@starci/hfs 4.9.11 → 4.10.0

package/db/post-cutover.mjs

@@ -6,12 +6,13 @@
 //   2. a time gate: --green-at <ISO> at least minAgeHours (48) ago, or --owner-confirms-old-app-gone;
 //   3. STARCI_DB_ARMED=1.
 // Idempotent: when every held-back version is already on the remote it prints `nothing to do`. The pg_proc query goes through `options.query(sql)`
-// (specs inject one) or, by default, `supabase db query` of the linked project or the --url-env connection.
+// (specs inject one) or, by default, psql against the database --url-env names (default DATABASE_URL).
 import fs from 'node:fs';
 import path from 'node:path';
 import { failure, refusal } from '../stack/errors.mjs';
 import { runVerb } from '../release/index.mjs';
-import { buildModel, listRemote, loadDatabase, pendingVersions, requireArmed, resolveTarget, runCli, targetArgs } from './migrate.mjs';
+import { applyVersions, buildModel, listRemote, loadDatabase, requireArmed, resolveTarget } from './migrate.mjs';
+import { queryRows as psqlRows } from './postgres.mjs';
 
 const DROP_FUNCTION = /^drop\s+function\s+/iu;
 const IF_EXISTS = /^if\s+exists\s+/iu;
@@ -54,7 +55,7 @@ function preflightSql({ schema, prefixes, names }) {
   return `select oid::regprocedure::text as signature from pg_proc where pronamespace = '${schema}'::regnamespace and (${clauses.join(' or ')})`;
 }
 
-const cliQuery = (session) => (sql) => JSON.parse(runCli(session, ['db', 'query', sql, '--output', 'json', '--agent', 'no', ...targetArgs(session.target, session.ctx.cwd)]).stdout);
+const cliQuery = (session) => (sql) => psqlRows(session.ctx, session.target, sql, { withhold: true });
 
 async function queryRows(session, sql, options) {
   try {
@@ -89,26 +90,21 @@ function timeGate(ctx, post, options) {
 }
 
 function applyHeld(session, remote) {
-  const { model, ctx } = session;
+  const { model } = session;
   const lacking = [...model.pushVersions].filter((version) => !remote.has(version));
-  if (lacking.length > 0) throw refusal('DB_BASELINE_NOT_APPLIED', `the remote history lacks ${lacking.join(', ')}: run starci app db migrate first`);
-  const args = ['db', 'push', '--include-all'];
-  const pending = pendingVersions(runCli(session, [...args, '--dry-run', ...targetArgs(session.target, ctx.cwd)]).text);
-  const stray = pending.filter((version) => !model.heldVersions.includes(version));
-  if (stray.length > 0) throw failure('DB_PUSH_STRAY', `the dry run lists more than the held-back migrations: ${pending.join(', ')}. Stopped.`);
-  if (pending.length > 0) runCli(session, [...args, '--yes', ...targetArgs(session.target, ctx.cwd)]);
-  return pending;
+  if (lacking.length > 0) throw refusal('DB_BASELINE_NOT_APPLIED', `the history lacks ${lacking.join(', ')}: run starci app db migrate first`);
+  return applyVersions(session, model.heldVersions.filter((version) => !remote.has(version)));
 }
 
 /**
- * `starci app db post-cutover`. options: { execute, linked, urlEnv, greenAt, ownerConfirms, query }. Dry run: remote read plus the read-only preflight.
- * --execute: gate open and STARCI_DB_ARMED=1, then `db push --include-all` of exactly the held-back versions.
+ * `starci app db post-cutover`. options: { execute, urlEnv, greenAt, ownerConfirms, query }. Dry run: history read plus the read-only preflight.
+ * --execute: gate open and STARCI_DB_ARMED=1, then exactly the held-back versions, each with its history row in one transaction.
  */
 async function postCutoverDatabase(ctx, decl, options = {}) {
   const model = buildModel(ctx.cwd, decl);
   if (model.held.length === 0) return { ok: true, lines: ['no held-back migration in the repository. Nothing to do.'], data: { held: [], done: true, executed: false } };
   if (decl.postCutover === null) throw refusal('DB_POSTCUTOVER_UNDECLARED', 'database.postCutover is not declared: the function preflight needs it (an empty mapping declares no family)');
-  const session = { ctx, decl, model, target: resolveTarget(ctx, decl, options) };
+  const session = { ctx, decl, model, target: resolveTarget(ctx, options) };
   const remote = listRemote(session);
   const data = { held: model.heldVersions, done: false, executed: false };
   if (model.heldVersions.every((version) => remote.has(version))) return { ok: true, lines: [`held-back migrations ${model.held.join(', ')} are already applied. Nothing to do.`], data: { ...data, done: true } };
@@ -123,14 +119,14 @@ async function postCutoverDatabase(ctx, decl, options = {}) {
   return { ok: true, lines: [...lines, pending.length > 0 ? `applied: ${pending.join(', ')}` : 'nothing pending: already applied.'], data: { ...data, done: true, executed: true, pushed: pending, signatures: preflight.count } };
 }
 
-const SPEC = { boolean: ['--execute', '--json', '--linked', '--owner-confirms-old-app-gone'], value: ['--url-env', '--green-at'] };
+const SPEC = { boolean: ['--execute', '--json', '--owner-confirms-old-app-gone'], value: ['--url-env', '--green-at'] };
 
-/** Entry of the verb: `starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--linked | --url-env NAME] [--json]`. */
+/** Entry of the verb: `starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--url-env NAME] [--json]`. */
 export function dbPostCutoverMain(argv, io = {}) {
   return runVerb({
     label: 'starci app db post-cutover', name: 'db post-cutover', code: 'DB_USAGE', io, argv, spec: SPEC,
     run: (ctx, flags) => postCutoverDatabase(ctx, loadDatabase(ctx.cwd), {
-      execute: flags.execute === true, linked: flags.linked === true, urlEnv: flags['url-env'], greenAt: flags['green-at'], ownerConfirms: flags['owner-confirms-old-app-gone'] === true,
+      execute: flags.execute === true, urlEnv: flags['url-env'], greenAt: flags['green-at'], ownerConfirms: flags['owner-confirms-old-app-gone'] === true,
     }),
   });
 }

package/db/postgres.mjs

@@ -0,0 +1,80 @@
+// postgres.mjs - the one door of the `starci app db` verbs to a self-hosted PostgreSQL: psql and pg_dump through ctx.spawn (never a
+// shell). The database is named by an environment variable holding a postgres connection URL (`--url-env <NAME>`, default
+// DATABASE_URL); the password travels only in the child's PGPASSWORD, never in argv, a file, a line or an error.
+import { failure, refusal } from '../stack/errors.mjs';
+import { firstLine, tool } from '../stack/context.mjs';
+
+/** The default environment variable that names the app's database. */
+export const DEFAULT_DB_URL_ENV = 'DATABASE_URL';
+/** The history table `starci app db migrate` records applied migrations in (the layout the supabase/postgres image already ships). */
+export const HISTORY_TABLE = 'supabase_migrations.schema_migrations';
+
+const KEY = /^[A-Z][A-Z0-9_]*$/u;
+
+const scrub = (text, secrets) => secrets.reduce((out, secret) => out.replaceAll(secret, '[value]'), String(text));
+
+/** { url, password } of a postgres connection URL with the password removed, or null when `value` is not one. */
+export function parseConnection(value) {
+  try {
+    const url = new URL(value);
+    if (!/^postgres(?:ql)?:$/u.test(url.protocol)) return null;
+    const password = decodeURIComponent(url.password);
+    url.password = '';
+    return { url: url.toString(), password };
+  } catch { return null; }
+}
+
+/** The database `name` (an UPPER_CASE environment variable, default DATABASE_URL) names: { how, url, env, secrets }. */
+export function dbTarget(ctx, name = DEFAULT_DB_URL_ENV) {
+  if (!KEY.test(name)) throw refusal('DB_USAGE', '--url-env must name an UPPER_CASE environment variable');
+  const value = ctx.env[name];
+  if (typeof value !== 'string' || value === '') throw refusal('DB_URL_ENV_MISSING', `${name} is not set`);
+  const parsed = parseConnection(value);
+  if (!parsed) throw refusal('DB_URL_INVALID', `${name} is not a postgres connection URL`);
+  return { kind: 'url', how: `connection string from ${name}`, urlEnv: name, url: parsed.url, env: parsed.password ? { PGPASSWORD: parsed.password } : {}, secrets: [value, parsed.password].filter(Boolean) };
+}
+
+/** Runs a PostgreSQL client tool against `target`; a failure names the first stderr line with every secret scrubbed (or withholds it). */
+export function pgTool(ctx, target, command, args, { withhold = false, code = 'DB_CLI_FAILED' } = {}) {
+  const run = tool(ctx, command, args, { cwd: ctx.cwd, env: { ...ctx.env, ...target.env } });
+  if (run.error) throw failure('DB_CLI_MISSING', `cannot run ${command}; install the PostgreSQL client tools (psql, pg_dump)`);
+  if (run.status !== 0) throw failure(code, withhold ? `${command} failed; output withheld` : `${command} failed: ${scrub(firstLine(run.stderr), target.secrets)}`);
+  return { stdout: run.stdout ?? '', text: `${run.stdout ?? ''}${run.stderr ?? ''}` };
+}
+
+const PSQL = ['-X', '-q', '-v', 'ON_ERROR_STOP=1'];
+
+/** Runs SQL statements (`-c`) and files (`-f`) in ONE transaction: each step is { sql } or { file }. */
+export function psqlTransaction(ctx, target, steps, options = {}) {
+  const args = [...PSQL, '-1', '-d', target.url, ...steps.flatMap((step) => (step.file !== undefined ? ['-f', step.file] : ['-c', step.sql]))];
+  return pgTool(ctx, target, 'psql', args, options);
+}
+
+/** The rows of one read-only query as plain objects (json_agg on the server, so no psql formatting is parsed). */
+export function queryRows(ctx, target, sql, options = {}) {
+  const wrapped = `select coalesce(json_agg(row_to_json(q)), '[]'::json) from (${sql.replace(/;\s*$/u, '')}) q`;
+  const { stdout } = pgTool(ctx, target, 'psql', [...PSQL, '-A', '-t', '-d', target.url, '-c', wrapped], options);
+  let rows;
+  try { rows = JSON.parse(stdout.trim() || '[]'); } catch { throw failure('DB_QUERY_UNREADABLE', 'the database answered rows psql could not print as JSON; output withheld'); }
+  if (!Array.isArray(rows) || rows.some((row) => !row || typeof row !== 'object' || Array.isArray(row))) throw failure('DB_QUERY_UNREADABLE', 'the database answer is not a rows array');
+  return rows;
+}
+
+/** A SQL string literal of `value`. */
+export const literal = (value) => `'${String(value).replaceAll("'", "''")}'`;
+
+/** The versions the history table records; an absent table is an empty history (a database `migrate` has never touched). */
+export function historyVersions(ctx, target) {
+  const [presence] = queryRows(ctx, target, `select pg_catalog.to_regclass(${literal(HISTORY_TABLE)}) is not null as present`);
+  if (presence?.present !== true) return new Set();
+  return new Set(queryRows(ctx, target, `select version from ${HISTORY_TABLE} order by version`).map((row) => String(row.version)));
+}
+
+/** The statement that creates the history table when it is absent (same columns as the image's own: version, statements, name). */
+export const HISTORY_DDL = `create schema if not exists supabase_migrations; create table if not exists ${HISTORY_TABLE} (version text primary key, statements text[], name text)`;
+
+/** Records `version` (named `name`) as applied. */
+export const markApplied = (version, name) => `insert into ${HISTORY_TABLE} (version, name) values (${literal(version)}, ${literal(name)}) on conflict (version) do update set name = excluded.name`;
+
+/** Removes `version` from the history. */
+export const markReverted = (version) => `delete from ${HISTORY_TABLE} where version = ${literal(version)}`;

package/emit/contracts.mjs

@@ -18,10 +18,7 @@
  * TypeScript, Nest and graphql are the repository's own packages; nothing is added to the managed devDependencies. Every app
  * runs in its own child process (`schema-worker.mjs`) because Nest GraphQL's type metadata is process-global.
  *
- * An app whose declaration enables the slot `app.supabase.types` (a connection with provider supabase) also gets its generated
- * Database types written: `supabase/types/database.types.ts` at the app root through `writeDbTypes` (emit/db-types.mjs), the
- * same `supabase gen types typescript --local` text L09 DB_TYPES_DRIFT regenerates to judge drift. The types are an app-level
- * artifact, so a redirected `outDir` (the R23 check mode, which emits into a scratch root) does not get them.
+ * * artifact, so a redirected `outDir` (the R23 check mode, which emits into a scratch root) does not get them.
  */
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
@@ -30,7 +27,6 @@ import { fileURLToPath } from 'node:url';
 import { emitEvents, eventServices, eventsSnapshotPath } from './events.mjs';
 import { openapiPath } from './operations.mjs';
 import { readEnv } from '../runtime/scripts/lib/env.mjs';
-import { appHasDbTypes, writeDbTypes } from './db-types.mjs';
 import { createSlotResolver, loadSlotManifest, locateDeclaration, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 
 /** The stderr prefix of a dependency the worker could not load and stood in for. */
@@ -84,7 +80,7 @@ function emitApp(repoRoot, app) {
  * resolves there (a bare folder is not an app and emits no types). `repoRoot` is the be side folder, so `locateDeclaration`
  * answers the app root above it.
  */
-function appSupabaseScope(repoRoot) {
+function appDbScope(repoRoot) {
   try {
     const { appRoot } = locateDeclaration(repoRoot);
     const manifest = loadSlotManifest();
@@ -100,9 +96,9 @@ function appSupabaseScope(repoRoot) {
  * being the apps with neither. `declaration` is the parsed hfs.json. `outDir` (absolute) redirects the snapshots to another
  * root, keeping their relative paths.
  *
- * On the real write pass (`outDir` is `repoRoot`) the app's Supabase types are written too when the slot `app.supabase.types`
+ * On the real write pass (`outDir` is `repoRoot`) the app's database types are written too when the slot `app.db.types`
  * is enabled: `resolver` is the app-scope slot view (built from the declaration at the app root when not passed), `appRoot`
- * overrides where the types land, and `run` is the command runner `writeDbTypes` spawns `supabase` with. `types` in the answer
+ * overrides where the types land, and `run` is the command runner `writeDbTypes` spawns `psql` with. `types` in the answer
  * is `writeDbTypes`'s `{ path, changed }`, or null for an app without the slot or a redirected pass.
  */
 export function emitContracts({ repoRoot, declaration, outDir = repoRoot, resolver, appRoot, run } = {}) {
@@ -137,7 +133,7 @@ export function emitContracts({ repoRoot, declaration, outDir = repoRoot, resolv
   // The generated Database types are an app-level artifact of the write pass only: a redirected outDir is the R23 check
   // mode, and L09 judges drift on the same emitted text through the injected emitTypes (emit/db-types.mjs dbTypesEmitter).
   if (outDir === repoRoot) {
-    const scope = resolver === undefined ? appSupabaseScope(repoRoot) : { appRoot: locateDeclaration(repoRoot).appRoot, resolver };
+    const scope = resolver === undefined ? appDbScope(repoRoot) : { appRoot: locateDeclaration(repoRoot).appRoot, resolver };
     const target = appRoot ?? scope?.appRoot;
     if (target !== null && target !== undefined && scope?.resolver != null && appHasDbTypes(scope.resolver)) types = writeDbTypes({ root: target, run });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.9.11",
+  "version": "4.10.0",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/gate.mjs

@@ -33,13 +33,11 @@ export const VERSION = /^(\d+)\.(\d+)\.(\d+)$/u;
 const THRESHOLD_MISS = /coverage threshold .* not met/gu;
 const WRAPPED = new Set(['npm', 'npx']);
 // Every row the managed CI runs, so a release that does not wait for its candidate CI (release.requireCi false) still ran them all locally:
-// fast (audit, format, typecheck), lint, test + coverage (the managed `test` script is the per-file 100 threshold), build, the lite database lint and types, and Sonar.
+// fast (audit, format, typecheck), lint, test + coverage (the managed `test` script is the per-file 100 threshold), build, the lite database lint, and Sonar.
 const SCRIPT_GATES = ['format:check', 'typecheck', 'build:be', 'lint', 'db:lint', 'build:fe', 'test'];
 // A full app has a test world (integration, e2e and contract projects, always present: the managed `test:e2e` script marks it), so those layers are rows of its gate;
 // a lite app's integration project exists only where it has integration specs, so it has no world rows.
 const WORLD_SCRIPTS = ['test:integration', 'test:e2e', 'test:contract'];
-const DB_TYPES_SCRIPTS = ['db:start', 'db:reset', 'db:types', 'db:stop'];
-const DB_TYPES_COMMITTED = { name: 'db-types-committed', command: ['git', 'diff', '--exit-code', '--', 'supabase/types/database.types.ts'], summary: null, env: {} };
 // An app with an entity list (db/entity-list.mjs) checks its entities against the migrated schema: a row of every gate, declared or default.
 const DB_DRIFT = { name: 'db-drift', command: ['npx', 'starci', 'app', 'db', 'drift'], summary: null, env: {} };
 
@@ -53,21 +51,11 @@ const scriptGate = (script) => ({
   env: {},
 });
 
-/**
- * The lite database-types rows of the managed CI, in its order: start Supabase, apply the migrations, regenerate the types, require them committed, stop.
- * The stop is the teardown of the start (`teardownOf`): it runs whenever the start ran, also after a red row, so a failed database row never leaves Supabase running.
- */
-function dbTypesGates(scripts) {
-  if (!DB_TYPES_SCRIPTS.every((script) => typeof scripts?.[script] === 'string')) return [];
-  const [start, reset, types, stop] = DB_TYPES_SCRIPTS.map(scriptGate);
-  return [start, reset, types, DB_TYPES_COMMITTED, { ...stop, teardownOf: start.name }];
-}
-
-/** Default gates run app-check, the enabled audit, then every managed script present in the app, the database-types rows and the entity drift row, Sonar following when it is declared. */
+/** Default gates run app-check, the enabled audit, then every managed script present in the app and the entity drift row, Sonar following when it is declared. */
 function defaultGates(scripts, audit, entities) {
   const present = SCRIPT_GATES.filter((script) => typeof scripts?.[script] === 'string');
   const world = typeof scripts?.['test:e2e'] === 'string' ? WORLD_SCRIPTS.filter((script) => typeof scripts?.[script] === 'string') : [];
-  return [{ name: 'app-check', command: ['npx', 'starci', 'app', 'check'], summary: null, env: {} }, ...(audit ? [audit] : []), ...present.map(scriptGate), ...world.map(scriptGate), ...dbTypesGates(scripts), ...(entities ? [DB_DRIFT] : [])];
+  return [{ name: 'app-check', command: ['npx', 'starci', 'app', 'check'], summary: null, env: {} }, ...(audit ? [audit] : []), ...present.map(scriptGate), ...world.map(scriptGate), ...(entities ? [DB_DRIFT] : [])];
 }
 
 /** Shared quality settings retain the release reader's audit validation, disabled mode and legacy string host compatibility. */

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.10
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.6.8
+    version: 3.7.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.4.9
+    version: 9.5.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.10
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.10
+    version: 0.15.11
     group: starci
     install: registry
     side: fe
@@ -85,12 +85,12 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.4.1
+    version: 2.5.0
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
-    why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
+    why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeQueryBuilder, queueQueryBuilders, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
     version: 1.2.3
     group: starci
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.9.11
+    version: 4.10.0
     group: starci
     install: registry
     side: both
@@ -543,7 +543,7 @@ pins:
     version: 3.1150.0
     group: framework
     side: be
-    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces, Supabase Storage); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
+    why: 'the S3 transport of integrations/object-storage, the one ObjectStorage adapter of both editions (MinIO, S3, Spaces); 3.1150.0 is the release of 2026-10-12, chosen over newer ones that had not aged two weeks.'
   '@aws-sdk/s3-request-presigner':
     version: 3.1150.0
     group: framework
@@ -594,27 +594,47 @@ pins:
     group: framework
     side: be
     why: 'the Express 5 integration @nestjs/apollo loads at boot (R111 nestjs-apollo-express5, knowledge/hfs/peer-integrations.yaml); every api app that serves GraphQL installs it; the latest registry version on 2026-10-13.'
-  # --- Supabase lite
-  '@supabase/ssr':
-    version: 0.12.7
+  # --- lite identity (integrations/passport, ruling lite-self-hosted-postgres-passport-minio)
+  '@nestjs/passport':
+    version: 11.0.5
     group: framework
-    side: fe
-    why: the one server/browser client factory for a lite Next app; exact version registry-checked for the lite scaffold.
-  '@supabase/supabase-js':
-    version: 2.117.2
+    side: be
+    why: 'PassportStrategy of integrations/passport; 11.0.5 is CommonJS on the Nest 11 line (12.0.0 is ESM-only and breaks Nest 11 jest under the CommonJS transform of @starci/jest-preset), as nivo-lite runs it.'
+  passport:
+    version: 0.7.0
     group: framework
-    side: both
-    why: the generated Database-typed client used by the FE data owner and the BE Auth/Storage integration.
+    side: be
+    why: the strategy runtime under @nestjs/passport (its peer range ^0.5 || ^0.6 || ^0.7).
+  passport-google-oauth20:
+    version: 2.0.0
+    group: framework
+    side: be
+    why: Google OAuth 2.0 (authorization code with state and PKCE) of integrations/passport.
+  passport-local:
+    version: 1.0.0
+    group: framework
+    side: be
+    why: the email and password strategy of integrations/passport.
+  bcryptjs:
+    version: 3.0.3
+    group: framework
+    side: be
+    why: 'bcrypt in pure JavaScript (no native build on the alpine image); verifies the $2a$/$2b$ hashes auth.users carries over.'
+  '@types/passport-google-oauth20':
+    version: 2.0.17
+    group: framework
+    side: be
+    why: types of passport-google-oauth20.
+  '@types/passport-local':
+    version: 1.0.38
+    group: framework
+    side: be
+    why: types of passport-local.
   jose:
     version: 6.2.12
     group: framework
     side: be
-    why: verifies Supabase access tokens against the project JWKS with issuer, audience, expiry and algorithm checks.
-  supabase:
-    version: 2.119.0
-    group: tooling
-    side: both
-    why: the root CLI wrapper owns local schema lifecycle and generates the committed database types.
+    why: signs the app's own ES256 access tokens and verifies them against its own key set (createLocalJWKSet) in integrations/passport.
   class-transformer:
     version: 0.5.1
     group: framework

package/runtime/knowledge/hfs/design-truths.yaml

@@ -29,7 +29,7 @@ outsideTheGates:
     entries: [node_modules, dist, build, coverage, .next, storybook-static, "*.tsbuildinfo", __generated__, .starci]
   - id: root-output-and-records
     cite: {ruling: design-truths-confirmed}
-    entries: [reports, contracts, supabase/types, .starcistacks, .starciwork, package-lock.json]
+    entries: [reports, contracts, .starcistacks, .starciwork, package-lock.json]
 
 # The gate limits of the Sonar gate (knowledge/sonar-gate.yaml): a floor is a number that may not be lower, a ceiling a number that may not be higher.
 gateLimits:

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -37,10 +37,10 @@ concerns:
   - id: rest
     tier: core
     packages: [axios]
-    home: [fe.modules.api]
+    home: [fe.modules.api, fe.modules.auth]
     pattern: FE-API-REST
     forbids: [ky, superagent, node-fetch, cross-fetch, isomorphic-fetch]
-    why: modules/api/rest/<area>/*.ts for uploads, presigned URLs and auth endpoints only; GraphQL carries every other call.
+    why: modules/api/rest/<area>/*.ts for uploads and presigned URLs, and modules/auth/auth-door.ts for the app's own auth doors only; GraphQL carries every other call.
   - id: data
     tier: core
     packages: [swr]
@@ -99,8 +99,8 @@ concerns:
     packages: []
     home: [fe.modules.auth]
     pattern: FE-AUTH
-    forbids: []
-    why: modules/auth is the identity-provider client (lite - the @supabase/supabase-js auth client; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
+    forbids: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-js']
+    why: modules/auth is the session issuer's client (lite - auth-door.ts over the app's own back-end auth doors with the in-memory token store; full - the app's IdP client); it yields the session and the access token for the Apollo link and never reads data.
   - id: i18n
     tier: core
     packages: [next-intl]
@@ -256,13 +256,6 @@ concerns:
     pattern: FE-RULE-OWNERSHIP
     forbids: []
     why: The selected Grammar family's lint package runs beside the universal front-end canon; the family catalog declares the package and factory.
-  - id: auth-supabase
-    tier: opt
-    packages: ['@supabase/supabase-js', '@supabase/ssr']
-    home: [fe.modules.auth]
-    pattern: FE-AUTH
-    forbids: []
-    why: the lite auth provider client and PKCE server cookie adapter, confined to modules/auth; data still goes through the back end.
   - id: framework-support
     tier: opt
     packages: [server-only, rxjs]