@starci/hfs 4.9.11 → 4.10.1

package/runtime/scripts/hfs/architecture/{supabase-be.mjs → identity.mjs}

@@ -1,12 +1,17 @@
-// supabase-be.mjs - the back-end half of the slot-driven Supabase architecture machine: a single integration owns
-// JWT verification, pins the remote JWKS/issuer/audience/algorithms, and never trusts authorization claims from a body.
+// identity.mjs - the back-end identity machine. Under lite the one token verifier is be.integrations.passport: jose's jwtVerify
+// there checks the app's OWN key set (createLocalJWKSet over the keys it signs with, never createRemoteJWKSet), pins issuer,
+// audience and algorithms, and no file decodes a token unverified or reads authorization claims from a request body (R329).
+// In both editions every jwtVerify call holds the JWT policy (R260, jwtPolicyProblems).
 import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
-import { importedFrom, reportAt, unwrap } from './supabase-ast.mjs';
+import { importedFrom, jwtPolicyProblems, reportAt, unwrap } from './jwt-ast.mjs';
 import { accessName } from '../../lib/ts-ast.mjs';
 
-const BE_SUPABASE_SLOT = 'be.integrations.supabase';
-const BE_JWT_VERIFIED = 'BE_SUPABASE_JWT_VERIFIED';
+const PASSPORT_SLOT = 'be.integrations.passport';
+const BE_JWT_VERIFIED = 'BE_AUTH_JWT_OWN_JWKS';
+
+/** The rule ids the back-end identity machine reports. */
+export const IDENTITY_RULE_IDS = Object.freeze(['BE_AUTH_JWT_OWN_JWKS', 'BE_JWT_ALG_PINNED']);
 const JWT_MODULES = new Set(['jose', 'jsonwebtoken', 'jwt-decode']);
 const CLAIM_NAMES = new Set(['role', 'roles', 'membership', 'memberships']);
 
@@ -33,7 +38,7 @@ const staticStrings = (kit, checker, node) => {
 
 const jwksArgument = (kit, checker, node) => {
   const current = unwrap(kit.ts, node);
-  if (kit.ts.isCallExpression(current)) return importedFrom(kit, checker, current.expression, new Set(['jose']), new Set(['createRemoteJWKSet']));
+  if (kit.ts.isCallExpression(current)) return importedFrom(kit, checker, current.expression, new Set(['jose']), new Set(['createLocalJWKSet']));
   if (!kit.ts.isIdentifier(current)) return false;
   return kit.declarationsOf(checker, current).some((declaration) => kit.ts.isVariableDeclaration(declaration) && declaration.initializer
     && jwksArgument(kit, checker, declaration.initializer));
@@ -69,8 +74,8 @@ const fromRequestBody = (kit, checker, node, seen = new Set()) => {
 
 function verifyJwtCall(kit, checker, file, node, counters, violations) {
   counters.verifyCalls += 1;
-  if (file.slot !== BE_SUPABASE_SLOT) {
-    reportAt(violations, kit, BE_JWT_VERIFIED, file, node, `jwtVerify is called outside ${BE_SUPABASE_SLOT}; the integration is the one token verifier.`);
+  if (file.slot !== PASSPORT_SLOT) {
+    reportAt(violations, kit, BE_JWT_VERIFIED, file, node, `jwtVerify is called outside ${PASSPORT_SLOT}; the integration is the one token verifier.`);
     return true;
   }
   const options = objectLiteral(kit, checker, node.arguments[2]);
@@ -82,10 +87,10 @@ function verifyJwtCall(kit, checker, file, node, counters, violations) {
   const issuer = property('issuer');
   const audience = values('audience');
   const algorithms = values('algorithms');
-  const good = jwksArgument(kit, checker, node.arguments[1]) && issuer != null && audience?.includes('authenticated')
+  const good = jwksArgument(kit, checker, node.arguments[1]) && issuer != null && audience !== null && audience.length > 0
     && algorithms !== null && algorithms.length > 0;
   if (!good) {
-    reportAt(violations, kit, BE_JWT_VERIFIED, file, node, 'Supabase jwtVerify must use createRemoteJWKSet(...) and pin issuer, audience `authenticated`, and a non-empty algorithms list; jwtVerify then enforces signature and exp.');
+    reportAt(violations, kit, BE_JWT_VERIFIED, file, node, 'jwtVerify must check the app\'s own key set (createLocalJWKSet(...) over the keys integrations/passport signs with) and pin issuer, audience and a non-empty algorithms list; jwtVerify then enforces signature and exp.');
   } else counters.verifiedCalls += 1;
   return false;
 }
@@ -93,7 +98,7 @@ function verifyJwtCall(kit, checker, file, node, counters, violations) {
 function inspectJwtCall(kit, checker, file, node, counters, violations) {
   const binding = importedCall(kit, checker, node);
   if (binding && JWT_MODULES.has(binding.module) && ['decode', 'decodeJwt', 'jwtDecode'].includes(binding.name)) {
-    reportAt(violations, kit, BE_JWT_VERIFIED, file, node, `${binding.module}.${binding.name} decodes a token without proving its signature; use the Supabase JWKS verifier.`, { module: binding.module, method: binding.name });
+    reportAt(violations, kit, BE_JWT_VERIFIED, file, node, `${binding.module}.${binding.name} decodes a token without proving its signature; verify it through integrations/passport.`, { module: binding.module, method: binding.name });
   }
   if (binding?.module === 'jose' && binding.name === 'jwtVerify') return verifyJwtCall(kit, checker, file, node, counters, violations);
   return false;
@@ -118,10 +123,10 @@ function inspectBackendNode(kit, checker, file, node, counters, violations) {
   if (!handled) inspectRequestClaims(kit, file, node, checker, violations);
 }
 
-export function checkBackendJwt(input) {
+function checkOwnJwks(input) {
   const kit = machineKit(input);
   const violations = [];
-  const integrations = [...input.graph.files.values()].filter((file) => file.slot === BE_SUPABASE_SLOT);
+  const integrations = [...input.graph.files.values()].filter((file) => file.slot === PASSPORT_SLOT);
   if (!integrations.length) return { violations, coverage: { status: 'not-applicable', integrationFiles: 0, verifiedCalls: 0 } };
   const counters = { verifyCalls: 0, verifiedCalls: 0 };
   for (const file of input.graph.files.values()) {
@@ -129,8 +134,33 @@ export function checkBackendJwt(input) {
     kit.walk(file.sourceFile, node => inspectBackendNode(kit, checker, file, node, counters, violations));
   }
   if (counters.verifyCalls === 0) {
-    const anchor = integrations.find((file) => path.posix.basename(file.rel).endsWith('.jwks.ts')) ?? integrations[0];
-    reportAt(violations, kit, BE_JWT_VERIFIED, anchor, anchor.sourceFile, `${BE_SUPABASE_SLOT} has no jose.jwtVerify call backed by createRemoteJWKSet.`);
+    const anchor = integrations.find((file) => path.posix.basename(file.rel).endsWith('.tokens.ts')) ?? integrations[0];
+    reportAt(violations, kit, BE_JWT_VERIFIED, anchor, anchor.sourceFile, `${PASSPORT_SLOT} has no jose.jwtVerify call backed by createLocalJWKSet over the app's own keys.`);
   }
   return { violations, coverage: { status: 'checked', integrationFiles: integrations.length, verifyCalls: counters.verifyCalls, verifiedCalls: counters.verifiedCalls } };
 }
+
+/** R260 BE_JWT_ALG_PINNED: every jose jwtVerify call pins a literal secure algorithm list, a configured issuer and the authenticated role. */
+export function checkJwtPolicy(input) {
+  const kit = machineKit(input);
+  const violations = [];
+  let verifyCalls = 0;
+  for (const file of input.graph.files.values()) {
+    const checker = kit.checkerOf(file.sourceFile);
+    kit.walk(file.sourceFile, node => {
+      if (!kit.ts.isCallExpression(node) || !kit.isImportOf(checker, node.expression, 'jwtVerify', 'jose')) return;
+      verifyCalls += 1;
+      const problems = jwtPolicyProblems(kit.ts, checker, node);
+      if (problems.length) reportAt(violations, kit, 'BE_JWT_ALG_PINNED', file, node, problems.join(' '));
+    });
+  }
+  return { violations, coverage: { status: 'checked', verifyCalls } };
+}
+
+/** The back-end identity machine: the own-JWKS law where the passport integration exists (lite), the JWT policy everywhere. */
+export function checkBackendIdentity(input) {
+  const slot = input.graph.resolver.slot(PASSPORT_SLOT);
+  const own = slot && input.graph.resolver.slotEnabled(slot) ? checkOwnJwks(input) : { violations: [], coverage: { status: 'not-applicable', reason: 'no passport integration slot (full edition)' } };
+  const policy = checkJwtPolicy(input);
+  return { violations: [...own.violations, ...policy.violations], coverage: { status: 'checked', ownJwks: own.coverage, jwtPolicy: policy.coverage } };
+}

package/runtime/scripts/hfs/architecture/index.mjs

@@ -48,7 +48,7 @@ import { checkPackageShape, PACKAGE_SHAPE_RULE_IDS } from './package-shape.mjs';
 import { checkFeSlotAllows, FE_SLOT_ALLOWS_RULE_IDS } from './fe-slot-allows.mjs';
 import { checkI18nKeys, I18N_KEYS_RULE_IDS } from './i18n-keys.mjs';
 import { checkDocLanguage, DOC_LANGUAGE_RULE_IDS } from './doc-language.mjs';
-import { checkBackendSupabase, checkFrontendSupabase, BACKEND_SUPABASE_RULE_IDS, FRONTEND_SUPABASE_RULE_IDS } from './supabase.mjs';
+import { checkBackendIdentity, IDENTITY_RULE_IDS } from './identity.mjs';
 import { checkServerActions, SERVER_ACTION_RULE_IDS } from './server-action.mjs';
 import { LINT_CODES, onLintSurface } from './surface.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
@@ -86,7 +86,7 @@ const BACKEND_MACHINE = {
   backgroundUnowned: [checkBackgroundUnowned, BACKGROUND_UNOWNED_RULE_IDS],
   testWorldFiles: [checkTestWorldFiles, TEST_WORLD_FILES_RULE_IDS],
   contractFixtureGuard: [checkContractFixtureGuard, CONTRACT_FIXTURE_GUARD_RULE_IDS],
-  supabaseBackend: [checkBackendSupabase, BACKEND_SUPABASE_RULE_IDS],
+  identity: [checkBackendIdentity, IDENTITY_RULE_IDS],
 };
 
 // The frontend repository machine (R21, R50, R54, R55, R56, R63, R94, R106): same shape, run for a front-end repository only.
@@ -99,7 +99,6 @@ const FRONTEND_MACHINE = {
   crossAppDuplicate: [checkCrossAppDuplicate, CROSS_APP_DUPLICATE_RULE_IDS],
   feSlotAllows: [checkFeSlotAllows, FE_SLOT_ALLOWS_RULE_IDS],
   i18nKeys: [checkI18nKeys, I18N_KEYS_RULE_IDS],
-  supabaseFrontend: [checkFrontendSupabase, FRONTEND_SUPABASE_RULE_IDS],
   serverActions: [checkServerActions, SERVER_ACTION_RULE_IDS],
 };
 

package/runtime/scripts/hfs/architecture/{supabase-ast.mjs → jwt-ast.mjs}

@@ -1,11 +1,9 @@
-// supabase-ast.mjs - shared TypeScript-symbol and expression helpers for the front-end and back-end Supabase
-// architecture checks. Recognition follows imported declarations and inferred types, never local spelling alone.
+// jwt-ast.mjs - shared TypeScript-symbol and expression helpers of the identity checks (token verification and the principal).
+// Recognition follows imported declarations and inferred types, never local spelling alone.
 import { unwrapExpression } from '../../lib/ts-analysis.mjs';
 import { accessName as memberName, hasAnyFlag } from '../../lib/ts-ast.mjs';
 export { accessName as memberName } from '../../lib/ts-ast.mjs';
 
-export const SUPABASE_MODULES = Object.freeze({ has: name => typeof name === 'string' && name.startsWith('@supabase/') });
-
 export const moduleNameOf = (ts, node) => {
   if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) return node.moduleSpecifier.text;
   if (!ts.isCallExpression(node)) return null;
@@ -19,39 +17,8 @@ export const importedFrom = (kit, checker, node, modules, names = null) => {
   return Boolean(binding && modules.has(binding.module) && (names === null || names.has(binding.name)));
 };
 
-const declarationFromSupabase = (declaration) => /(?:^|\/)node_modules\/@supabase\/[^/]+(?:\/|$)/u
-  .test(String(declaration?.getSourceFile?.().fileName ?? '').replaceAll('\\', '/'));
-
-const typeFromSupabase = (checker, node) => {
-  let type;
-  try { type = checker.getTypeAtLocation(node); } catch { return false; }
-  const queue = [type];
-  const seen = new Set();
-  while (queue.length) {
-    const item = queue.shift();
-    if (!item || seen.has(item)) continue;
-    seen.add(item);
-    if ([item.symbol, item.aliasSymbol].some((symbol) => symbol?.declarations?.some(declarationFromSupabase))) return true;
-    if (item.types) queue.push(...item.types);
-    if (item.target && item.target !== item) queue.push(item.target);
-  }
-  return false;
-};
-
-const signatureFromSupabase = (checker, call) => {
-  try { return declarationFromSupabase(checker.getResolvedSignature(call)?.declaration); } catch { return false; }
-};
-
 export const unwrap = (ts, node) => unwrapExpression(ts, node, { awaitExpressions: true, satisfiesExpressions: false });
 
-const isSupabaseValue = (kit, checker, node) => {
-  const current = unwrap(kit.ts, node);
-  if (!current) return false;
-  if (importedFrom(kit, checker, current, SUPABASE_MODULES)) return true;
-  if (kit.ts.isCallExpression(current) && signatureFromSupabase(checker, current)) return true;
-  return typeFromSupabase(checker, current);
-};
-
 export const callName = (ts, call) => ts.isCallExpression(call) ? memberName(ts, call.expression) : null;
 
 export const chainParts = (ts, expression) => {
@@ -73,74 +40,6 @@ export const chainParts = (ts, expression) => {
   return names;
 };
 
-export const isSupabaseCall = (kit, checker, node) => kit.ts.isCallExpression(node)
-  && (signatureFromSupabase(checker, node) || isSupabaseValue(kit, checker,
-    kit.ts.isPropertyAccessExpression(node.expression) || kit.ts.isElementAccessExpression(node.expression) ? node.expression.expression : node.expression));
-
-const authStorageValue = (kit, checker, expression, seen = new Set()) => {
-  const current = unwrap(kit.ts, expression);
-  if (!current || seen.has(current)) return false;
-  seen.add(current);
-  if (['auth', 'storage'].includes(memberName(kit.ts, current)) && isSupabaseValue(kit, checker, current.expression)) return true;
-  if (checker.getTypeAtLocation(current).symbol?.declarations?.some(declaration =>
-    /\/node_modules\/@supabase\/(?:storage-js|auth-js)\//u.test(String(declaration.getSourceFile().fileName).replaceAll('\\', '/')))) return true;
-  if (!kit.ts.isIdentifier(current)) return false;
-  return kit.declarationsOf(checker, current).some(declaration =>
-    (kit.ts.isVariableDeclaration(declaration) || kit.ts.isPropertyDeclaration(declaration)) && declaration.initializer
-    && authStorageValue(kit, checker, declaration.initializer, seen));
-};
-
-const chainAccesses = (ts, node) => {
-  const accesses = [];
-  let current = unwrap(ts, node);
-  while (current) {
-    if (ts.isCallExpression(current)) current = unwrap(ts, current.expression);
-    else if (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
-      accesses.unshift(current);
-      current = unwrap(ts, current.expression);
-    } else break;
-  }
-  return accesses;
-};
-
-/** The first forbidden SDK access in a call chain, anchored once even when more methods follow it. */
-export const supabaseDataAccess = (kit, checker, node, members, { storageAllowed = false } = {}) => {
-  for (const access of chainAccesses(kit.ts, node)) {
-    const name = memberName(kit.ts, access);
-    if (storageAllowed && (name === 'storage' || name === 'auth')) return null;
-    if (members.has(name) && isSupabaseValue(kit, checker, access.expression)) {
-      if (storageAllowed && authStorageValue(kit, checker, access.expression)) return null;
-      return { name, node: access };
-    }
-  }
-  return null;
-};
-
-export const isDatabaseType = (ts, node) => {
-  if (!node) return false;
-  if (ts.isTypeReferenceNode(node)) {
-    const name = ts.isIdentifier(node.typeName) ? node.typeName.text : node.typeName.right.text;
-    return name === 'Database';
-  }
-  return false;
-};
-
-export const supabaseClientType = (kit, checker, node) => {
-  if (!node || !kit.ts.isTypeReferenceNode(node)) return false;
-  const name = kit.ts.isIdentifier(node.typeName) ? node.typeName : null;
-  return Boolean(name && importedFrom(kit, checker, name, SUPABASE_MODULES, new Set(['SupabaseClient'])));
-};
-
-export const contextTypesClient = (kit, checker, call) => {
-  let parent = call.parent;
-  while (parent && (kit.ts.isParenthesizedExpression(parent) || kit.ts.isAsExpression(parent))) {
-    if (kit.ts.isAsExpression(parent) && supabaseClientType(kit, checker, parent.type) && isDatabaseType(kit.ts, parent.type.typeArguments?.[0])) return true;
-    parent = parent.parent;
-  }
-  return kit.ts.isVariableDeclaration(parent) && supabaseClientType(kit, checker, parent.type)
-    && isDatabaseType(kit.ts, parent.type.typeArguments?.[0]);
-};
-
 export const reportAt = (violations, kit, ruleId, file, node, message, extra = {}) => {
   violations.push({ ruleId, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
 };

package/runtime/scripts/hfs/architecture/owners.mjs

@@ -4,6 +4,7 @@ import { relativePath, workspaceExportSources } from './typescript.mjs';
 import { sourceLocation } from '../../lib/ts-ast.mjs';
 import { globExpression } from '../../lib/glob.mjs';
 import { posixPath } from '../../lib/path-key.mjs';
+import { registryImporter, registrySlot } from './entity-registry.mjs';
 
 function absolute(root, relative) {
   return canonical(path.resolve(root, ...relative.split('/')));
@@ -68,6 +69,15 @@ function arrangesSchema(config, from, to) {
     && resolver.classifyPath(relativePath(config.root, to)).slot === 'be.persistence';
 }
 
+/**
+ * The entity registry (slot role entity-registry, entity-registry.mjs) is imported by deep path, and only from the files its slot's
+ * `importedBy` names: app composition and the test world. Any other importer goes through the owner's entry, which never exports it.
+ */
+function importsRegistry(config, from, to) {
+  const slot = registrySlot(config.hfs, relativePath(config.root, to));
+  return slot !== null && registryImporter(config.hfs, slot, relativePath(config.root, from));
+}
+
 function publicEntryViolations(config, context, owners, sourceFiles) {
   const violations = [];
   for (const owner of owners) {
@@ -104,6 +114,7 @@ function ownerImportViolations(config, context, owners) {
       const bypass = privateOwnerChain(context, owners, edge);
       if (!bypass) continue;
       if (arrangesSchema(config, from, bypass.chain.at(-1))) continue;
+      if (bypass.chain.length === 2 && importsRegistry(config, from, bypass.chain.at(-1))) continue;
       violations.push({
         ruleId: 'ARCH_OWNER_EXPORT_BYPASS',
         path: relativePath(config.root, from),

package/runtime/scripts/hfs/architecture/register-once.mjs

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import { isComposeGroup, machineKit } from './machine-ast.mjs';
-import { callName } from './supabase-ast.mjs';
+import { callName } from './jwt-ast.mjs';
 import { isTestWorldSlot } from '../test-world-slot.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 

package/runtime/scripts/hfs/architecture/schema-owner.mjs

@@ -20,6 +20,11 @@ import { byCodeUnit } from '../../lib/list.mjs';
  *     (`<c>` the camelCase capability name), and no other name coming from `persistence/`;
  *   - a migration file is `<epochMs13>-<kebab-name>.ts`, holds a class `<Pascal><epochMs13>` and a `name` property equal to
  *     that class name, and has no unit spec beside it.
+ *
+ * Lite (persistence.md BE-PERSISTENCE-3, ruling lite-persistence-typeorm-entities) has entities and no be migration: the
+ * capability's `persistence/entities/index.ts` declares `<c>Entities`, its `index.ts` exports that one persistence name, and
+ * `platform/database/entities.ts` names it in `PRIMARY_ENTITIES`, the one list the app composition registers; there is a
+ * single primary connection, so the per-connection checks do not apply.
  */
 export const SCHEMA_OWNER_RULE_IDS = ['BE_SCHEMA_OWNER'];
 
@@ -27,6 +32,8 @@ const RULE = 'BE_SCHEMA_OWNER';
 const PERSISTENCE_SLOT = 'be.persistence';
 const SCHEMA_FOLDERS = new Set(['entities', 'migrations']);
 const MIGRATION_FILE = /^(\d{13})-([a-z0-9]+(?:-[a-z0-9]+)*)\.ts$/u;
+/** The lite entity list every capability's `<c>Entities` is named in (BE-PERSISTENCE-3). */
+const LITE_ENTITY_LIST = `${DATABASE_DIR}/entities.ts`;
 const camel = name => { const text = pascal(name); return text[0].toLowerCase() + text.slice(1); };
 
 function noteSchemaOwner(found, persistence, kind) {
@@ -127,6 +134,22 @@ function reportRegistrationSites(registered, connections, resolver, report) {
   }
 }
 
+/** The identifiers a file of the graph declares or names, for the lite list checks. */
+function identifiersOf(ts, file) {
+  const names = new Set();
+  const visit = node => { if (ts.isIdentifier(node)) names.add(node.text); ts.forEachChild(node, visit); };
+  if (file) visit(file.sourceFile);
+  return names;
+}
+
+function reportLiteEntityArrays(key, kinds, graph, ts, plain) {
+  const wanted = `${camel(kinds.name)}Entities`;
+  const listFile = `${key}/persistence/entities/index.ts`;
+  const declared = new Set((graph.files.get(listFile)?.sourceFile.statements.filter(ts.isVariableStatement).flatMap(statement => statement.declarationList.declarations) ?? []).map(item => item.name.text));
+  if (!declared.has(wanted)) plain(listFile, `${listFile} must export ${wanted}, the entities of the ${kinds.name} capability, the one file that lists them.`, { capability: kinds.name });
+  if (!identifiersOf(ts, graph.files.get(LITE_ENTITY_LIST)).has(wanted)) plain(LITE_ENTITY_LIST, `The ${kinds.name} capability has entities but ${LITE_ENTITY_LIST} does not name ${wanted} in PRIMARY_ENTITIES; list it there by name, the one list the app composition registers.`, { capability: kinds.name });
+}
+
 function reportDeclaredPersistenceArrays(key, kinds, registered, graph, ts, plain) {
   if (!registered.get(key)?.connections.size) plain(`${key}/persistence/connection.ts`, `The ${kinds.name} capability has entities or migrations but no app registers them; add ${camel(kinds.name)}Entities and ${camel(kinds.name)}Migrations to a connection of DatabaseModule.register and of the cli app.`, { capability: kinds.name });
   const connectionFile = graph.files.get(`${key}/persistence/connection.ts`);
@@ -160,6 +183,7 @@ function reportFoundCapability(input, kit, key, kinds, view) {
   const { registered, connections, plain, report } = view;
   const { graph } = input;
   const { resolver } = kit;
+  if (view.lite) { reportLiteEntityArrays(key, kinds, graph, kit.ts, plain); return; }
   reportDeclaredPersistenceArrays(key, kinds, registered, graph, kit.ts, plain);
   const only = registered.get(key)?.connections;
   if (!only || only.size < 1) return;
@@ -170,7 +194,7 @@ function reportFoundCapability(input, kit, key, kinds, view) {
 }
 
 function reportFoundCapabilities(input, kit, found, registered, connections, plain, report) {
-  const view = { registered, connections, plain, report };
+  const view = { registered, connections, plain, report, lite: kit.resolver.repo?.edition === 'lite' };
   for (const [key, kinds] of found) reportFoundCapability(input, kit, key, kinds, view);
 }
 
@@ -178,7 +202,7 @@ function reportPersistenceExport(capabilityRoot, index, statement, element, want
   const from = statement.moduleSpecifier?.text;
   const inPersistence = from?.startsWith('.') && path.posix.join(capabilityRoot, from).split('/').includes('persistence');
   if (inPersistence && !Object.values(wanted).includes(element.name.text)) {
-    report(index, element, `${element.name.text} is exported from persistence/; the persistence of a capability is exposed only as ${wanted.Entities} and ${wanted.Migrations}.`, { name: element.name.text });
+    report(index, element, `${element.name.text} is exported from persistence/; the persistence of a capability is exposed only as ${Object.values(wanted).join(' and ')}.`, { name: element.name.text });
   }
 }
 
@@ -204,10 +228,11 @@ function reportCapabilityIndex(input, kit, capabilityRoot, kinds, report) {
   const { graph } = input;
   const index = graph.files.get(`${capabilityRoot}/index.ts`);
   if (!index) return;
-  const wanted = { Entities: `${camel(kinds.name)}Entities`, Migrations: `${camel(kinds.name)}Migrations` };
+  const lite = kit.resolver.repo?.edition === 'lite';
+  const wanted = lite ? { Entities: `${camel(kinds.name)}Entities` } : { Entities: `${camel(kinds.name)}Entities`, Migrations: `${camel(kinds.name)}Migrations` };
   const exported = collectIndexExports(kit, capabilityRoot, index, wanted, report);
   for (const [kind, has] of [['Entities', kinds.entities], ['Migrations', kinds.migrations]]) {
-    if (has && !exported.has(wanted[kind])) report(index, index.sourceFile, `${capabilityRoot}/index.ts must export ${wanted[kind]}, the ${kind.toLowerCase()} of the capability; apps concatenate them per connection into DatabaseModule.register.`, { capability: kinds.name, expected: wanted[kind] });
+    if (has && wanted[kind] && !exported.has(wanted[kind])) report(index, index.sourceFile, `${capabilityRoot}/index.ts must export ${wanted[kind]}, the ${kind.toLowerCase()} of the capability; apps concatenate them per connection into DatabaseModule.register.`, { capability: kinds.name, expected: wanted[kind] });
   }
 }
 

package/runtime/scripts/hfs/architecture/server-action.mjs

@@ -7,7 +7,7 @@ import { sourceLocation } from '../../lib/ts-ast.mjs';
  *   - FE_SERVER_ACTION_FORBIDDEN: a `"use server"` directive anywhere in a front-end source file, in the file's directive prologue
  *     (a Server Action module) or in the prologue of any function body (an inline Server Action), apps and packages alike;
  *   - FE_ROUTE_HANDLER_FORBIDDEN: a route handler (`route.ts`, `route.js` and their module variants) under `apps/<app>/src/app/` other than the
- *     liveness probe `health/live/route.ts` and the file the slot `fe.route.callback` owns (the Supabase auth code exchange).
+ *     liveness probe `health/live/route.ts`.
  *
  * The check is provider-independent: it runs for every front-end repository.
  */
@@ -15,7 +15,6 @@ export const SERVER_ACTION_RULE_IDS = Object.freeze(['FE_SERVER_ACTION_FORBIDDEN
 
 const SERVER_ACTION = 'FE_SERVER_ACTION_FORBIDDEN';
 const ROUTE_HANDLER = 'FE_ROUTE_HANDLER_FORBIDDEN';
-const CALLBACK_SLOT = 'fe.route.callback';
 const ROUTE_FILE = /^apps\/([^/]+)\/src\/app\/(?:.+\/)?route\.[cm]?[jt]s$/u;
 
 /** The statement nodes of a directive prologue: the leading string-literal expression statements. */
@@ -57,10 +56,10 @@ function serverActionViolations(ts, file) {
 function routeHandlerViolation(file) {
   const match = ROUTE_FILE.exec(file.rel);
   if (!match) return null;
-  if (file.rel === `apps/${match[1]}/src/app/health/live/route.ts` || file.slot === CALLBACK_SLOT) return null;
+  if (file.rel === `apps/${match[1]}/src/app/health/live/route.ts`) return null;
   return {
     ruleId: ROUTE_HANDLER, path: file.rel, line: 1, column: 1,
-    message: `${file.rel} is a front-end route handler outside health/live/route.ts and the ${CALLBACK_SLOT} slot: the front end serves no API. Webhooks, cron, public APIs and third-party callbacks belong to be features; the browser reaches the back end through modules/api.`,
+    message: `${file.rel} is a front-end route handler outside health/live/route.ts: the front end serves no API. Webhooks, cron, public APIs and third-party callbacks belong to be features; the browser reaches the back end through modules/api.`,
   };
 }
 

package/runtime/scripts/hfs/architecture/side-boundary.mjs

@@ -1,7 +1,7 @@
 // side-boundary.mjs - what counts as an import that leaves a side of an app (ARCH_INTERNAL_IMPORT_OUTSIDE).
 // A side (be/ or fe/) imports nothing of the app outside itself: the root holds no source and the other side is another program; a
 // declared read of the OTHER side (be/contracts/) is codegen input, never an import. A declared read of a tree the APP ROOT owns
-// (supabase/types/, sides.<side>.reads of the slot manifest) is the one thing both sides do import: the generated database types.
+// (db/types/, sides.<side>.reads of the slot manifest) is the one thing both sides do import: the generated database types.
 import path from 'node:path';
 import { isInside, slash } from './config.mjs';
 

package/runtime/scripts/hfs/architecture/{supabase-keys.mjs → sql-keys.mjs}

@@ -248,7 +248,7 @@ function activeMigrations(root) {
  * Public-table key sets proven by ordered, tracked active migrations. Direct event triggers taint later DDL proof.
  * Opaque bodies discard current facts; persistent schema machinery hidden inside them is outside static authority.
  */
-export function supabaseUniqueSetsOf(appRoot) {
+export function sqlUniqueSetsOf(appRoot) {
   const root = path.resolve(appRoot);
   const files = activeMigrations(root);
   const state = { tables: new Map(), safe: new Set(), schema: 'public', tainted: false };

package/runtime/scripts/hfs/architecture/sql-owner.mjs

@@ -2,8 +2,7 @@ import path from 'node:path';
 import { analyzeSql, HOLE } from './sql-tokens.mjs';
 import { machineKit } from './machine-ast.mjs';
 import { contextModelOf } from './context-map.mjs';
-import { supabaseTablesOf } from './supabase-tables.mjs';
-import { supabaseUniqueSetsOf } from './supabase-keys.mjs';
+import { sqlUniqueSetsOf } from './sql-keys.mjs';
 
 /**
  * R86 `sql-owner` (BE_SQL_TABLE_OWNER). Every `sql` tagged template (the tag declared in platform/database) of a
@@ -14,7 +13,7 @@ import { supabaseUniqueSetsOf } from './supabase-keys.mjs';
  *     capability's, or those of a same-context capability its owner may import (the tier matrix, through `resolver.importAllowed`
  *     to the table owner's public entry); a table of another context is refused (cross-context data comes only by events);
  *   - every table it names is declared by some entity under TypeORM authority, or by the generated
- *     `Database['public']['Tables']` contract under Supabase authority;
+ *     public tables the ordered db/migrations create under the SQL migration authority;
  *   - a SELECT carries LIMIT, or reads a single relation under a complete primary/unique-key equality to scalar values,
  *     or selects only proven scalar aggregates without GROUP BY. Inferred bounds reject multiplying projections and set operations.
  * Table positions that hold a `${...}` substitution (SqlIdent) are dynamic; they are counted in the coverage and judged by
@@ -130,11 +129,10 @@ export function entitiesOf(kit, graph) {
 
 const capabilityTable = root => path.posix.basename(root).replaceAll('-', '_').toLowerCase();
 
-/** Supabase declarations, with an owner when the generated table name matches a capability's persistence folder. */
-function supabaseDeclarations(graph, appRoot, ts) {
-  const generated = supabaseTablesOf(appRoot, ts);
-  const keys = supabaseUniqueSetsOf(appRoot);
-  const tables = new Map([...generated].map(table => [table, { table, owner: null, rel: null, uniqueSets: keys.get(table) ?? [] }]));
+/** SQL-authority declarations (the public tables db/migrations create), with an owner when a table name matches a capability's persistence folder. */
+function sqlDeclarations(graph, appRoot) {
+  const keys = sqlUniqueSetsOf(appRoot);
+  const tables = new Map([...keys.keys()].map(table => [table, { table, owner: null, rel: null, uniqueSets: keys.get(table) ?? [] }]));
   for (const file of graph.files.values()) {
     if (file.slot !== 'be.persistence' || !file.owner) continue;
     const key = capabilityTable(file.owner.root);
@@ -150,16 +148,16 @@ const isOwnTable = (table, ownTable) => {
   return name === ownTable || name.startsWith(`${ownTable}_`);
 };
 
-function reportSqlWrite({ tables, supabase, file, ownTable, report }, write) {
+function reportSqlWrite({ tables, sqlAuthority, file, ownTable, report }, write) {
   const declaration = tables.get(write.table.toLowerCase());
   if (!declaration) {
-    report(supabase
-      ? `SQL writes table ${write.table}, which Database['public']['Tables'] does not declare; regenerate supabase/types/database.types.ts from the migrations.`
+    report(sqlAuthority
+      ? `SQL writes table ${write.table}, which no db/migrations migration creates; add the table in a migration first.`
       : `SQL writes table ${write.table}, which no @Entity declares; declare the entity in the owning capability's persistence/entities.`, { table: write.table });
-  } else if (supabase) {
+  } else if (sqlAuthority) {
     if (isOwnTable(write.table, ownTable) && (declaration.owner === null || declaration.owner === file.owner.root)) return;
     const ownerNote = declaration.owner ? `, owned by ${declaration.owner}` : '';
-    report(`SQL in ${file.owner.root} writes table ${write.table}${ownerNote}; under Supabase schema authority a capability writes only its own table (${ownTable}), named for that capability.`, { table: write.table, ...(declaration.owner ? { tableOwner: declaration.owner } : {}) });
+    report(`SQL in ${file.owner.root} writes table ${write.table}${ownerNote}; under the SQL migration authority a capability writes only its own table (${ownTable}), named for that capability.`, { table: write.table, ...(declaration.owner ? { tableOwner: declaration.owner } : {}) });
   } else if (declaration.owner !== file.owner.root) {
     report(`SQL in ${file.owner.root} writes table ${write.table}, owned by ${declaration.owner}; a capability writes only the tables of its own entities, call the owner's public API instead.`, { table: write.table, tableOwner: declaration.owner });
   }
@@ -169,11 +167,11 @@ function reportSqlWrites(input) {
   for (const write of input.result.writes) reportSqlWrite(input, write);
 }
 
-function reportSqlRead(tables, supabase, file, model, resolver, report, read) {
+function reportSqlRead(tables, sqlAuthority, file, model, resolver, report, read) {
   const declaration = tables.get(read.table.toLowerCase());
   if (!declaration) {
-    report(supabase
-      ? `SQL reads table ${read.table}, which Database['public']['Tables'] does not declare; regenerate supabase/types/database.types.ts from the migrations.`
+    report(sqlAuthority
+      ? `SQL reads table ${read.table}, which no db/migrations migration creates; add the table in a migration first.`
       : `SQL reads table ${read.table}, which no @Entity declares; declare the entity in the owning capability's persistence/entities.`, { table: read.table });
     return;
   }
@@ -188,8 +186,8 @@ function reportSqlRead(tables, supabase, file, model, resolver, report, read) {
   if (!verdict.allowed) report(`SQL in ${file.owner.root} reads table ${read.table}, owned by ${declaration.owner}, which ${file.owner.root} may not import (${verdict.reason}); read it through the owner's public API.`, { table: read.table, tableOwner: declaration.owner, reason: verdict.reason });
 }
 
-function reportSqlReads({ result, tables, supabase, file, model, resolver, report }) {
-  for (const read of result.reads) reportSqlRead(tables, supabase, file, model, resolver, report, read);
+function reportSqlReads({ result, tables, sqlAuthority, file, model, resolver, report }) {
+  for (const read of result.reads) reportSqlRead(tables, sqlAuthority, file, model, resolver, report, read);
 }
 
 function reportSqlSelects({ result, tables, report }) {
@@ -201,7 +199,7 @@ function reportSqlSelects({ result, tables, report }) {
 }
 
 function inspectSqlTag(input, state, file, checker, node) {
-  const { kit, ts, tables, supabase, model, resolver } = input;
+  const { kit, ts, tables, sqlAuthority, model, resolver } = input;
   if (!ts.isTaggedTemplateExpression(node)) return true;
   const home = kit.declarationsOf(checker, node.tag).map(kit.ownerOfDeclaration).find(Boolean);
   if (home?.tier !== 'platform' || home?.name !== 'database') { state.foreignTags += 1; return true; }
@@ -217,13 +215,13 @@ function inspectSqlTag(input, state, file, checker, node) {
     state.violations.push({ ruleId: RULE, path: file.rel, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
   };
   const result = analyzeSql(text, { uniqueSetsOf: (table, schema) => {
-    if (supabase && ((schema && schema !== 'public') || table !== table.toLowerCase())) return null;
+    if (sqlAuthority && ((schema && schema !== 'public') || table !== table.toLowerCase())) return null;
     return tables.get(table.toLowerCase())?.uniqueSets ?? null;
   } });
   state.dynamic += result.dynamic;
   const ownTable = capabilityTable(file.owner.root);
-  reportSqlWrites({ result, tables, supabase, file, ownTable, report });
-  reportSqlReads({ result, tables, supabase, file, model, resolver, report });
+  reportSqlWrites({ result, tables, sqlAuthority, file, ownTable, report });
+  reportSqlReads({ result, tables, sqlAuthority, file, model, resolver, report });
   reportSqlSelects({ result, tables, report });
   return true;
 }
@@ -239,13 +237,13 @@ export function checkSqlOwner(input) {
   const { config, graph } = input;
   const kit = machineKit(input);
   const { ts, resolver } = kit;
-  const supabase = resolver.ruleParams().schemaAuthority === 'supabase';
-  const entityDeclarations = supabase ? { tables: new Map(), unreadable: 0 } : entitiesOf(kit, graph);
-  const tables = supabase ? supabaseDeclarations(graph, config.packageRoot, ts) : entityDeclarations.tables;
+  const sqlAuthority = resolver.ruleParams().schemaAuthority === 'sql';
+  const entityDeclarations = sqlAuthority ? { tables: new Map(), unreadable: 0 } : entitiesOf(kit, graph);
+  const tables = sqlAuthority ? sqlDeclarations(graph, config.packageRoot) : entityDeclarations.tables;
   const model = contextModelOf(kit, graph);
   const state = { violations: [], templates: 0, dynamic: 0, foreignTags: 0 };
-  const inspection = { kit, ts, tables, supabase, model, resolver };
+  const inspection = { kit, ts, tables, sqlAuthority, model, resolver };
   for (const file of graph.files.values()) inspectSqlFile(inspection, state, file);
   return { violations: state.violations, coverage: { status: 'checked', entities: entityDeclarations.tables.size, unreadableEntities: entityDeclarations.unreadable,
-    ...(supabase ? { supabaseTables: tables.size } : {}), templates: state.templates, dynamicIdentifiers: state.dynamic, foreignTags: state.foreignTags } };
+    ...(sqlAuthority ? { sqlTables: tables.size } : {}), templates: state.templates, dynamicIdentifiers: state.dynamic, foreignTags: state.foreignTags } };
 }

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -1,4 +1,5 @@
 import { byCodeUnit } from '../../lib/list.mjs';
+import { registryListImport, registrySlot } from './entity-registry.mjs';
 
 /**
  * HFS checks 1 and 2 (knowledge/hfs/slots.yaml `tiers`):
@@ -8,7 +9,9 @@ import { byCodeUnit } from '../../lib/list.mjs';
  *      kind (slot field `trigger`: api, webhooks, realtime, saga, reactors, jobs, cli) importing a feature of another is
  *      BE_KIND_ISOLATION, whose fix is the event bus,
  *      an app never imports another app (BE_SERVICE_ISOLATION / FE_APP_ISOLATION), and a component layer imports only the layers after it;
- *   2. owner cycles: a strongly connected component of the owner graph, type-only imports included (ARCH_OWNER_CYCLE),
+ *      the entity registry naming a capability's `<c>Entities` from its public entry is the one platform-to-domain edge (entity-registry.mjs);
+ *   2. owner cycles: a strongly connected component of the owner graph, type-only imports included (ARCH_OWNER_CYCLE), the entity
+ *      registry counted as a unit of its own,
  *      reported with the cycle path and the import that closes each hop.
  * Importing inside one owner is always allowed; the public-entry rule stays with owners.mjs (ARCH_OWNER_EXPORT_BYPASS).
  */
@@ -138,15 +141,23 @@ function inspectTierEdge(graph, edge, tierRule, counts, violations, coverage) {
     return;
   }
   coverage.edgesChecked += 1;
+  if (verdict.reason === 'tierDirection' && registryListImport(graph.resolver, edge)) return;
   reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, violations);
 }
 
+/**
+ * The cycle unit of a file: its owner unit, except the entity registry (entity-registry.mjs), which is a unit of its own. It sits in
+ * platform/database but is composition-level by role (it imports every capability's `<c>Entities`), so it never closes a cycle
+ * among capabilities through the owner it lives in.
+ */
+const cycleUnit = (graph, resolver, rel) => (registrySlot(resolver, rel) ? `entity-registry:${rel}` : graph.unit(rel));
+
 function ownerAdjacency(graph, resolver) {
   const adjacency = new Map();
   const witness = new Map();
   for (const edge of graph.edges) {
-    const a = graph.unit(edge.from);
-    const b = graph.unit(edge.to);
+    const a = cycleUnit(graph, resolver, edge.from);
+    const b = cycleUnit(graph, resolver, edge.to);
     if (!a || !b || a === b) continue;
     if (resolver.tierOf(edge.from) === 'none' || resolver.tierOf(edge.to) === 'none') continue;
     if (!adjacency.has(a)) adjacency.set(a, new Set());