@starci/hfs 4.9.11 → 4.10.1

package/runtime/scripts/api/supabase/lib.mjs

@@ -1,55 +0,0 @@
-// lib.mjs - resolve and spawn the app-local Supabase CLI for this API system, with no shell.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-
-const candidateNames = (platform) => platform === 'win32'
-  ? ['supabase.exe', 'supabase', 'supabase.cmd']
-  : ['supabase'];
-
-/** Resolve the app's installed npm launcher before executable discovery; npm command shims cannot run without a shell. */
-function resolveSupabase(appRoot, { env = process.env, platform = process.platform, exists = fs.existsSync } = {}) {
-  const launcher = path.join(appRoot, 'node_modules', 'supabase', 'dist', 'supabase.js');
-  if (exists(launcher)) return { file: process.execPath, args: [launcher] };
-  const names = candidateNames(platform);
-  const local = path.join(appRoot, 'node_modules', '.bin');
-  for (const name of names) {
-    const file = path.join(local, name);
-    if (exists(file)) return { file, args: [] };
-  }
-  const delimiter = platform === 'win32' ? ';' : ':';
-  for (const directory of String(env.PATH ?? '').split(delimiter).filter(Boolean)) {
-    for (const name of names) {
-      const file = path.join(directory, name);
-      if (exists(file)) return { file, args: [] };
-    }
-  }
-  return { file: 'supabase', args: [] };
-}
-
-/** Run one shell-free Supabase call at the app root; an unusable command shim returns an ENOEXEC spawn failure. */
-export const supabaseSpawn = (appRoot, args, {
-  env = process.env,
-  supabase,
-  timeout = 60_000,
-  run = spawnSync,
-  platform = process.platform,
-  exists = fs.existsSync,
-} = {}) => {
-  const command = supabase === undefined || supabase === null ? resolveSupabase(appRoot, { env, platform, exists }) : { file: supabase, args: [] };
-  if (/\.(?:cmd|bat)$/iu.test(command.file)) return {
-    status: null, stdout: '', stderr: '', signal: null,
-    error: Object.assign(new Error('The Supabase command shim requires a shell; use an executable or the app-local npm launcher.'), { code: 'ENOEXEC' }),
-  };
-  return run(command.file, [...command.args, ...args], {
-    cwd: appRoot,
-    encoding: 'utf8',
-    env,
-    timeout,
-    windowsHide: true,
-  });
-};
-
-/** Invoke one Supabase command prefix with caller arguments and runner options. */
-export const supabaseCall = (prefix, appRoot, args = [], options = {}) =>
-  supabaseSpawn(appRoot, [...prefix, ...args], options);

package/runtime/scripts/api/supabase/migration-repair.mjs

@@ -1,5 +0,0 @@
-// migration-repair.mjs - migration history repair for an app's local or linked Supabase database.
-import { supabaseCall } from './lib.mjs';
-
-/** The spawn result of supabase migration repair; arguments and runner options remain with the caller. */
-export function migrationRepair(...args) { return supabaseCall(['migration', 'repair'], ...args); }

package/runtime/scripts/hfs/architecture/supabase-tables.mjs

@@ -1,50 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
-const CACHE = new Map();
-
-/** A static TypeScript property name, as emitted by `supabase gen types typescript`. */
-const propertyName = (typescript, name) => (typescript.isIdentifier(name) || typescript.isStringLiteralLike(name) ? name.text : null);
-
-/** The type-literal members below property `name`, or null when the generated shape is not statically readable. */
-const propertyMembers = (typescript, members, name) => {
-  const property = members.find(member => typescript.isPropertySignature(member) && propertyName(typescript, member.name) === name);
-  return property?.type && typescript.isTypeLiteralNode(property.type) ? property.type.members : null;
-};
-
-function addTableNames(typescript, members, tables) {
-  if (!members) return;
-  for (const member of members) {
-    if (!typescript.isPropertySignature(member)) continue;
-    const name = propertyName(typescript, member.name);
-    if (name) tables.add(name.toLowerCase());
-  }
-}
-
-function readTableNames(typescript, file, tables) {
-  const source = typescript.createSourceFile(file, fs.readFileSync(file, 'utf8'), typescript.ScriptTarget.Latest, true, typescript.ScriptKind.TS);
-  if (source.parseDiagnostics.length !== 0) return;
-  const database = source.statements.find(statement => typescript.isTypeAliasDeclaration(statement) && statement.name.text === 'Database');
-  const databaseMembers = database && typescript.isTypeLiteralNode(database.type) ? database.type.members : null;
-  const publicMembers = databaseMembers ? propertyMembers(typescript, databaseMembers, 'public') : null;
-  const tableMembers = publicMembers ? propertyMembers(typescript, publicMembers, 'Tables') : null;
-  addTableNames(typescript, tableMembers, tables);
-}
-
-/**
- * The lower-case keys of `Database['public']['Tables']`, parsed with the architecture context's target compiler.
- * An absent, malformed or unreadable contract proves no table. The result is cached once per app root.
- */
-export function supabaseTablesOf(appRoot, typescript) {
-  const root = path.resolve(appRoot);
-  if (CACHE.has(root)) return CACHE.get(root);
-  const tables = new Set();
-  const file = path.join(root, 'supabase', 'types', 'database.types.ts');
-  try {
-    readTableNames(typescript, file, tables);
-  } catch {
-    // Missing and unreadable generated contracts are fail-closed: no table is proven.
-  }
-  CACHE.set(root, tables);
-  return tables;
-}

package/runtime/scripts/hfs/architecture/supabase.mjs

@@ -1,226 +0,0 @@
-import { machineKit } from './machine-ast.mjs';
-import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, jwtPolicyProblems, moduleNameOf, reportAt, supabaseClientType, supabaseDataAccess, SUPABASE_MODULES } from './supabase-ast.mjs';
-import { checkBackendJwt } from './supabase-be.mjs';
-
-/**
- * L10-L16, the slot-driven Supabase machine. On the back end Supabase provides Auth/Storage with one owner,
- * `be.integrations.supabase`. On the front end Supabase is auth only (owner ruling 2026-10-13): `fe.modules.auth` is the one
- * importer of `@supabase/*` and calls only the auth API; data, storage, rpc and realtime go through the back end (modules/api).
- * The checks below recognise provider calls and types by their imported package declarations, not by local variable or type names.
- */
-export const FRONTEND_SUPABASE_RULE_IDS = Object.freeze(['FE_SUPABASE_CLIENT_OWNER', 'FE_SERVICE_ROLE_FORBIDDEN']);
-export const BACKEND_SUPABASE_RULE_IDS = Object.freeze(['BE_SUPABASE_CLIENT_OWNER', 'BE_SUPABASE_JWT_VERIFIED', 'BE_JWT_ALG_PINNED']);
-
-const FE_CLIENT_OWNER = 'FE_SUPABASE_CLIENT_OWNER';
-const BE_CLIENT_OWNER = 'BE_SUPABASE_CLIENT_OWNER';
-const FE_SERVICE_ROLE = 'FE_SERVICE_ROLE_FORBIDDEN';
-const BE_SUPABASE_SLOT = 'be.integrations.supabase';
-const FE_AUTH_SLOT = 'fe.modules.auth';
-/** The front-end provider slot: enabled exactly when a connection declares provider supabase. */
-const FE_SUPABASE_PROVIDER_SLOT = 'fe.route.callback';
-const FE_CONFIG_SLOT = 'fe.modules.config';
-const BE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'functions', 'channel', 'realtime', 'getChannels', 'removeChannel', 'removeAllChannels']);
-/** The members of a Supabase client that read or write data, files or channels: never called from the front end. */
-const FE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'storage', 'functions', 'realtime', 'channel', 'getChannels', 'removeChannel', 'removeAllChannels']);
-const supabaseSlotEnabled = (input, slotId) => {
-  const slot = input.graph.resolver.slot(slotId);
-  return Boolean(slot && input.graph.resolver.slotEnabled(slot));
-};
-
-const CLIENT_FACTORY = /^create(?:Client|ServerClient|BrowserClient)$/u;
-
-function inspectSupabaseImport(scope, node) {
-  const { kit, file, slots, ruleId, violations, counters } = scope;
-  const moduleName = moduleNameOf(kit.ts, node);
-  if (!moduleName || !SUPABASE_MODULES.has(moduleName)) return;
-  counters.imports += 1;
-  if (!slots.has(file.slot)) reportAt(violations, kit, ruleId, file, node, `${moduleName} is imported by ${file.rel}, whose slot is ${file.slot ?? 'unowned'}; Supabase imports belong only to ${[...slots].join(' or ')}.`, { module: moduleName, slot: file.slot ?? null });
-}
-
-function inspectClientTypeReference(scope, node) {
-  const { kit, checker, file, ruleId, violations, counters } = scope;
-  if (!kit.ts.isTypeReferenceNode(node) || !supabaseClientType(kit, checker, node)) return;
-  counters.clients += 1;
-  if (!isDatabaseType(kit.ts, node.typeArguments?.[0])) reportAt(violations, kit, ruleId, file, node, 'SupabaseClient must carry the committed Database type as SupabaseClient<Database>.');
-}
-
-function inspectClientFactoryCall(scope, node) {
-  const { kit, checker, file, ruleId, violations, counters } = scope;
-  const binding = kit.importBinding(checker, node.expression);
-  if (!binding || !SUPABASE_MODULES.has(binding.module) || !CLIENT_FACTORY.test(binding.name)) return;
-  counters.clients += 1;
-  if (!isDatabaseType(kit.ts, node.typeArguments?.[0]) && !contextTypesClient(kit, checker, node)) {
-    reportAt(violations, kit, ruleId, file, node, `${binding.name} creates an untyped Supabase client; create it as ${binding.name}<Database>(...) (or give it the contextual type SupabaseClient<Database>).`);
-  }
-}
-
-function inspectProviderCall(scope, node) {
-  const { kit, checker, file, slots, ruleId, violations, counters, reportedData } = scope;
-  const { ts } = kit;
-  const data = supabaseDataAccess(kit, checker, node, BE_DATA_MEMBERS, { storageAllowed: true });
-  if (data) {
-    if (!reportedData.has(data.node.pos)) {
-      reportedData.add(data.node.pos);
-      reportAt(violations, kit, ruleId, file, data.node, `A Supabase .${data.name} data call is made from ${file.slot ?? 'an unowned path'}; the back-end SDK is Auth/Storage only, including inside ${BE_SUPABASE_SLOT}. Data uses EntityManager as app_be.`, { member: data.name, slot: file.slot ?? null });
-    }
-    if (ts.isCallExpression(node)) counters.calls += 1;
-    return;
-  }
-  if (!isSupabaseCall(kit, checker, node)) return;
-  const properties = chainParts(ts, node);
-  const method = callName(ts, node);
-  if (!properties.includes('auth') && !properties.includes('storage')) return;
-  counters.calls += 1;
-  if (!slots.has(file.slot)) reportAt(violations, kit, ruleId, file, node, `A Supabase ${method ?? 'client'} call is made from ${file.slot ?? 'an unowned path'}; database, auth and storage calls belong only to ${[...slots].join(' or ')}.`, { method, slot: file.slot ?? null });
-}
-
-function inspectOwnershipNode(scope, node) {
-  inspectSupabaseImport(scope, node);
-  inspectClientTypeReference(scope, node);
-  const { ts } = scope.kit;
-  if (!ts.isCallExpression(node) && !ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return;
-  if (ts.isCallExpression(node)) inspectClientFactoryCall(scope, node);
-  inspectProviderCall(scope, node);
-}
-
-function checkClientOwnership(input, { slots, ruleId }) {
-  const kit = machineKit(input);
-  const violations = [];
-  const counters = { imports: 0, clients: 0, calls: 0 };
-  for (const file of input.graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    const scope = { kit, checker, file, slots, ruleId, violations, counters, reportedData: new Set() };
-    kit.walk(file.sourceFile, node => inspectOwnershipNode(scope, node));
-  }
-  return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [...slots] } };
-}
-
-const words = text => String(text).replace(/([a-z0-9])([A-Z])/gu, '$1_$2').toUpperCase();
-const serviceRoleText = text => /(?:^|[^A-Z0-9])SERVICE[_ -]?ROLE(?:[^A-Z0-9]|$)/iu.test(words(text));
-const credentialEnv = name => /(?:^|_)(?:SECRET|PRIVATE|TOKEN|PASSWORD)$/u.test(name) || /(?:^|_)SERVICE_ROLE(?:_|$)/u.test(name);
-const CORE_PUBLIC_ENV = new Set(['NEXT_PUBLIC_SUPABASE_URL', 'NEXT_PUBLIC_SUPABASE_ANON_KEY', 'NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'NEXT_PUBLIC_SITE_URL']);
-
-const envRead = (ts, node) => {
-  if (!ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return null;
-  const object = node.expression;
-  const processEnv = ts.isPropertyAccessExpression(object) && ts.isIdentifier(object.expression) && object.expression.text === 'process' && object.name.text === 'env';
-  const importMetaEnv = ts.isPropertyAccessExpression(object) && object.name.text === 'env' && object.expression.kind === ts.SyntaxKind.MetaProperty;
-  if (!processEnv && !importMetaEnv) return null;
-  if (ts.isPropertyAccessExpression(node)) return node.name.text;
-  return ts.isStringLiteralLike(node.argumentExpression) ? node.argumentExpression.text : null;
-};
-
-/** Reports a SERVICE_ROLE identifier or string literal: the browser and Next process never hold the service role. */
-function inspectServiceRoleText(ts, node, report) {
-  if (ts.isIdentifier(node) && serviceRoleText(node.text)) report(node, 'A SERVICE_ROLE identifier appears in the front end; the browser and Next process never hold the Supabase service role.', node.text);
-  if (ts.isStringLiteralLike(node) && serviceRoleText(node.text)) report(node, 'A service_role string appears in the front end; the service role belongs behind the back-end guard chain.', node.text);
-}
-
-/** Counts an environment read and reports a credential-shaped or product-specific public variable. */
-function inspectEnvironmentRead(state, file, node, name) {
-  state.reads += 1;
-  if (credentialEnv(name)) state.report(node, `${name} is a credential-shaped environment read in the front end; no *_SECRET, *_PRIVATE, *_TOKEN, *_PASSWORD or service-role value enters fe/.`, name);
-  else if (name.startsWith('NEXT_PUBLIC_') && !CORE_PUBLIC_ENV.has(name) && file.slot !== FE_CONFIG_SLOT) {
-    state.report(node, `${name} is not a core Supabase/site public variable and is read outside ${FE_CONFIG_SLOT}; product public configuration is declared by the one config owner.`, name);
-  }
-}
-
-function checkFrontendSecretNames(input) {
-  const kit = machineKit(input);
-  const { ts } = kit;
-  const violations = [];
-  const state = { reads: 0, report: null };
-  for (const file of input.graph.files.values()) {
-    const seen = new Set();
-    state.report = (node, message, name) => {
-      const key = `${node.pos}:${name ?? ''}`;
-      if (seen.has(key)) return;
-      seen.add(key);
-      reportAt(violations, kit, FE_SERVICE_ROLE, file, node, message, name ? { name } : {});
-    };
-    kit.walk(file.sourceFile, node => {
-      inspectServiceRoleText(ts, node, state.report);
-      const name = envRead(ts, node);
-      if (name) inspectEnvironmentRead(state, file, node, name);
-    });
-  }
-  return { violations, coverage: { status: 'checked', envReads: state.reads } };
-}
-
-function inspectFrontendNode(scope, node) {
-  const { kit, checker, file, violations, counters, reportedData } = scope;
-  const { ts } = kit;
-  const moduleName = moduleNameOf(ts, node);
-  if (moduleName?.startsWith('@supabase/')) {
-    counters.imports += 1;
-    if (file.slot !== FE_AUTH_SLOT) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `${moduleName} is imported by ${file.rel}, whose slot is ${file.slot ?? 'unowned'}; on the front end Supabase is auth only and ${FE_AUTH_SLOT} (modules/auth) is its one importer.`, { module: moduleName, slot: file.slot ?? null });
-    return;
-  }
-  if (!ts.isCallExpression(node) && !ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return;
-  const data = supabaseDataAccess(kit, checker, node, FE_DATA_MEMBERS);
-  if (data) {
-    if (!reportedData.has(data.node.pos)) {
-      reportedData.add(data.node.pos);
-      reportAt(violations, kit, FE_CLIENT_OWNER, file, data.node, `A Supabase .${data.name} call is made from the front end; Supabase on the front end is auth only - read and write data, files and realtime through the back end (a modules/api GraphQL operation, an SWR hook, hooks/socketio).`, { member: data.name, slot: file.slot ?? null });
-    }
-    return;
-  }
-  if (!isSupabaseCall(kit, checker, node)) return;
-  counters.calls += 1;
-  const parts = chainParts(ts, node);
-  if (file.slot !== FE_AUTH_SLOT && parts.includes('auth')) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase auth call is made from ${file.slot ?? 'an unowned path'}; the auth client is called only inside ${FE_AUTH_SLOT}, which exports the session and the access token.`, { slot: file.slot ?? null });
-}
-
-function checkFrontendClientOwner(input) {
-  const kit = machineKit(input);
-  const violations = [];
-  const counters = { imports: 0, calls: 0 };
-  for (const file of input.graph.files.values()) {
-    const scope = { kit, checker: kit.checkerOf(file.sourceFile), file, violations, counters, reportedData: new Set() };
-    kit.walk(file.sourceFile, node => inspectFrontendNode(scope, node));
-  }
-  return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [FE_AUTH_SLOT] } };
-}
-
-export function checkFrontendSupabase(input) {
-  const owner = checkFrontendClientOwner(input);
-  if (!supabaseSlotEnabled(input, FE_SUPABASE_PROVIDER_SLOT)) return {
-    violations: owner.violations,
-    coverage: { status: owner.coverage.imports || owner.coverage.calls || owner.violations.length ? 'checked' : 'not-applicable', owner: owner.coverage, reason: 'no connection declares provider supabase; SDK ownership is still checked' },
-  };
-  const secrets = checkFrontendSecretNames(input);
-  return {
-    violations: [...owner.violations, ...secrets.violations],
-    coverage: { status: 'checked', owner: owner.coverage, secrets: secrets.coverage },
-  };
-}
-
-export function checkBackendSupabase(input) {
-  const owner = checkClientOwnership(input, { slots: new Set([BE_SUPABASE_SLOT]), ruleId: BE_CLIENT_OWNER });
-  if (!supabaseSlotEnabled(input, BE_SUPABASE_SLOT)) return {
-    violations: owner.violations,
-    coverage: { status: owner.coverage.imports || owner.coverage.calls || owner.violations.length ? 'checked' : 'not-applicable', owner: owner.coverage, reason: 'the Supabase integration slot is disabled; SDK ownership is still checked' },
-  };
-  const jwt = checkBackendJwt(input);
-  const policy = checkJwtPolicy(input);
-  return {
-    violations: [...owner.violations, ...jwt.violations, ...policy.violations],
-    coverage: { status: 'checked', owner: owner.coverage, jwt: jwt.coverage, jwtPolicy: policy.coverage },
-  };
-}
-
-export function checkJwtPolicy(input) {
-  const kit = machineKit(input);
-  const violations = [];
-  let verifyCalls = 0;
-  for (const file of input.graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    kit.walk(file.sourceFile, node => {
-      if (!kit.ts.isCallExpression(node) || !kit.isImportOf(checker, node.expression, 'jwtVerify', 'jose')) return;
-      verifyCalls += 1;
-      const problems = jwtPolicyProblems(kit.ts, checker, node);
-      if (problems.length) reportAt(violations, kit, 'BE_JWT_ALG_PINNED', file, node, problems.join(' '));
-    });
-  }
-  return { violations, coverage: { status: 'checked', verifyCalls } };
-}

package/scaffold/supabase-ports.mjs

@@ -1,26 +0,0 @@
-// supabase-ports.mjs - the local Supabase ports of one lite app, derived from its project name.
-// The Supabase CLI default ports (54321-54329) belong to whichever stack starts first, so a scaffolded app never uses them: it
-// writes its own port block into supabase/config.toml, one block of ten consecutive ports per project name, so two apps (and a
-// proof run beside another stack) never contend. The same name always gets the same block.
-
-/** The first port of the block range and how many blocks it holds (41000-44999); clear of the CLI defaults (543xx) and of the Next dev port. */
-const RANGE_START = 41000;
-const BLOCK_SIZE = 10;
-const BLOCK_COUNT = 400;
-/** The offsets inside one block, by config.toml section. */
-const OFFSETS = Object.freeze({ shadow: 0, api: 1, db: 2, studio: 3, inbucket: 4, analytics: 7, pooler: 9 });
-
-/** The template variables of the port block: `supabasePort<Name>` for every section above. */
-export const SUPABASE_PORT_VARIABLES = Object.freeze(Object.keys(OFFSETS).map((key) => `supabasePort${key[0].toUpperCase()}${key.slice(1)}`));
-
-/** FNV-1a over the project name: stable, dependency-free. */
-const hash = (text) => [...text].reduce((value, char) => Math.imul(value ^ char.charCodeAt(0), 16777619) >>> 0, 2166136261);
-
-/** The first port of the project's block. */
-const supabasePortBase = (project) => RANGE_START + (hash(String(project)) % BLOCK_COUNT) * BLOCK_SIZE;
-
-/** { supabasePortApi: '41231', ... }: the variables a skeleton file fills. */
-export function supabasePortVars(project) {
-  const base = supabasePortBase(project);
-  return Object.fromEntries(Object.entries(OFFSETS).map(([key, offset]) => [`supabasePort${key[0].toUpperCase()}${key.slice(1)}`, String(base + offset)]));
-}

package/templates/app/package-scripts/supabase.json

@@ -1,7 +0,0 @@
-    "db:start": "supabase start",
-    "db:stop": "supabase stop",
-    "db:reset": "supabase db reset",
-    "db:new": "supabase migration new",
-    "db:push": "supabase db push",
-    "db:types": "npm run contract:emit",
-    "db:lint": "{{appBinary}} check --fast",

package/templates/app/skeleton-lite/supabase/config.toml

@@ -1,48 +0,0 @@
-project_id = "{{project}}"
-
-[api]
-enabled = true
-port = {{supabasePortApi}}
-schemas = []
-extra_search_path = ["public", "extensions"]
-max_rows = 1000
-
-[db]
-port = {{supabasePortDb}}
-shadow_port = {{supabasePortShadow}}
-major_version = 17
-
-[db.pooler]
-enabled = false
-port = {{supabasePortPooler}}
-
-[studio]
-port = {{supabasePortStudio}}
-
-[inbucket]
-port = {{supabasePortInbucket}}
-
-[analytics]
-port = {{supabasePortAnalytics}}
-
-[edge_runtime]
-enabled = false
-
-[storage]
-enabled = true
-file_size_limit = "50MiB"
-
-[auth]
-enabled = true
-site_url = "http://127.0.0.1:3000"
-additional_redirect_urls = ["http://127.0.0.1:3000/"]
-enable_signup = false
-jwt_expiry = 3600
-
-[auth.email]
-enable_signup = false
-
-[auth.external.google]
-enabled = false
-client_id = "env(SUPABASE_AUTH_GOOGLE_CLIENT_ID)"
-secret = "env(SUPABASE_AUTH_GOOGLE_SECRET)"

package/templates/be/inbox/platform/event-bus/persistence/event-bus.sql.ts.tpl

@@ -1,5 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Writes only the typed envelope; a reactor or job reads the committed row afterward. */
-export const INSERT_OUTBOX_EVENT = sql`INSERT INTO public.event_bus (event_id, event_name, payload, correlation_id)
-VALUES ($1, $2, $3::jsonb, $4)`

package/templates/be/inbox/platform/inbox/persistence/inbox.rows.ts.tpl

@@ -1,33 +0,0 @@
-/** The JSON envelope makes a completed null value distinct from a pending SQL-null outcome. */
-export interface ClientOutcomeRow<T> {
-    /** The operation's complete JSON result, including expected refusals. */
-    readonly value: T
-}
-
-/** The row returned by the atomic client claim. */
-export interface ClaimClientRow<T> {
-    /** The digest recorded by the first operation under this scoped key. */
-    readonly request_fingerprint: string | null
-    /** The saved result, or null only for a claim inserted by this transaction. */
-    readonly outcome: ClientOutcomeRow<T> | null
-    /** An existing row had no completed outcome, so it must never run an effect again. */
-    readonly incomplete: boolean
-}
-
-/** The persisted outcome returned to the first caller. */
-export interface SavedClientOutcomeRow<T> {
-    /** The normalized JSON result as the database stores it. */
-    readonly outcome: ClientOutcomeRow<T>
-}
-
-/** A claimed or deleted delivery key returned by inbox persistence. */
-export interface InboxEventRow {
-    /** The event or client key owned by the row. */
-    readonly event_id: string
-}
-
-/** The bounded retention batch's aggregate result. */
-export interface InboxSweepRow {
-    /** Number of completed client claims removed by this transaction. */
-    readonly deleted_count: number
-}

package/templates/be/inbox/platform/inbox/persistence/inbox.sql.ts.tpl

@@ -1,33 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** The unique source and delivery id let only one transaction record or process each delivery. */
-export const CLAIM_EVENT = sql`INSERT INTO public.inbox (source, event_id)
-VALUES ($1, $2)
-ON CONFLICT (source, event_id) DO NOTHING
-RETURNING event_id`
-
-/** A conflicting insert locks the existing row and returns its committed fingerprint and outcome after the winner commits. */
-export const CLAIM_CLIENT = sql`INSERT INTO public.inbox (source, event_id, request_fingerprint, claimed_at)
-VALUES ($1, $2, $3, $4)
-ON CONFLICT (source, event_id) DO UPDATE SET outcome = COALESCE(inbox.outcome, '{}'::jsonb)
-RETURNING request_fingerprint, outcome, (outcome IS NOT NULL AND (jsonb_typeof(outcome) <> 'object' OR NOT (outcome ? 'value'))) AS incomplete`
-
-/** The JSON envelope distinguishes a completed null result from an uncompleted claim in this transaction. */
-export const SAVE_CLIENT_OUTCOME = sql`WITH saved AS (
-    UPDATE public.inbox SET outcome = $3::jsonb
-    WHERE source = $1 AND event_id = $2
-    RETURNING outcome
-)
-SELECT outcome FROM saved LIMIT 1`
-
-/** Retention never deletes delivery rows or an incomplete claim; its bounded batch skips rows held by active retries. */
-export const SWEEP_CLIENTS = sql`WITH expired AS (
-    SELECT source, event_id FROM public.inbox
-    WHERE source LIKE 'client:%' AND request_fingerprint IS NOT NULL AND outcome IS NOT NULL AND jsonb_typeof(outcome) = 'object' AND outcome ? 'value' AND claimed_at < $1
-    ORDER BY claimed_at, source, event_id LIMIT $2 FOR UPDATE SKIP LOCKED
-), deleted AS (
-DELETE FROM public.inbox AS claims USING expired
-WHERE claims.source = expired.source AND claims.event_id = expired.event_id
-RETURNING claims.event_id
-)
-SELECT count(*)::int AS deleted_count FROM deleted`

package/templates/be/inbox/sql.ts.tpl

@@ -1,16 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Records one pending @@provider@@ delivery and returns its durable inbox identity only to the winning transaction. */
-export const INSERT_@@providerUpper@@_INBOX = sql`INSERT INTO public.@@table@@ (provider, delivery_id, payload)
-VALUES ($1, $2, $3::jsonb)
-ON CONFLICT (provider, delivery_id) DO NOTHING
-RETURNING id`
-
-/** The reactor or job marks a recorded delivery complete in the transaction that applies its effect. Never called by the intake. */
-export const COMPLETE_@@providerUpper@@_INBOX = sql`WITH completed AS (
-    UPDATE public.@@table@@
-    SET processed_at = now()
-    WHERE id = $1
-    RETURNING id
-)
-SELECT id FROM completed`

package/templates/be/patterns/jobs/platform-lite/persistence.jobs.sql.ts.tpl

@@ -1,33 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/**
- * Claims a delivery in one statement ($1 kind, $2 job key, $3 worker, $4 lease end, $5 payload, $6 instant). A new key inserts the row
- * with token 1; an existing key is claimed again only when the job failed or its lease expired, and then the token is bumped by the
- * store. A done job and a live claim match nothing, so no row comes back.
- */
-export const CLAIM_JOB = sql`INSERT INTO public.jobs (kind, job_key, status, fencing_token, claimed_by, lease_expires_at, payload, created_at, updated_at)
-    VALUES ($1, $2, 'running', 1, $3, $4, $5::jsonb, $6, $6)
-    ON CONFLICT (job_key) DO UPDATE
-       SET fencing_token = jobs.fencing_token + 1, claimed_by = $3, lease_expires_at = $4, status = 'running', error = NULL, updated_at = $6
-     WHERE jobs.status = 'failed' OR (jobs.status = 'running' AND jobs.lease_expires_at < $6)
-    RETURNING id, kind, fencing_token, current_step, payload`
-
-/** The guarded writes wrap their UPDATE in a CTE: TypeORM returns a bare `UPDATE ... RETURNING` as `[rows, count]`, a SELECT as rows. */
-
-/** Records a step ($1 job id, $2 expected token, $3 step, $4 instant); no row comes back when the token is stale. */
-export const ADVANCE_JOB = sql`WITH changed AS (UPDATE public.jobs SET current_step = $3, updated_at = $4
-    WHERE id = $1 AND fencing_token = $2 AND status = 'running'
-       RETURNING id)
-    SELECT id FROM changed`
-
-/** Completes the job ($1 job id, $2 expected token, $3 instant). */
-export const COMPLETE_JOB = sql`WITH changed AS (UPDATE public.jobs SET status = 'done', lease_expires_at = NULL, updated_at = $3
-    WHERE id = $1 AND fencing_token = $2 AND status = 'running'
-       RETURNING id)
-    SELECT id FROM changed`
-
-/** Fails the job ($1 job id, $2 expected token, $3 reason, $4 instant). */
-export const FAIL_JOB = sql`WITH changed AS (UPDATE public.jobs SET status = 'failed', error = $3, lease_expires_at = NULL, updated_at = $4
-    WHERE id = $1 AND fencing_token = $2 AND status = 'running'
-       RETURNING id)
-    SELECT id FROM changed`

package/templates/be/patterns/queues/platform-lite/persistence.queue.sql.ts.tpl

@@ -1,12 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Writes one job in the outbox ($1 queue, $2 payload, $3 instant, $4 correlation id); the relay hands it to BullMQ after the commit. */
-export const INSERT_QUEUE_ROW = sql`INSERT INTO public.queue (queue, payload, created_at, correlation_id)
-    VALUES ($1, $2::jsonb, $3, $4)`
-
-/** Locks and reads the oldest rows that wait ($1 batch size); a second relay skips the rows this one holds. */
-export const SELECT_WAITING_ROWS = sql`SELECT id, queue, payload, coalesce(correlation_id, id::text) AS "correlationId" FROM public.queue
-    WHERE sent_at IS NULL ORDER BY created_at, id LIMIT $1 FOR UPDATE SKIP LOCKED`
-
-/** Marks the rows as handed to BullMQ ($1 ids, $2 instant). */
-export const MARK_ROWS_SENT = sql`UPDATE public.queue SET sent_at = $2 WHERE id = ANY($1::uuid[])`

package/templates/be/skeleton-lite/src/modules/integrations/supabase/errors/supabase.error.ts

@@ -1,16 +0,0 @@
-import { DomainError } from "@modules/platform/errors"
-import type { ErrorKind } from "@modules/platform/errors"
-
-/** Codes of the Supabase integration. */
-export enum SupabaseErrorCode {
-    /** The access token failed signature or required-claim verification. */
-    AccessTokenInvalid = "SUPABASE_ACCESS_TOKEN_INVALID",
-}
-
-/** How each Supabase integration code travels. */
-export const SUPABASE_ERROR_KINDS: Record<SupabaseErrorCode, ErrorKind> = {
-    [SupabaseErrorCode.AccessTokenInvalid]: "unauthenticated",
-}
-
-/** The one error class of the Supabase integration. */
-export class SupabaseError extends DomainError<SupabaseErrorCode> {}

package/templates/be/skeleton-lite/src/modules/integrations/supabase/index.ts

@@ -1,6 +0,0 @@
-export { createSupabaseAdminClient } from "./supabase.client"
-export { parseSupabaseConfig } from "./supabase.config"
-export { SUPABASE_ACCESS_TOKEN_VERIFIER, SUPABASE_ADMIN_CLIENT } from "./supabase.decorators"
-export { SUPABASE_ERROR_KINDS, SupabaseErrorCode } from "./errors/supabase.error"
-export { createSupabaseAccessTokenVerifier } from "./supabase.jwks"
-export type { SupabaseOptions, VerifySupabaseAccessToken } from "./supabase.options"

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.client.spec.ts

@@ -1,27 +0,0 @@
-import { Test } from "@nestjs/testing"
-import { Secret } from "@modules/platform/config"
-import { createSupabaseAdminClient } from "./supabase.client"
-import type { SupabaseAdminClient } from "./supabase.client"
-import { SUPABASE_ADMIN_CLIENT } from "./supabase.decorators"
-
-describe("createSupabaseAdminClient", () => {
-    it("exposes only the Auth administration and Storage surfaces of a session-less service client", async () => {
-        const moduleRef = await Test.createTestingModule({
-            providers: [
-                {
-                    provide: SUPABASE_ADMIN_CLIENT,
-                    useFactory: () =>
-                        createSupabaseAdminClient({
-                            url: "http://127.0.0.1:54321",
-                            serviceRoleKey: new Secret("service-role"),
-                        }),
-                },
-            ],
-        }).compile()
-        const client = moduleRef.get<SupabaseAdminClient>(SUPABASE_ADMIN_CLIENT)
-
-        expect(Object.keys(client).sort()).toEqual(["auth", "storage"])
-        expect(typeof client.auth.createUser).toBe("function")
-        expect(typeof client.storage.from).toBe("function")
-    })
-})

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.client.ts

@@ -1,24 +0,0 @@
-import { createClient } from "@supabase/supabase-js"
-import type { SupabaseClient } from "@supabase/supabase-js"
-import type { Database } from "../../../../../supabase/types/database.types"
-import type { SupabaseOptions } from "./supabase.options"
-
-/** The privileged surface exposed by this integration: Auth administration and Storage, never database queries. */
-export interface SupabaseAdminClient {
-    /** Supabase Auth administration. */
-    readonly auth: SupabaseClient<Database>["auth"]["admin"]
-    /** Supabase Storage administration. */
-    readonly storage: SupabaseClient<Database>["storage"]
-}
-
-/** Creates the back-end-only client and narrows it to Auth and Storage administration. */
-export const createSupabaseAdminClient = (options: SupabaseOptions): SupabaseAdminClient => {
-    const client: SupabaseClient<Database> = createClient<Database>(options.url, options.serviceRoleKey.reveal(), {
-        auth: {
-            autoRefreshToken: false,
-            detectSessionInUrl: false,
-            persistSession: false,
-        },
-    })
-    return { auth: client.auth.admin, storage: client.storage }
-}