@starci/hfs 4.9.11 → 4.10.1

package/src/main.mjs

@@ -49,7 +49,7 @@
 //   starci app ci secret set <NAME> [--env E | --dependabot] [--repo owner/name]  reads the value from stdin only.
 //   starci app ci var set <NAME> [--env E] [--value v] | var sync [--execute] | verify [--json]
 //                                            declared GitHub CI custody; verify compares names, scopes and public values.
-//   starci app db baseline | restamp --map <restamp.yaml> | plan
+//   starci app db new <name> | baseline | restamp --map <restamp.yaml> | plan | migrate | post-cutover | dump
 //                                            preview the database cutover or compare its state with the repo; baseline and restamp mutate only with --apply.
 //   starci app add <api|webhook|realtime|saga|job|reactor|queue|projection> <name> [--event <event> --from <service> --service <Class>=<module>] [--owner <service> --failed <event> --done <event>] [--connection <name>] [--cwd <dir>]
 //                                            exactly that kind's file tree, generated FROM the files: tree of its pattern topic (knowledge/patterns/be) with the
@@ -79,7 +79,6 @@ import { main as syncMain } from '../sync/cli.mjs';
 import { SyncError, bundledPresets } from '../sync/index.mjs';
 import { managedFindings } from '../sync/managed.mjs';
 import { emitContracts } from '../emit/contracts.mjs';
-import { dbTypesEmitter } from '../emit/db-types.mjs';
 import { ScaffoldError, newService, newSpec } from '../scaffold/service.mjs';
 import { EditionRefusal } from '../scaffold/edition-gate.mjs';
 import { addKind } from '../scaffold/add.mjs';
@@ -95,26 +94,26 @@ import { releaseMain } from '../release/index.mjs';
 import { dbMigrateMain } from '../db/migrate.mjs';
 import { dbPostCutoverMain } from '../db/post-cutover.mjs';
 import { dbDumpMain } from '../db/dump.mjs';
-import { dbResetMain } from '../db/reset.mjs';
+import { dbNewMain } from '../db/new.mjs';
 import { dbDriftMain } from '../db/drift.mjs';
 import { codemodMain } from '../codemod/button-intent.mjs';
 
 export const VERBS = Object.freeze(['scaffold', 'add', 'lint', 'sync', 'check', 'upgrade', 'stack', 'release', 'explain', 'emit', 'new', 'secret', 'ci', 'db', 'hygiene', 'coverage', 'codemod']);
-const DATABASE_VERBS = new Map([['baseline', dbBaselineMain], ['restamp', dbRestampMain], ['plan', dbPlanMain], ['migrate', dbMigrateMain], ['post-cutover', dbPostCutoverMain], ['dump', dbDumpMain], ['reset', dbResetMain], ['drift', dbDriftMain]]);
+const DATABASE_VERBS = new Map([['baseline', dbBaselineMain], ['restamp', dbRestampMain], ['plan', dbPlanMain], ['migrate', dbMigrateMain], ['post-cutover', dbPostCutoverMain], ['dump', dbDumpMain], ['new', dbNewMain], ['drift', dbDriftMain]]);
 
 const USAGE = `starci app scaffold <name> [--into <dir>] [--edition full|lite] [--registry-visibility public|private] [--cwd <dir>]
 starci app add <api|webhook|realtime|saga|job|reactor|queue|projection|cli|table|app|block|composite|branch|leaf|page|overlay|layout> <name> [options] [--cwd <dir>]
 starci app lint [--cwd <dir>] [--changed <file>...] [--workspace <dir>] [--side be|fe] [--fix] [--format text|json] [--sonar <file>]
 starci app codemod button-intent [--write] [--format json|markdown] [--report <file.json|file.md>] [--cwd <dir>]
 starci app sync (--check | --write) [--cwd <dir>]
-starci app check [--cwd <dir>] [--json] [--fast] [--base <ref>] [--db-types] [--wiring] [--coverage-from <lcov>]
-starci app db baseline [--stamp <version>] [--local] [--apply] [--cwd <dir>]
-starci app db restamp --map <restamp.yaml> [--local] [--apply] [--cwd <dir>]
-starci app db plan [--local] [--json] [--cwd <dir>]
-starci app db dump (--linked | --local | --url-env <NAME>) --out <dir> [--schema-only] [--json] [--cwd <dir>]
-starci app db reset --linked --auth keep|drop --storage keep|drop --backup <receipt.json> [--execute] [--json] [--cwd <dir>]
-starci app db migrate [--execute] [--local | --linked | --url-env <NAME>] [--json] [--cwd <dir>]
-starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--linked | --url-env <NAME>] [--json] [--cwd <dir>]
+starci app check [--cwd <dir>] [--json] [--fast] [--base <ref>] [--wiring] [--coverage-from <lcov>]
+starci app db new <kebab-name> [--json] [--cwd <dir>]
+starci app db baseline [--stamp <version>] [--url-env <NAME>] [--apply] [--cwd <dir>]
+starci app db restamp --map <restamp.yaml> [--url-env <NAME>] [--apply] [--cwd <dir>]
+starci app db plan [--url-env <NAME>] [--json] [--cwd <dir>]
+starci app db dump [--url-env <NAME>] --out <dir> [--schema-only] [--json] [--cwd <dir>]
+starci app db migrate [--execute] [--url-env <NAME>] [--json] [--cwd <dir>]
+starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app db drift [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app release gate [--execute] [--source <ref>] [--tag-prefix <prefix>] [--backfill <tag>] [--json] [--cwd <dir>]
 starci app release push [--execute] [--remote <name>] [--urgent --reason <text>] [--json] [--cwd <dir>]
@@ -147,7 +146,7 @@ const PER_CODE_LIMIT = 25;
 const VALUE_FLAGS = new Set(['--base', '--inject', '--into', '--event', '--from', '--service', '--connection', '--owner', '--failed', '--done', '--coverage-from', '--registry-visibility', '--shapes', '--read', '--app', '--kind', '--blocks', '--tabs']);
 /** Flags that may repeat: their values are collected in order. */
 const LIST_FLAGS = new Set(['--inject']);
-const BOOL_FLAGS = new Set(['--json', '--fast', '--fe', '--no-types', '--db-types', '--wiring', '--form']);
+const BOOL_FLAGS = new Set(['--json', '--fast', '--fe', '--wiring', '--form']);
 
 function coverageArgument(arg, args, opts) {
   const inline = arg.startsWith('--coverage-from=');
@@ -250,11 +249,11 @@ function printExplain(e, out) {
  * The app pass: slots, managed files, formatter, contract snapshots and the architecture machine's check surface, root and sides.
  * `only` limits the formatter to those (app-relative) files.
  */
-async function runCheck({ repoRoot, harness, fast = false, base, only, presets, prettier, dbTypes = false }) {
+async function runCheck({ repoRoot, harness, fast = false, base, only, presets, prettier }) {
   const tracked = trackedFiles(repoRoot);
   // Managed files of the root and both sides, the .gitignore block and sonar against their render (R04, R05, R11, ...), and prettier
   // through the app's own install (R19, never under --fast).
-  const extraFindings = [...await managedFindings({ repoRoot, tracked, presets }), ...await checkDatabase({ repoRoot, files: tracked, base, ...(dbTypes ? { emitTypes: dbTypesEmitter() } : {}) }), ...(fast ? [] : await formatFindings({ repoRoot, files: only ?? tracked, prettier }))];
+  const extraFindings = [...await managedFindings({ repoRoot, tracked, presets }), ...await checkDatabase({ repoRoot, files: tracked, base }), ...(fast ? [] : await formatFindings({ repoRoot, files: only ?? tracked, prettier }))];
   // R23 against the be side itself (full pass only): committed snapshots equal what `starci app emit` writes now.
   let contracts = null;
   let be = null;
@@ -345,7 +344,7 @@ async function installedStackMain(cwd) {
 function databaseMain(argv, io) {
   const [verb, ...rest] = argv;
   const dispatch = DATABASE_VERBS.get(verb);
-  if (!dispatch) throw new Error('starci app db takes baseline, restamp, plan, migrate, post-cutover, dump, reset or drift');
+  if (!dispatch) throw new Error('starci app db takes new, baseline, restamp, plan, migrate, post-cutover, dump or drift');
   return dispatch(rest, io);
 }
 
@@ -357,7 +356,7 @@ function printCheckProofs(result, out) {
 async function checkMain(opts, { cwd: repoRoot, harness, edition, stdout: out, presets, prettier, checkApp = runCheck, runLinter }) {
   if (opts.positional.length) throw new Error('starci app check takes no path');
   if (opts.base !== undefined && opts.fast !== true) throw new Error('--base names the ref --fast compares with; it needs --fast');
-  const checked = await checkEdition({ repoRoot, edition, normal: () => checkApp({ repoRoot, harness, fast: opts.fast === true, base: opts.base, presets, prettier, dbTypes: opts['db-types'] === true }), presets, prettier });
+  const checked = await checkEdition({ repoRoot, edition, normal: () => checkApp({ repoRoot, harness, fast: opts.fast === true, base: opts.base, presets, prettier }), presets, prettier });
   const proof = withCheckProofs(checked, { repoRoot, edition, wiring: opts.wiring === true, coverageFrom: opts['coverage-from'] });
   const changed = opts.fast === true ? changedSince(repoRoot, proof.fast?.base ?? opts.base).files : null;
   const existing = changed ? changed.filter(file => fs.existsSync(path.join(repoRoot, file))) : [];
@@ -398,7 +397,7 @@ function newMain(opts, { cwd: repoRoot, stdout: out }) {
 function addMain(opts, { cwd: repoRoot, stdout: out }) {
   const [noun, name, ...extra] = opts.positional;
   if (!noun || !name || extra.length) throw new Error('starci app add takes `<noun> <name>` and the options of the noun');
-  const { created, registered } = addKind({ repoRoot, noun, name, options: { event: opts.event, from: opts.from, service: opts.service, connection: opts.connection, owner: opts.owner, failed: opts.failed, done: opts.done, fe: opts.fe, noTypes: opts['no-types'], shapes: opts.shapes, read: opts.read, app: opts.app, kind: opts.kind, form: opts.form, blocks: opts.blocks, tabs: opts.tabs } });
+  const { created, registered } = addKind({ repoRoot, noun, name, options: { event: opts.event, from: opts.from, service: opts.service, connection: opts.connection, owner: opts.owner, failed: opts.failed, done: opts.done, fe: opts.fe, shapes: opts.shapes, read: opts.read, app: opts.app, kind: opts.kind, form: opts.form, blocks: opts.blocks, tabs: opts.tabs } });
   for (const file of created) out(`created ${file}\n`);
   const kinds = registered.kinds.length ? `; kinds ${registered.kinds.join(', ')}` : '';
   // A noun that registers nothing in hfs.json (a table, an app, a front-end unit) ends with what it wrote.
@@ -437,7 +436,7 @@ function declaredEdition(cwd) {
  */
 async function stackAppMain(argv, { cwd, edition, stackMain, stdout: out, stderr: err, env, sops, stackIo }) {
   if (STACK_ACTIONS.includes(argv[0])) return deployStackMain(argv, { ...stackIo, cwd, stdout: out, stderr: err, env, ...(sops ? { sops } : {}) });
-  if ((edition ?? declaredEdition(cwd)) === 'lite') throw new Error('starci app stack up|down|status manage the local test world of the full edition; a lite app starts its local infrastructure with the Supabase CLI');
+  if ((edition ?? declaredEdition(cwd)) === 'lite') throw new Error('starci app stack up|down|status manage the local test world of the full edition; a lite app starts its local database with npm run db:start');
   const run = stackMain ?? await installedStackMain(cwd);
   return run(argv, { cwd, out, err });
 }
@@ -460,7 +459,7 @@ function errorMessage(error) {
 
 /**
  * `harness` ({ version }) is the CLI that runs this package in-process: its version is the starci-harness an app is judged and
- * scaffolded at (runtime/scripts/hfs/canon-pins.mjs). `run` injects the Supabase runner, `runLinter` the linter transport, `checkApp`
+ * scaffolded at (runtime/scripts/hfs/canon-pins.mjs). `run` injects the database runner, `runLinter` the linter transport, `checkApp`
  * the HFS check and `stackIo` Swarm tools; production defaults execute every check.
  */
 export async function main(argv, {

package/stack/target-binding.mjs

@@ -6,7 +6,6 @@ import { refusal } from './errors.mjs';
 const slug = value => typeof value === 'string' && /^[a-z][a-z0-9-]*$/.test(value);
 const label = value => typeof value === 'string' && /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/.test(value);
 const host = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(value);
-const port = value => Number.isInteger(value) && value > 0 && value <= 65535;
 const denied = () => { throw refusal('STACKS_DEPLOY_CONFIG_INVALID', 'the native endpoint binding is invalid or differs from the selected owner target'); };
 const exact = (value, fields) => value && typeof value === 'object' && !Array.isArray(value)
   && Object.keys(value).length === fields.length && fields.every(key => Object.hasOwn(value, key));
@@ -28,44 +27,11 @@ function ordinaryInput(root, file) {
 /** A bound native owner opens only an ordinary envelope below its actual app, without ancestor links. */
 export const assertBoundCustody = (root, file) => ordinaryInput(root, file);
 
-/** Bound database commands require the app-local launcher; they cannot discover a global replacement. */
-export function boundSupabaseLauncher(root) {
-  const launcher = path.join(root, 'node_modules', 'supabase', 'dist', 'supabase.js');
-  ordinaryInput(root, launcher);
-  return launcher;
-}
-
 /** Native custody can use AGE; tools that do not decrypt custody must not inherit that identity. */
 export function nativeToolEnvironment(env) {
   return Object.fromEntries(Object.entries(env).filter(([key]) => !/^SOPS_/i.test(key)));
 }
 
-/** Bound database tools receive only their selected private password and native routing, without ambient libpq or provider credentials. */
-export function nativeDatabaseEnvironment(env, binding, selected = {}, omit = []) {
-  const omitted = new Set(omit.filter(value => typeof value === 'string').map(value => value.toUpperCase()));
-  return { ...Object.fromEntries(Object.entries(nativeToolEnvironment(env)).filter(([key]) => !/^(?:PG[A-Z_]*|SUPABASE_)/i.test(key) && !omitted.has(key.toUpperCase()))),
-    'SUPABASE_ENV': binding.environment, ...selected };
-}
-
-/** Preserve a logical linked project while selecting a fixed native SQL endpoint without the CLI's linked Management finalizer. */
-export function boundLinkedDatabaseUrl(binding, savedPooler = null) {
-  if (!binding || binding.mode !== 'linked' || !/^[a-z0-9]{20}$/.test(binding.projectRef)) denied();
-  if (savedPooler === null) return `postgresql://postgres@db.${binding.projectRef}.supabase.co:5432/postgres?sslmode=require`;
-  let url;
-  try {
-    if (typeof savedPooler !== 'string' || savedPooler.length > 8192) denied();
-    url = new URL(savedPooler.trim());
-    if (!['postgres:', 'postgresql:'].includes(url.protocol) || !/^[A-Za-z0-9.-]+\.pooler\.supabase\.com$/.test(url.hostname)
-      || decodeURIComponent(url.username) !== `postgres.${binding.projectRef}` || url.pathname !== '/postgres'
-      || url.port && !['5432', '6543'].includes(url.port) || url.hash
-      || [...url.searchParams].some(([key, value]) => key !== 'sslmode' || !['require', 'verify-full'].includes(value))) denied();
-  } catch { denied(); }
-  url.password = '';
-  url.port = '5432';
-  if (!url.searchParams.has('sslmode')) url.searchParams.set('sslmode', 'require');
-  return url.toString();
-}
-
 /** Parse the internal public binding; ordinary commands without this flag retain their native behavior. */
 export function parseTargetBinding(text, kind) {
   if (text === undefined) return null;
@@ -75,16 +41,6 @@ export function parseTargetBinding(text, kind) {
   if (kind === 'docker-swarm') {
     if (!exact(binding, ['kind', 'environment', 'stack', 'host', 'user', 'port']) || !slug(binding.stack)
       || !host(binding.host) || !label(binding.user) || binding.port !== 22) denied();
-  } else if (kind === 'supabase-db') {
-    if (binding.mode === 'local') {
-      if (!exact(binding, ['kind', 'mode', 'environment', 'localProject', 'port']) || !label(binding.localProject) || !port(binding.port)) denied();
-    } else if (binding.mode === 'linked') {
-      if (!exact(binding, ['kind', 'mode', 'environment', 'projectRef']) || !/^[a-z0-9]{20}$/.test(binding.projectRef ?? '')) denied();
-    } else if (binding.mode === 'url-env') {
-      if (!exact(binding, ['kind', 'mode', 'environment', 'urlEnv', 'host', 'port', 'database', 'user'])
-        || !/^[A-Z][A-Z0-9_]*$/.test(binding.urlEnv ?? '') || !host(binding.host) || !port(binding.port)
-        || !label(binding.database) || !label(binding.user)) denied();
-    } else denied();
   } else denied();
   return Object.freeze(binding);
 }
@@ -107,19 +63,3 @@ export function assertStackAccount(binding, account, knownHosts) {
   if (!binding) return;
   if (account !== `${binding.user}@${binding.host}` || binding.port !== 22 || !knownHosts.trim()) denied();
 }
-
-/** Compare the effective local Supabase identity after its existing config/environment resolver. */
-export function assertLocalDatabase(binding, target) {
-  if (binding && (binding.mode !== 'local' || binding.localProject !== target.project || binding.port !== target.port)) denied();
-}
-
-/** Refuse a selected URL unless its non-secret endpoint exactly matches the accepted target. */
-export function assertUrlDatabase(binding, value) {
-  if (!binding) return;
-  let url;
-  try { url = new URL(value); } catch { denied(); }
-  if (binding.mode !== 'url-env' || !['postgres:', 'postgresql:'].includes(url.protocol)
-    || url.hostname !== binding.host || Number(url.port || '5432') !== binding.port
-    || decodeURIComponent(url.username) !== binding.user || decodeURIComponent(url.pathname.slice(1)) !== binding.database
-    || url.search || url.hash || !url.password) denied();
-}

package/stack/urgent-floor.mjs

@@ -22,8 +22,8 @@ import { refusal } from './errors.mjs';
 const AGE_HEADER = 'age-encryption.org/v1\n';
 const SHA = /^[a-f0-9]{64}$/u;
 
-/** The database a floor step reaches: the connection named by --db-url-env, else the linked project of the `database:` block. */
-const targetOf = (options) => (options.dbUrlEnv ? { urlEnv: options.dbUrlEnv } : { linked: true });
+/** The database a floor step reaches: the connection named by --db-url-env (default DATABASE_URL). */
+const targetOf = (options) => (options.dbUrlEnv ? { urlEnv: options.dbUrlEnv } : {});
 
 /** The backups of an urgent deploy live outside every repository: --backup-out, else ~/.starci-backups/<project>. */
 const backupDir = (config, options) => options.backupOut ?? path.join(os.homedir(), '.starci-backups', config.project);

package/sync/index.mjs

@@ -157,6 +157,8 @@ function trailingNewline(text) {
 }
 
 /** The digest-pinned image of a lite app's declared Redis, in every environment that runs it (ruling:R212/case-10). */
+/** The pinned image of a lite app's db service (contexts/stack/pins.yaml images): PostgreSQL with pg_cron, pg_net, pgmq and pgvector. */
+export const DB_IMAGE = 'supabase/postgres:17.11.0.006@sha256:c141fd17ac6a76c4323e90b3aee8ff1a23d2e89e547c2b963cfadc309c079cc2';
 export const REDIS_IMAGE = 'redis:7@sha256:c6eabf748fc7a61dbb5a705c78bcf3d6377b1127a97d0ce965c11c44ba46896f';
 
 const redisDevText = project => render(readBundled('app/package-scripts/redis-dev.json'), { project, redisImage: REDIS_IMAGE });
@@ -286,7 +288,7 @@ export function appScripts(app, source) {
   const watch = entry => `cd be && ts-node-dev --respawn -r tsconfig-paths/register apps/${entry.name}/src/main.ts`;
   const built = entry => `node be/dist/apps/${entry.name}/src/main.js`;
   const workspace = entry => feAppPackageName(app.project, entry.name);
-  // Both editions generate before they run (owner ruling 2026-10-13): the fe's GraphQL wire types, and under lite the Supabase types check.
+  // Both editions generate before they run (owner ruling 2026-10-13): the fe's GraphQL wire types, and under lite the database types check.
   const dev = entry => `npm run codegen --silent && turbo run dev --filter=${workspace(entry)}`;
   const images = imageEntries(app, source);
   const imageCommand = ({ side, entry }) => `docker build -f ${dockerfilePath(side, entry.name)} -t ${app.project}/${entry.name}:dev .`;
@@ -347,7 +349,7 @@ export function imageFiles(app, source) {
   const side = app.sides.fe;
   const inputs = [...(opensPackages(side) ? ['fe/packages'] : []), ...((side.reads ?? []).includes('be/contracts/') ? ['be/contracts'] : [])];
   const copyInputs = inputs.map(folder => `COPY ${folder} ${folder}\n`).join('');
-  // The folders outside be/ that the back end declares it reads (the generated Supabase types of a lite back end, which an upgraded app keeps reading) are in every one of its images.
+  // The folders outside be/ that the back end declares it reads (the generated database types of a lite back end, db/types/) are in every one of its images.
   const beFolders = (app.sides.be.reads ?? []).map(folder => folder.replace(/\/$/, ''));
   const copyBeInputs = beFolders.map(folder => `COPY ${folder} ${folder}\n`).join('');
   const entries = imageEntries(app, source).map(({ side: which, entry: item }) => ({ side: which, item }));
@@ -373,8 +375,8 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     project: app.project,
     appBinary: APP_BINARY,
     appScripts: appScripts(app, source),
-    // A full upgrade keeps the app's declared Supabase connection and its local database commands.
-    supabaseScripts: providers.includes('supabase') ? render(readBundled('app/package-scripts/supabase.json'), { appBinary: APP_BINARY }) : '',
+    // A lite app's own database runs in development as one container of the pinned db image (ruling:lite-self-hosted-postgres-passport-minio).
+    dbImage: DB_IMAGE,
     // A lite app's declared Redis (sides.be.backing, ruling:R212/case-10) runs in development as one container of its pinned image.
     backingScripts: lite && (app.sides.be.backing ?? []).includes('redis') ? redisDevText(app.project) : '',
     // turbo builds every fe app workspace; ^build (turbo.json) builds the packages each app imports first, and caches both.
@@ -555,6 +557,24 @@ export async function renderRepo(root, { presets, parseYaml, notices, manifest =
   return { hfs, targets: renderTargets(hfs, presets ?? await loadPresets(root), { sonarKey, manifest, source: appSource(root, { parseYaml, notices }) }) };
 }
 
+/** The folders a lite app's sync retires (ruling lite-self-hosted-postgres-passport-minio): the generated Supabase row types nothing reads any more. */
+const LITE_RETIRED_DIRS = Object.freeze(['supabase/types']);
+
+/** The app-relative files of the retired folders that still exist under `root` of a lite app; sync --write deletes them, --check reports them. */
+export function retiredFiles(root, hfs) {
+  if (hfs?.edition !== 'lite') return [];
+  const found = [];
+  const walk = (rel) => {
+    const full = path.join(root, rel);
+    const stat = fs.lstatSync(full, { throwIfNoEntry: false });
+    if (!stat) return;
+    if (stat.isDirectory()) for (const name of fs.readdirSync(full).sort(byCodeUnit)) walk(`${rel}/${name}`);
+    else found.push(rel);
+  };
+  for (const dir of LITE_RETIRED_DIRS) walk(dir);
+  return found;
+}
+
 /** `starci app sync --check | --write [--cwd <dir>]` at the app root; returns 0 clean, 1 drift, 2 usage. */
 function syncOptions(argv) {
   const check = argv.includes('--check'), write = argv.includes('--write');
@@ -567,16 +587,17 @@ function syncOptions(argv) {
   return { write, cwdAt };
 }
 
-function reportSyncCheck(root, targets, out) {
+function reportSyncCheck(root, targets, out, retired = []) {
   const results = checkTargets(root, targets);
   const bad = results.filter(item => item.status !== 'ok');
+  for (const file of retired) out(`HFS_SYNC_DRIFT ${file}: retired, the lite edition generates no database types; run "npx starci app sync --write" to delete it`);
   for (const result of bad) {
     const found = result.actualHash ? `, found ${result.actualHash.slice(0, 12)}` : '';
     const where = result.difference ? ` (line ${result.difference.line}: expected ${JSON.stringify(result.difference.expected)}, found ${JSON.stringify(result.difference.actual)})` : '';
     out(`HFS_SYNC_DRIFT ${result.path}: ${result.status}, expected sha256 ${result.expectedHash.slice(0, 12)}${found}${where}`);
   }
   out(`starci app sync --check: ${results.length - bad.length} of ${results.length} in sync${bad.length ? '; run "npx starci app sync --write"' : ''}`);
-  return bad.length ? 1 : 0;
+  return bad.length || retired.length ? 1 : 0;
 }
 
 export async function runSync(argv, { cwd = process.cwd(), out = line => process.stdout.write(`${line}\n`), presets, parseYaml } = {}) {
@@ -589,15 +610,18 @@ export async function runSync(argv, { cwd = process.cwd(), out = line => process
   const root = cwdAt >= 0 ? path.resolve(cwd, argv[cwdAt + 1]) : cwd;
   try {
     const notices = [];
-    const { targets } = await renderRepo(root, { presets, parseYaml, notices });
+    const { hfs, targets } = await renderRepo(root, { presets, parseYaml, notices });
+    const retired = retiredFiles(root, hfs);
     if (targets.some(target => target.path === 'README.md')) for (const notice of new Set(notices)) out(notice);
     if (write) {
       const written = writeTargets(root, targets);
       for (const file of written) out(`wrote ${file}`);
+      for (const file of retired) { fs.rmSync(path.join(root, file)); out(`removed ${file} (retired)`); }
+      for (const dir of LITE_RETIRED_DIRS) if (retired.length && fs.existsSync(path.join(root, dir)) && !fs.readdirSync(path.join(root, dir)).length) fs.rmdirSync(path.join(root, dir));
       out(`starci app sync: ${written.length} written, ${targets.length - written.length} already in sync`);
       return 0;
     }
-    return reportSyncCheck(root, targets, out);
+    return reportSyncCheck(root, targets, out, retired);
   } catch (error) {
     if (!(error instanceof SyncError)) throw error;
     out(error.message);

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -17,7 +17,7 @@ concurrency:
   cancel-in-progress: false
 
 # The job shape of the StarCi CI standard (knowledge/hfs/ci-standard.yaml): fast, lint per side, the unit run in shards, one coverage merge, build,
-# sonar, and the database types of the lite edition. Timeouts and the shard count come from ci.jobs of .starcistacks/application-stacks.yaml (defaults in the standard).
+# and sonar. Timeouts and the shard count come from ci.jobs of .starcistacks/application-stacks.yaml (defaults in the standard).
 jobs:
   fast:
     timeout-minutes: {{timeoutFast}}
@@ -110,19 +110,3 @@ jobs:
           NODE_OPTIONS: {{nodeOptions}}
 
 {{sonarJob}}
-  db-types:
-    timeout-minutes: {{timeoutDbTypes}}
-    runs-on: ubuntu-latest
-    steps:
-{{> app/ci-workflows/install-steps.yml}}
-      - name: start Supabase
-        run: npm run db:start
-      - name: apply migrations
-        run: npm run db:reset
-      - name: regenerate database types
-        run: npm run db:types
-      - name: database types are committed
-        run: git diff --exit-code -- supabase/types/database.types.ts
-      - name: stop Supabase
-        if: always()
-        run: npm run db:stop

package/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml

@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
     inputs:
       environment:
-        description: Protected environment with sealed Supabase custody under .starcistacks
+        description: Protected environment whose sealed custody under .starcistacks holds DATABASE_URL
         required: true
         type: environment
       backup_receipt:
@@ -45,7 +45,7 @@ jobs:
         uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
         with:
           version: v3.13.2
-      - name: materialize sealed custody and push migrations
+      - name: materialize sealed custody and migrate the database
         env:
           XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         shell: bash
@@ -57,9 +57,7 @@ jobs:
           secret_dir="$XDG_DATA_HOME/StarCi/secrets/{{project}}/$STACK_ENVIRONMENT"
           trap 'rm -rf -- "$secret_dir"' EXIT
           npx --no-install starci app secret materialize "$STACK_ENVIRONMENT"
-          export SUPABASE_ACCESS_TOKEN="$(cat "$secret_dir/SUPABASE_ACCESS_TOKEN")"
-          export SUPABASE_DB_PASSWORD="$(cat "$secret_dir/SUPABASE_DB_PASSWORD")"
-          project_id="$(cat "$secret_dir/SUPABASE_PROJECT_ID")"
-          npx --no-install supabase link --project-ref "$project_id"
-          npm run db:push -- --dry-run
-          npm run db:push
+          DATABASE_URL="$(cat "$secret_dir/DATABASE_URL")"
+          export DATABASE_URL
+          npx --no-install starci app db migrate --url-env DATABASE_URL
+          STARCI_DB_ARMED=1 npx --no-install starci app db migrate --url-env DATABASE_URL --execute

package/templates/app/codegen-lite/scripts/codegen.mjs

@@ -1,42 +1,5 @@
 // Generated by {{appBinary}} sync (app root). Do not edit: run "npx {{appBinary}} sync --write".
-// Database types hook, offline: the app compiles against the committed supabase/types/database.types.ts, which `npm run contract:emit`
-// regenerates from the local stack and stamps with the digest of the migrations it was generated from. This refuses a missing or
-// stale file, so lint, typecheck, dev and build never run against types older than the migrations; it starts nothing and needs no stack.
-// `--graphql` runs only the GraphQL wire types below (`npm run codegen:graphql`).
-import { createHash } from "node:crypto"
-import fs from "node:fs"
-import path from "node:path"
-
-const byCodeUnit = (left, right) => {
-    if (left === right) return 0
-    return left < right ? -1 : 1
-}
-
-const MIGRATIONS = path.join("supabase", "migrations")
-const TYPES = path.join("supabase", "types", "database.types.ts")
-const STAMP = /^\/\/ migrations-sha256: ([0-9a-f]{64})$/
-
-const fail = (message) => {
-    console.error(`codegen: ${message}`)
-    process.exit(1)
-}
-
-if (!process.argv.includes("--graphql")) {
-    const hash = createHash("sha256")
-    for (const name of (fs.existsSync(MIGRATIONS) ? fs.readdirSync(MIGRATIONS) : [])
-        .filter((file) => file.endsWith(".sql"))
-        .sort(byCodeUnit)) {
-        hash.update(`${name}\0${fs.readFileSync(path.join(MIGRATIONS, name), "utf8").replace(/\r\n/g, "\n")}\0`)
-    }
-    const digest = hash.digest("hex")
-
-    if (!fs.existsSync(TYPES))
-        fail(`${TYPES} is missing; start the local stack and run \`npm run contract:emit\`, then commit it`)
-    const stamped = STAMP.exec(fs.readFileSync(TYPES, "utf8").split(/\r?\n/, 1)[0])?.[1]
-    if (stamped !== digest)
-        fail(
-            `${TYPES} is ${stamped === undefined ? "not stamped" : "older than the migrations"}; run \`npm run contract:emit\` and commit the regenerated types`,
-        )
-}
+// The GraphQL wire types of the front end (`npm run codegen`, also `npm run codegen:graphql`); a lite app generates no database types.
+// {{> app/codegen-prelude.mjs.partial}}
 
 // {{> app/codegen-graphql.mjs.partial}}

package/templates/app/db-bootstrap/db/bootstrap.sql

@@ -0,0 +1,139 @@
+-- Managed by starci app sync (slot app.db.bootstrap); do not edit: run "npx starci app sync --write".
+-- The pre-migration bootstrap of a lite app's self-hosted PostgreSQL (ruling lite-self-hosted-postgres-passport-minio). Migrations written
+-- for Supabase reference objects GoTrue and Supabase Storage created: the browser roles, the `auth` schema (auth.users, auth.identities,
+-- auth.sessions, auth.uid/jwt/role) and the `storage` schema (storage.buckets, storage.objects). The supabase/postgres image ships only a partial
+-- copy of them, and a lite app runs neither GoTrue nor storage-api: auth is the app's own (integrations/passport) and storage is the S3 endpoint
+-- of integrations/object-storage. This file gives the migrations those objects, EMPTY, and nothing else. It is idempotent; `starci app db migrate`
+-- applies it as the database owner before the first migration of an empty database.
+--
+-- auth.users keeps the GoTrue column set so restored rows and foreign keys from public tables stay valid; encrypted_password holds bcrypt hashes.
+-- auth.uid(), auth.role() and auth.jwt() read the request.jwt.claims setting; the API connects as app_be and sets none, so they return NULL and
+-- every policy that names them denies the browser roles, which have no door in lite.
+
+create schema if not exists extensions;
+create schema if not exists auth;
+create schema if not exists storage;
+
+do $roles$
+begin
+    if not exists (select 1 from pg_roles where rolname = 'anon') then create role anon nologin noinherit; end if;
+    if not exists (select 1 from pg_roles where rolname = 'authenticated') then create role authenticated nologin noinherit; end if;
+    if not exists (select 1 from pg_roles where rolname = 'service_role') then create role service_role nologin noinherit bypassrls; end if;
+end
+$roles$;
+
+grant usage on schema auth, storage to anon, authenticated, service_role;
+grant usage on schema extensions to anon, authenticated, service_role;
+
+-- auth.users: the full GoTrue column set (the image's old copy is extended in place).
+create table if not exists auth.users (id uuid primary key);
+alter table auth.users
+    add column if not exists instance_id uuid,
+    add column if not exists aud varchar(255),
+    add column if not exists role varchar(255),
+    add column if not exists email varchar(255),
+    add column if not exists encrypted_password varchar(255),
+    add column if not exists email_confirmed_at timestamptz,
+    add column if not exists invited_at timestamptz,
+    add column if not exists confirmation_token varchar(255),
+    add column if not exists confirmation_sent_at timestamptz,
+    add column if not exists recovery_token varchar(255),
+    add column if not exists recovery_sent_at timestamptz,
+    add column if not exists email_change_token_new varchar(255),
+    add column if not exists email_change varchar(255),
+    add column if not exists email_change_sent_at timestamptz,
+    add column if not exists last_sign_in_at timestamptz,
+    add column if not exists raw_app_meta_data jsonb,
+    add column if not exists raw_user_meta_data jsonb,
+    add column if not exists is_super_admin boolean,
+    add column if not exists created_at timestamptz,
+    add column if not exists updated_at timestamptz,
+    add column if not exists phone text,
+    add column if not exists phone_confirmed_at timestamptz,
+    add column if not exists confirmed_at timestamptz,
+    add column if not exists banned_until timestamptz,
+    add column if not exists deleted_at timestamptz,
+    add column if not exists is_anonymous boolean not null default false;
+create unique index if not exists users_email_partial_key on auth.users (email) where is_anonymous = false;
+
+create table if not exists auth.identities (
+    provider_id text not null,
+    user_id uuid not null references auth.users (id) on delete cascade,
+    identity_data jsonb not null,
+    provider text not null,
+    last_sign_in_at timestamptz,
+    created_at timestamptz,
+    updated_at timestamptz,
+    email text generated always as (lower(identity_data ->> 'email')) stored,
+    id uuid not null default gen_random_uuid() primary key,
+    unique (provider_id, provider)
+);
+
+create table if not exists auth.sessions (
+    id uuid primary key,
+    user_id uuid not null references auth.users (id) on delete cascade,
+    created_at timestamptz,
+    updated_at timestamptz,
+    factor_id uuid,
+    aal text,
+    not_after timestamptz,
+    refreshed_at timestamp,
+    user_agent text,
+    ip inet,
+    tag text
+);
+create index if not exists sessions_user_id_idx on auth.sessions (user_id);
+
+create or replace function auth.uid() returns uuid language sql stable as
+$$ select nullif(coalesce(current_setting('request.jwt.claim.sub', true), (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')), '')::uuid $$;
+
+create or replace function auth.role() returns text language sql stable as
+$$ select nullif(coalesce(current_setting('request.jwt.claim.role', true), (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role')), '')::text $$;
+
+create or replace function auth.jwt() returns jsonb language sql stable as
+$$ select coalesce(nullif(current_setting('request.jwt.claim', true), ''), nullif(current_setting('request.jwt.claims', true), ''))::jsonb $$;
+
+grant execute on function auth.uid(), auth.role(), auth.jwt() to public;
+
+-- storage: the two tables the migrations seed and police; the objects live in MinIO, these stay empty bookkeeping.
+create table if not exists storage.buckets (
+    id text primary key,
+    name text not null,
+    owner uuid,
+    created_at timestamptz default now(),
+    updated_at timestamptz default now(),
+    public boolean default false,
+    avif_autodetection boolean default false,
+    file_size_limit bigint,
+    allowed_mime_types text[],
+    owner_id text
+);
+create unique index if not exists bname on storage.buckets (name);
+
+create table if not exists storage.objects (
+    id uuid not null default gen_random_uuid() primary key,
+    bucket_id text references storage.buckets (id),
+    name text,
+    owner uuid,
+    created_at timestamptz default now(),
+    updated_at timestamptz default now(),
+    last_accessed_at timestamptz default now(),
+    metadata jsonb,
+    path_tokens text[] generated always as (string_to_array(name, '/')) stored,
+    version text,
+    owner_id text,
+    user_metadata jsonb
+);
+create unique index if not exists bucketid_objname on storage.objects (bucket_id, name);
+alter table storage.objects enable row level security;
+alter table storage.buckets enable row level security;
+
+grant select, insert, update, delete on storage.objects, storage.buckets to authenticated, service_role;
+grant select on storage.objects, storage.buckets to anon;
+
+-- Replication publication the baseline adds tables to (the image ships it; a bare PostgreSQL does not).
+do $pub$
+begin
+    if not exists (select 1 from pg_publication where pubname = 'supabase_realtime') then create publication supabase_realtime; end if;
+end
+$pub$;

package/templates/app/gitignore-lite

@@ -1,9 +1,6 @@
 {{> common/gitignore.base}}
 # Jest transforms reused by the CI test job
 .jest-cache/
-# Supabase CLI state is local Docker metadata, never application source.
-supabase/.temp/
-supabase/.branches/
 # be: the schema Nest writes when it boots GraphQL
 schema.gql
 # fe: Next build output and its generated type file

package/templates/app/package-scripts/db.json

@@ -0,0 +1,9 @@
+    "db:create": "docker create --name {{project}}-dev-db -p 127.0.0.1:54322:5432 -e POSTGRES_HOST_AUTH_METHOD=trust -v {{project}}-dev-db-data:/var/lib/postgresql/data {{dbImage}}",
+    "db:start": "docker start {{project}}-dev-db",
+    "db:stop": "docker stop {{project}}-dev-db",
+    "db:reset": "docker rm -f {{project}}-dev-db && docker volume rm {{project}}-dev-db-data && npm run db:create && npm run db:start",
+    "db:new": "{{appBinary}} db new",
+    "db:push": "{{appBinary}} db migrate --url-env DATABASE_URL --execute",
+    "db:plan": "{{appBinary}} db plan --url-env DATABASE_URL",
+    "db:dump": "{{appBinary}} db dump --url-env DATABASE_URL --out ../{{project}}-db-backups",
+    "db:lint": "{{appBinary}} check --fast",

package/templates/app/package-scripts/package.json

@@ -9,7 +9,6 @@
     "test:e2e": "npm run typecheck:tests && cd be && jest --selectProjects e2e",
     "test:contract": "npm run typecheck:tests && cd be && jest --selectProjects contract",
     "test:stack": "starci app stack",
-{{supabaseScripts}}
     "contract:emit": "starci app emit"
   }
 }

package/templates/app/package-scripts-lite/package.json

@@ -6,7 +6,7 @@
     "typecheck:tests": "tsc -p be/src/tests/tsconfig.json",
     "test": "cd be && jest --selectProjects unit --coverage",
     "test:integration": "npm run typecheck:tests && cd be && jest --selectProjects integration",
-{{> app/package-scripts/supabase.json}}
+{{> app/package-scripts/db.json}}
 {{backingScripts}}
     "contract:emit": "{{appBinary}} emit"
   }

package/templates/app/skeleton/.starcistacks/dev/README.md

@@ -1,6 +1,6 @@
 # Development stack
 
-Every development dependency runs in Docker Linux containers. This starter's Docker Compose model contains the core API, the product and landing front ends, and a pinned local PostgreSQL database. Compose is an implementation detail; declared dependencies may also use managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts, and local Supabase, when declared, runs through the Supabase CLI. A declared native profile may run app processes locally while dependencies stay in Docker. Trust authentication is confined to this local, unpublished database.
+Every development dependency runs in Docker Linux containers. This starter's Docker Compose model contains the core API, the product and landing front ends, and a pinned local PostgreSQL database. Compose is an implementation detail; declared dependencies may also use managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts. A declared native profile may run app processes locally while dependencies stay in Docker. Trust authentication is confined to this local, unpublished database.
 Starter release images and external secrets must be prepared before starting the container model. Local source development remains available through the app scripts.
 
 | Command | Operation |