@starci/hfs 4.9.9 → 4.10.0

package/scaffold/add-queue-lite.mjs

@@ -1,5 +1,5 @@
 // `starci app add queue|job` in a lite app (ruling:R212/case-10): the queue is full's BullMQ adapter on the declared Redis, so lite
-// generates full's queue and jobs trees with three differences. The outbox and job tables are a Supabase migration instead of the
+// generates full's queue and jobs trees with three differences. The outbox and job tables are a db migration instead of the
 // TypeORM entity, connection and migration; the SQL names the public schema; and the queue options read the Redis password of
 // its sealed secret. The verb also declares redis in hfs.json sides.be.backing with its bullmq client, and renders the one
 // declared Redis into every docker-swarm environment of the stack: the stateful component, its backup and restore record, the
@@ -7,7 +7,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { parseYaml } from '../runtime/engine/yaml.mjs';
-import { dbTypesPath, emitDbTypes } from '../emit/db-types.mjs';
 import { configuredRecipients } from '../runtime/scripts/hfs/secret-init.mjs';
 import { materializeDeclaredPlaceholders } from '../runtime/scripts/hfs/sealed-members.mjs';
 import { REDIS_IMAGE, TEMPLATES_DIR, redisDevScripts, render } from '../sync/index.mjs';
@@ -35,13 +34,18 @@ const LITE_TEMPLATES = Object.freeze({
   'queues/platform/queue-relay.service.ts.tpl': 'queues/platform-lite/queue-relay.service.ts.tpl',
   'queues/platform/queue-relay.service.spec.ts.tpl': 'queues/platform-lite/queue-relay.service.spec.ts.tpl',
   'queues/platform/queue.module.ts.tpl': 'queues/platform-lite/queue.module.ts.tpl',
-  'queues/platform/persistence.queue.sql.ts.tpl': 'queues/platform-lite/persistence.queue.sql.ts.tpl',
+  'queues/platform/queue-outbox.service.ts.tpl': 'queues/platform-lite/queue-outbox.service.ts.tpl',
+  'queues/platform/queue-outbox.service.spec.ts.tpl': 'queues/platform-lite/queue-outbox.service.spec.ts.tpl',
   'jobs/platform/jobs.index.ts.tpl': 'jobs/platform-lite/jobs.index.ts.tpl',
-  'jobs/platform/persistence.jobs.sql.ts.tpl': 'jobs/platform-lite/persistence.jobs.sql.ts.tpl',
+  'jobs/platform/job-claim.service.ts.tpl': 'jobs/platform-lite/job-claim.service.ts.tpl',
+  'jobs/platform/job-claim.service.spec.ts.tpl': 'jobs/platform-lite/job-claim.service.spec.ts.tpl',
 });
 
-/** The TypeORM-only files of a platform capability: lite's schema authority is supabase/migrations (be.persistence lite overlay). */
-const TYPEORM_ONLY = /\/persistence\/(?:connection\.ts$|entities\/|migrations\/)/;
+/**
+ * The persistence files lite leaves out: the TypeORM schema (its authority is db/migrations) and the SQL text and row files (the
+ * statements are database functions of the lite migration, called through callDbFunction; R334 and the be.persistence lite overlay).
+ */
+const TYPEORM_ONLY = /\/persistence\/(?:connection\.ts$|entities\/|migrations\/|[^/]+\.(?:sql|rows)\.ts$)/;
 
 /** The e2e proof slot lite forbids (R212); a lite pattern proves itself with optional integration specs (the topic's liteAdapter proof). */
 const E2E_SLOT = 'be.tests.e2e';
@@ -80,20 +84,20 @@ function skeletonFiles(repoRoot) {
   return { created, patches: after === before ? [] : [{ file: errorFile, text: after }] };
 }
 
-/** The capability tables a platform capability the verb adds for the first time needs, as one forward-only Supabase migration. */
+/** The capability tables a platform capability the verb adds for the first time needs, as one forward-only db migration. */
 function migrationFiles({ repoRoot, beRoot, patterns, now }) {
   const sections = [
     ['queue-outbox', 'queue', 'queues/platform-lite/queue-outbox.sql.tpl', 'queue'],
     ['jobs', 'fenced-job', 'jobs/platform-lite/jobs.sql.tpl', 'jobs'],
   ].filter(([, pattern, , capability]) => patterns.includes(pattern) && !fs.existsSync(path.join(beRoot, 'src', 'modules', 'platform', capability, 'index.ts')));
   if (!sections.length) return [];
-  const folder = path.join(repoRoot, 'supabase', 'migrations');
+  const folder = path.join(repoRoot, 'db', 'migrations');
   const migrations = fs.existsSync(folder) ? fs.readdirSync(folder).filter((file) => MIGRATION.test(file)).sort(byCodeUnit) : [];
   const stamp = new Date(now()).toISOString().replace(/\D/g, '').slice(0, 14);
   const latest = migrations.at(-1)?.slice(0, 14);
   if (latest && stamp <= latest) throw new ScaffoldError('HFS_ADD_MIGRATION_ORDER', `the current UTC timestamp ${stamp} is not later than the latest migration ${latest}; fix the clock or wait for the next second`);
   const text = sections.map(([, , source]) => template(`be/patterns/${source}`)).join('\n');
-  return [{ relative: `supabase/migrations/${stamp}_${sections.map(([name]) => name).join('-')}.sql`, text }];
+  return [{ relative: `db/migrations/${stamp}_${sections.map(([name]) => name).join('-')}.sql`, text }];
 }
 
 /** The queue imports bullmq, which loads ioredis as an optional peer and cannot connect without it. */
@@ -320,10 +324,9 @@ function stackFiles(repoRoot, { project, consumers }) {
 
 /**
  * Plans the lite additions of `add queue|job` before any file is written; returns null outside lite or for another noun. The
- * plan's apply() writes them and returns the app-relative paths it created or changed. A new migration regenerates the
- * database types through `emitTypes` (the local Supabase stack, as `add table`); false is the `--no-types` seam.
+ * plan's apply() writes them and returns the app-relative paths it created or changed.
  */
-export function planLiteQueue({ repoRoot, repo, noun, patterns, now, emitTypes = emitDbTypes }) {
+export function planLiteQueue({ repoRoot, repo, noun, patterns, now }) {
   if (repo.edition !== 'lite' || !['queue', 'job'].includes(noun)) return null;
   const beRoot = path.join(repoRoot, 'be');
   const migrations = migrationFiles({ repoRoot, beRoot, patterns, now });
@@ -345,22 +348,11 @@ export function planLiteQueue({ repoRoot, repo, noun, patterns, now, emitTypes =
       const exported = registerLiteExports({ root: repoRoot, generator: 'queue' });
       const sealed = sealRedisMembers(repoRoot, stack.environments);
       const changed = patches.map((patch) => path.relative(repoRoot, patch.file).split(path.sep).join('/'));
-      const types = migrations.length && typeof emitTypes === 'function' ? writeTypes(repoRoot, emitTypes) : [];
-      return [...new Set([...created.map((entry) => entry.relative), ...changed, ...exported, ...sealed, ...types])];
+      return [...new Set([...created.map((entry) => entry.relative), ...changed, ...exported, ...sealed])];
     },
   };
 }
 
-/** The SQL of the new capabilities names public.queue and public.jobs, which the generated database types must declare. */
-function writeTypes(repoRoot, emitTypes) {
-  const generated = emitTypes({ root: repoRoot });
-  if (typeof generated !== 'string') return [];
-  const target = path.join(repoRoot, ...dbTypesPath.split('/'));
-  fs.mkdirSync(path.dirname(target), { recursive: true });
-  fs.writeFileSync(target, generated);
-  return [dbTypesPath];
-}
-
 /** Seals a placeholder redis-password member to the app's configured recipient; without one, `starci app secret init` seals it. */
 function sealRedisMembers(repoRoot, environments) {
   if (!environments.length || !fs.existsSync(path.join(repoRoot, '.sops.yaml'))) return [];

package/scaffold/add-table.mjs

@@ -1,6 +1,5 @@
 import fs from "node:fs";
 import path from "node:path";
-import { emitDbTypes, dbTypesPath } from "../emit/db-types.mjs";
 import {
   loadSlotManifest,
   readRepoDeclaration,
@@ -288,7 +287,7 @@ const apiFeatureFiles = (values) => {
 /**
  * The fe data code of a table in one product app: one GraphQL operation file per operation (modules/api/graphql/{queries,
  * mutations}, its request/data types from the generated wire types) and one SWR hook per operation (hooks/swr/api/graphql).
- * Never a Server Action and never a Supabase reader: Supabase on the front end is the Auth client only.
+ * Never a Server Action and never a database reader: the front end reaches data only through the back end.
  */
 const feOperationFiles = (app, values) => {
   const api = `fe/apps/${app}/src/modules/api/graphql`;
@@ -326,9 +325,8 @@ const withExport = (text, line) => {
 };
 
 /**
- * Adds one Supabase table migration and its domain capability; with `fe`, the table's api feature over GraphQL (the GraphQL
+ * Adds one db table migration and its domain capability; with `fe`, the table's api feature over GraphQL (the GraphQL
  * server capability on first use) and, in every product Next app, its operation files and SWR hooks.
- * `emitTypes` returns the generated database.types.ts text; false is the explicit `--no-types` seam.
  */
 function tableContext({ root, name }) {
   const requestedName = String(name);
@@ -341,11 +339,11 @@ function tableContext({ root, name }) {
   const table = snakeOf(requestedName);
   const manifest = loadSlotManifest();
   const repo = readRepoDeclaration(manifest, root);
-  const connection = repo.sides?.be?.connections?.find((candidate) => candidate.provider === "supabase");
+  const connection = repo.sides?.be?.connections?.find((candidate) => candidate.provider === "postgres");
   if (!connection) {
     throw new ScaffoldError(
       "HFS_ADD_TABLE_PROVIDER",
-      "add table needs a back-end connection whose provider is supabase",
+      "add table needs a back-end connection whose provider is postgres",
     );
   }
 
@@ -353,7 +351,7 @@ function tableContext({ root, name }) {
 }
 
 function nextMigration({ root, feature, requestedName, now }) {
-  const migrationsDir = path.join(root, "supabase", "migrations");
+  const migrationsDir = path.join(root, "db", "migrations");
   const migrations = fs.existsSync(migrationsDir)
     ? fs
         .readdirSync(migrationsDir)
@@ -408,7 +406,7 @@ function tableFiles({ root, repo, feature, stamp, values, fe, apps }) {
   const domain = `be/src/modules/domain/${feature}`;
   const planned = [
     {
-      relative: `supabase/migrations/${stamp}_${feature}.sql`,
+      relative: `db/migrations/${stamp}_${feature}.sql`,
       body: template("be/table/migration.sql.tpl", values),
     },
     { relative: `${domain}/index.ts`, body: template("be/table/index.ts.tpl", values) },
@@ -417,16 +415,9 @@ function tableFiles({ root, repo, feature, stamp, values, fe, apps }) {
     { relative: `${domain}/${feature}.module-definition.ts`, body: template("be/table/module-definition.ts.tpl", values) },
     { relative: `${domain}/${feature}.options.ts`, body: template("be/table/options.ts.tpl", values) },
     { relative: `${domain}/${feature}.service.ts`, body: template(`be/table/service${api}.ts.tpl`, values) },
-    { relative: `${domain}/persistence/${feature}.rows.ts`, body: template("be/table/rows.ts.tpl", values) },
-    { relative: `${domain}/persistence/${feature}.sql.ts`, body: template(`be/table/sql${api}.ts.tpl`, values) },
+    { relative: `${domain}/persistence/entities/${feature}.entity.ts`, body: template("be/table/entity.ts.tpl", values) },
+    { relative: `${domain}/persistence/entities/index.ts`, body: template("be/table/entities.index.ts.tpl", values) },
   ];
-  const databaseSql = "be/src/modules/platform/database/database.sql.ts";
-  if (repo.edition === "lite" && !fs.existsSync(at(root, databaseSql))) {
-    planned.splice(1, 0, {
-      relative: databaseSql,
-      body: render(fs.readFileSync(path.join(TEMPLATES_DIR, "be", "skeleton-lite", "src", "modules", "platform", "database", "database.sql.ts"), "utf8"), {}),
-    });
-  }
   if (fe) {
     planned.push(...apiFeatureFiles(values));
     if (!fs.existsSync(at(root, `${GRAPHQL_PLATFORM}/index.ts`))) planned.push(...graphqlPlatformFiles());
@@ -450,7 +441,7 @@ function tableOwner({ root, repo, connection, name, requestedName, planned }) {
     );
   const owner = repo.sides.be.apps.find((app) => app.name === connection.owner && app.kind === "api");
   if (!owner)
-    throw new ScaffoldError("HFS_ADD_NO_API_OWNER", `add table needs the Supabase connection owner ${connection.owner} to be a declared api app`);
+    throw new ScaffoldError("HFS_ADD_NO_API_OWNER", `add table needs the database connection owner ${connection.owner} to be a declared api app`);
   const ownerRelative = `be/apps/${owner.name}/src/app.module.ts`;
   if (!fs.existsSync(at(root, ownerRelative)))
     throw new ScaffoldError("HFS_ADD_WIRE_MISSING", `add table registers ${name} in ${ownerRelative}, which does not exist`);
@@ -471,17 +462,13 @@ function tableEditor(root, touched) {
   return edit;
 }
 
-function writeTableFiles({ root, planned, emitTypes, edit }, created) {
+function writeTableFiles({ root, planned, edit }, created) {
   for (const file of planned) {
     const target = at(root, file.relative);
     fs.mkdirSync(path.dirname(target), { recursive: true });
     fs.writeFileSync(target, file.body);
     created.push(target);
   }
-  if (typeof emitTypes === "function") {
-    const generated = emitTypes({ root });
-    if (typeof generated === "string") edit(dbTypesPath, () => generated);
-  }
 
 }
 
@@ -504,8 +491,30 @@ function wireTableFrontends({ root, feature, values, apps, edit }) {
       }
 }
 
+/** The lite entity list: platform/database/entities.ts names the capability's `<c>Entities` in PRIMARY_ENTITIES (BE-PERSISTENCE-3). */
+const PRIMARY_ENTITIES_FILE = "be/src/modules/platform/database/entities.ts";
+const PRIMARY_ENTITIES = /(export const PRIMARY_ENTITIES[^=]*=\s*\[)([\s\S]*?)(\])/;
+
+/** `text` of entities.ts with `<c>Entities` imported from the capability barrel and spread into PRIMARY_ENTITIES, once. */
+function withPrimaryEntities(text, { feature, nameCamel }) {
+  const list = `${nameCamel}Entities`;
+  if (!PRIMARY_ENTITIES.test(text))
+    throw new ScaffoldError("HFS_ADD_WIRE_MISSING", `add table names ${list} in PRIMARY_ENTITIES of ${PRIMARY_ENTITIES_FILE}, which declares no PRIMARY_ENTITIES array`);
+  if (new RegExp(`\\.\\.\\.${list}\\b`).test(text)) return text;
+  const imported = `import { ${list} } from "@modules/domain/${feature}"\n`;
+  const withList = text.replace(PRIMARY_ENTITIES, (all, head, items, tail) => {
+    const entries = items.split(",").map((item) => item.trim()).filter(Boolean);
+    return `${head}${[...entries, `...${list}`].join(", ")}${tail}`;
+  });
+  const lines = withList.split("\n");
+  const lastImport = lines.reduce((at, line, index) => (line.startsWith("import ") ? index : at), -1);
+  if (lastImport >= 0) lines.splice(lastImport + 1, 0, imported.trimEnd());
+  return lastImport >= 0 ? lines.join("\n") : `${imported}${withList}`;
+}
+
 function wireTable({ root, repo, feature, values, ownerRelative, composition, fe, apps, edit }) {
     const kindsHome = kindsHomeOf(root, ownerRelative);
+    if (repo.edition === "lite") edit(PRIMARY_ENTITIES_FILE, (text) => withPrimaryEntities(text, { feature, nameCamel: values.nameCamel }));
     for (const patch of composition) edit(patch.relative, () => patch.text);
     edit(kindsHome, (text) => wireKinds(text, kindsHome, { kinds: `${snakeOf(feature).toUpperCase()}_ERROR_KINDS`, specifier: `@modules/domain/${feature}` }));
   tableRegistrations({ root, repo, fe, edit });
@@ -538,7 +547,7 @@ function applyTable(context) {
 }
 
 /** Adds one table through typed domain/API groups and restores every touched byte on failure. */
-export function addTable({ root, name, fe = false, emitTypes = emitDbTypes, now = Date.now }) {
+export function addTable({ root, name, fe = false, now = Date.now }) {
   const context = tableContext({ root, name });
   const stamp = nextMigration({ ...context, now });
   const values = tableValues(context);
@@ -546,9 +555,8 @@ export function addTable({ root, name, fe = false, emitTypes = emitDbTypes, now
   const planned = tableFiles({ ...context, stamp, values, apps, fe });
   const owner = tableOwner({ ...context, planned });
   const composition = tableComposition({ ...context, ...owner, fe });
-  applyTable({ ...context, ...owner, planned, composition, apps, values, fe, emitTypes });
+  applyTable({ ...context, ...owner, planned, composition, apps, values, fe });
   return {
     created: [...planned.map((file) => file.relative), ...composition.filter((patch) => patch.exists === false).map((patch) => patch.relative)],
-    types: typeof emitTypes === "function" ? dbTypesPath : "skipped",
   };
 }

package/scaffold/add.mjs

@@ -52,7 +52,7 @@ const FE_OWNERS = Object.freeze({
  */
 export function addKind({ repoRoot, noun, name, options = {}, now = Date.now }) {
   if (noun === 'table') {
-    const result = addTable({ root: repoRoot, name, fe: options.fe === true, emitTypes: options.noTypes === true ? false : options.emitTypes, now });
+    const result = addTable({ root: repoRoot, name, fe: options.fe === true, now });
     return { ...result, registered: { patterns: [], kinds: [] } };
   }
   if (noun === 'app') {
@@ -81,7 +81,7 @@ function registerFeatureExports({ repoRoot, repo, noun, values }) {
 
 function writeKind({ repoRoot, noun, name, now, options, manifest, repo, spec, declarationFile, values, forms, beRoot, patterns, planned }) {
   if (noun === 'api' || noun === 'webhook') preflightFeatureComposition({ repoRoot, repo, noun, name });
-  const liteQueue = planLiteQueue({ repoRoot, repo, noun, patterns, now, emitTypes: options.noTypes === true ? false : options.emitTypes });
+  const liteQueue = planLiteQueue({ repoRoot, repo, noun, patterns, now });
   const bootstrapCreated = noun === 'cli' && repo.edition === 'lite' ? ensureLiteCli({ root: repoRoot, manifest, repo }) : [];
   for (const file of planned) {
     fs.mkdirSync(path.dirname(file.absolute), { recursive: true });

package/scaffold/app.mjs

@@ -18,10 +18,8 @@ import { spawnSync } from 'node:child_process';
 import { loadSlotManifest, resolveRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 import { parseYaml } from '../runtime/engine/yaml.mjs';
 import { HARNESS_PACKAGE, canonPins } from '../runtime/scripts/hfs/canon-pins.mjs';
-import { dbTypesPath, generateDbTypes } from '../emit/db-types.mjs';
 import { TEMPLATES_DIR, appSource, imageFiles, render, renderTargets, writeTargets } from '../sync/index.mjs';
 import { ScaffoldError } from './service.mjs';
-import { SUPABASE_PORT_VARIABLES, supabasePortVars } from './supabase-ports.mjs';
 import { testWorldFiles } from './test-world.mjs';
 import { FE_APP_SCRIPTS, PACKAGE_MANAGER, WORKSPACES, WORKSPACE_LINT, feAppPackageName } from '../runtime/scripts/hfs/rules/monorepo.mjs';
 import { isLinkLike } from '../runtime/scripts/api/fs/is-link-like.mjs';
@@ -128,23 +126,14 @@ const STARTER_SIDES = Object.freeze({
   fe: Object.freeze({ grammar: 'core', apps: [{ name: 'landing', kind: 'next' }, { name: 'app', kind: 'next' }], reads: ['be/contracts/'], optionalSlots: ['fe.package.ui', 'fe.package.i18n'] }),
 });
 
-/** The lite starter is the upgrade-safe subset: one API, one web app and one Supabase schema authority. */
+/** The lite starter is the upgrade-safe subset: one API, one web app and one SQL schema authority (db/migrations). */
 const LITE_STARTER_SIDES = Object.freeze({
   be: Object.freeze({
     apps: [{ name: 'api', kind: 'api' }],
     kinds: ['api'],
-    connections: [{ name: 'primary', envPrefix: 'PRIMARY_DB', owner: 'api', isolation: 'schema', provider: 'supabase' }],
-    reads: ['supabase/types/'],
+    connections: [{ name: 'primary', envPrefix: 'PRIMARY_DB', owner: 'api', isolation: 'schema', provider: 'postgres' }],
   }),
-  fe: Object.freeze({ grammar: 'core', apps: [{ name: 'web', kind: 'next' }], reads: ['be/contracts/', 'supabase/types/'] }),
-});
-
-/** The checked local Supabase auth posture of every newly scaffolded lite app. */
-const LITE_STARTER_SUPABASE = Object.freeze({
-  enableSignup: false,
-  jwtExpiry: 3600,
-  siteUrl: 'http://127.0.0.1:3000',
-  redirectUrls: ['http://127.0.0.1:3000/'],
+  fe: Object.freeze({ grammar: 'core', apps: [{ name: 'web', kind: 'next' }], reads: ['be/contracts/'] }),
 });
 
 /**
@@ -175,16 +164,17 @@ const STARTER_DEPENDENCIES = Object.freeze({
 const LITE_STARTER_DEPENDENCIES = Object.freeze({
   dependencies: {
     '@apollo/server': null, '@nestjs/apollo': null, '@nestjs/common': null, '@nestjs/core': null, '@nestjs/cqrs': null, '@nestjs/graphql': null,
-    '@nestjs/platform-express': null, '@nestjs/typeorm': null, '@supabase/supabase-js': null,
+    '@nestjs/platform-express': null, '@nestjs/typeorm': null, '@nestjs/passport': null, passport: null, 'passport-google-oauth20': null, 'passport-local': null,
+    '@aws-sdk/client-s3': null, '@aws-sdk/s3-request-presigner': null, bcryptjs: null,
     'class-transformer': null, 'class-validator': null, graphql: null, jose: null, pg: null,
     'reflect-metadata': null, rxjs: null, tslib: null, typeorm: null, zod: null,
   },
   devDependencies: {
     turbo: null, '@nestjs/testing': null, '@starci/eslint-canon-be': null, '@starci/eslint-canon-fe': null,
     '@starci/jest-preset': null, '@starci/prettier-config': null, '@starci/stylelint-canon': null, '@starci/tsconfig': null, 'starci-harness': null, '@tailwindcss/postcss': null,
-    '@types/express': null, '@types/jest': null, '@types/node': null, '@types/react': null, '@types/react-dom': null,
+    '@types/express': null, '@types/jest': null, '@types/node': null, '@types/passport-google-oauth20': null, '@types/passport-local': null, '@types/react': null, '@types/react-dom': null,
     eslint: null, 'eslint-plugin-react-hooks': null, husky: null, jest: null, 'postcss-value-parser': null, prettier: null,
-    stylelint: null, supabase: null, tailwindcss: null, 'ts-jest': null, 'ts-node-dev': null, 'tsc-alias': null,
+    stylelint: null, tailwindcss: null, 'ts-jest': null, 'ts-node-dev': null, 'tsc-alias': null,
     'tsconfig-paths': null, typescript: null,
   },
 });
@@ -201,12 +191,12 @@ const FE_APP_DEPENDENCIES = Object.freeze({
 });
 
 /**
- * The lite fe workspace: the same base without the shared packages, plus its infra adapter (owner ruling 2026-10-13: Supabase on
- * the front end is the Auth client of modules/auth only) and server-only for its own next-intl request config.
+ * The lite fe workspace: the same base without the shared packages, plus server-only for its own next-intl request config. It
+ * holds no identity SDK: modules/auth talks only to the app's own back-end auth doors.
  */
 const LITE_FE_APP_DEPENDENCIES = Object.freeze({
   '@heroicons/react': null, '@heroui/react': null, '@heroui/styles': null, '@starci/grammar': null, '@starci/heroicons': null, '@xyflow/react': null, 'react-aria-components': null,
-  '@supabase/supabase-js': null, next: null, 'next-intl': null, react: null, 'react-dom': null, 'server-only': null,
+  next: null, 'next-intl': null, react: null, 'react-dom': null, 'server-only': null,
 });
 
 /**
@@ -229,51 +219,9 @@ export const starterDeclaration = (name, manifest = loadSlotManifest(), edition
   kind: 'app',
   ...(edition === 'full' ? {} : { edition }),
   project: name,
-  ...(edition === 'lite' ? { supabase: structuredClone(LITE_STARTER_SUPABASE) } : {}),
   sides: structuredClone(edition === 'lite' ? LITE_STARTER_SIDES : STARTER_SIDES),
 });
 
-/** Opting into a server PKCE callback also selects Supabase Auth and declares its route slot. */
-function enableAuthCallback(declaration) {
-  requireAuthCallbackConnection(declaration);
-  declaration.sides.fe.optionalSlots = [...(declaration.sides.fe.optionalSlots ?? []), 'fe.route.callback'];
-  declaration.supabase ??= structuredClone(LITE_STARTER_SUPABASE);
-  declaration.supabase.redirectUrls = ['http://127.0.0.1:3000/auth/callback'];
-}
-
-/** Callback-specific source files are excluded from the browser-only starter. */
-const CALLBACK_SOURCE_FILES = Object.freeze(new Set([
-  'src/app/auth/callback/route.ts', 'src/modules/auth/server.ts', 'src/modules/auth/pkce-client.ts',
-]));
-export const hasAuthCallback = repo => (repo.sides.fe.optionalSlots ?? []).includes('fe.route.callback');
-
-function requireAuthCallbackConnection(repo) {
-  if (!(repo.sides.be?.connections ?? []).some(entry => entry.provider === 'supabase'))
-    throw new ScaffoldError('HFS_ADD_CONNECTION_REQUIRED', 'the auth callback requires an existing Supabase connection; the full starter has none');
-}
-
-/** Apply the callback's cookie-backed auth owner and its config readers to product apps only. */
-export function callbackSourceFiles(files, repo) {
-  const enabled = hasAuthCallback(repo);
-  if (enabled) requireAuthCallbackConnection(repo);
-  const selected = files.filter(file => {
-    const [, , app, ...parts] = file.path.split('/');
-    const relative = parts.join('/');
-    if (relative === 'src/modules/auth/pkce-client.ts') return false;
-    return MARKETING_FE_APPS.has(app) || enabled || !CALLBACK_SOURCE_FILES.has(relative);
-  });
-  if (!enabled) return selected;
-  const config = fs.readFileSync(path.join(TEMPLATES_DIR, 'fe/skeleton-lite/apps/web/src/modules/config/index.ts'), 'utf8');
-  const client = render(fs.readFileSync(path.join(TEMPLATES_DIR, 'fe/skeleton/apps/__app__/src/modules/auth/pkce-client.ts'), 'utf8').replace(/\r\n/g, '\n'), PARTIAL_VARIABLES);
-  return selected.map(file => {
-    const [, , app, ...parts] = file.path.split('/');
-    if (MARKETING_FE_APPS.has(app)) return file;
-    const relative = parts.join('/');
-    if (relative === 'src/modules/config/index.ts') return { ...file, content: config };
-    return relative === 'src/modules/auth/client.ts' ? { ...file, content: client } : file;
-  });
-}
-
 /** A dependency section at the canon pins (a null range takes the pin, which must exist; every pinned name is null). */
 function pinnedSection(entries, pins) {
   const pinned = (dependency, range) => {
@@ -329,10 +277,9 @@ const workspaceSection = (entries, project, pins) => pinnedSection(Object.fromEn
  * The package.json of the fe app workspace `app` of the app `project`: @<project>/<app>, private, the workspace scripts, its own
  * dependencies. A product app (`core`, it carries the shared app core) also takes every core runtime package of the fe stack.
  */
-function feAppManifest(project, app, pins, edition, { core = true, authCallback = false, stack = coreFeStackPackages() } = {}) {
+function feAppManifest(project, app, pins, edition, { core = true, stack = coreFeStackPackages() } = {}) {
   const base = edition === 'lite' ? LITE_FE_APP_DEPENDENCIES : FE_APP_DEPENDENCIES;
   const dependencies = { ...base, ...(core ? Object.fromEntries(stack.app.filter(name => !Object.hasOwn(base, name)).map(name => [name, null])) : {}) };
-  if (core && authCallback) Object.assign(dependencies, { '@supabase/ssr': null, '@supabase/supabase-js': null, 'server-only': null });
   return { name: feAppPackageName(project, app), version: '0.0.0', private: true, scripts: { ...FE_APP_SCRIPTS }, dependencies: workspaceSection(dependencies, project, pins) };
 }
 
@@ -381,8 +328,8 @@ function nextAppTsconfig() {
   };
 }
 
-/** The names a skeleton file may fill: {{project}}, {{app}}, {{appPascal}} (the side's app), {{sonarGate}}, {{registryVisibility}} (the image visibility written once into deploy.registry) and the lite Supabase port block ({{supabasePort<Section>}}, supabase-ports.mjs). */
-const SKELETON_VARIABLES = Object.freeze(['project', 'app', 'appPascal', 'sonarGate', 'registryVisibility', ...SUPABASE_PORT_VARIABLES]);
+/** The names a skeleton file may fill: {{project}}, {{app}}, {{appPascal}} (the side's app), {{sonarGate}} and {{registryVisibility}} (the image visibility written once into deploy.registry). */
+const SKELETON_VARIABLES = Object.freeze(['project', 'app', 'appPascal', 'sonarGate', 'registryVisibility']);
 
 /**
  * A skeleton file with its variables filled. Only the skeleton names are variables: every other `{{name}}` is source the app keeps
@@ -411,7 +358,7 @@ const LITE_DEFERRED_GENERATOR_FILES = new Set([
   'src/modules/platform/database/seed-runner.service.ts',
   'src/modules/platform/primitives/sequence.policy.ts',
 ]);
-/** The TypeORM schema files of a platform capability: lite's schema authority is supabase/migrations (be.persistence lite overlay). */
+/** The TypeORM schema files of a platform capability: lite's schema authority is db/migrations (be.persistence lite overlay). */
 const LITE_TYPEORM_SCHEMA = /^src\/modules\/platform\/[^/]+\/persistence\/(?:connection\.ts$|entities\/|migrations\/)/;
 const liteBaseSource = (rel) => !rel.startsWith('apps/cli/')
     && !rel.startsWith('src/features/cli/')
@@ -509,7 +456,7 @@ export function skeletonOf(scope, app, vars) {
   for (const entry of scope === 'fe' ? app.sides.fe.apps : []) {
     if (!unique.some(file => file.path.startsWith(`fe/apps/${entry.name}/`))) throw new ScaffoldError('HFS_SCAFFOLD_SKELETON_MISSING', `no skeleton templates for the fe app ${entry.name}`);
   }
-  return scope === 'fe' ? [...new Map(callbackSourceFiles(unique, app).map(file => [file.path, file])).values()] : unique;
+  return unique;
 }
 
 /** The npm step that resolves the lockfile of a new app, exactly as the error names it. */
@@ -622,17 +569,6 @@ function scaffoldWrites(root, original) {
   };
 }
 
-/** Generate the lite database types and translate generation errors into the scaffold failure contract. */
-function emitScaffoldDatabaseTypes(root, name, writes, emitTypes) {
-  try {
-    const text = emitTypes({ root });
-    if (typeof text !== 'string' || !text.trim()) throw new Error('the Supabase CLI returned no database types');
-    writes.write(dbTypesPath, text);
-  } catch (error) {
-    throw new ScaffoldError('HFS_SCAFFOLD_TYPES_FAILED', `Supabase database types could not be generated for ${root} (${String(error?.message ?? error)}). Start the local Supabase stack and run starci app scaffold ${name} --edition lite again`);
-  }
-}
-
 /**
  * `starci app scaffold <name>`: writes the new app under `into`, resolves its lockfile with npm (`lock`, npmLock), and returns
  * `{ root, files }` (app-relative paths, sorted). A new path is first made an empty repository with unborn main (`initGit`), so the
@@ -660,17 +596,15 @@ function bornRepository(root, initGit) {
   return fs.lstatSync(root);
 }
 
-export function scaffoldApp({ name, into, presets, harness, edition = 'full', authCallback = false, registryVisibility = 'public', manifest = loadSlotManifest(), pins = canonPins({ harness }), lock = npmLock, emitTypes = generateDbTypes, initGit = gitInit, now = () => new Date() }) {
+export function scaffoldApp({ name, into, presets, harness, edition = 'full', registryVisibility = 'public', manifest = loadSlotManifest(), pins = canonPins({ harness }), lock = npmLock, initGit = gitInit, now = () => new Date() }) {
   if (!NAME.test(String(name))) throw new ScaffoldError('HFS_SCAFFOLD_NAME_INVALID', `the app name ${name} must be kebab-case (a project name: ${NAME})`);
   const root = path.resolve(into, name);
   const existing = fs.lstatSync(root, { throwIfNoEntry: false });
   if (existing && !emptyUnbornGit(root, existing)) throw new ScaffoldError('HFS_SCAFFOLD_EXISTS', `${root} already exists; only a plain directory containing solely .git with unborn main and an empty index can be scaffolded`);
   if (!['public', 'private'].includes(registryVisibility)) throw new ScaffoldError('HFS_SCAFFOLD_REGISTRY_VISIBILITY', `--registry-visibility accepts public or private (got ${registryVisibility})`);
-  if (typeof authCallback !== 'boolean') throw new ScaffoldError('HFS_SCAFFOLD_NAME_INVALID', 'authCallback must be a boolean');
   if (!pins[HARNESS_PACKAGE]) throw new ScaffoldError('HFS_SCAFFOLD_PIN_MISSING', `${HARNESS_PACKAGE} has no pin: an app pins the CLI that scaffolds it, so run the scaffold through it (starci app scaffold)`);
   const original = existing ?? bornRepository(root, initGit);
   const declaration = starterDeclaration(name, manifest, edition);
-  if (authCallback) enableAuthCallback(declaration);
   const app = resolveRepoDeclaration(manifest, declaration);
   const pkg = packageManifest(name, pins, app.edition, app.sides.fe.grammar);
   const timestamp = now().toISOString().replace(/\D/g, '').slice(0, 14);
@@ -683,14 +617,14 @@ export function scaffoldApp({ name, into, presets, harness, edition = 'full', au
       path: `fe/apps/${entry.name}/src/modules/types/ambient/styles.d.ts`,
       content: '/** Declares stylesheets loaded by the Next bundler; non-CSS side-effect imports remain checked. */\ndeclare module "*.css" {}\n',
     })),
-    ...app.sides.fe.apps.map(entry => ({ path: `fe/apps/${entry.name}/package.json`, content: packageJsonText(feAppManifest(name, entry.name, pins, app.edition, { core: coreFeApps([entry]).length === 1, authCallback })) })),
+    ...app.sides.fe.apps.map(entry => ({ path: `fe/apps/${entry.name}/package.json`, content: packageJsonText(feAppManifest(name, entry.name, pins, app.edition, { core: coreFeApps([entry]).length === 1 })) })),
     ...imageFiles(app),
     ...(app.edition === 'lite' ? [] : Object.keys(FE_PACKAGES).flatMap(pkg => [
       { path: `fe/packages/${name}-${pkg}/package.json`, content: packageJsonText(fePackageManifest(name, pkg, pins)) },
       { path: `fe/packages/${name}-${pkg}/tsconfig.json`, content: jsonText(fePackageTsconfig()) },
       { path: `fe/packages/${name}-${pkg}/tsconfig.build.json`, content: jsonText(fePackageBuildTsconfig()) },
     ])),
-    ...['app', 'be', 'fe'].flatMap(scope => skeletonOf(scope, app, { sonarGate: sonarGateName(parseYaml(fs.readFileSync(SONAR_GATE_FILE, 'utf8')), app.edition), timestamp, registryVisibility, ...supabasePortVars(name) })),
+    ...['app', 'be', 'fe'].flatMap(scope => skeletonOf(scope, app, { sonarGate: sonarGateName(parseYaml(fs.readFileSync(SONAR_GATE_FILE, 'utf8')), app.edition), timestamp, registryVisibility })),
     // A full app has a test world (integration, e2e and contract are rows of its release gate); lite has none (ruling:R212/case-3, hosting amended by owner:lite-production-swarm).
     ...(app.edition === 'lite' ? [] : testWorldFiles(app)),
   ];
@@ -700,12 +634,11 @@ export function scaffoldApp({ name, into, presets, harness, edition = 'full', au
     const targets = renderTargets(declaration, presets, { manifest, source: appSource(root) });
     for (const target of targets) writes.claim(target.path);
     writeTargets(root, targets);
-    if (app.edition === 'lite') emitScaffoldDatabaseTypes(root, name, writes, emitTypes);
     const secretFiles = initializeScaffoldSecrets(root, writes);
     let locked;
     try { locked = lock(root); } finally { writes.lockfile(); }
     if (!locked.ok) throw new ScaffoldError('HFS_SCAFFOLD_LOCK_FAILED', `\`${LOCK_STEP}\` could not resolve the lockfile of ${root} (${locked.detail}). Check the network and the npm registry, then run starci app scaffold ${name} again`);
-    return { root, files: [...new Set([...files.map(file => file.path), ...targets.map(target => target.path), ...secretFiles, ...(app.edition === 'lite' ? [dbTypesPath] : []), 'package-lock.json'])].sort(byCodeUnit) };
+    return { root, files: [...new Set([...files.map(file => file.path), ...targets.map(target => target.path), ...secretFiles, 'package-lock.json'])].sort(byCodeUnit) };
   } catch (error) {
     const held = writes.rollback();
     if (held.length) error.message += `; cleanup retained replaced or occupied entries: ${held.join(', ')}`;

package/scaffold/lite-exports.mjs

@@ -26,7 +26,7 @@ const REGISTRATIONS = Object.freeze({
     {
       file: "be/src/modules/platform/database/index.ts",
       source: "./database.sql",
-      names: ["requireOwnedRow", "sql"],
+      names: ["requireOwnedEntity"],
       beforeSource: "./errors/database.error",
     },
     {