@starci/hfs 4.9.11 → 4.10.0

package/runtime/scripts/hfs/rules/database-access.mjs

@@ -1,10 +1,8 @@
-// R254-R256 inspect the final database access state, so later revokes and policy drops retire old browser doors.
+// R255-R256 inspect the final database access state: the application role, forced RLS, policies, views and storage prefixes.
 import { found } from './read.mjs';
 import { parseSql } from '../sql/pg-parse.mjs';
 import { eachInOrder } from '../../lib/in-order.mjs';
 
-export const DB_BE_ONLY_ACCESS = 'DB_BE_ONLY_ACCESS';
-export const DB_REALTIME_UNLISTED = 'DB_REALTIME_UNLISTED';
 export const DB_APP_ROLE = 'DB_APP_ROLE';
 export const DB_FORCE_RLS_DEFAULT = 'DB_FORCE_RLS_DEFAULT';
 export const DB_POLICY_TAUTOLOGY = 'DB_POLICY_TAUTOLOGY';
@@ -20,8 +18,6 @@ const unwrap = (node) => node?.TypeCast ? unwrap(node.TypeCast.arg) : node;
 const stringValue = (node) => unwrap(node)?.A_Const?.sval?.sval;
 const operator = (node) => names(node.name);
 const publicRead = (policy) => policy.cmd === 'select' && policy.name.endsWith('_public_read');
-const anonymous = (role) => role === 'anon' || role === 'public';
-const browserRole = (role) => anonymous(role) || role === 'authenticated';
 const AND = ['AND', 'EXPR'].join('_');
 const OR = ['OR', 'EXPR'].join('_');
 const NOT = ['NOT', 'EXPR'].join('_');
@@ -119,40 +115,10 @@ function updatePrivileges(state, granting, privileges) {
   if (privileges.some((privilege) => ['select', 'all'].includes(privilege))) state.revokedRead = true;
 }
 
-function grantAccessFindings(grants, policies, exposed, directAccess) {
-  const findings = [];
-  for (const state of grants.values()) {
-    if (!state.privileges.size || !browserRole(state.role)) continue;
-    if (!exposed.has(state.target.split('.')[0]) || directAccess.has(state.target)) continue;
-    const readOnly = state.privileges.size === 1 && state.privileges.has('select');
-    const policy = policies.some((item) => `${item.schema}.${item.table}` === state.target && publicRead(item)
-      && item.roles.some((role) => role === state.role || role === 'public'));
-    if (anonymous(state.role) && state.objtype === 'OBJECT_TABLE' && readOnly && policy) continue;
-    findings.push(note(DB_BE_ONLY_ACCESS, state, `grants ${state.role} data privileges on ${state.target}; browser data access requires supabase.directAccess, or anonymous SELECT beside *_public_read`, { table: state.target }));
-  }
-  return findings;
-}
-
-function defaultAccessFindings(analyses, exposed) {
-  const findings = [];
-  for (const { file, facts } of analyses) {
-    for (const defaults of facts.defaultPrivileges) {
-      if (!defaults.grant || !['OBJECT_TABLE', SEQUENCE].includes(defaults.objtype)) continue;
-      if (defaults.schemas?.length && !defaults.schemas.some((schema) => exposed.has(schema))) continue;
-      if (defaults.grantees.some(browserRole)) findings.push(note(DB_BE_ONLY_ACCESS, { ...defaults, file }, 'grants default browser data privileges; exposed data grants must be explicit per table'));
-    }
-  }
-  return findings;
-}
-
-function policyFindings(policies, exposed, directAccess, appRole, helpers) {
+function policyFindings(policies, appRole, helpers) {
   const findings = [];
   for (const policy of policies) {
     const table = `${policy.schema}.${policy.table}`;
-    const listed = directAccess.has(table);
-    if (exposed.has(policy.schema) && !listed && policy.roles.some((role) => browserRole(role) && !(anonymous(role) && publicRead(policy)))) {
-      findings.push(note(DB_BE_ONLY_ACCESS, policy, `policy ${policy.name} opens ${table} to browser roles; list intentional access in supabase.directAccess`, { table, policy: policy.name }));
-    }
     if (policy.roles.every((role) => role === appRole) || publicRead(policy)) continue;
     const predicates = [policy.qual, policy.withCheck].filter((expression) => expression !== undefined);
     if (!predicates.length || predicates.some((expression) => !principalPredicate(expression, helpers))) {
@@ -187,34 +153,6 @@ function roleStatementFindings(statement, appRole) {
   return [note(DB_APP_ROLE, statement, `${appRole} must LOGIN NOINHERIT without SUPERUSER, BYPASSRLS or administrative role attributes`)];
 }
 
-function publicationTargets(node, defaultSchema) {
-  if (node.for_all_tables) return ['*'];
-  return (node.pubobjects ?? []).map(({ PublicationObjSpec: spec }) => {
-    if (spec.pubtable?.relation) return relationName(spec.pubtable.relation, defaultSchema);
-    return `${spec.name ?? defaultSchema}.*`;
-  });
-}
-
-function publicationFindings(analyses, directAccess) {
-  const tables = new Map();
-  for (const { file, facts } of analyses) {
-    for (const statement of facts.statements) {
-      applyPublication(tables, { ...statement, file });
-    }
-  }
-  return [...tables].filter(([table]) => !directAccess.has(table)).map(([table, source]) => note(DB_REALTIME_UNLISTED, source, `supabase_realtime publishes unlisted ${table}; every browser data table must be in supabase.directAccess`, { table }));
-}
-
-function applyPublication(tables, statement) {
-  const { type, node, defaultSchema } = statement;
-  if (!['CreatePublicationStmt', 'AlterPublicationStmt'].includes(type) || node.pubname !== 'supabase_realtime') return;
-  if (type === 'CreatePublicationStmt' || node.action === 'AP_SetObjects') tables.clear();
-  for (const table of publicationTargets(node, defaultSchema)) {
-    if (node.action === 'AP_DropObjects') tables.delete(table);
-    else tables.set(table, statement);
-  }
-}
-
 function tableStates(analyses) {
   const tables = new Map();
   let owner = null;
@@ -251,10 +189,10 @@ function applyTableAlter(tables, statement) {
   tables.set(key, table);
 }
 
-function forceFindings(analyses, supabase, appRole) {
-  const exemptions = new Set((supabase.forceRlsExemptions ?? []).filter((item) => typeof item?.table === 'string' && typeof item.reason === 'string' && item.reason.trim()).map((item) => qualify(item.table)));
+function forceFindings(analyses, db, appRole) {
+  const exemptions = new Set((db.forceRlsExemptions ?? []).filter((item) => typeof item?.table === 'string' && typeof item.reason === 'string' && item.reason.trim()).map((item) => qualify(item.table)));
   return [...tableStates(analyses)].filter(([name, table]) => table.owner === appRole && !table.forced && !exemptions.has(name))
-    .map(([table, source]) => note(DB_FORCE_RLS_DEFAULT, source, `${appRole} owns ${table} without FORCE ROW LEVEL SECURITY; an exemption needs supabase.forceRlsExemptions with a table and reason`, { table }));
+    .map(([table, source]) => note(DB_FORCE_RLS_DEFAULT, source, `${appRole} owns ${table} without FORCE ROW LEVEL SECURITY; an exemption needs hfs.json db.forceRlsExemptions with a table and reason`, { table }));
 }
 
 function viewFindings(analyses, grants, exposed) {
@@ -318,10 +256,9 @@ function storagePrefixFindings(policies, helpers) {
 }
 
 /** All new access checks run on the ordered active migrations in either edition, through checkDatabase. */
-export async function databaseAccessFindings({ analyses, exposed, supabase = {} }) {
-  const declared = supabase ?? {};
+export async function databaseAccessFindings({ analyses, exposed, db = {} }) {
+  const declared = db ?? {};
   const appRole = declared.appRole ?? 'app_be';
-  const directAccess = new Set((declared.directAccess ?? []).filter((table) => typeof table === 'string').map(qualify));
   const policyMap = new Map();
   const grants = new Map();
   for (const { file, facts } of analyses) {
@@ -331,10 +268,7 @@ export async function databaseAccessFindings({ analyses, exposed, supabase = {}
   const policies = [...policyMap.values()];
   const helpers = await principalHelpers(analyses);
   return [
-    ...grantAccessFindings(grants, policies, exposed, directAccess),
-    ...defaultAccessFindings(analyses, exposed),
-    ...policyFindings(policies, exposed, directAccess, appRole, helpers),
-    ...publicationFindings(analyses, directAccess),
+    ...policyFindings(policies, appRole, helpers),
     ...roleFindings(analyses, appRole),
     ...forceFindings(analyses, declared, appRole),
     ...viewFindings(analyses, grants, exposed),

package/runtime/scripts/hfs/rules/database-baseline.mjs

@@ -8,8 +8,8 @@ import { found, readText } from './read.mjs';
 import { migrationStamp } from './database-migrations.mjs';
 import { DB_BASELINE_SHAPE, DB_ARCHIVE_MUTATED, MIGRATIONS_DIR, MIGRATIONS_ARCHIVE_DIR } from './database-constants.mjs';
 
-const ACTIVE = /^supabase\/migrations\/\d{14}_[^/]+\.sql$/;
-const ARCHIVED = /^supabase\/migrations\/_archive\/\d{14}_[^/]+\.sql$/;
+const ACTIVE = /^db\/migrations\/\d{14}_[^/]+\.sql$/;
+const ARCHIVED = /^db\/migrations\/archive\/\d{14}_[^/]+\.sql$/;
 const stampOf = (file) => /(?:^|\/)(\d{14})_/.exec(file)?.[1] ?? null;
 
 /** Header comments only: SQL literals and later comments cannot impersonate a baseline marker. */
@@ -68,7 +68,7 @@ function shapeFindings(repoRoot, active, archived) {
   if (!archived.length) return { findings: [], marked };
   const findings = [];
   if (marked.length !== 1) {
-    findings.push(found(DB_BASELINE_SHAPE, MIGRATIONS_DIR, 'a nonempty _archive requires exactly one active -- starci:baseline <archived-last-stamp> header marker'));
+    findings.push(found(DB_BASELINE_SHAPE, MIGRATIONS_DIR, 'a nonempty archive requires exactly one active -- starci:baseline <archived-last-stamp> header marker'));
     return { findings, marked };
   }
   const latest = archived.map(stampOf).filter((stamp) => stamp && migrationStamp(stamp) !== null).sort((left, right) => left.localeCompare(right)).at(-1);

package/runtime/scripts/hfs/rules/database-config.mjs

@@ -1,141 +1,13 @@
-// database-config.mjs - L08 Supabase TOML policy and L09 generated-type drift checks. Parsing and type emission stay
-// lazy/injected so applications without Supabase do not load either tool and this rule starts no Docker process.
-import { sameText } from '../../lib/same-text.mjs';
-import path from 'node:path';
-import { parse as parseTomlSync } from 'smol-toml';
-import { found, readJson, readText } from './read.mjs';
+// database-config.mjs - the database content checks of db/ (R259: extensions, custody SQL, destructive migrations, seed data). It starts no
+// database and no Docker process.
+import { found, readText } from './read.mjs';
 import {
-  CONFIG_FILE, DB_API_EXPOSED, DB_CONFIG_POLICY, DB_EXTENSION_ALLOWED, DB_TYPES_DRIFT, DB_VAULT_WRITE,
-  HFS_SEED_PII, isActiveMigration, TYPES_FILE,
+  DB_EXTENSION_ALLOWED, DB_VAULT_WRITE, HFS_SEED_PII, isActiveMigration, SEED_FILE,
 } from './database-constants.mjs';
 import { databaseExecutableTokens, databaseSqlStatements, databaseSqlTokens, destructiveMigrationFindings } from './database-migrations.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
-const ENV_REF = /^env\([A-Za-z_]\w*\)$/;
-const PUBLIC_KEYS = new Set(['anon_key', 'publishable_key', 'public_key']);
-
-
-function tomlEntries(value, path = []) {
-  if (!value || typeof value !== 'object') return [];
-  if (Array.isArray(value)) return value.flatMap((item) => tomlEntries(item, path));
-  return Object.entries(value).flatMap(([key, child]) => {
-    const at = [...path, key];
-    if (child && typeof child === 'object') {
-      if (Array.isArray(child)) {
-        if (child.every((item) => item && typeof item === 'object' && !Array.isArray(item))) return child.flatMap((item) => tomlEntries(item, at));
-      } else return tomlEntries(child, at);
-    }
-    return [[at.join('.'), key, child]];
-  });
-}
-
-const isCredentialKey = (key) => {
-  const leaf = key.toLowerCase();
-  return ['secret', 'client_id', 'key', 'pass', 'password', 'token'].includes(leaf)
-    || /_(secret|password|token|client_id|api_key)$/.test(leaf)
-    || (leaf.endsWith('_key') && !PUBLIC_KEYS.has(leaf));
-};
-
-const escapeRegexPart = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-
-const tomlLine = (text, key) => {
-  const expression = new RegExp(String.raw`^\s*["']?${escapeRegexPart(key)}["']?\s*=`, 'm');
-  const match = expression.exec(text);
-  return match ? text.slice(0, match.index).split('\n').length : undefined;
-};
-
-function credentialConfigFindings(file, text, toml) {
-  const findings = [];
-  for (const [at, key, value] of tomlEntries(toml)) {
-    if (!isCredentialKey(key)) continue;
-    const line = tomlLine(text, key);
-    if (typeof value !== 'string' || !ENV_REF.test(value)) {
-      const lineNote = line ? `:${line}` : '';
-      findings.push(found(DB_CONFIG_POLICY, file, `${file}${lineNote} ${at} holds a literal credential; a secret in config.toml is written env(NAME), never a value`, { ...(line ? { line } : {}), key: at }));
-    }
-  }
-  return findings;
-}
-
-// A finding for an auth setting of config.toml that differs from what hfs.json supabase.<field> declares; `shown` is the setting as read.
-const settingFinding = (file, key, field, shown, declaredValue, note = '') => found(DB_CONFIG_POLICY, file, `${file} ${key} is ${shown}; hfs.json supabase.${field} declares ${declaredValue}${note}`, { key, declared: declaredValue });
-
-const shownSetting = (value) => JSON.stringify(value ?? 'absent');
-
-function signupFindings(file, auth, declared) {
-  const findings = [];
-  if (declared.enableSignup === undefined) return findings;
-  if (auth.enable_signup !== declared.enableSignup) findings.push(settingFinding(file, 'auth.enable_signup', 'enableSignup', shownSetting(auth.enable_signup), declared.enableSignup, ' - the invite posture is a checked fact, not a doc claim'));
-  if (auth.email?.enable_signup !== undefined && auth.email.enable_signup !== declared.enableSignup) {
-    findings.push(settingFinding(file, 'auth.email.enable_signup', 'enableSignup', JSON.stringify(auth.email.enable_signup), declared.enableSignup));
-  }
-  return findings;
-}
-
-function redirectUrlFindings(file, auth, declared) {
-  const findings = [];
-  if (declared.redirectUrls === undefined) return findings;
-  const configured = Array.isArray(auth.additional_redirect_urls) ? auth.additional_redirect_urls : [];
-  for (const url of configured) {
-    if (!declared.redirectUrls.includes(url)) findings.push(found(DB_CONFIG_POLICY, file, `${file} auth.additional_redirect_urls holds ${url}, which hfs.json supabase.redirectUrls does not declare; the config states nothing the app did not declare`, { key: 'auth.additional_redirect_urls', url }));
-  }
-  for (const url of declared.redirectUrls) {
-    if (!configured.includes(url)) findings.push(found(DB_CONFIG_POLICY, file, `${file} auth.additional_redirect_urls omits ${url}, which hfs.json supabase.redirectUrls declares; the config and declaration must carry the same redirect set`, { key: 'auth.additional_redirect_urls', url }));
-  }
-  return findings;
-}
-
-function declarationConfigFindings(file, auth, declared) {
-  const findings = [];
-  if (declared.jwtExpiry !== undefined && auth.jwt_expiry !== declared.jwtExpiry) findings.push(settingFinding(file, 'auth.jwt_expiry', 'jwtExpiry', shownSetting(auth.jwt_expiry), declared.jwtExpiry));
-  findings.push(...signupFindings(file, auth, declared));
-  if (declared.siteUrl !== undefined && auth.site_url !== declared.siteUrl) findings.push(settingFinding(file, 'auth.site_url', 'siteUrl', shownSetting(auth.site_url), declared.siteUrl));
-  findings.push(...redirectUrlFindings(file, auth, declared));
-  return findings;
-}
-
-/** The parsed TOML of `text`, or null when it does not parse. */
-export async function parseToml(text) {
-  try {
-    const module = await import('smol-toml');
-    return module.parse(text);
-  } catch {
-    return null;
-  }
-}
-
-/** L08 policy findings in one already-parsed supabase/config.toml. */
-export function configFindings({ file, text, toml, supabase }) {
-  const findings = credentialConfigFindings(file, text, toml);
-  const auth = toml?.auth ?? {};
-  if (auth.jwt_expiry !== undefined && (typeof auth.jwt_expiry !== 'number' || auth.jwt_expiry > 3600)) {
-    findings.push(found(DB_CONFIG_POLICY, file, `${file} auth.jwt_expiry is ${JSON.stringify(auth.jwt_expiry)}; the access token lives at most 3600 seconds`, { key: 'auth.jwt_expiry' }));
-  }
-  if (!supabase) return findings;
-  const declared = {
-    enableSignup: supabase.enableSignup, jwtExpiry: supabase.jwtExpiry, siteUrl: supabase.siteUrl,
-    redirectUrls: Array.isArray(supabase.redirectUrls) ? supabase.redirectUrls : undefined,
-  };
-  findings.push(...declarationConfigFindings(file, auth, declared));
-  return findings;
-}
-
-/** L09 drift findings for the committed generated database type file. */
-export async function typesFindings({ repoRoot, files, emitTypes, declaration }) {
-  if (typeof emitTypes !== 'function') return [];
-  const tracked = new Set(files);
-  let emitted;
-  try { emitted = await emitTypes({ repoRoot, declaration }); } catch (error) {
-    return [found(DB_TYPES_DRIFT, TYPES_FILE, `${TYPES_FILE} cannot be verified: the types emit failed (${String(error?.message ?? error).split('\n').filter(Boolean).slice(0, 3).join(' | ')})`, { drift: 'emit-failed' })];
-  }
-  const committed = tracked.has(TYPES_FILE) ? readText(repoRoot, TYPES_FILE) : null;
-  if (committed === null) return [found(DB_TYPES_DRIFT, TYPES_FILE, `${TYPES_FILE} is not committed; run \`npm run contract:emit\` and commit the generated types`, { drift: 'not-committed' })];
-  if (!sameText(committed, String(emitted))) return [found(DB_TYPES_DRIFT, TYPES_FILE, `${TYPES_FILE} differs from what \`contract:emit\` generates from the migrations now; run \`npm run contract:emit\` and commit the result`, { drift: 'stale' })];
-  return [];
-}
 
 const DEFAULT_EXTENSIONS = ['pgmq', 'pg_cron', 'pgcrypto', 'pg_trgm', 'vector', 'uuid-ossp', 'pg_net', 'supabase_vault', 'unaccent'];
-const DEFAULT_API_SCHEMAS = ['public', 'graphql_public'];
-const FORBIDDEN_API_SCHEMAS = new Set(['pgmq', 'pgmq_public']);
 const word = (token, value) => token?.t === 'word' && token.v === value;
 const identifier = (token) => token && ['word', 'ident'].includes(token.t) ? token.v : null;
 
@@ -143,8 +15,6 @@ function dbParameters(manifest) {
   const declared = manifest?.ruleParams?.db ?? {};
   return {
     extensions: Array.isArray(declared.extensions) ? declared.extensions : DEFAULT_EXTENSIONS,
-    apiSchemas: Array.isArray(declared.apiSchemas) ? declared.apiSchemas : DEFAULT_API_SCHEMAS,
-    majorVersion: declared.majorVersion ?? 17,
   };
 }
 
@@ -257,76 +127,6 @@ function applyPublicReadPolicy(statement, policies) {
   policies.set(key, { name, schema: target.schema, select: word(statement[forAt + 1], 'select'), roles: roles ?? ['public'] });
 }
 
-function publicReadSchemas(sources) {
-  const policies = new Map();
-  for (const { tokens } of sources) for (const statement of databaseSqlStatements(tokens)) applyPublicReadPolicy(statement, policies);
-  return new Set([...policies.values()].filter((policy) => policy.select && policy.name.endsWith('_public_read')
-    && policy.roles.some((role) => ['anon', 'public'].includes(role))).map((policy) => policy.schema));
-}
-
-function schemaConfigFindings(file, config, parameters, edition, publicSchemas) {
-  const schemas = config.api?.schemas;
-  const findings = [];
-  const allowed = new Set(parameters.apiSchemas);
-  if (!Array.isArray(schemas) || schemas.some((schema) => typeof schema !== 'string' || !allowed.has(schema))) {
-    findings.push(found(DB_CONFIG_POLICY, file, `${file} api.schemas must be an array drawn from ruleParams.db.apiSchemas`, { key: 'api.schemas' }));
-  }
-  if (Array.isArray(schemas) && schemas.some((schema) => FORBIDDEN_API_SCHEMAS.has(schema))) findings.push(found(DB_API_EXPOSED, file,
-    `${file} api.schemas exposes a pgmq schema; queues are accessible only to the application role`, { key: 'api.schemas' }));
-  const exposed = Array.isArray(schemas) ? schemas : DEFAULT_API_SCHEMAS;
-  if (edition === 'lite' && config.api?.enabled !== false && exposed.length > 0 && !exposed.some((schema) => publicSchemas.has(schema))) {
-    findings.push(found(DB_API_EXPOSED, file, `${file} enables the lite data API without an exposed *_public_read FOR SELECT policy; disable api or set schemas = []`, { key: 'api.enabled' }));
-  }
-  return findings;
-}
-
-function safetyConfigFindings(file, config, parameters, supabase) {
-  const findings = [];
-  const anonymous = config.auth?.enable_anonymous_sign_ins;
-  if (anonymous !== undefined && (typeof anonymous !== 'boolean' || (anonymous && supabase?.enableAnonymousSignIns !== true))) findings.push(found(DB_CONFIG_POLICY, file,
-    `${file} auth.enable_anonymous_sign_ins is enabled without hfs.json supabase.enableAnonymousSignIns`, { key: 'auth.enable_anonymous_sign_ins' }));
-  if (config.edge_runtime?.enabled !== false) findings.push(found(DB_CONFIG_POLICY, file,
-    `${file} edge_runtime.enabled must be false; application execution belongs to the back end`, { key: 'edge_runtime.enabled' }));
-  const storageLimit = config.storage?.file_size_limit;
-  if (config.storage?.enabled !== false && (typeof storageLimit !== 'string' || !/^[1-9]\d*(?:B|KB|MB|GB|KiB|MiB|GiB)$/.test(storageLimit))) findings.push(found(DB_CONFIG_POLICY, file,
-    `${file} storage.file_size_limit must declare a positive byte limit`, { key: 'storage.file_size_limit' }));
-  if (config.db?.major_version !== parameters.majorVersion) findings.push(found(DB_CONFIG_POLICY, file,
-    `${file} db.major_version must equal the ruleParams.db.majorVersion pin (${parameters.majorVersion})`, { key: 'db.major_version' }));
-  return findings;
-}
-
-function seedPattern(value) {
-  if (typeof value !== 'string' || !value || value.includes('\\') || path.posix.isAbsolute(value) || /^[A-Za-z]:/.test(value)) return null;
-  const relative = path.posix.normalize(`supabase/${value}`);
-  if (!relative.startsWith('supabase/')) return null;
-  const expression = relative.split(/(\*\*|\*|\?)/).map((part) => {
-    if (part === '**') return '.*';
-    if (part === '*') return '[^/]*';
-    if (part === '?') return '[^/]';
-    return escapeRegexPart(part);
-  }).join('');
-  return new RegExp(`^${expression}$`);
-}
-
-function seedConfigResult(repoRoot, files, config) {
-  const seeds = new Set(files.filter((file) => /^(?:supabase\/(?:seed\.sql|seeds?\/.+\.sql)|\.starcistacks\/[^/]+\/seeds\/.+\.sql)$/.test(file)));
-  const seed = config?.db?.seed;
-  if (!seed || seed.enabled === false) return { findings: [], seeds };
-  const paths = seed.sql_paths ?? ['./seed.sql'];
-  const findings = [];
-  if (!Array.isArray(paths) || paths.length === 0) return {
-    seeds, findings: [found(DB_CONFIG_POLICY, CONFIG_FILE, `${CONFIG_FILE} db.seed.sql_paths must list tracked SQL seed files`, { key: 'db.seed.sql_paths' })],
-  };
-  for (const value of paths) {
-    const pattern = seedPattern(value);
-    const matches = pattern ? files.filter((file) => file.endsWith('.sql') && pattern.test(file) && readText(repoRoot, file) !== null) : [];
-    if (matches.length === 0) findings.push(found(DB_CONFIG_POLICY, CONFIG_FILE,
-      `${CONFIG_FILE} db.seed.sql_paths contains a path with no readable tracked SQL seed file`, { key: 'db.seed.sql_paths' }));
-    for (const file of matches) seeds.add(file);
-  }
-  return { findings, seeds };
-}
-
 const EMAIL_LITERAL = /^[A-Z0-9._%+-]+@([A-Z0-9-]+(?:\.[A-Z0-9-]+)+)$/i;
 function piiLiteral(value) {
   if (value.split(/[^\w.%+@-]+/).some((part) => {
@@ -356,20 +156,12 @@ function seedPiiFindings(repoRoot, seeds) {
 export function databaseConfigFindings({ repoRoot, files = [], all = files, repo = {}, manifest, isRoot, inScope = () => true }) {
   if (isRoot === false || ['be', 'fe'].includes(repo.profile)) return [];
   const parameters = dbParameters(manifest);
-  const declaration = readJson(repoRoot, 'hfs.json');
-  const edition = repo.edition ?? declaration?.edition ?? 'full';
   const migrations = all.filter((file) => isActiveMigration(file) && file.endsWith('.sql')).sort(byCodeUnit);
   const sources = migrations.map((file) => ({ file, tokens: databaseExecutableTokens(readText(repoRoot, file) ?? '') }));
   const findings = [];
   for (const { file, tokens } of sources) findings.push(...extensionFindings(file, tokens, new Set(parameters.extensions)), ...custodySqlFindings(file, tokens));
   findings.push(...destructiveMigrationFindings({ repoRoot, migrations, files: all }));
-  let config = null;
-  if (all.includes(CONFIG_FILE)) {
-    try { const text = readText(repoRoot, CONFIG_FILE); if (text !== null) config = parseTomlSync(text); } catch { /* L08 owns invalid TOML. */ }
-  }
-  if (config) findings.push(...schemaConfigFindings(CONFIG_FILE, config, parameters, edition, publicReadSchemas(sources)),
-    ...safetyConfigFindings(CONFIG_FILE, config, parameters, declaration?.supabase));
-  const seeds = seedConfigResult(repoRoot, all, config);
-  findings.push(...seeds.findings, ...seedPiiFindings(repoRoot, seeds.seeds));
+  const seeds = all.filter((file) => file === SEED_FILE || /^\.starcistacks\/[^/]+\/seeds\/.+\.sql$/.test(file));
+  findings.push(...seedPiiFindings(repoRoot, seeds));
   return findings.filter((finding) => inScope(finding.path));
 }

package/runtime/scripts/hfs/rules/database-constants.mjs

@@ -1,26 +1,24 @@
-// Single source of database-rule finding codes and owned Supabase paths.
+// Single source of database-rule finding codes and the owned db/ paths of a lite app (slot app.db).
 export const DB_MIGRATION_SHAPE = 'DB_MIGRATION_SHAPE';
 export const DB_RLS_REQUIRED = 'DB_RLS_REQUIRED';
 export const DB_DYNAMIC_DDL = 'DB_DYNAMIC_DDL';
 export const DB_POLICY_SHAPE = 'DB_POLICY_SHAPE';
 export const DB_DEFINER_SAFE = 'DB_DEFINER_SAFE';
 export const DB_STORAGE_POLICY = 'DB_STORAGE_POLICY';
-export const DB_CONFIG_POLICY = 'DB_CONFIG_POLICY';
-export const DB_TYPES_DRIFT = 'DB_TYPES_DRIFT';
+export const LITE_DB_MIGRATION = 'LITE_DB_MIGRATION';
 export const DB_BASELINE_SHAPE = 'DB_BASELINE_SHAPE';
 export const DB_ARCHIVE_MUTATED = 'DB_ARCHIVE_MUTATED';
 export const DB_PGMQ_DECLARED = 'DB_PGMQ_DECLARED';
 export const DB_CRON_OWNED = 'DB_CRON_OWNED';
 export const DB_EXTENSION_ALLOWED = 'DB_EXTENSION_ALLOWED';
-export const DB_API_EXPOSED = 'DB_API_EXPOSED';
 export const DB_MIGRATION_DESTRUCTIVE = 'DB_MIGRATION_DESTRUCTIVE';
 export const HFS_SEED_PII = 'HFS_SEED_PII';
 export const DB_VAULT_WRITE = 'DB_VAULT_WRITE';
 
-export const MIGRATIONS_DIR = 'supabase/migrations';
-/** The migrations retired at a baseline cutover (slot app.supabase.migrations.archive): never applied, never judged by L02-L08. */
-export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/_archive`;
-/** True for a migration the Supabase CLI applies: a path under supabase/migrations/ outside the archive. */
+export const DB_DIR = 'db';
+export const MIGRATIONS_DIR = `${DB_DIR}/migrations`;
+/** The migrations retired at a baseline cutover (slot app.db.migrations.archive): never applied, never judged by L02-L08. */
+export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/archive`;
+/** True for a migration `starci app db migrate` applies: a path under db/migrations/ outside the archive. */
 export const isActiveMigration = (file) => file.startsWith(`${MIGRATIONS_DIR}/`) && !file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`);
-export const CONFIG_FILE = 'supabase/config.toml';
-export const TYPES_FILE = 'supabase/types/database.types.ts';
+export const SEED_FILE = `${DB_DIR}/seed.sql`;

package/runtime/scripts/hfs/rules/database-migrations.mjs

@@ -74,7 +74,7 @@ function localMigrationFindings(local) {
   const stamps = new Map();
   for (const entry of local) {
     if (!entry.match) {
-      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is not named <ts14>_<kebab>.sql; a migration is created by \`npm run db:new\` (supabase migration new), never renamed by hand`, { expected: '<ts14>_<kebab>.sql' }));
+      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is not named <ts14>_<kebab>.sql; a migration is created by \`npm run db:new\` (starci app db new), never renamed by hand`, { expected: '<ts14>_<kebab>.sql' }));
       continue;
     }
     const stamp = migrationStamp(entry.match[1]);
@@ -143,8 +143,8 @@ function removedMigrationFindings(local, retired, baseNames, baseSha) {
 }
 
 /**
- * L02 findings for names, stamps, ordering and immutability of supabase/migrations/*.sql. `archived` are the files of
- * supabase/migrations/_archive/ (app.supabase.migrations.archive): never judged, and a migration moved there at a baseline
+ * L02 findings for names, stamps, ordering and immutability of db/migrations/*.sql. `archived` are the files of
+ * db/migrations/archive/ (app.db.migrations.archive): never judged, and a migration moved there at a baseline
  * cutover is retired from the ordering chain, not removed. New files append after HEAD's active migrations; timestamps
  * on archived migrations, remote branches and the wall clock do not constrain a replacement baseline.
  */

package/runtime/scripts/hfs/rules/database-queues.mjs

@@ -172,7 +172,7 @@ function migrationStatement(state, node, file) {
 }
 
 function migrationFacts(state, files) {
-  for (const file of files.filter((item) => item.endsWith('.sql') && !item.includes('/_archive/')).sort((left, right) => left.localeCompare(right))) {
+  for (const file of files.filter((item) => item.endsWith('.sql') && !item.startsWith('db/migrations/archive/')).sort((left, right) => left.localeCompare(right))) {
     const text = readText(state.repoRoot, file);
     if (text === null) continue;
     const tree = sqlTree(text);
@@ -373,9 +373,8 @@ function tickOwner(state, tick, name, schedule, ticks) {
 function queueState({ repoRoot, files = [], all = files, repo = {}, manifest }) {
   const paths = [...new Set(all)];
   const declaration = readJson(repoRoot, 'hfs.json') ?? repo;
-  const connected = ['be', 'fe'].some((side) => (declaration.sides?.[side]?.connections ?? []).some((item) => item.provider === 'supabase'));
-  if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !declaration.supabase && !connected && !paths.some((file) => file.startsWith('supabase/'))) return null;
-  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), declaredOutbox: queueOutboxDeclaration(declaration), scheduledNames: new Set(), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
+  if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !paths.some((file) => file.startsWith('db/'))) return null;
+  const state = { repoRoot, appRole: declaration.db?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), declaredOutbox: queueOutboxDeclaration(declaration), scheduledNames: new Set(), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
   state.sources = queueSourceFacts(state, paths, inspectCalls);
   migrationFacts(state, paths);
   return state;
@@ -394,7 +393,7 @@ function validateQueues(state, inScope) {
   return state.findings.filter((finding) => inScope(finding.path));
 }
 
-/** Cross-file R258 findings. A full app participates when it declares or contains Supabase files. */
+/** Cross-file R258 findings. A full app participates when it contains a db/ tree. */
 export function databaseQueuesFindings(context) {
   // The app-root pass owns the cross-file inventory; a side pass cannot see its migrations.
   if (context.appSide === true) return [];

package/runtime/scripts/hfs/rules/database-sql.mjs

@@ -283,7 +283,7 @@ function rlsFindings(file, facts, exposed, forceRls) {
       findings.push(found(DB_RLS_REQUIRED, file, `${file}:${table.line} ${operation} ${qualified} into the exposed schema ${table.schema} without a later \`alter table ${qualified} enable row level security\` in the same migration`, { line: table.line, table: qualified }));
     }
     if (forceRls.has(qualified) && !relationHasLaterEvent(facts.forces, table)) {
-      findings.push(found(DB_RLS_REQUIRED, file, `${file}:${table.line} ${operation} ${qualified}, which hfs.json supabase.forceRls declares definer-owned, without \`alter table ${qualified} force row level security\` in the same migration`, { line: table.line, table: qualified }));
+      findings.push(found(DB_RLS_REQUIRED, file, `${file}:${table.line} ${operation} ${qualified}, which hfs.json db.forceRls declares definer-owned, without \`alter table ${qualified} force row level security\` in the same migration`, { line: table.line, table: qualified }));
     }
   }
   findings.push(...rlsWeakeningFindings(file, facts.rlsEvents, exposed));

package/runtime/scripts/hfs/rules/database.mjs

@@ -1,41 +1,50 @@
-// Supabase database rules (design 4.2, L02-L09). SQL migrations are parsed with libpg-query through
-// database-sql.mjs; config, Git history and generated-type checks are split into bounded sibling modules.
+// The database rules of a lite app's db/ tree (design 4.2, L02-L09). SQL migrations are parsed with libpg-query through
+// database-sql.mjs; Git history and generated-type checks are split into bounded sibling modules.
 import { found, readJson, readText } from './read.mjs';
-import { configFindings, parseToml, typesFindings } from './database-config.mjs';
 import { defaultGit, migrationShapeFindings } from './database-migrations.mjs';
 import { migrationSetPolicyFindings, sqlAnalysis } from './database-sql.mjs';
 import { migrationSetDefinerFindings } from './database-plpgsql.mjs';
 import { databaseAccessFindings } from './database-access.mjs';
-import { CONFIG_FILE, DB_CONFIG_POLICY, DB_MIGRATION_SHAPE, isActiveMigration, MIGRATIONS_ARCHIVE_DIR, TYPES_FILE } from './database-constants.mjs';
+import { DB_DIR, DB_MIGRATION_SHAPE, isActiveMigration, LITE_DB_MIGRATION, MIGRATIONS_ARCHIVE_DIR, MIGRATIONS_DIR } from './database-constants.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 import { eachInOrder } from '../../lib/in-order.mjs';
 
 export { migrationStamp } from './database-migrations.mjs';
 export {
-  DB_BE_ONLY_ACCESS, DB_REALTIME_UNLISTED, DB_APP_ROLE, DB_FORCE_RLS_DEFAULT,
-  DB_POLICY_TAUTOLOGY, DB_VIEW_UNSAFE, DB_STORAGE_PREFIX,
+  DB_APP_ROLE, DB_FORCE_RLS_DEFAULT, DB_POLICY_TAUTOLOGY, DB_VIEW_UNSAFE, DB_STORAGE_PREFIX,
 } from './database-access.mjs';
 export const DB_DEFINER_REVOKE = 'DB_DEFINER_REVOKE';
 export {
-  CONFIG_FILE,
-  DB_CONFIG_POLICY,
   DB_DEFINER_SAFE,
   DB_DYNAMIC_DDL,
   DB_MIGRATION_SHAPE,
   DB_POLICY_SHAPE,
   DB_RLS_REQUIRED,
   DB_STORAGE_POLICY,
-  DB_TYPES_DRIFT,
-  TYPES_FILE,
+  LITE_DB_MIGRATION,
 } from './database-constants.mjs';
 
-const declaresSupabaseConnection = (declaration) => ['be', 'fe'].some((side) => (declaration?.sides?.[side]?.connections ?? []).some((connection) => connection?.provider === 'supabase'));
+/** The schemas the app's tables live in; no schema is exposed to a browser, which reaches data only through the back end. */
+const APP_SCHEMAS = new Set(['public']);
 
-async function configResult(repoRoot, declared) {
-  const configText = readText(repoRoot, CONFIG_FILE);
-  const config = configText === null ? null : await parseToml(configText);
-  if (config === null) return { config, findings: [found(DB_CONFIG_POLICY, CONFIG_FILE, `${CONFIG_FILE} is not readable valid TOML; the config is policy, so it must parse`, {})] };
-  return { config, findings: configFindings({ file: CONFIG_FILE, text: configText, toml: config, supabase: declared ?? null }) };
+/** A .starcistacks seed is the one SQL file a lite app keeps outside db/. */
+const STACK_SEED = /^\.starcistacks\/[^/]+\/seeds\/.+\.sql$/;
+
+/**
+ * LITE_DB_MIGRATION: a lite app's schema lives only under db/: no supabase/ tree and no SQL file outside db/ (but a
+ * .starcistacks seed), and every SQL file under db/ is a migration, the archive, the seed or nothing.
+ */
+export function liteDbPathFindings(files) {
+  const findings = [];
+  for (const file of files) {
+    if (file === 'supabase' || file.startsWith('supabase/')) {
+      findings.push(found(LITE_DB_MIGRATION, file, `${file} is a Supabase project file; a lite app keeps its schema in ${MIGRATIONS_DIR}/<ts14>_<kebab>.sql (move the migrations, delete supabase/)`, {}));
+      continue;
+    }
+    if (!file.endsWith('.sql') || STACK_SEED.test(file)) continue;
+    if (!file.startsWith(`${DB_DIR}/`)) findings.push(found(LITE_DB_MIGRATION, file, `${file} is SQL outside ${DB_DIR}/; a schema change is one ${MIGRATIONS_DIR}/<ts14>_<kebab>.sql`, {}));
+  }
+  return findings;
 }
 
 async function migrationAnalyses({ repoRoot, migrations, exposed, forceRls, findings }) {
@@ -54,38 +63,26 @@ async function migrationAnalyses({ repoRoot, migrations, exposed, forceRls, find
 }
 
 /**
- * Judge the Supabase paths in one app. Git and type emission are injected for deterministic specs; this function
- * starts neither Docker nor the Supabase CLI. A full app is judged when it declares a Supabase connection, while
- * lite apps are judged even before their initial Supabase files have all been scaffolded.
+ * Judge the db/ tree of one lite app. Git is injected for deterministic specs; this function starts no
+ * database and no Docker process. A full app keeps its TypeORM migrations under be/ and is judged here only for a stray db/ tree.
  */
-export async function checkDatabase({ repoRoot, files, base, git, edition, supabase, emitTypes } = {}) {
+export async function checkDatabase({ repoRoot, files, base, git, edition, db } = {}) {
   const findings = [];
+  const declaration = readJson(repoRoot, 'hfs.json');
+  const lite = (edition ?? declaration?.edition) === 'lite';
   const migrations = files.filter(isActiveMigration).sort(byCodeUnit);
+  if (!lite && !migrations.length) return findings;
+  const declared = db === undefined ? declaration?.db : db;
   const archived = files.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`));
-  const declaration = readJson(repoRoot, 'hfs.json');
-  const declared = supabase === undefined ? declaration?.supabase : supabase;
-  const hasConfig = files.includes(CONFIG_FILE);
-  const supabaseConnection = declaresSupabaseConnection(declaration);
-  if (!migrations.length && !hasConfig && !files.includes(TYPES_FILE) && !declared && !supabaseConnection && (edition ?? declaration?.edition) !== 'lite') return findings;
-
-  let config = null;
-  if (hasConfig) {
-    const result = await configResult(repoRoot, declared);
-    config = result.config;
-    findings.push(...result.findings);
-  }
-
-  const apiSchemas = (config?.api?.schemas ?? []).filter((schema) => typeof schema === 'string');
-  const exposed = new Set(['public', ...apiSchemas]);
+  if (lite) findings.push(...liteDbPathFindings(files));
   const forceRls = new Set((declared?.forceRls ?? []).map((name) => (name.includes('.') ? name : `public.${name}`)));
   findings.push(...await migrationShapeFindings({ repoRoot, migrations, archived, git: git ?? defaultGit, base }));
 
-  const analyses = await migrationAnalyses({ repoRoot, migrations, exposed, forceRls, findings });
+  const analyses = await migrationAnalyses({ repoRoot, migrations, exposed: APP_SCHEMAS, forceRls, findings });
   findings.push(
     ...migrationSetPolicyFindings(analyses),
-    ...migrationSetDefinerFindings(analyses, exposed),
-    ...await databaseAccessFindings({ analyses, exposed, supabase: declared }),
-    ...await typesFindings({ repoRoot, files, emitTypes, declaration: declared }),
+    ...migrationSetDefinerFindings(analyses, APP_SCHEMAS),
+    ...await databaseAccessFindings({ analyses, exposed: APP_SCHEMAS, db: declared }),
   );
   return findings;
 }