageName } from '../runtime/scripts/hfs/rules/monorepo.mjs';
 import { isLinkLike } from '../runtime/scripts/api/fs/is-link-like.mjs';
@@ -128,23 +126,14 @@ const STARTER_SIDES = Object.freeze({
   fe: Object.freeze({ grammar: 'core', apps: [{ name: 'landing', kind: 'next' }, { name: 'app', kind: 'next' }], reads: ['be/contracts/'], optionalSlots: ['fe.package.ui', 'fe.package.i18n'] }),
 });
 
-/** The lite starter is the upgrade-safe subset: one API, one web app and one Supabase schema authority. */
+/** The lite starter is the upgrade-safe subset: one API, one web app and one SQL schema authority (db/migrations). */
 const LITE_STARTER_SIDES = Object.freeze({
   be: Object.freeze({
     apps: [{ name: 'api', kind: 'api' }],
     kinds: ['api'],
-    connections: [{ name: 'primary', envPrefix: 'PRIMARY_DB', owner: 'api', isolation: 'schema', provider: 'supabase' }],
-    reads: ['supabase/types/'],
+    connections: [{ name: 'primary', envPrefix: 'PRIMARY_DB', owner: 'api', isolation: 'schema', provider: 'postgres' }],
   }),
-  fe: Object.freeze({ grammar: 'core', apps: [{ name: 'web', kind: 'next' }], reads: ['be/contracts/', 'supabase/types/'] }),
-});
-
-/** The checked local Supabase auth posture of every newly scaffolded lite app. */
-const LITE_STARTER_SUPABASE = Object.freeze({
-  enableSignup: false,
-  jwtExpiry: 3600,
-  siteUrl: 'http://127.0.0.1:3000',
-  redirectUrls: ['http://127.0.0.1:3000/'],
+  fe: Object.freeze({ grammar: 'core', apps: [{ name: 'web', kind: 'next' }], reads: ['be/contracts/'] }),
 });
 
 /**
@@ -175,16 +164,17 @@ const STARTER_DEPENDENCIES = Object.freeze({
 const LITE_STARTER_DEPENDENCIES = Object.freeze({
   dependencies: {
     '@apollo/server': null, '@nestjs/apollo': null, '@nestjs/common': null, '@nestjs/core': null, '@nestjs/cqrs': null, '@nestjs/graphql': null,
-    '@nestjs/platform-express': null, '@nestjs/typeorm': null, '@supabase/supabase-js': null,
+    '@nestjs/platform-express': null, '@nestjs/typeorm': null, '@nestjs/passport': null, passport: null, 'passport-google-oauth20': null, 'passport-local': null,
+    '@aws-sdk/client-s3': null, '@aws-sdk/s3-request-presigner': null, bcryptjs: null,
     'class-transformer': null, 'class-validator': null, graphql: null, jose: null, pg: null,
     'reflect-metadata': null, rxjs: null, tslib: null, typeorm: null, zod: null,
   },
   devDependencies: {
     turbo: null, '@nestjs/testing': null, '@starci/eslint-canon-be': null, '@starci/eslint-canon-fe': null,
     '@starci/jest-preset': null, '@starci/prettier-config': null, '@starci/stylelint-canon': null, '@starci/tsconfig': null, 'starci-harness': null, '@tailwindcss/postcss': null,
-    '@types/express': null, '@types/jest': null, '@types/node': null, '@types/react': null, '@types/react-dom': null,
+    '@types/express': null, '@types/jest': null, '@types/node': null, '@types/passport-google-oauth20': null, '@types/passport-local': null, '@types/react': null, '@types/react-dom': null,
     eslint: null, 'eslint-plugin-react-hooks': null, husky: null, jest: null, 'postcss-value-parser': null, prettier: null,
-    stylelint: null, supabase: null, tailwindcss: null, 'ts-jest': null, 'ts-node-dev': null, 'tsc-alias': null,
+    stylelint: null, tailwindcss: null, 'ts-jest': null, 'ts-node-dev': null, 'tsc-alias': null,
     'tsconfig-paths': null, typescript: null,
   },
 });
@@ -201,12 +191,12 @@ const FE_APP_DEPENDENCIES = Object.freeze({
 });
 
 /**
- * The lite fe workspace: the same base without the shared packages, plus its infra adapter (owner ruling 2026-10-13: Supabase on
- * the front end is the Auth client of modules/auth only) and server-only for its own next-intl request config.
+ * The lite fe workspace: the same base without the shared packages, plus server-only for its own next-intl request config. It
+ * holds no identity SDK: modules/auth talks only to the app's own back-end auth doors.
  */
 const LITE_FE_APP_DEPENDENCIES = Object.freeze({
   '@heroicons/react': null, '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@starci/heroicons': null, '@xyflow/react': null, 'react-aria-components': null,
-  '@supabase/supabase-js': null, next: null, 'next-intl': null, react: null, 'react-dom': null, 'server-only': null,
+  next: null, 'next-intl': null, react: null, 'react-dom': null, 'server-only': null,
 });
 
 /**
@@ -229,51 +219,9 @@ export const starterDeclaration = (name, manifest = loadSlotManifest(), edition
   kind: 'app',
   ...(edition === 'full' ? {} : { edition }),
   project: name,
-  ...(edition === 'lite' ? { supabase: structuredClone(LITE_STARTER_SUPABASE) } : {}),
   sides: structuredClone(edition === 'lite' ? LITE_STARTER_SIDES : STARTER_SIDES),
 });
 
-/** Opting into a server PKCE callback also selects Supabase Auth and declares its route slot. */
-function enableAuthCallback(declaration) {
-  requireAuthCallbackConnection(declaration);
-  declaration.sides.fe.optionalSlots = [...(declaration.sides.fe.optionalSlots ?? []), 'fe.route.callback'];
-  declaration.supabase ??= structuredClone(LITE_STARTER_SUPABASE);
-  declaration.supabase.redirectUrls = ['http://127.0.0.1:3000/auth/callback'];
-}
-
-/** Callback-specific source files are excluded from the browser-only starter. */
-const CALLBACK_SOURCE_FILES = Object.freeze(new Set([
-  'src/app/auth/callback/route.ts', 'src/modules/auth/server.ts', 'src/modules/auth/pkce-client.ts',
-]));
-export const hasAuthCallback = repo => (repo.sides.fe.optionalSlots ?? []).includes('fe.route.callback');
-
-function requireAuthCallbackConnection(repo) {
-  if (!(repo.sides.be?.connections ?? []).some(entry => entry.provider === 'supabase'))
-    throw new ScaffoldError('HFS_ADD_CONNECTION_REQUIRED', 'the auth callback requires an existing Supabase connection; the full starter has none');
-}
-
-/** Apply the callback's cookie-backed auth owner and its config readers to product apps only. */
-export function callbackSourceFiles(files, repo) {
-  const enabled = hasAuthCallback(repo);
-  if (enabled) requireAuthCallbackConnection(repo);
-  const selected = files.filter(file => {
-    const [, , app, ...parts] = file.path.split('/');
-    const relative = parts.join('/');
-    if (relative === 'src/modules/auth/pkce-client.ts') return false;
-    return MARKETING_FE_APPS.has(app) || enabled || !CALLBACK_SOURCE_FILES.has(relative);
-  });
-  if (!enabled) return selected;
-  const config = fs.readFileSync(path.join(TEMPLATES_DIR, 'fe/skeleton-lite/apps/web/src/modules/config/index.ts'), 'utf8');
-  const client = render(fs.readFileSync(path.join(TEMPLATES_DIR, 'fe/skeleton/apps/__app__/src/modules/auth/pkce-client.ts'), 'utf8').replace(/\r\n/g, '\n'), PARTIAL_VARIABLES);
-  return selected.map(file => {
-    const [, , app, ...parts] = file.path.split('/');
-    if (MARKETING_FE_APPS.has(app)) return file;
-    const relative = parts.join('/');
-    if (relative === 'src/modules/config/index.ts') return { ...file, content: config };
-    return relative === 'src/modules/auth/client.ts' ? { ...file, content: client } : file;
-  });
-}
-
 /** A dependency section at the canon pins (a null range takes the pin, which must exist; every pinned name is null). */
 function pinnedSection(entries, pins) {
   const pinned = (dependency, range) => {
@@ -329,10 +277,9 @@ const workspaceSection = (entries, project, pins) => pinnedSection(Object.fromEn
  * The package.json of the fe app workspace `app` of the app `project`: @<project>/<app>, private, the workspace scripts, its own
  * dependencies. A product app (`core`, it carries the shared app core) also takes every core runtime package of the fe stack.
  */
-function feAppManifest(project, app, pins, edition, { core = true, authCallback = false, stack = coreFeStackPackages() } = {}) {
+function feAppManifest(project, app, pins, edition, { core = true, stack = coreFeStackPackages() } = {}) {
   const base = edition === 'lite' ? LITE_FE_APP_DEPENDENCIES : FE_APP_DEPENDENCIES;
   const dependencies = { ...base, ...(core ? Object.fromEntries(stack.app.filter(name => !Object.hasOwn(base, name)).map(name => [name, null])) : {}) };
-  if (core && authCallback) Object.assign(dependencies, { '@supabase/ssr': null, '@supabase/supabase-js': null, 'server-only': null });
   return { name: feAppPackageName(project, app), version: '0.0.0', private: true, scripts: { ...FE_APP_SCRIPTS }, dependencies: workspaceSection(dependencies, project, pins) };
 }
 
@@ -381,8 +328,8 @@ function nextAppTsconfig() {
   };
 }
 
-/** The names a skeleton file may fill: {{project}}, {{app}}, {{appPascal}} (the side's app), {{sonarGate}}, {{registryVisibility}} (the image visibility written once into deploy.registry) and the lite Supabase port block ({{supabasePort<Section>}}, supabase-ports.mjs). */
-const SKELETON_VARIABLES = Object.freeze(['project', 'app', 'appPascal', 'sonarGate', 'registryVisibility', ...SUPABASE_PORT_VARIABLES]);
+/** The names a skeleton file may fill: {{project}}, {{app}}, {{appPascal}} (the side's app), {{sonarGate}} and {{registryVisibility}} (the image visibility written once into deploy.registry). */
+const SKELETON_VARIABLES = Object.freeze(['project', 'app', 'appPascal', 'sonarGate', 'registryVisibility']);
 
 /**
  * A skeleton file with its variables filled. Only the skeleton names are variables: every other `{{name}}` is source the app keeps
@@ -411,7 +358,7 @@ const LITE_DEFERRED_GENERATOR_FILES = new Set([
   'src/modules/platform/database/seed-runner.service.ts',
   'src/modules/platform/primitives/sequence.policy.ts',
 ]);
-/** The TypeORM schema files of a platform capability: lite's schema authority is supabase/migrations (be.persistence lite overlay). */
+/** The TypeORM schema files of a platform capability: lite's schema authority is db/migrations (be.persistence lite overlay). */
 const LITE_TYPEORM_SCHEMA = /^src\/modules\/platform\/[^/]+\/persistence\/(?:connection\.ts$|entities\/|migrations\/)/;
 const liteBaseSource = (rel) => !rel.startsWith('apps/cli/')
     && !rel.startsWith('src/features/cli/')
@@ -509,7 +456,7 @@ export function skeletonOf(scope, app, vars) {
   for (const entry of scope === 'fe' ? app.sides.fe.apps : []) {
     if (!unique.some(file => file.path.startsWith(`fe/apps/${entry.name}/`))) throw new ScaffoldError('HFS_SCAFFOLD_SKELETON_MISSING', `no skeleton templates for the fe app ${entry.name}`);
   }
-  return scope === 'fe' ? [...new Map(callbackSourceFiles(unique, app).map(file => [file.path, file])).values()] : unique;
+  return unique;
 }
 
 /** The npm step that resolves the lockfile of a new app, exactly as the error names it. */
@@ -622,17 +569,6 @@ function scaffoldWrites(root, original) {
   };
 }
 
-/** Generate the lite database types and translate generation errors into the scaffold failure contract. */
-function emitScaffoldDatabaseTypes(root, name, writes, emitTypes) {
-  try {
-    const text = emitTypes({ root });
-    if (typeof text !== 'string' || !text.trim()) throw new Error('the Supabase CLI returned no database types');
-    writes.write(dbTypesPath, text);
-  } catch (error) {
-    throw new ScaffoldError('HFS_SCAFFOLD_TYPES_FAILED', `Supabase database types could not be generated for ${root} (${String(error?.message ?? error)}). Start the local Supabase stack and run starci app scaffold ${name} --edition lite again`);
-  }
-}
-
 /**
  * `starci app scaffold <name>`: writes the new app under `into`, resolves its lockfile with npm (`lock`, npmLock), and returns
  * `{ root, files }` (app-relative paths, sorted). A new path is first made an empty repository with unborn main (`initGit`), so the
@@ -660,17 +596,15 @@ function bornRepository(root, initGit) {
   return fs.lstatSync(root);
 }
 
-export function scaffoldApp({ name, into, presets, harness, edition = 'full', authCallback = false, registryVisibility = 'public', manifest = loadSlotManifest(), pins = canonPins({ harness }), lock = npmLock, emitTypes = generateDbTypes, initGit = gitInit, now = () => new Date() }) {
+export function scaffoldApp({ name, into, presets, harness, edition = 'full', registryVisibility = 'public', manifest = loadSlotManifest(), pins = canonPins({ harness }), lock = npmLock, initGit = gitInit, now = () => new Date() }) {
   if (!NAME.test(String(name))) throw new ScaffoldError('HFS_SCAFFOLD_NAME_INVALID', `the app name ${name} must be kebab-case (a project name: ${NAME})`);
   const root = path.resolve(into, name);
   const existing = fs.lstatSync(root, { throwIfNoEntry: false });
   if (existing && !emptyUnbornGit(root, existing)) throw new ScaffoldError('HFS_SCAFFOLD_EXISTS', `${root} already exists; only a plain directory containing solely .git with unborn main and an empty index can be scaffolded`);
   if (!['public', 'private'].includes(registryVisibility)) throw new ScaffoldError('HFS_SCAFFOLD_REGISTRY_VISIBILITY', `--registry-visibility accepts public or private (got ${registryVisibility})`);
-  if (typeof authCallback !== 'boolean') throw new ScaffoldError('HFS_SCAFFOLD_NAME_INVALID', 'authCallback must be a boolean');
   if (!pins[HARNESS_PACKAGE]) throw new ScaffoldError('HFS_SCAFFOLD_PIN_MISSING', `${HARNESS_PACKAGE} has no pin: an app pins the CLI that scaffolds it, so run the scaffold through it (starci app scaffold)`);
   const original = existing ?? bornRepository(root, initGit);
   const declaration = starterDeclaration(name, manifest, edition);
-  if (authCallback) enableAuthCallback(declaration);
   const app = resolveRepoDeclaration(manifest, declaration);
   const pkg = packageManifest(name, pins, app.edition, app.sides.fe.grammar);
   const timestamp = now().toISOString().replace(/\D/g, '').slice(0, 14);
@@ -683,14 +617,14 @@ export function scaffoldApp({ name, into, presets, harness, edition = 'full', au
       path: `fe/apps/${entry.name}/src/modules/types/ambient/styles.d.ts`,
       content: '/** Declares stylesheets loaded by the Next bundler; non-CSS side-effect imports remain checked. */\ndeclare module "*.css" {}\n',
     })),
-    ...app.sides.fe.apps.map(entry => ({ path: `fe/apps/${entry.name}/package.json`, content: packageJsonText(feAppManifest(name, entry.name, pins, app.edition, { core: coreFeApps([entry]).length === 1, authCallback })) })),
+    ...app.sides.fe.apps.map(entry => ({ path: `fe/apps/${entry.name}/package.json`, content: packageJsonText(feAppManifest(name, entry.name, pins, app.edition, { core: coreFeApps([entry]).length === 1 })) })),
     ...imageFiles(app),
     ...(app.edition === 'lite' ? [] : Object.keys(FE_PACKAGES).flatMap(pkg => [
       { path: `fe/packages/${name}-${pkg}/package.json`, content: packageJsonText(fePackageManifest(name, pkg, pins)) },
       { path: `fe/packages/${name}-${pkg}/tsconfig.json`, content: jsonText(fePackageTsconfig()) },
       { path: `fe/packages/${name}-${pkg}/tsconfig.build.json`, content: jsonText(fePackageBuildTsconfig()) },
     ])),
-    ...['app', 'be', 'fe'].flatMap(scope => skeletonOf(scope, app, { sonarGate: sonarGateName(parseYaml(fs.readFileSync(SONAR_GATE_FILE, 'utf8')), app.edition), timestamp, registryVisibility, ...supabasePortVars(name) })),
+    ...['app', 'be', 'fe'].flatMap(scope => skeletonOf(scope, app, { sonarGate: sonarGateName(parseYaml(fs.readFileSync(SONAR_GATE_FILE, 'utf8')), app.edition), timestamp, registryVisibility })),
     // A full app has a test world (integration, e2e and contract are rows of its release gate); lite has none (ruling:R212/case-3, hosting amended by owner:lite-production-swarm).
     ...(app.edition === 'lite' ? [] : testWorldFiles(app)),
   ];
@@ -700,12 +634,11 @@ export function scaffoldApp({ name, into, presets, harness, edition = 'full', au
     const targets = renderTargets(declaration, presets, { manifest, source: appSource(root) });
     for (const target of targets) writes.claim(target.path);
     writeTargets(root, targets);
-    if (app.edition === 'lite') emitScaffoldDatabaseTypes(root, name, writes, emitTypes);
     const secretFiles = initializeScaffoldSecrets(root, writes);
     let locked;
     try { locked = lock(root); } finally { writes.lockfile(); }
     if (!locked.ok) throw new ScaffoldError('HFS_SCAFFOLD_LOCK_FAILED', `\`${LOCK_STEP}\` could not resolve the lockfile of ${root} (${locked.detail}). Check the network and the npm registry, then run starci app scaffold ${name} again`);
-    return { root, files: [...new Set([...files.map(file => file.path), ...targets.map(target => target.path), ...secretFiles, ...(app.edition === 'lite' ? [dbTypesPath] : []), 'package-lock.json'])].sort(byCodeUnit) };
+    return { root, files: [...new Set([...files.map(file => file.path), ...targets.map(target => target.path), ...secretFiles, 'package-lock.json'])].sort(byCodeUnit) };
   } catch (error) {
     const held = writes.rollback();
     if (held.length) error.message += `; cleanup retained replaced or occupied entries: ${held.join(', ')}`;

package/scaffold/lite-exports.mjs

@@ -26,7 +26,7 @@ const REGISTRATIONS = Object.freeze({
     {
       file: "be/src/modules/platform/database/index.ts",
       source: "./database.sql",
-      names: ["requireOwnedRow", "sql"],
+      names: ["requireOwnedEntity"],
       beforeSource: "./errors/database.error",
     },
     {

package/src/main.mjs

@@ -49,7 +49,7 @@
 //   starci app ci secret set <NAME> [--env E | --dependabot] [--repo owner/name]  reads the value from stdin only.
 //   starci app ci var set <NAME> [--env E] [--value v] | var sync [--execute] | verify [--json]
 //                                            declared GitHub CI custody; verify compares names, scopes and public values.
-//   starci app db baseline | restamp --map <restamp.yaml> | plan
+//   starci app db new <name> | baseline | restamp --map <restamp.yaml> | plan | migrate | post-cutover | dump
 //                                            preview the database cutover or compare its state with the repo; baseline and restamp mutate only with --apply.
 //   starci app add <api|webhook|realtime|saga|job|reactor|queue|projection> <name> [--event <event> --from <service> --service <Class>=<module>] [--owner <service> --failed <event> --done <event>] [--connection <name>] [--cwd <dir>]
 //                                            exactly that kind's file tree, generated FROM the files: tree of its pattern topic (knowledge/patterns/be) with the
@@ -79,7 +79,6 @@ import { main as syncMain } from '../sync/cli.mjs';
 import { SyncError, bundledPresets } from '../sync/index.mjs';
 import { managedFindings } from '../sync/managed.mjs';
 import { emitContracts } from '../emit/contracts.mjs';
-import { dbTypesEmitter } from '../emit/db-types.mjs';
 import { ScaffoldError, newService, newSpec } from '../scaffold/service.mjs';
 import { EditionRefusal } from '../scaffold/edition-gate.mjs';
 import { addKind } from '../scaffold/add.mjs';
@@ -95,26 +94,26 @@ import { releaseMain } from '../release/index.mjs';
 import { dbMigrateMain } from '../db/migrate.mjs';
 import { dbPostCutoverMain } from '../db/post-cutover.mjs';
 import { dbDumpMain } from '../db/dump.mjs';
-import { dbResetMain } from '../db/reset.mjs';
+import { dbNewMain } from '../db/new.mjs';
 import { dbDriftMain } from '../db/drift.mjs';
 import { codemodMain } from '../codemod/button-intent.mjs';
 
 export const VERBS = Object.freeze(['scaffold', 'add', 'lint', 'sync', 'check', 'upgrade', 'stack', 'release', 'explain', 'emit', 'new', 'secret', 'ci', 'db', 'hygiene', 'coverage', 'codemod']);
-const DATABASE_VERBS = new Map([['baseline', dbBaselineMain], ['restamp', dbRestampMain], ['plan', dbPlanMain], ['migrate', dbMigrateMain], ['post-cutover', dbPostCutoverMain], ['dump', dbDumpMain], ['reset', dbResetMain], ['drift', dbDriftMain]]);
+const DATABASE_VERBS = new Map([['baseline', dbBaselineMain], ['restamp', dbRestampMain], ['plan', dbPlanMain], ['migrate', dbMigrateMain], ['post-cutover', dbPostCutoverMain], ['dump', dbDumpMain], ['new', dbNewMain], ['drift', dbDriftMain]]);
 
 const USAGE = `starci app scaffold <name> [--into <dir>] [--edition full|lite] [--registry-visibility public|private] [--cwd <dir>]
 starci app add <api|webhook|realtime|saga|job|reactor|queue|projection|cli|table|app|block|composite|branch|leaf|page|overlay|layout> <name> [options] [--cwd <dir>]
 starci app lint [--cwd <dir>] [--changed <file>...] [--workspace <dir>] [--side be|fe] [--fix] [--format text|json] [--sonar <file>]
 starci app codemod button-intent [--write] [--format json|markdown] [--report <file.json|file.md>] [--cwd <dir>]
 starci app sync (--check | --write) [--cwd <dir>]
-starci app check [--cwd <dir>] [--json] [--fast] [--base <ref>] [--db-types] [--wiring] [--coverage-from <lcov>]
-starci app db baseline [--stamp <version>] [--local] [--apply] [--cwd <dir>]
-starci app db restamp --map <restamp.yaml> [--local] [--apply] [--cwd <dir>]
-starci app db plan [--local] [--json] [--cwd <dir>]
-starci app db dump (--linked | --local | --url-env <NAME>) --out <dir> [--schema-only] [--json] [--cwd <dir>]
-starci app db reset --linked --auth keep|drop --storage keep|drop --backup <receipt.json> [--execute] [--json] [--cwd <dir>]
-starci app db migrate [--execute] [--local | --linked | --url-env <NAME>] [--json] [--cwd <dir>]
-starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--linked | --url-env <NAME>] [--json] [--cwd <dir>]
+starci app check [--cwd <dir>] [--json] [--fast] [--base <ref>] [--wiring] [--coverage-from <lcov>]
+starci app db new <kebab-name> [--json] [--cwd <dir>]
+starci app db baseline [--stamp <version>] [--url-env <NAME>] [--apply] [--cwd <dir>]
+starci app db restamp --map <restamp.yaml> [--url-env <NAME>] [--apply] [--cwd <dir>]
+starci app db plan [--url-env <NAME>] [--json] [--cwd <dir>]
+starci app db dump [--url-env <NAME>] --out <dir> [--schema-only] [--json] [--cwd <dir>]
+starci app db migrate [--execute] [--url-env <NAME>] [--json] [--cwd <dir>]
+starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app db drift [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app release gate [--execute] [--source <ref>] [--tag-prefix <prefix>] [--backfill <tag>] [--json] [--cwd <dir>]
 starci app release push [--execute] [--remote <name>] [--urgent --reason <text>] [--json] [--cwd <dir>]
@@ -147,7 +146,7 @@ const PER_CODE_LIMIT = 25;
 const VALUE_FLAGS = new Set(['--base', '--inject', '--into', '--event', '--from', '--service', '--connection', '--owner', '--failed', '--done', '--coverage-from', '--registry-visibility', '--shapes', '--read', '--app', '--kind', '--blocks', '--tabs']);
 /** Flags that may repeat: their values are collected in order. */
 const LIST_FLAGS = new Set(['--inject']);
-const BOOL_FLAGS = new Set(['--json', '--fast', '--fe', '--no-types', '--db-types', '--wiring', '--form']);
+const BOOL_FLAGS = new Set(['--json', '--fast', '--fe', '--wiring', '--form']);
 
 function coverageArgument(arg, args, opts) {
   const inline = arg.startsWith('--coverage-from=');
@@ -250,11 +249,11 @@ function printExplain(e, out) {
  * The app pass: slots, managed files, formatter, contract snapshots and the architecture machine's check surface, root and sides.
  * `only` limits the formatter to those (app-relative) files.
  */
-async function runCheck({ repoRoot, harness, fast = false, base, only, presets, prettier, dbTypes = false }) {
+async function runCheck({ repoRoot, harness, fast = false, base, only, presets, prettier }) {
   const tracked = trackedFiles(repoRoot);
   // Managed files of the root and both sides, the .gitignore block and sonar against their render (R04, R05, R11, ...), and prettier
   // through the app's own install (R19, never under --fast).
-  const extraFindings = [...await managedFindings({ repoRoot, tracked, presets }), ...await checkDatabase({ repoRoot, files: tracked, base, ...(dbTypes ? { emitTypes: dbTypesEmitter() } : {}) }), ...(fast ? [] : await formatFindings({ repoRoot, files: only ?? tracked, prettier }))];
+  const extraFindings = [...await managedFindings({ repoRoot, tracked, presets }), ...await checkDatabase({ repoRoot, files: tracked, base }), ...(fast ? [] : await formatFindings({ repoRoot, files: only ?? tracked, prettier }))];
   // R23 against the be side itself (full pass only): committed snapshots equal what `starci app emit` writes now.
   let contracts = null;
   let be = null;
@@ -345,7 +344,7 @@ async function installedStackMain(cwd) {
 function databaseMain(argv, io) {
   const [verb, ...rest] = argv;
   const dispatch = DATABASE_VERBS.get(verb);
-  if (!dispatch) throw new Error('starci app db takes baseline, restamp, plan, migrate, post-cutover, dump, reset or drift');
+  if (!dispatch) throw new Error('starci app db takes new, baseline, restamp, plan, migrate, post-cutover, dump or drift');
   return dispatch(rest, io);
 }
 
@@ -357,7 +356,7 @@ function printCheckProofs(result, out) {
 async function checkMain(opts, { cwd: repoRoot, harness, edition, stdout: out, presets, prettier, checkApp = runCheck, runLinter }) {
   if (opts.positional.length) throw new Error('starci app check takes no path');
   if (opts.base !== undefined && opts.fast !== true) throw new Error('--base names the ref --fast compares with; it needs --fast');
-  const checked = await checkEdition({ repoRoot, edition, normal: () => checkApp({ repoRoot, harness, fast: opts.fast === true, base: opts.base, presets, prettier, dbTypes: opts['db-types'] === true }), presets, prettier });
+  const checked = await checkEdition({ repoRoot, edition, normal: () => checkApp({ repoRoot, harness, fast: opts.fast === true, base: opts.base, presets, prettier }), presets, prettier });
   const proof = withCheckProofs(checked, { repoRoot, edition, wiring: opts.wiring === true, coverageFrom: opts['coverage-from'] });
   const changed = opts.fast === true ? changedSince(repoRoot, proof.fast?.base ?? opts.base).files : null;
   const existing = changed ? changed.filter(file => fs.existsSync(path.join(repoRoot, file))) : [];
@@ -398,7 +397,7 @@ function newMain(opts, { cwd: repoRoot, stdout: out }) {
 function addMain(opts, { cwd: repoRoot, stdout: out }) {
   const [noun, name, ...extra] = opts.positional;
   if (!noun || !name || extra.length) throw new Error('starci app add takes `<noun> <name>` and the options of the noun');
-  const { created, registered } = addKind({ repoRoot, noun, name, options: { event: opts.event, from: opts.from, service: opts.service, connection: opts.connection, owner: opts.owner, failed: opts.failed, done: opts.done, fe: opts.fe, noTypes: opts['no-types'], shapes: opts.shapes, read: opts.read, app: opts.app, kind: opts.kind, form: opts.form, blocks: opts.blocks, tabs: opts.tabs } });
+  const { created, registered } = addKind({ repoRoot, noun, name, options: { event: opts.event, from: opts.from, service: opts.service, connection: opts.connection, owner: opts.owner, failed: opts.failed, done: opts.done, fe: opts.fe, shapes: opts.shapes, read: opts.read, app: opts.app, kind: opts.kind, form: opts.form, blocks: opts.blocks, tabs: opts.tabs } });
   for (const file of created) out(`created ${file}\n`);
   const kinds = registered.kinds.length ? `; kinds ${registered.kinds.join(', ')}` : '';
   // A noun that registers nothing in hfs.json (a table, an app, a front-end unit) ends with what it wrote.
@@ -437,7 +436,7 @@ function declaredEdition(cwd) {
  */
 async function stackAppMain(argv, { cwd, edition, stackMain, stdout: out, stderr: err, env, sops, stackIo }) {
   if (STACK_ACTIONS.includes(argv[0])) return deployStackMain(argv, { ...stackIo, cwd, stdout: out, stderr: err, env, ...(sops ? { sops } : {}) });
-  if ((edition ?? declaredEdition(cwd)) === 'lite') throw new Error('starci app stack up|down|status manage the local test world of the full edition; a lite app starts its local infrastructure with the Supabase CLI');
+  if ((edition ?? declaredEdition(cwd)) === 'lite') throw new Error('starci app stack up|down|status manage the local test world of the full edition; a lite app starts its local database with npm run db:start');
   const run = stackMain ?? await installedStackMain(cwd);
   return run(argv, { cwd, out, err });
 }
@@ -460,7 +459,7 @@ function errorMessage(error) {
 
 /**
  * `harness` ({ version }) is the CLI that runs this package in-process: its version is the starci-harness an app is judged and
- * scaffolded at (runtime/scripts/hfs/canon-pins.mjs). `run` injects the Supabase runner, `runLinter` the linter transport, `checkApp`
+ * scaffolded at (runtime/scripts/hfs/canon-pins.mjs). `run` injects the database runner, `runLinter` the linter transport, `checkApp`
  * the HFS check and `stackIo` Swarm tools; production defaults execute every check.
  */
 export async function main(argv, {