@starci/hfs 4.9.11 → 4.10.1

package/runtime/scripts/hfs/rules/database.mjs

@@ -1,41 +1,50 @@
-// Supabase database rules (design 4.2, L02-L09). SQL migrations are parsed with libpg-query through
-// database-sql.mjs; config, Git history and generated-type checks are split into bounded sibling modules.
+// The database rules of a lite app's db/ tree (design 4.2, L02-L09). SQL migrations are parsed with libpg-query through
+// database-sql.mjs; Git history and generated-type checks are split into bounded sibling modules.
 import { found, readJson, readText } from './read.mjs';
-import { configFindings, parseToml, typesFindings } from './database-config.mjs';
 import { defaultGit, migrationShapeFindings } from './database-migrations.mjs';
 import { migrationSetPolicyFindings, sqlAnalysis } from './database-sql.mjs';
 import { migrationSetDefinerFindings } from './database-plpgsql.mjs';
 import { databaseAccessFindings } from './database-access.mjs';
-import { CONFIG_FILE, DB_CONFIG_POLICY, DB_MIGRATION_SHAPE, isActiveMigration, MIGRATIONS_ARCHIVE_DIR, TYPES_FILE } from './database-constants.mjs';
+import { DB_DIR, DB_MIGRATION_SHAPE, isActiveMigration, LITE_DB_MIGRATION, MIGRATIONS_ARCHIVE_DIR, MIGRATIONS_DIR } from './database-constants.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 import { eachInOrder } from '../../lib/in-order.mjs';
 
 export { migrationStamp } from './database-migrations.mjs';
 export {
-  DB_BE_ONLY_ACCESS, DB_REALTIME_UNLISTED, DB_APP_ROLE, DB_FORCE_RLS_DEFAULT,
-  DB_POLICY_TAUTOLOGY, DB_VIEW_UNSAFE, DB_STORAGE_PREFIX,
+  DB_APP_ROLE, DB_FORCE_RLS_DEFAULT, DB_POLICY_TAUTOLOGY, DB_VIEW_UNSAFE, DB_STORAGE_PREFIX,
 } from './database-access.mjs';
 export const DB_DEFINER_REVOKE = 'DB_DEFINER_REVOKE';
 export {
-  CONFIG_FILE,
-  DB_CONFIG_POLICY,
   DB_DEFINER_SAFE,
   DB_DYNAMIC_DDL,
   DB_MIGRATION_SHAPE,
   DB_POLICY_SHAPE,
   DB_RLS_REQUIRED,
   DB_STORAGE_POLICY,
-  DB_TYPES_DRIFT,
-  TYPES_FILE,
+  LITE_DB_MIGRATION,
 } from './database-constants.mjs';
 
-const declaresSupabaseConnection = (declaration) => ['be', 'fe'].some((side) => (declaration?.sides?.[side]?.connections ?? []).some((connection) => connection?.provider === 'supabase'));
+/** The schemas the app's tables live in; no schema is exposed to a browser, which reaches data only through the back end. */
+const APP_SCHEMAS = new Set(['public']);
 
-async function configResult(repoRoot, declared) {
-  const configText = readText(repoRoot, CONFIG_FILE);
-  const config = configText === null ? null : await parseToml(configText);
-  if (config === null) return { config, findings: [found(DB_CONFIG_POLICY, CONFIG_FILE, `${CONFIG_FILE} is not readable valid TOML; the config is policy, so it must parse`, {})] };
-  return { config, findings: configFindings({ file: CONFIG_FILE, text: configText, toml: config, supabase: declared ?? null }) };
+/** A .starcistacks seed is the one SQL file a lite app keeps outside db/. */
+const STACK_SEED = /^\.starcistacks\/[^/]+\/seeds\/.+\.sql$/;
+
+/**
+ * LITE_DB_MIGRATION: a lite app's schema lives only under db/: no supabase/ tree and no SQL file outside db/ (but a
+ * .starcistacks seed), and every SQL file under db/ is a migration, the archive, the seed or nothing.
+ */
+export function liteDbPathFindings(files) {
+  const findings = [];
+  for (const file of files) {
+    if (file === 'supabase' || file.startsWith('supabase/')) {
+      findings.push(found(LITE_DB_MIGRATION, file, `${file} is a Supabase project file; a lite app keeps its schema in ${MIGRATIONS_DIR}/<ts14>_<kebab>.sql (move the migrations, delete supabase/)`, {}));
+      continue;
+    }
+    if (!file.endsWith('.sql') || STACK_SEED.test(file)) continue;
+    if (!file.startsWith(`${DB_DIR}/`)) findings.push(found(LITE_DB_MIGRATION, file, `${file} is SQL outside ${DB_DIR}/; a schema change is one ${MIGRATIONS_DIR}/<ts14>_<kebab>.sql`, {}));
+  }
+  return findings;
 }
 
 async function migrationAnalyses({ repoRoot, migrations, exposed, forceRls, findings }) {
@@ -54,38 +63,26 @@ async function migrationAnalyses({ repoRoot, migrations, exposed, forceRls, find
 }
 
 /**
- * Judge the Supabase paths in one app. Git and type emission are injected for deterministic specs; this function
- * starts neither Docker nor the Supabase CLI. A full app is judged when it declares a Supabase connection, while
- * lite apps are judged even before their initial Supabase files have all been scaffolded.
+ * Judge the db/ tree of one lite app. Git is injected for deterministic specs; this function starts no
+ * database and no Docker process. A full app keeps its TypeORM migrations under be/ and is judged here only for a stray db/ tree.
  */
-export async function checkDatabase({ repoRoot, files, base, git, edition, supabase, emitTypes } = {}) {
+export async function checkDatabase({ repoRoot, files, base, git, edition, db } = {}) {
   const findings = [];
+  const declaration = readJson(repoRoot, 'hfs.json');
+  const lite = (edition ?? declaration?.edition) === 'lite';
   const migrations = files.filter(isActiveMigration).sort(byCodeUnit);
+  if (!lite && !migrations.length) return findings;
+  const declared = db === undefined ? declaration?.db : db;
   const archived = files.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`));
-  const declaration = readJson(repoRoot, 'hfs.json');
-  const declared = supabase === undefined ? declaration?.supabase : supabase;
-  const hasConfig = files.includes(CONFIG_FILE);
-  const supabaseConnection = declaresSupabaseConnection(declaration);
-  if (!migrations.length && !hasConfig && !files.includes(TYPES_FILE) && !declared && !supabaseConnection && (edition ?? declaration?.edition) !== 'lite') return findings;
-
-  let config = null;
-  if (hasConfig) {
-    const result = await configResult(repoRoot, declared);
-    config = result.config;
-    findings.push(...result.findings);
-  }
-
-  const apiSchemas = (config?.api?.schemas ?? []).filter((schema) => typeof schema === 'string');
-  const exposed = new Set(['public', ...apiSchemas]);
+  if (lite) findings.push(...liteDbPathFindings(files));
   const forceRls = new Set((declared?.forceRls ?? []).map((name) => (name.includes('.') ? name : `public.${name}`)));
   findings.push(...await migrationShapeFindings({ repoRoot, migrations, archived, git: git ?? defaultGit, base }));
 
-  const analyses = await migrationAnalyses({ repoRoot, migrations, exposed, forceRls, findings });
+  const analyses = await migrationAnalyses({ repoRoot, migrations, exposed: APP_SCHEMAS, forceRls, findings });
   findings.push(
     ...migrationSetPolicyFindings(analyses),
-    ...migrationSetDefinerFindings(analyses, exposed),
-    ...await databaseAccessFindings({ analyses, exposed, supabase: declared }),
-    ...await typesFindings({ repoRoot, files, emitTypes, declaration: declared }),
+    ...migrationSetDefinerFindings(analyses, APP_SCHEMAS),
+    ...await databaseAccessFindings({ analyses, exposed: APP_SCHEMAS, db: declared }),
   );
   return findings;
 }

package/runtime/scripts/hfs/rules/edition.mjs

@@ -75,7 +75,7 @@ function scriptFindings(rel, pkg) {
   const scripts = isPlainObject(pkg.scripts) ? pkg.scripts : {};
   return Object.keys(scripts)
     .filter((name) => LITE_FORBIDDEN_SCRIPT.test(name))
-    .map((name) => found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} has script ${JSON.stringify(name)}: a lite app has unit specs, optional integration specs on the local Supabase stack and optional contract specs, never an e2e, stack or browser run`, { name }));
+    .map((name) => found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} has script ${JSON.stringify(name)}: a lite app has unit specs, optional integration specs on the local db service and optional contract specs, never an e2e, stack or browser run`, { name }));
 }
 
 /** The backing services of the manifest (ruleParams.be.backing): name -> {clients, patterns, images, editions?}. */

package/runtime/scripts/hfs/rules/{supabase-secrets.mjs → lite-secrets.mjs}

@@ -1,6 +1,6 @@
-// supabase-secrets.mjs - L17 extends the one R06 secret scan for edition lite. It keeps the ordinary
+// lite-secrets.mjs - L17 extends the one R06 secret scan for edition lite. It keeps the ordinary
 // HFS_PLAINTEXT_SECRET judgement, then adds the reduced lite custody tree and provider-shaped literals
-// which are meaningful only in the Supabase/FE surface. Findings name shapes, never captured values.
+// in the trees that hold no secret at all (fe/ and db/). Findings name shapes, never captured values.
 import { Buffer } from 'node:buffer';
 import { secretFindings } from './secrets.mjs';
 import { found, readText } from './read.mjs';
@@ -40,11 +40,11 @@ const validJwt = candidate => {
 
 const liteSecretPatterns = line => {
   const names = LITE_SECRET_PATTERNS.filter(pattern => pattern.re.test(line)).map(pattern => pattern.name);
-  if ([...line.matchAll(JWT_CANDIDATE)].some(match => validJwt(match[0]))) names.push('supabase-eyj-service-token');
+  if ([...line.matchAll(JWT_CANDIDATE)].some(match => validJwt(match[0]))) names.push('signed-jwt');
   return names;
 };
 
-const inSecretFreeTree = (repo, file) => repo.profile === 'fe' || file.startsWith('fe/') || file.startsWith('supabase/');
+const inSecretFreeTree = (repo, file) => repo.profile === 'fe' || file.startsWith('fe/') || file.startsWith('db/');
 
 function custodyPathFinding(file, repo, findings) {
   if (repo.profile === 'app') {
@@ -71,7 +71,7 @@ function providerSecretFindings(repoRoot, file, repo, findings) {
     for (const pattern of liteSecretPatterns(line)) {
       if (seen.has(pattern)) continue;
       seen.add(pattern);
-      findings.push(found(LITE_SECRET_CUSTODY, file, `${file}:${index + 1} holds a provider-shaped secret (${pattern}); lite keeps no secret literal under fe/ or supabase/.`, { line: index + 1, pattern }));
+      findings.push(found(LITE_SECRET_CUSTODY, file, `${file}:${index + 1} holds a provider-shaped secret (${pattern}); lite keeps no secret literal under fe/ or db/.`, { line: index + 1, pattern }));
     }
   }
 }
@@ -90,7 +90,7 @@ export function liteSecretCustodyFindings({ repoRoot, files, repo }) {
  * Drop-in extension of secretFindings for scripts/hfs/check.mjs. When an L17 finding identifies the same file/line as
  * the generic R06 scanner (a complete JWT, for example), the specific lite code wins so one physical issue is emitted once.
  */
-export function supabaseSecretFindings(input) {
+export function liteSecretFindings(input) {
   const ordinary = secretFindings(input);
   const lite = liteSecretCustodyFindings(input);
   const liteJwtAuthority = (input.repo.edition ?? 'full') === 'lite';

package/runtime/scripts/hfs/rules/script-hygiene.mjs

@@ -1,12 +1,10 @@
-// R252: inspect executable source for plaintext loads, tracing and service-role custody.
+// R252: inspect executable source for plaintext loads and tracing.
 // Only source is read. Secret files and sealed envelopes are excluded before any read,
 // and findings carry a path and a fixed explanation, never source text or values.
 import { found, readJson, readText } from './read.mjs';
 
 const PLAINTEXT_LOAD = 'HFS_SCRIPT_PLAINTEXT_LOAD';
 const XTRACE = 'HFS_SCRIPT_XTRACE';
-const SERVICE_ROLE = 'HFS_SERVICE_ROLE_SCOPE';
-const SUPABASE_OWNER = 'be.integrations.supabase';
 const SECRET_ENV_FILE = /(?:^|\/)(?:secrets?\.env|\.env)(?:\.[^/]*)?/iu;
 const SECRET_NIVO_FILE = /(?:^|\/)\.nivo-lite(?:\/|$)/iu;
 const SECRET_ENC_FILE = /\.enc$/iu;
@@ -36,7 +34,6 @@ const isLoad = (line) => LOAD_PATTERNS.some((pattern) => pattern.test(line));
 const READ_CALL = /\b(?:readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|load_dotenv|loadEnvFile|dotenv\s*\.\s*(?:config|parse))\s*\(/giu;
 const TRACE_COMMAND = /(?:^|[\s;&|('"`]|#!)(?:set|\/?(?:[\w.-]+\/)*(?:bash|sh|dash|zsh|ksh))\s+/giu;
 const SHELL_OPTIONS = /\bSHELLOPTS\s*=\s*['"]?([^\s;'"]*)/giu;
-const SERVICE_ROLE_NAME = /(?:^|[^a-z0-9])(?:[a-z0-9]+[_-])*service[_-]?role(?:[_-][a-z0-9]+)*(?=$|[^a-z0-9])/iu;
 
 /** Retain executable strings, including remote shell commands, but discard comment-only lines. */
 function executableText(text) {
@@ -130,11 +127,6 @@ function enablesTracing(text) {
   return false;
 }
 
-function integrationOwns(file, resolver) {
-  if (!file.startsWith('be/src/modules/integrations/supabase/')) return false;
-  return !resolver?.ownerOf || resolver.ownerOf(file)?.slot === SUPABASE_OWNER;
-}
-
 function isSource(file) {
   if (isSecretFile(file) || EXCLUDED_TREE.test(file) || TEST_FILE.test(file)) return false;
   return SOURCE.test(file) || WORKFLOW.test(file) || DOCKER.test(file)
@@ -161,7 +153,6 @@ export function scriptHygieneFindings({ repoRoot, files = [], all = files, repo,
     const text = executableText(raw);
     if (plaintextLoad(text)) findings.push(found(PLAINTEXT_LOAD, file, 'Executable source loads a plaintext secret file; use starci app secret with sealed envelopes.'));
     if (enablesTracing(text)) findings.push(found(XTRACE, file, 'Executable source enables shell tracing or secret reveal; remove xtrace and --reveal.'));
-    if (SERVICE_ROLE_NAME.test(text.replace(/([a-z0-9])([A-Z])/gu, '$1_$2')) && !integrationOwns(file, resolver)) findings.push(found(SERVICE_ROLE, file, 'Service-role access belongs only to be/src/modules/integrations/supabase/ and its configuration.'));
   }
   return findings;
 }

package/runtime/scripts/hfs/rules/stacks-lite-backing.mjs

@@ -1,9 +1,10 @@
-// R276: lite keeps Postgres and pgvector on managed Supabase, admits only the backing services available to its edition,
+// R276: lite runs exactly its own PostgreSQL (the db component, image supabase/postgres) with pgvector, admits only the backing services available to its edition,
 // and runs a declared Redis as one service with AOF fsynced at least every second on a named volume and no eviction
 // (ruling:R212/case-10, owner:lite-vector-is-pgvector); sidecar SQLite persists on declared named volumes.
 import { isPlainObject as plain } from '../../../engine/plain-object.mjs';
 import { composeEntries } from '../../lib/compose-values.mjs';
 import { repositoryOf } from '../../lib/stack-services.mjs';
+import { isLiteDatabaseImage } from '../../lib/swarm-stack.mjs';
 import { loadSlotManifest } from '../slots.mjs';
 import { judgedInEdition } from '../edition-slots.mjs';
 import { readJson } from './read.mjs';
@@ -43,12 +44,12 @@ function imageIssues(components, services, { catalog, declared }) {
     for (const [id, entry] of Object.entries(inventory)) {
       if (!present(entry?.image)) continue;
       const service = serviceOfImage(catalog, entry.image);
-      if (DATABASE_IMAGE.test(repositoryOf(entry.image)))
+      if (DATABASE_IMAGE.test(repositoryOf(entry.image)) && !isLiteDatabaseImage(entry.image))
         errors.push({ code: 'STACKS_LITE_SELFHOSTED_DB', at: `${prefix}.${id}.image`,
-          message: 'lite must not run a self-hosted Postgres or Mongo database image; use managed Supabase backing' });
+          message: 'lite runs one database, the db component of image supabase/postgres; no other Postgres or Mongo image' });
       else if (service !== null && !judgedInEdition(catalog[service], 'lite'))
         errors.push({ code: 'STACKS_LITE_SELFHOSTED_DB', at: `${prefix}.${id}.image`,
-          message: `lite must not run ${service}; vector search uses Supabase pgvector (owner:lite-vector-is-pgvector)` });
+          message: `lite must not run ${service}; vector search uses pgvector in the db service (owner:lite-vector-is-pgvector)` });
       else if (service !== null && !declared.has(service))
         errors.push({ code: 'STACKS_LITE_SELFHOSTED_DB', at: `${prefix}.${id}.image`,
           message: `lite runs ${service} only when hfs.json sides.be.backing declares it for the capability that needs it (ruling:R212/case-10)` });

package/runtime/scripts/hfs/rules/stacks-release.mjs

@@ -81,7 +81,8 @@ function stateful(component, service) {
 function recoveryComponents({ doc, spec, model }) {
   const components = mapping(doc.components), services = mapping(model?.services);
   const selected = new Set([...Object.keys(mapping(spec.components)), ...Object.keys(services)]);
-  const required = new Set(Object.entries(mapping(doc.backing)).filter(([, entry]) => entry?.managed === true).map(([id]) => id));
+  // Every declared backing (the lite db: backing.db naming its component) owes a backup, as every stateful component does.
+  const required = new Set(Object.entries(mapping(doc.backing)).filter(([, entry]) => typeof entry?.provider === 'string').map(([id]) => id));
   for (const id of selected) if (stateful(mapping(components[id]), mapping(services[id]))) required.add(id);
   return [...required];
 }
@@ -290,7 +291,7 @@ function sqlTemplateText(node) {
 }
 
 function recurringObservations({ doc, repoRoot, files, file, issues }) {
-  const sql = file.startsWith('supabase/migrations/') && file.endsWith('.sql') && !file.includes('/_archive/');
+  const sql = file.startsWith('db/migrations/') && file.endsWith('.sql') && !file.startsWith('db/migrations/archive/');
   const sourceFile = SOURCE.test(file) && !TEST.test(file);
   if ((!sql && !sourceFile) || !publicReference(repoRoot, files, file)) return [];
   const text = readText(repoRoot, file);

package/runtime/scripts/hfs/rules/stacks-runtime.mjs

@@ -92,8 +92,8 @@ function swarmDeploymentFiles(repoRoot, files) {
 function liteEnvironmentFindings({ doc, environments, deployments }) {
   const findings = [];
   const delivery = deployments.length || Object.values(environments).some(spec => Array.isArray(spec?.composeFiles) && spec.composeFiles.length);
-  if (delivery && (doc.backing?.supabase?.provider !== 'supabase' || doc.backing?.supabase?.managed !== true))
-    findings.push(found(CODE, DECLARATION, `${DECLARATION}: lite Swarm delivery must declare backing.supabase with provider: supabase and managed: true`));
+  if (delivery && (doc.backing?.db?.provider !== 'postgres' || doc.backing?.db?.component !== 'db'))
+    findings.push(found(CODE, DECLARATION, `${DECLARATION}: lite Swarm delivery must declare backing.db with provider: postgres and component: db (its db service)`));
   for (const [environment, spec] of Object.entries(environments)) {
     if (!Array.isArray(spec?.composeFiles) || !spec.composeFiles.length) continue;
     if (spec.runtime !== 'docker-swarm' || spec.composeFiles.some(file => typeof file !== 'string' || !file.startsWith('infra/swarm/')))

package/runtime/scripts/hfs/rules/stacks.mjs

@@ -5,7 +5,7 @@
 //     `deployment.json` and `k8s/` are not in the list, so they fall out of it;
 //   - the declaration (read by scripts/lib/stack-declaration.mjs, the one reader of it) states a sonar service, a local
 //     Sonar is owned by the host (`stack.owner: host`, root `.claude/ext/sonar`).
-// The lite overlay admits Swarm compute and managed Supabase backing. Runtime rules are shared with the stack gates.
+// The lite overlay admits Swarm compute and its own db service. Runtime rules are shared with the stack gates.
 // The declaration's quality/delivery services contract (custody, CI wiring, project keys) stays check-starcistacks's.
 import { braceVariants, globExpression } from '../../lib/glob.mjs';
 import { declaredStack, findStackDeclaration, STACK_ROOT, text } from '../../lib/stack-declaration.mjs';

package/runtime/scripts/hfs/slot-app-view.mjs

@@ -49,7 +49,7 @@ function sideCrossing(repo, fromSide, toSide, toPath) {
 function importAllowedApp({ repo, root, sides }, fromPath, toPath) {
   const from = splitSide(fromPath);
   const to = splitSide(toPath);
-  // A side file may read an app-root path (supabase/types/) only through a declared read, exactly as it reads the other side.
+  // A side file may read an app-root path (db/types/) only through a declared read, exactly as it reads the other side.
   if (from && from.side !== to?.side) return sideCrossing(repo, from.side, to?.side ?? null, toPath);
   if (from && to) return sides[from.side].importAllowed(from.rest, to.rest);
   return root.importAllowed(fromPath, toPath);

package/runtime/scripts/hfs/slots.mjs

@@ -120,6 +120,7 @@ function sideDeclaration(manifest, declaration, name, edition, providers) {
     connections: Object.freeze((s.connections ?? []).map(connectionView)),
     providers,
     reads: Object.freeze([...(s.reads ?? [])]),
+    dbFunctions: Object.freeze((s.dbFunctions ?? []).map((entry) => Object.freeze({ ...entry }))),
     ...(s.grammar === undefined ? {} : { grammar: s.grammar }),
     ...(s.extraPackages === undefined ? {} : { extraPackages: Object.freeze(s.extraPackages.map(entry => Object.freeze({ ...entry }))) }),
     manifestVersion: manifest.version,
@@ -221,7 +222,8 @@ function createScopeResolver(manifest, repo) {
     trackingOf,
     /** True only for a path a slot owns and requires to be committed. */
     isTracked: (p) => trackingOf(p) === 'tracked',
-    ruleParams: () => ruleParams(manifest, profile, edition),
+    // The app's own database functions (hfs.json sides.be.dbFunctions) join the canon's list (R334).
+    ruleParams: () => withDeclaredDbFunctions(ruleParams(manifest, profile, edition), repo.dbFunctions),
     allowedImports: (tier) => manifest.tiers[profile]?.[tier]?.mayImport ?? null,
   });
 }
@@ -235,13 +237,17 @@ function createScopeResolver(manifest, repo) {
  */
 export function createSlotResolver(manifest, repo) {
   if (repo.profile !== APP_SCOPE) return createScopeResolver(manifest, repo);
-  // The root declares no connection of its own, yet a provider slot of the app profile (app.supabase*) is enabled by a
+  // The root declares no connection of its own, yet a provider slot of the app profile is enabled by a
   // side's connection with that provider: the root scope reads the union of the sides' connections.
   const root = createScopeResolver(manifest, { ...repo, connections: SIDES.flatMap((side) => repo.sides[side].connections) });
   const sides = Object.fromEntries(PROFILES.map((side) => [side, createScopeResolver(manifest, repo.sides[side])]));
   return appResolver(repo, root, sides);
 }
 
+/** The rule parameters with the app's declared database functions appended to `dbFunctions` (be only), frozen. */
+const withDeclaredDbFunctions = (params, declared = []) => (params.dbFunctions === undefined && !declared.length ? params
+  : Object.freeze({ ...params, dbFunctions: Object.freeze([...(params.dbFunctions ?? []), ...declared]) }));
+
 /** The rule parameters of one profile (be: infraOwners, suffixes, bannedSuffixes and the rest over the shared ruleParams.common fileLines and duplicateBlock; fe: common alone or with its overrides; runtime: ruleParams.runtime of a runtime manifest), as a frozen deep copy. Under `edition` lite the `lite` overrides of ruleParams.<profile> merge over the base (the `lite` key itself is never returned). */
 export function ruleParams(manifest, profile, edition = 'full') {
   const profiles = manifestKind(manifest) === RUNTIME_KIND ? [RUNTIME_KIND] : PROFILES;

package/runtime/scripts/hfs/sql/pg-parse.mjs

@@ -1,6 +1,6 @@
 // pg-parse.mjs - the one SQL parse entry of the hfs database rules (scripts/hfs/rules/database.mjs): the WASM build
 // of libpg-query, the real PostgreSQL parser compiled to WebAssembly (no native build, no postgres server). It is
-// loaded lazily: a check of an app with no supabase/ tree never pays the module init. parseSql gives the statement
+// loaded lazily: a check of an app with no db/ tree never pays the module init. parseSql gives the statement
 // tree of a migration (`{version, stmts}`, each stmt `{stmt, stmt_location, stmt_len}` with byte offsets); a
 // plpgsql body (a DO block's or a function's `as` source) is judged through parsePlpgsqlBody, which wraps it in a
 // probe CREATE FUNCTION because libpg-query parses plpgsql only in that form. A parse failure throws the
@@ -10,7 +10,7 @@ let loading = null;
 
 /**
  * The libpg-query module (wasm build), initialized once per process. A bare dynamic import so the package can be
- * absent until a supabase/ tree exists to judge; the caller reports the load failure, not this module.
+ * absent until a db/ tree exists to judge; the caller reports the load failure, not this module.
  */
 function loadPgParser() {
   loading ??= (async () => {

package/runtime/scripts/lib/secret-patterns.mjs

@@ -100,7 +100,7 @@ const SECRET_NAME_TEST = NAME_WORD(SECRET_WORD, String.raw`(?:[_\-.]|[A-Z]|[^A-Z
 const BENIGN_TAIL_TEST = NAME_WORD(BENIGN_WORD, '$');
 
 /** True when a bare variable `name` holds secret material as an identifier segment (DB_PASSWORD, dbPassword,
- *  SUPABASE_SERVICE_ROLE_KEY) and does not end in a config suffix (PASSWORD_MIN_LENGTH, SECRET_FILE,
+ *  STORAGE_SECRET_ACCESS_KEY) and does not end in a config suffix (PASSWORD_MIN_LENGTH, SECRET_FILE,
  *  tokenBudget). The same name judgement the `assigned-secret` patterns make, for callers that read keys. */
 export const secretNameLike = (name) => SECRET_NAME_TEST.test(name) && !BENIGN_TAIL_TEST.test(name);
 
@@ -117,7 +117,7 @@ export const SECRET_PATTERNS = [
   { name: 'jwt', re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
   { name: 'age-secret-key', re: /\bAGE-SECRET-KEY-1[0-9A-Z]{20,}\b/ },
   { name: 'password-connection-string', re: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:[^@\s/${}]{8,}@/iu },
-  // A value written `env(NAME)` (the Supabase config.toml reference form) names a variable, not a secret.
+  // A value written `env(NAME)` (a config reference form) names a variable, not a secret.
   // A keyword-assigned value that names itself a stand-in (a test stub's `accessToken: "fixture-..."`) is no
   // candidate; only this heuristic takes the exemption, never a provider-shaped token above.
   // A spec file's keyword-assigned values are test inputs (a spec's sign-in

package/runtime/scripts/lib/swarm-stack.mjs

@@ -10,6 +10,9 @@ const BACKING_IMAGE_SQL_AND_CACHE = 'postgres(?:ql)?|postgresql-repmgr|mysql(?:-
 const BACKING_IMAGE_BROKERS_AND_OTHERS = '(?:cp-)?kafka(?:-native)?|keycloak|minio|rabbitmq';
 const BACKING_IMAGE = new RegExp(`^(?:${BACKING_IMAGE_SQL_AND_CACHE}|${BACKING_IMAGE_BROKERS_AND_OTHERS})$`, 'i');
 const mapping = value => plain(value) ? value : {};
+
+/** True for the one database image a lite app runs (its db component): supabase/postgres, pinned by digest. */
+export const isLiteDatabaseImage = image => typeof image === 'string' && /^supabase\/postgres(?::[^@]+)?@sha256:[a-f0-9]{64}$/i.test(image);
 const present = value => typeof value === 'string' && Boolean(value.trim());
 const configured = value => Object.keys(mapping(value)).length > 0;
 const schedulerImage = image => present(image) && /(?:^|\/)swarm-cronjob(?:[:@]|$)/.test(image);
@@ -49,8 +52,8 @@ export function swarmInventoryIssues({ components, lite = false }) {
   const add = (at, message) => errors.push({ at, message });
   for (const [id, entry] of Object.entries(catalog)) {
     const component = mapping(entry);
-    if (lite && present(component.image) && BACKING_IMAGE.test(repositoryOf(component.image)))
-      add(`components.${id}.image`, 'lite must use managed Supabase backing services; this image duplicates a Supabase-provided service');
+    if (lite && present(component.image) && BACKING_IMAGE.test(repositoryOf(component.image)) && !isLiteDatabaseImage(component.image))
+      add(`components.${id}.image`, 'lite runs no backing image but its db component (supabase/postgres); storage is the external S3 endpoint, identity the API');
     jobDeclarationIssues(id, component, catalog, add);
   }
   return errors;
@@ -117,8 +120,8 @@ export function swarmModelIssues({ model, components, bindings, lite = false })
       add(`services.${id}.ports`, 'Swarm ports must be an array of published port definitions');
     else if (service.ports?.length && component.role !== 'ingress')
       add(`services.${id}.ports`, 'only a component with role ingress may publish Swarm ports');
-    if (lite && present(service.image) && BACKING_IMAGE.test(repositoryOf(service.image)))
-      add(`services.${id}.image`, 'lite stack must not run an image that duplicates a Supabase-provided backing service');
+    if (lite && present(service.image) && BACKING_IMAGE.test(repositoryOf(service.image)) && !isLiteDatabaseImage(service.image))
+      add(`services.${id}.image`, 'lite stack runs no backing image but its db service (supabase/postgres)');
     jobServiceIssues(id, service, component, services, bound, add);
   }
   for (const id of Object.keys(bound)) {

package/scaffold/add-app.mjs

@@ -7,8 +7,7 @@ import {
 } from "../runtime/scripts/hfs/slots.mjs";
 import { imageFiles, render, TEMPLATES_DIR } from "../sync/index.mjs";
 import { ScaffoldError, pascalOf } from "./service.mjs";
-import { bundledPins } from "../runtime/scripts/hfs/canon-pins.mjs";
-import { PARTIAL_VARIABLES, callbackSourceFiles, coreFeApps, hasAuthCallback, jsonText, packageJsonText } from "./app.mjs";
+import { PARTIAL_VARIABLES, coreFeApps, jsonText, packageJsonText } from "./app.mjs";
 
 /** The shared fe app core (modules/api, auth, toast, redux, the providers, the hooks): the base tree, then the edition overlay. */
 const CORE_DIRS = Object.freeze({
@@ -66,8 +65,7 @@ function planAppTemplates(repo, name) {
     if (!fs.existsSync(dir)) continue;
     for (const relative of listFiles(dir)) byPath.set(relative, { relative: `${targetBase}/${relative}`, body: readTemplate(dir, relative) });
   }
-  return callbackSourceFiles([...byPath.values()].map(file => ({ path: file.relative, content: file.body })), repo)
-    .map(file => ({ relative: file.path, body: file.content }));
+  return [...byPath.values()];
 }
 
 /** The package and TypeScript manifests of a new Next workspace. */
@@ -85,12 +83,6 @@ function planWorkspaceManifests(root, repo, name) {
     );
   const workspacePackage = JSON.parse(fs.readFileSync(firstPackage, "utf8"));
   workspacePackage.name = `@${repo.project}/${name}`;
-  if (hasAuthCallback(repo)) {
-    const pins = bundledPins();
-    workspacePackage.dependencies ??= {};
-    for (const dependency of ["@supabase/ssr", "@supabase/supabase-js", "server-only"])
-      workspacePackage.dependencies[dependency] = pins[dependency].version;
-  }
   const appTemplates = path.join(TEMPLATES_DIR, "fe", "app");
   return [
     {

package/scaffold/add-cli-lite.mjs

@@ -21,7 +21,7 @@ const managedScripts = (repo, source) => {
 
 const CLI_OPTIONS = `import type { DatabaseConnectionOptions } from "@modules/platform/database"
 
-/** Everything the lite cli needs: the least-privilege Supabase PostgreSQL connection. */
+/** Everything the lite cli needs: the least-privilege PostgreSQL connection. */
 export interface CliAppOptions {
     /** The connections the built-in migrate and seed groups operate on. */
     readonly connections: ReadonlyArray<DatabaseConnectionOptions>
@@ -36,8 +36,8 @@ export const createCliAppOptions = (primary: DatabaseConnectionOptions): CliAppO
 const MIGRATE_RUN = `import { CommandRunner, SubCommand } from "nest-commander"
 import { MigrationRunnerService } from "@modules/platform/database"
 
-@SubCommand({ name: "run", description: "Push the pending Supabase migrations" })
-/** \`cli migrate run\`: delegates schema authority to the managed Supabase db:push script. */
+@SubCommand({ name: "run", description: "Apply the pending db migrations" })
+/** \`cli migrate run\`: delegates schema authority to the managed db:push script (starci app db migrate). */
 export class RunCli extends CommandRunner {
     constructor(private readonly migrations: MigrationRunnerService) {
         super()
@@ -53,7 +53,7 @@ export class RunCli extends CommandRunner {
 const SEED_RUN = `import { CommandRunner, SubCommand } from "nest-commander"
 import { SeedRunnerService } from "@modules/platform/database"
 
-@SubCommand({ name: "run", description: "Run the tracked Supabase seed through the application role" })
+@SubCommand({ name: "run", description: "Run the tracked seed through the application role" })
 /** \`cli seed run\`: executes the one tracked seed through the shared least-privilege EntityManager. */
 export class RunSeedsCli extends CommandRunner {
     constructor(private readonly seeds: SeedRunnerService) {
@@ -91,7 +91,7 @@ import { SeedCli } from "./seed.cli"
 import { RunSeedsCli } from "./subs/run.cli"
 
 @Module({ providers: [SeedCli, RunSeedsCli] })
-/** The lite seed group: the command and its one tracked Supabase seed runner. */
+/** The lite seed group: the command and its one tracked seed runner. */
 export class SeedModule {}
 `;
 
@@ -144,7 +144,7 @@ function enableLiteCliDatabase(root) {
 }
 
 /**
- * Creates the optional lite cli app, its typed CliEnv/readCliEnv boundary and Supabase migrate/seed groups on first `add cli`.
+ * Creates the optional lite cli app, its typed CliEnv/readCliEnv boundary and its migrate/seed groups on first `add cli`.
  * Existing cli trees are never repaired or overwritten: drift remains a check finding.
  */
 export function ensureLiteCli({ root, manifest, repo }) {

package/scaffold/add-compose.mjs

@@ -36,7 +36,7 @@ export function readComposeGroup({ repoRoot, repo, app, area, noun }) {
   const skeleton = repo.edition === 'lite' ? 'skeleton-lite/apps/api' : 'skeleton/apps/__app__';
   const template = path.join(TEMPLATES_DIR, 'be', ...skeleton.split('/'), 'src', 'compose', `${area}.ts`);
   const text = fs.readFileSync(exists ? file : template, 'utf8').replace(/\r\n/g, '\n');
-  const argument = area === 'domain' && repo.edition === 'lite' ? 'verifyAccessToken: VerifySupabaseAccessToken' : '';
+  const argument = area === 'domain' && repo.edition === 'lite' ? 'verifyAccessToken: VerifyAccessToken' : '';
   const marker = `export const ${area}Modules = (${argument}): Array<Type<unknown> | DynamicModule> => [`;
   const declarationAt = compositionCode(text).indexOf(`\n${marker}`);
   const active = declarationAt >= 0;

package/scaffold/add-inbox-lite.mjs

@@ -72,8 +72,8 @@ const databasePatches = (root) => {
       "lite add webhook needs the scaffolded platform/database capability",
     );
   let index = fs.readFileSync(indexFile, "utf8").replace(/\r\n/g, "\n");
-  if (!index.includes('export { recordWebhookDelivery } from "./webhook-inbox.client"'))
-    index = `${index.trimEnd()}\nexport { recordWebhookDelivery } from "./webhook-inbox.client"\n`;
+  if (!index.includes('export { recordWebhookDelivery, webhookReceiptInsert } from "./webhook-inbox.client"'))
+    index = `${index.trimEnd()}\nexport { recordWebhookDelivery, webhookReceiptInsert } from "./webhook-inbox.client"\n`;
   if (!index.split("\n").some((line) => line.startsWith("export { ") && line.includes("DatabaseErrorCode") && line.endsWith(' } from "./errors/database.error"')))
     index = `${index.trimEnd()}\nexport { DatabaseError, DatabaseErrorCode } from "./errors/database.error"\n`;
   let error = withSqlIdentifierError(fs.readFileSync(errorFile, "utf8").replace(/\r\n/g, "\n"));
@@ -169,7 +169,7 @@ export function addLiteWebhookInbox({
   validateProcessingOwner({ root, ...values, provider });
   const Provider = pascalOf(provider);
   const table = `${snakeOf(provider)}_inbox`;
-  const migrationsDir = path.join(root, "supabase", "migrations");
+  const migrationsDir = path.join(root, "db", "migrations");
   const migrations = fs.existsSync(migrationsDir)
     ? fs.readdirSync(migrationsDir).filter((file) => MIGRATION.test(file)).sort(byCodeUnit)
     : [];
@@ -197,7 +197,7 @@ export function addLiteWebhookInbox({
   const events = eventFiles(root, provider, renderValues);
   const planned = [
     {
-      relative: `supabase/migrations/${stamp}_${suffix}`,
+      relative: `db/migrations/${stamp}_${suffix}`,
       text: template("migration.sql.tpl", renderValues),
     },
     { relative: `${base}/index.ts`, text: template("index.ts.tpl", renderValues) },
@@ -221,10 +221,6 @@ export function addLiteWebhookInbox({
       relative: `${base}/${provider}-inbox.service.spec.ts`,
       text: template("service.spec.ts.tpl", renderValues),
     },
-    {
-      relative: `${base}/persistence/${provider}-inbox.sql.ts`,
-      text: template("sql.ts.tpl", renderValues),
-    },
     {
       relative: `be/src/modules/events/${provider}/${provider}-delivery-recorded.event.ts`,
       text: template("delivery-recorded.event.ts.tpl", renderValues),

package/scaffold/add-plan.mjs

@@ -162,7 +162,7 @@ function appendEntries(entries, context, planned) {
 
 /** Planned app migrations append after every active migration, before any generated file is written. */
 function requireMigrationOrder(repoRoot, planned) {
-  const directory = path.join(repoRoot, 'supabase', 'migrations');
+  const directory = path.join(repoRoot, 'db', 'migrations');
   const migrations = planned.filter(file => path.dirname(file.absolute) === directory);
   if (migrations.length === 0) return;
   const existing = fs.existsSync(directory) ? fs.readdirSync(directory) : [];