@starci/hfs 4.9.9 → 4.10.0

package/templates/app/ci-workflows/github/workflows/stack-deploy.yml

@@ -8,7 +8,8 @@
 # The environment input names a protected GitHub environment (required reviewers) that holds:
 #   vars    VPS_HOST, VPS_USER (the swarm manager); a variable named in deploy.passEnv, when the stack interpolates one
 #   secrets SOPS_AGE_KEY (the age identity of .sops.yaml), VPS_SSH_KEY (CI-only deploy key), VPS_KNOWN_HOSTS (pinned host keys)
-# Nothing else is a secret: images are pushed with the workflow token. Dispatch inputs reach scripts only through env.
+# Nothing else is a secret: images are pushed with the workflow token, which also reads the CI verdict of the tag's commit a production deploy
+# waits for (requireCi deploy.prod). Dispatch inputs reach scripts only through env.
 name: deploy stack
 
 on:
@@ -48,6 +49,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      actions: read
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
     steps:{{stackGuard}}
@@ -88,6 +90,7 @@ jobs:
       - name: deploy the release
         env:
           XDG_DATA_HOME: ${{ runner.temp }}/starci-data
+          GH_TOKEN: ${{ github.token }}
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}{{stackImageEnv}}{{stackPassEnv}}
         run: |
           npx --no-install starci app stack deploy --env "$STACK_ENVIRONMENT" \{{stackImageArgs}}

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -17,7 +17,7 @@ concurrency:
   cancel-in-progress: false
 
 # The job shape of the StarCi CI standard (knowledge/hfs/ci-standard.yaml): fast, lint per side, the unit run in shards, one coverage merge, build,
-# sonar, and the database types of the lite edition. Timeouts and the shard count come from ci.jobs of .starcistacks/application-stacks.yaml (defaults in the standard).
+# and sonar. Timeouts and the shard count come from ci.jobs of .starcistacks/application-stacks.yaml (defaults in the standard).
 jobs:
   fast:
     timeout-minutes: {{timeoutFast}}
@@ -110,19 +110,3 @@ jobs:
           NODE_OPTIONS: {{nodeOptions}}
 
 {{sonarJob}}
-  db-types:
-    timeout-minutes: {{timeoutDbTypes}}
-    runs-on: ubuntu-latest
-    steps:
-{{> app/ci-workflows/install-steps.yml}}
-      - name: start Supabase
-        run: npm run db:start
-      - name: apply migrations
-        run: npm run db:reset
-      - name: regenerate database types
-        run: npm run db:types
-      - name: database types are committed
-        run: git diff --exit-code -- supabase/types/database.types.ts
-      - name: stop Supabase
-        if: always()
-        run: npm run db:stop

package/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml

@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
     inputs:
       environment:
-        description: Protected environment with sealed Supabase custody under .starcistacks
+        description: Protected environment whose sealed custody under .starcistacks holds DATABASE_URL
         required: true
         type: environment
       backup_receipt:
@@ -45,7 +45,7 @@ jobs:
         uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
         with:
           version: v3.13.2
-      - name: materialize sealed custody and push migrations
+      - name: materialize sealed custody and migrate the database
         env:
           XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         shell: bash
@@ -57,9 +57,7 @@ jobs:
           secret_dir="$XDG_DATA_HOME/StarCi/secrets/{{project}}/$STACK_ENVIRONMENT"
           trap 'rm -rf -- "$secret_dir"' EXIT
           npx --no-install starci app secret materialize "$STACK_ENVIRONMENT"
-          export SUPABASE_ACCESS_TOKEN="$(cat "$secret_dir/SUPABASE_ACCESS_TOKEN")"
-          export SUPABASE_DB_PASSWORD="$(cat "$secret_dir/SUPABASE_DB_PASSWORD")"
-          project_id="$(cat "$secret_dir/SUPABASE_PROJECT_ID")"
-          npx --no-install supabase link --project-ref "$project_id"
-          npm run db:push -- --dry-run
-          npm run db:push
+          DATABASE_URL="$(cat "$secret_dir/DATABASE_URL")"
+          export DATABASE_URL
+          npx --no-install starci app db migrate --url-env DATABASE_URL
+          STARCI_DB_ARMED=1 npx --no-install starci app db migrate --url-env DATABASE_URL --execute

package/templates/app/ci-workflows-lite/github/workflows/stack-deploy.yml

@@ -8,7 +8,8 @@
 # The environment input names a protected GitHub environment (required reviewers) that holds:
 #   vars    VPS_HOST, VPS_USER (the swarm manager); a variable named in deploy.passEnv, when the stack interpolates one
 #   secrets SOPS_AGE_KEY (the age identity of .sops.yaml), VPS_SSH_KEY (CI-only deploy key), VPS_KNOWN_HOSTS (pinned host keys)
-# Nothing else is a secret: images are pushed with the workflow token. Dispatch inputs reach scripts only through env.
+# Nothing else is a secret: images are pushed with the workflow token, which also reads the CI verdict of the tag's commit a production deploy
+# waits for (requireCi deploy.prod). Dispatch inputs reach scripts only through env.
 name: deploy stack
 
 on:
@@ -48,6 +49,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      actions: read
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
     steps:{{stackGuard}}
@@ -88,6 +90,7 @@ jobs:
       - name: deploy the release
         env:
           XDG_DATA_HOME: ${{ runner.temp }}/starci-data
+          GH_TOKEN: ${{ github.token }}
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}{{stackImageEnv}}{{stackPassEnv}}
         run: |
           npx --no-install starci app stack deploy --env "$STACK_ENVIRONMENT" \{{stackImageArgs}}

package/templates/app/codegen-lite/scripts/codegen.mjs

@@ -1,42 +1,5 @@
 // Generated by {{appBinary}} sync (app root). Do not edit: run "npx {{appBinary}} sync --write".
-// Database types hook, offline: the app compiles against the committed supabase/types/database.types.ts, which `npm run contract:emit`
-// regenerates from the local stack and stamps with the digest of the migrations it was generated from. This refuses a missing or
-// stale file, so lint, typecheck, dev and build never run against types older than the migrations; it starts nothing and needs no stack.
-// `--graphql` runs only the GraphQL wire types below (`npm run codegen:graphql`).
-import { createHash } from "node:crypto"
-import fs from "node:fs"
-import path from "node:path"
-
-const byCodeUnit = (left, right) => {
-    if (left === right) return 0
-    return left < right ? -1 : 1
-}
-
-const MIGRATIONS = path.join("supabase", "migrations")
-const TYPES = path.join("supabase", "types", "database.types.ts")
-const STAMP = /^\/\/ migrations-sha256: ([0-9a-f]{64})$/
-
-const fail = (message) => {
-    console.error(`codegen: ${message}`)
-    process.exit(1)
-}
-
-if (!process.argv.includes("--graphql")) {
-    const hash = createHash("sha256")
-    for (const name of (fs.existsSync(MIGRATIONS) ? fs.readdirSync(MIGRATIONS) : [])
-        .filter((file) => file.endsWith(".sql"))
-        .sort(byCodeUnit)) {
-        hash.update(`${name}\0${fs.readFileSync(path.join(MIGRATIONS, name), "utf8").replace(/\r\n/g, "\n")}\0`)
-    }
-    const digest = hash.digest("hex")
-
-    if (!fs.existsSync(TYPES))
-        fail(`${TYPES} is missing; start the local stack and run \`npm run contract:emit\`, then commit it`)
-    const stamped = STAMP.exec(fs.readFileSync(TYPES, "utf8").split(/\r?\n/, 1)[0])?.[1]
-    if (stamped !== digest)
-        fail(
-            `${TYPES} is ${stamped === undefined ? "not stamped" : "older than the migrations"}; run \`npm run contract:emit\` and commit the regenerated types`,
-        )
-}
+// The GraphQL wire types of the front end (`npm run codegen`, also `npm run codegen:graphql`); a lite app generates no database types.
+// {{> app/codegen-prelude.mjs.partial}}
 
 // {{> app/codegen-graphql.mjs.partial}}

package/templates/app/db-bootstrap/db/bootstrap.sql

@@ -0,0 +1,139 @@
+-- Managed by starci app sync (slot app.db.bootstrap); do not edit: run "npx starci app sync --write".
+-- The pre-migration bootstrap of a lite app's self-hosted PostgreSQL (ruling lite-self-hosted-postgres-passport-minio). Migrations written
+-- for Supabase reference objects GoTrue and Supabase Storage created: the browser roles, the `auth` schema (auth.users, auth.identities,
+-- auth.sessions, auth.uid/jwt/role) and the `storage` schema (storage.buckets, storage.objects). The supabase/postgres image ships only a partial
+-- copy of them, and a lite app runs neither GoTrue nor storage-api: auth is the app's own (integrations/passport) and storage is the S3 endpoint
+-- of integrations/object-storage. This file gives the migrations those objects, EMPTY, and nothing else. It is idempotent; `starci app db migrate`
+-- applies it as the database owner before the first migration of an empty database.
+--
+-- auth.users keeps the GoTrue column set so restored rows and foreign keys from public tables stay valid; encrypted_password holds bcrypt hashes.
+-- auth.uid(), auth.role() and auth.jwt() read the request.jwt.claims setting; the API connects as app_be and sets none, so they return NULL and
+-- every policy that names them denies the browser roles, which have no door in lite.
+
+create schema if not exists extensions;
+create schema if not exists auth;
+create schema if not exists storage;
+
+do $roles$
+begin
+    if not exists (select 1 from pg_roles where rolname = 'anon') then create role anon nologin noinherit; end if;
+    if not exists (select 1 from pg_roles where rolname = 'authenticated') then create role authenticated nologin noinherit; end if;
+    if not exists (select 1 from pg_roles where rolname = 'service_role') then create role service_role nologin noinherit bypassrls; end if;
+end
+$roles$;
+
+grant usage on schema auth, storage to anon, authenticated, service_role;
+grant usage on schema extensions to anon, authenticated, service_role;
+
+-- auth.users: the full GoTrue column set (the image's old copy is extended in place).
+create table if not exists auth.users (id uuid primary key);
+alter table auth.users
+    add column if not exists instance_id uuid,
+    add column if not exists aud varchar(255),
+    add column if not exists role varchar(255),
+    add column if not exists email varchar(255),
+    add column if not exists encrypted_password varchar(255),
+    add column if not exists email_confirmed_at timestamptz,
+    add column if not exists invited_at timestamptz,
+    add column if not exists confirmation_token varchar(255),
+    add column if not exists confirmation_sent_at timestamptz,
+    add column if not exists recovery_token varchar(255),
+    add column if not exists recovery_sent_at timestamptz,
+    add column if not exists email_change_token_new varchar(255),
+    add column if not exists email_change varchar(255),
+    add column if not exists email_change_sent_at timestamptz,
+    add column if not exists last_sign_in_at timestamptz,
+    add column if not exists raw_app_meta_data jsonb,
+    add column if not exists raw_user_meta_data jsonb,
+    add column if not exists is_super_admin boolean,
+    add column if not exists created_at timestamptz,
+    add column if not exists updated_at timestamptz,
+    add column if not exists phone text,
+    add column if not exists phone_confirmed_at timestamptz,
+    add column if not exists confirmed_at timestamptz,
+    add column if not exists banned_until timestamptz,
+    add column if not exists deleted_at timestamptz,
+    add column if not exists is_anonymous boolean not null default false;
+create unique index if not exists users_email_partial_key on auth.users (email) where is_anonymous = false;
+
+create table if not exists auth.identities (
+    provider_id text not null,
+    user_id uuid not null references auth.users (id) on delete cascade,
+    identity_data jsonb not null,
+    provider text not null,
+    last_sign_in_at timestamptz,
+    created_at timestamptz,
+    updated_at timestamptz,
+    email text generated always as (lower(identity_data ->> 'email')) stored,
+    id uuid not null default gen_random_uuid() primary key,
+    unique (provider_id, provider)
+);
+
+create table if not exists auth.sessions (
+    id uuid primary key,
+    user_id uuid not null references auth.users (id) on delete cascade,
+    created_at timestamptz,
+    updated_at timestamptz,
+    factor_id uuid,
+    aal text,
+    not_after timestamptz,
+    refreshed_at timestamp,
+    user_agent text,
+    ip inet,
+    tag text
+);
+create index if not exists sessions_user_id_idx on auth.sessions (user_id);
+
+create or replace function auth.uid() returns uuid language sql stable as
+$$ select nullif(coalesce(current_setting('request.jwt.claim.sub', true), (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')), '')::uuid $$;
+
+create or replace function auth.role() returns text language sql stable as
+$$ select nullif(coalesce(current_setting('request.jwt.claim.role', true), (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'role')), '')::text $$;
+
+create or replace function auth.jwt() returns jsonb language sql stable as
+$$ select coalesce(nullif(current_setting('request.jwt.claim', true), ''), nullif(current_setting('request.jwt.claims', true), ''))::jsonb $$;
+
+grant execute on function auth.uid(), auth.role(), auth.jwt() to public;
+
+-- storage: the two tables the migrations seed and police; the objects live in MinIO, these stay empty bookkeeping.
+create table if not exists storage.buckets (
+    id text primary key,
+    name text not null,
+    owner uuid,
+    created_at timestamptz default now(),
+    updated_at timestamptz default now(),
+    public boolean default false,
+    avif_autodetection boolean default false,
+    file_size_limit bigint,
+    allowed_mime_types text[],
+    owner_id text
+);
+create unique index if not exists bname on storage.buckets (name);
+
+create table if not exists storage.objects (
+    id uuid not null default gen_random_uuid() primary key,
+    bucket_id text references storage.buckets (id),
+    name text,
+    owner uuid,
+    created_at timestamptz default now(),
+    updated_at timestamptz default now(),
+    last_accessed_at timestamptz default now(),
+    metadata jsonb,
+    path_tokens text[] generated always as (string_to_array(name, '/')) stored,
+    version text,
+    owner_id text,
+    user_metadata jsonb
+);
+create unique index if not exists bucketid_objname on storage.objects (bucket_id, name);
+alter table storage.objects enable row level security;
+alter table storage.buckets enable row level security;
+
+grant select, insert, update, delete on storage.objects, storage.buckets to authenticated, service_role;
+grant select on storage.objects, storage.buckets to anon;
+
+-- Replication publication the baseline adds tables to (the image ships it; a bare PostgreSQL does not).
+do $pub$
+begin
+    if not exists (select 1 from pg_publication where pubname = 'supabase_realtime') then create publication supabase_realtime; end if;
+end
+$pub$;

package/templates/app/gitignore-lite

@@ -1,9 +1,6 @@
 {{> common/gitignore.base}}
 # Jest transforms reused by the CI test job
 .jest-cache/
-# Supabase CLI state is local Docker metadata, never application source.
-supabase/.temp/
-supabase/.branches/
 # be: the schema Nest writes when it boots GraphQL
 schema.gql
 # fe: Next build output and its generated type file

package/templates/app/package-scripts/db.json

@@ -0,0 +1,9 @@
+    "db:create": "docker create --name {{project}}-dev-db -p 127.0.0.1:54322:5432 -e POSTGRES_HOST_AUTH_METHOD=trust -v {{project}}-dev-db-data:/var/lib/postgresql/data {{dbImage}}",
+    "db:start": "docker start {{project}}-dev-db",
+    "db:stop": "docker stop {{project}}-dev-db",
+    "db:reset": "docker rm -f {{project}}-dev-db && docker volume rm {{project}}-dev-db-data && npm run db:create && npm run db:start",
+    "db:new": "{{appBinary}} db new",
+    "db:push": "{{appBinary}} db migrate --url-env DATABASE_URL --execute",
+    "db:plan": "{{appBinary}} db plan --url-env DATABASE_URL",
+    "db:dump": "{{appBinary}} db dump --url-env DATABASE_URL --out ../{{project}}-db-backups",
+    "db:lint": "{{appBinary}} check --fast",

package/templates/app/package-scripts/package.json

@@ -9,7 +9,6 @@
     "test:e2e": "npm run typecheck:tests && cd be && jest --selectProjects e2e",
     "test:contract": "npm run typecheck:tests && cd be && jest --selectProjects contract",
     "test:stack": "starci app stack",
-{{supabaseScripts}}
     "contract:emit": "starci app emit"
   }
 }

package/templates/app/package-scripts-lite/package.json

@@ -6,7 +6,7 @@
     "typecheck:tests": "tsc -p be/src/tests/tsconfig.json",
     "test": "cd be && jest --selectProjects unit --coverage",
     "test:integration": "npm run typecheck:tests && cd be && jest --selectProjects integration",
-{{> app/package-scripts/supabase.json}}
+{{> app/package-scripts/db.json}}
 {{backingScripts}}
     "contract:emit": "{{appBinary}} emit"
   }

package/templates/app/skeleton/.starcistacks/dev/README.md

@@ -1,6 +1,6 @@
 # Development stack
 
-Every development dependency runs in Docker Linux containers. This starter's Docker Compose model contains the core API, the product and landing front ends, and a pinned local PostgreSQL database. Compose is an implementation detail; declared dependencies may also use managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts, and local Supabase, when declared, runs through the Supabase CLI. A declared native profile may run app processes locally while dependencies stay in Docker. Trust authentication is confined to this local, unpublished database.
+Every development dependency runs in Docker Linux containers. This starter's Docker Compose model contains the core API, the product and landing front ends, and a pinned local PostgreSQL database. Compose is an implementation detail; declared dependencies may also use managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts. A declared native profile may run app processes locally while dependencies stay in Docker. Trust authentication is confined to this local, unpublished database.
 Starter release images and external secrets must be prepared before starting the container model. Local source development remains available through the app scripts.
 
 | Command | Operation |

package/templates/app/skeleton/.starcistacks/production/README.md

@@ -1,6 +1,6 @@
 # Production stack
 
-The app and its dependencies run on Docker Swarm; Supabase, when declared, is a hosted service. The tracked model declares the application services, one digest-pinned Caddy ingress and one digest-pinned PostgreSQL service on an internal backing network, with its data on a named persistent volume and credentials supplied through mounted secrets. On the first boot of an empty data volume, PostgreSQL runs the mounted `.starcistacks/production/infra/swarm/postgres-init.sh` config to create the `app_be` role with access to this app's database and schema, without superuser, database-creation, role-creation, replication or RLS-bypass privileges. Existing data volumes skip initialization and retain their roles and credentials.
+The app and its dependencies run on Docker Swarm. The tracked model declares the application services, one digest-pinned Caddy ingress and one digest-pinned PostgreSQL service on an internal backing network, with its data on a named persistent volume and credentials supplied through mounted secrets. On the first boot of an empty data volume, PostgreSQL runs the mounted `.starcistacks/production/infra/swarm/postgres-init.sh` config to create the `app_be` role with access to this app's database and schema, without superuser, database-creation, role-creation, replication or RLS-bypass privileges. Existing data volumes skip initialization and retain their roles and credentials.
 The model is a deployment declaration. It contains no owner credentials, real DNS receipt, completed release or restore proof. The public records under `.starcistacks/production/infra/swarm/` mark those owner-run operations as pending. Its all-zero application image digests are illustrative and must be replaced before deployment.
 
 The runtime template tracks no encrypted members. Scaffolding generates the declared database connection, application password and PostgreSQL administrator password members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace them with `starci app secret set production` using the matching host age identity in untracked local custody. The sealed connection uses role `app_be`, database `{{project}}` and internal endpoint `postgres:5432`; its URI-encoded password matches the separate `primary-db-password` member. The administrator password is distinct. The API receives only its least-privilege connection; only PostgreSQL receives the two password files for initialization. The non-empty application password contains no line breaks. The service has no TTY: initialization creates the role without a password, then feeds the two `psql` `\password` prompts through stdin using Bash's builtin `printf`, so psql encrypts it before sending SQL. No password travels in an initialization command argument or a plaintext SQL statement.

package/templates/app/skeleton/README.md

@@ -22,7 +22,7 @@ Declare `ci.github.repository` and `ci.github.defaultBranch` in `.starcistacks/a
 
 ## Development
 
-Every development dependency runs in Docker Linux containers. Local Supabase, when declared, runs through the Supabase CLI; every other declared dependency runs through its managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts or the declared container model. This starter uses Compose to run its pinned local PostgreSQL and app services; Compose is an implementation detail. A declared native profile may run the app processes locally while dependencies stay in Docker. In production, the app and its dependencies run on Docker Swarm, except Supabase, which is a hosted service.
+Every development dependency runs in Docker Linux containers. Every declared dependency runs through its managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts or the declared container model. This starter uses Compose to run its pinned local PostgreSQL and app services; Compose is an implementation detail. A declared native profile may run the app processes locally while dependencies stay in Docker. In production, the app and its dependencies run on Docker Swarm, except Supabase, which is a hosted service.
 
 ```sh
 npm install

package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml

@@ -7,15 +7,15 @@ schema: starci/application-stacks@1
 sources:
   - repository: {{project}}
 backing:
-  supabase:
-    provider: supabase
-    managed: true
+  db:
+    provider: postgres
+    component: db
 components:
   api:
     role: service
     image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
     compose: infra/swarm/stack.yaml
-    purpose: The application's GraphQL API; managed Supabase supplies its database and Auth integration.
+    purpose: The application's GraphQL API, its own Google and password sign-in and its storage integration.
     required: true
   web:
     role: service
@@ -23,6 +23,14 @@ components:
     compose: infra/swarm/stack.yaml
     purpose: The standalone Next.js application with public configuration supplied at build time.
     required: true
+  db:
+    role: service
+    stateful: true
+    volumes: [db-data]
+    image: "supabase/postgres:17.11.0.006@sha256:c141fd17ac6a76c4323e90b3aee8ff1a23d2e89e547c2b963cfadc309c079cc2"
+    compose: infra/swarm/stack.yaml
+    purpose: The app's own PostgreSQL (pg_cron, pg_net, pgmq, vector), migrated by starci app db migrate.
+    required: true
   ingress:
     role: ingress
     stateful: true
@@ -39,6 +47,7 @@ environments:
     components:
       api: {replicas: 1, port: 3001}
       web: {replicas: 1, port: 3000}
+      db: {replicas: 1, port: 5432}
       ingress: {replicas: 1, port: 80}
     runbook: README.md
     ingress:
@@ -62,8 +71,8 @@ environments:
         retention: Seven daily snapshots
         owner: Development operator
         restoreProof: .starcistacks/dev/infra/swarm/recovery/restore-proof.md
-      - component: supabase
-        target: Owner-provisioned encrypted off-host storage for development database exports
+      - component: db
+        target: Owner-provisioned encrypted off-host storage for starci app db dump archives
         retention: Seven daily exports
         owner: Development operator
         restoreProof: .starcistacks/dev/infra/swarm/recovery/restore-proof.md
@@ -75,10 +84,34 @@ environments:
         where: secrets/primary-db-url
         recipientPolicy: This app's own age recipient configured in .sops.yaml
         keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
-      - name: supabase-service-role-key
-        runtimeName: "{{project}}-dev-supabase-service-role-key-v1"
+      - name: db-password
+        runtimeName: "{{project}}-dev-db-password-v1"
+        version: 1
+        where: secrets/db-password
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: google-client-secret
+        runtimeName: "{{project}}-dev-google-client-secret-v1"
+        version: 1
+        where: secrets/google-client-secret
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: auth-jwt-private-key
+        runtimeName: "{{project}}-dev-auth-jwt-private-key-v1"
+        version: 1
+        where: secrets/auth-jwt-private-key
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: storage-access-key-id
+        runtimeName: "{{project}}-dev-storage-access-key-id-v1"
+        version: 1
+        where: secrets/storage-access-key-id
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: storage-secret-access-key
+        runtimeName: "{{project}}-dev-storage-secret-access-key-v1"
         version: 1
-        where: secrets/supabase-service-role-key
+        where: secrets/storage-secret-access-key
         recipientPolicy: This app's own age recipient configured in .sops.yaml
         keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
   production:
@@ -88,6 +121,7 @@ environments:
     components:
       api: {replicas: 1, port: 3001}
       web: {replicas: 1, port: 3000}
+      db: {replicas: 1, port: 5432}
       ingress: {replicas: 1, port: 443, httpPort: 80}
     runbook: README.md
     ingress:
@@ -114,9 +148,9 @@ environments:
         retention: Thirty daily snapshots
         owner: Production operator
         restoreProof: .starcistacks/production/infra/swarm/recovery/restore-proof.md
-      - component: supabase
-        target: Provider PITR plus owner-provisioned encrypted off-host database exports
-        retention: Seven days PITR and thirty daily exports
+      - component: db
+        target: Owner-provisioned encrypted off-host storage for starci app db dump archives
+        retention: Thirty daily encrypted exports
         owner: Production operator
         restoreProof: .starcistacks/production/infra/swarm/recovery/restore-proof.md
     # Scaffolding seals generated placeholders to this app's own recipient; set real values before use.
@@ -127,10 +161,34 @@ environments:
         where: secrets/primary-db-url
         recipientPolicy: This app's own age recipient configured in .sops.yaml
         keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
-      - name: supabase-service-role-key
-        runtimeName: "{{project}}-production-supabase-service-role-key-v1"
+      - name: db-password
+        runtimeName: "{{project}}-production-db-password-v1"
+        version: 1
+        where: secrets/db-password
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: google-client-secret
+        runtimeName: "{{project}}-production-google-client-secret-v1"
         version: 1
-        where: secrets/supabase-service-role-key
+        where: secrets/google-client-secret
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: auth-jwt-private-key
+        runtimeName: "{{project}}-production-auth-jwt-private-key-v1"
+        version: 1
+        where: secrets/auth-jwt-private-key
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: storage-access-key-id
+        runtimeName: "{{project}}-production-storage-access-key-id-v1"
+        version: 1
+        where: secrets/storage-access-key-id
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: storage-secret-access-key
+        runtimeName: "{{project}}-production-storage-secret-access-key-v1"
+        version: 1
+        where: secrets/storage-secret-access-key
         recipientPolicy: This app's own age recipient configured in .sops.yaml
         keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
     # What `starci app stack` deploys (verbs: prepare, doctor, deploy, verify, rollback); names and shapes only, never a value.
@@ -151,9 +209,9 @@ environments:
           buildArgs:
             values:
               NEXT_PUBLIC_SITE_URL: "https://{{project}}.example.invalid"
-              NEXT_PUBLIC_SUPABASE_URL: "https://supabase.{{project}}.example.invalid"
-              NEXT_PUBLIC_SUPABASE_ANON_KEY: "REPLACE_WITH_PUBLIC_SUPABASE_ANON_KEY"
+              NEXT_PUBLIC_API_URL: "https://api.{{project}}.example.invalid"
       volumes:
+        - {{project}}-production-db-data
         - {{project}}-production-ingress-data
         - {{project}}-production-ingress-config-data
       secrets:
@@ -162,7 +220,14 @@ environments:
             filePointers: true
             from:
               - member: primary-db-url
-              - member: supabase-service-role-key
+              - member: google-client-secret
+              - member: auth-jwt-private-key
+              - member: storage-access-key-id
+              - member: storage-secret-access-key
+          - service: db
+            filePointers: true
+            from:
+              - member: db-password
       # Release tasks: an idempotent write the release owes the data (a catalogue sync, a seed upsert) is declared under tasks and listed in postDeploy.
       # A deploy runs postDeploy after the stack converged and before verify, which stays read-only. Uncomment and name the real command:
       # tasks:
@@ -184,7 +249,7 @@ environments:
             retry: true
 k8s:
   status: deferred
-  reason: Lite production uses Docker Swarm with managed Supabase backing; Kubernetes belongs to a future full-edition deployment.
+  reason: Lite production uses Docker Swarm with its own PostgreSQL service; Kubernetes belongs to a future full-edition deployment.
 ci:
   secrets:
     - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app}

package/templates/app/skeleton-lite/.starcistacks/dev/README.md

@@ -1,14 +1,14 @@
 # Development stack
 
-Every development dependency runs in Docker Linux containers. Local Supabase starts through its CLI and supplies PostgreSQL, pgvector, Auth and Storage. Every other declared dependency, such as Redis, starts through its managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts or the declared container model; Compose is an implementation detail. The app services may run in the local Docker Swarm model or through a declared native development profile while dependencies stay in Docker.
-The application image references contain illustrative all-zero digests. Replace them with verified published release digests in the manifest, model and `.starcistacks/dev/infra/swarm/releases/images.lock.yaml` before starting the container model. Replace its starter `SUPABASE_URL` with the local Supabase endpoint reachable from the Swarm node, and seal that local database connection and integration credential; a container cannot use the host's loopback address without owner-configured networking. Local source development remains available through the app scripts.
+Every development dependency runs in Docker Linux containers. The `db` service (image supabase/postgres: PostgreSQL with pg_cron, pg_net, pgmq and pgvector) starts with `npm run db:start` and takes the migrations with `npm run db:push`; storage is the S3-compatible MinIO the environment names. Every other declared dependency, such as Redis, starts through its managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts or the declared container model; Compose is an implementation detail. The app services may run in the local Docker Swarm model or through a declared native development profile while dependencies stay in Docker.
+The application image references contain illustrative all-zero digests. Replace them with verified published release digests in the manifest, model and `.starcistacks/dev/infra/swarm/releases/images.lock.yaml` before starting the container model. Seal the local database connection and the integration credentials; a container cannot use the host's loopback address without owner-configured networking. Local source development remains available through the app scripts.
 
-The runtime template tracks no encrypted members. Scaffolding generates the two declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set dev` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
+The runtime template tracks no encrypted members. Scaffolding generates the six declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set dev` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
 
 | Command | Operation |
 | --- | --- |
-| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. For a declared Redis (its `redis:create`, `redis:start` and `redis:stop` scripts arrive in package.json with the first queue or job), run the create script once, then the start script when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
-| doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
+| prepare | Run `npm run db:start` at the app root; then `npm run db:push` to apply the migrations; export `DATABASE_URL` for the database verbs. For a declared Redis (its `redis:create`, `redis:start` and `redis:stop` scripts arrive in package.json with the first queue or job), run the create script once, then the start script when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
+| doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local database availability. |
 | up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
 | status | Run `docker stack services {{project}}-dev`. |
 | logs | Run `docker service logs {{project}}-dev_api`; never print mounted credentials. |

package/templates/app/skeleton-lite/.starcistacks/dev/environment.json

@@ -1,6 +1,6 @@
 {
   "environment": "dev",
-  "provider": "supabase",
+  "provider": "postgres",
   "project": "{{project}}",
   "runtime": "docker-swarm"
 }

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/recovery/restore-proof.md

@@ -2,6 +2,6 @@
 
 Status: pending owner execution. No backup or restore has been run by scaffolding.
 
-The development operator owns recovery of the managed Supabase database and both external ingress volumes, `{{project}}-dev-ingress-data` and `{{project}}-dev-ingress-config-data`. Retain seven daily encrypted off-host exports or snapshots for each target.
+The development operator owns recovery of the db service's volume `{{project}}-dev-db-data` and both external ingress volumes, `{{project}}-dev-ingress-data` and `{{project}}-dev-ingress-config-data`. Retain seven daily encrypted off-host exports or snapshots for each target.
 
 Before relying on the backup policy, restore a database export and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored ingress configuration and state. Attach the dated result here without credentials.