@starci/hfs 4.9.9 → 4.10.0

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/stack.yaml

@@ -8,13 +8,29 @@ services:
       HTTP_SECURITY_ALLOWED_ORIGINS: http://dev.{{project}}.example.invalid
       PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
       PRIMARY_DB_SCHEMA: public
-      SUPABASE_URL: https://{{project}}.supabase.co
-      SUPABASE_SERVICE_ROLE_KEY_FILE: /run/secrets/supabase-service-role-key
+      GOOGLE_CLIENT_ID: REPLACE_WITH_GOOGLE_OAUTH_CLIENT_ID
+      GOOGLE_CLIENT_SECRET_FILE: /run/secrets/google-client-secret
+      GOOGLE_CALLBACK_URL: http://dev.{{project}}.example.invalid/auth/google/callback
+      AUTH_JWT_ISSUER: http://dev.{{project}}.example.invalid
+      AUTH_JWT_AUDIENCE: {{project}}
+      AUTH_JWT_KEY_ID: dev-1
+      AUTH_JWT_PRIVATE_KEY_FILE: /run/secrets/auth-jwt-private-key
+      STORAGE_ENDPOINT: https://storage.{{project}}.example.invalid
+      STORAGE_REGION: us-east-1
+      STORAGE_BUCKET: {{project}}-dev
+      STORAGE_ACCESS_KEY_ID_FILE: /run/secrets/storage-access-key-id
+      STORAGE_SECRET_ACCESS_KEY_FILE: /run/secrets/storage-secret-access-key
     secrets:
       - source: primary-db-url
         target: primary-db-url
-      - source: supabase-service-role-key
-        target: supabase-service-role-key
+      - source: google-client-secret
+        target: google-client-secret
+      - source: auth-jwt-private-key
+        target: auth-jwt-private-key
+      - source: storage-access-key-id
+        target: storage-access-key-id
+      - source: storage-secret-access-key
+        target: storage-secret-access-key
     networks: [app]
     healthcheck:
       test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
@@ -66,6 +82,38 @@ services:
       restart_policy:
         condition: on-failure
         delay: 5s
+  db:
+    image: "supabase/postgres:17.11.0.006@sha256:c141fd17ac6a76c4323e90b3aee8ff1a23d2e89e547c2b963cfadc309c079cc2"
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD_FILE: /run/secrets/db-password
+    secrets:
+      - source: db-password
+        target: db-password
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
+      interval: 10s
+      timeout: 5s
+      start_period: 30s
+      retries: 5
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == dev"]
+      update_config:
+        parallelism: 1
+        order: stop-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
   ingress:
     image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
     configs:
@@ -104,13 +152,28 @@ secrets:
   primary-db-url:
     external: true
     name: "{{project}}-dev-primary-db-url-v1"
-  supabase-service-role-key:
+  db-password:
+    external: true
+    name: "{{project}}-dev-db-password-v1"
+  google-client-secret:
+    external: true
+    name: "{{project}}-dev-google-client-secret-v1"
+  auth-jwt-private-key:
     external: true
-    name: "{{project}}-dev-supabase-service-role-key-v1"
+    name: "{{project}}-dev-auth-jwt-private-key-v1"
+  storage-access-key-id:
+    external: true
+    name: "{{project}}-dev-storage-access-key-id-v1"
+  storage-secret-access-key:
+    external: true
+    name: "{{project}}-dev-storage-secret-access-key-v1"
 configs:
   ingress-config:
     file: ./Caddyfile
 volumes:
+  db-data:
+    external: true
+    name: "{{project}}-dev-db-data"
   ingress-data:
     external: true
     name: "{{project}}-dev-ingress-data"

package/templates/app/skeleton-lite/.starcistacks/dev/runtime/env/KEYS.md

@@ -1,18 +1,29 @@
 # Environment key roster
 
-This roster declares names only. Scaffolding generates the two declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set dev` before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Store product credential values in sealed custody and materialize private KEY files outside the repository.
+This roster declares names only. Scaffolding generates the six declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set dev` before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Store product credential values in sealed custody and materialize private KEY files outside the repository.
 
 | Key | Consumer |
 | --- | --- |
 | `PORT` | API listener |
 | `HTTP_SECURITY_ALLOWED_ORIGINS` | API origin allowlist |
-| `PRIMARY_DB_URL` | API primary database connection; `.starcistacks/dev/secrets/primary-db-url.enc` maps to external `{{project}}-dev-primary-db-url-v1` and mounted `/run/secrets/primary-db-url` |
+| `PRIMARY_DB_URL` | API least-privilege database connection; `.starcistacks/dev/secrets/primary-db-url.enc` maps to external `{{project}}-dev-primary-db-url-v1` and mounted `/run/secrets/primary-db-url` |
 | `PRIMARY_DB_SCHEMA` | API primary database schema |
-| `SUPABASE_URL` | API Auth and Storage integration |
-| `SUPABASE_SERVICE_ROLE_KEY` | API Auth and Storage integration; `.starcistacks/dev/secrets/supabase-service-role-key.enc` maps to external `{{project}}-dev-supabase-service-role-key-v1` and mounted `/run/secrets/supabase-service-role-key` |
+| `POSTGRES_PASSWORD` | The db service's superuser password; `.starcistacks/dev/secrets/db-password.enc` maps to external `{{project}}-dev-db-password-v1` and mounted `/run/secrets/db-password` |
+| `GOOGLE_CLIENT_ID` | API Google OAuth client |
+| `GOOGLE_CLIENT_SECRET` | API Google OAuth client; `.starcistacks/dev/secrets/google-client-secret.enc` maps to external `{{project}}-dev-google-client-secret-v1` and mounted `/run/secrets/google-client-secret` |
+| `GOOGLE_CALLBACK_URL` | API Google OAuth callback door |
+| `AUTH_JWT_ISSUER` | API access-token issuer |
+| `AUTH_JWT_AUDIENCE` | API access-token audience |
+| `AUTH_JWT_KEY_ID` | API signing key id, published in the JWKS |
+| `AUTH_JWT_PRIVATE_KEY` | API ES256 signing key; `.starcistacks/dev/secrets/auth-jwt-private-key.enc` maps to external `{{project}}-dev-auth-jwt-private-key-v1` and mounted `/run/secrets/auth-jwt-private-key` |
+| `STORAGE_ENDPOINT` | API S3-compatible storage endpoint |
+| `STORAGE_REGION` | API storage signing region |
+| `STORAGE_BUCKET` | API storage bucket |
+| `STORAGE_ACCESS_KEY_ID` | API storage credential; `.starcistacks/dev/secrets/storage-access-key-id.enc` maps to external `{{project}}-dev-storage-access-key-id-v1` and mounted `/run/secrets/storage-access-key-id` |
+| `STORAGE_SECRET_ACCESS_KEY` | API storage credential; `.starcistacks/dev/secrets/storage-secret-access-key.enc` maps to external `{{project}}-dev-storage-secret-access-key-v1` and mounted `/run/secrets/storage-secret-access-key` |
+| `DATABASE_URL` | `starci app db` verbs (migrate, dump, plan) and `contract:emit`, from the operator's environment |
 | `NEXT_PUBLIC_SITE_URL` | Front-end site URL |
+| `NEXT_PUBLIC_API_URL` | Front-end auth doors of the API |
 | `NEXT_PUBLIC_GRAPHQL_URL` | Front-end GraphQL transport |
-| `NEXT_PUBLIC_SUPABASE_URL` | Browser Auth client |
-| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Browser Auth client public key |
 
-Public front-end configuration is supplied at build time and stays outside sealed custody. Production database deployment consumes `SUPABASE_ACCESS_TOKEN`, `SUPABASE_DB_PASSWORD` and `SUPABASE_PROJECT_ID` from its environment's sealed custody; the GitHub secret store carries only the age identity.
+Public front-end configuration is supplied at build time and stays outside sealed custody. The database verbs read `DATABASE_URL` from the operator's environment; the GitHub secret store carries only the age identity.

package/templates/app/skeleton-lite/.starcistacks/production/README.md

@@ -1,11 +1,11 @@
 # Production stack
 
 The tracked model declares Docker Swarm application services and one digest-pinned Caddy ingress.
-Hosted Supabase supplies PostgreSQL, pgvector, Auth and Storage. The app and its other dependencies run on Docker Swarm. A Redis service runs only when `hfs.json` `sides.be.backing` declares it for a capability that needs it: one stateful replica with a digest-pinned image, a named volume with a backup entry and its password as a sealed member granted as a Swarm secret (Redis runs `--appendonly yes` with the volume at `/data`). The scaffold declares none; `starci app add queue|job` declares Redis and renders it here.
+The `db` service (image supabase/postgres) supplies PostgreSQL with pg_cron, pg_net, pgmq and pgvector on a named volume; sign-in is the API's own (Passport) and storage is the S3-compatible MinIO the environment names. The app and its dependencies run on Docker Swarm. A Redis service runs only when `hfs.json` `sides.be.backing` declares it for a capability that needs it: one stateful replica with a digest-pinned image, a named volume with a backup entry and its password as a sealed member granted as a Swarm secret (Redis runs `--appendonly yes` with the volume at `/data`). The scaffold declares none; `starci app add queue|job` declares Redis and renders it here.
 The model is a deployment declaration. It contains no owner credentials, real DNS receipt, completed release or restore proof. Public records under `.starcistacks/production/infra/swarm/` explicitly mark those owner-run operations as pending.
 Its application image references contain illustrative all-zero digests; they identify no published image and must be replaced before deployment.
 
-The runtime template tracks no encrypted members. Scaffolding generates the two declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set production` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
+The runtime template tracks no encrypted members. Scaffolding generates the six declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set production` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
 
 | Command | Operation |
 | --- | --- |
@@ -26,13 +26,13 @@ Every item is pending. Swarm initialization, provider URIs, DNS changes and key
 | Swarm and placement | Initialize the intended manager; label the intended stateful node `{{project}}=production`. Only that node owns the external ingress volumes. |
 | DNS | Replace the reserved `example.invalid` hosts consistently in the manifest, Caddyfile and public configuration; publish address records for the web and API hosts and retain a provider receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
 | TLS | Caddy issues certificates after real DNS resolves. Provision `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data` on the selected node; retain an issuance and renewal receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
-| Database | Provision Supabase and the app_be connection; provider backups remain enabled. Record the provider URI and recovery owner without copying credentials here. |
+| Database | Provision `{{project}}-production-db-data` on the stateful node; after the first deploy create the app_be login through the baseline migration (`starci app db migrate --url-env DATABASE_URL --execute`). Record the recovery owner without copying credentials here. |
 | Secret custody | Replace generated placeholder values with real values at the manifest's declared `.starcistacks/production/secrets/*.enc` paths; record their keys in `.starcistacks/production/runtime/env/KEYS.md`. The app's age identity stays only in the host's untracked `.claude/secret.env`. |
-| External secrets | Materialize the sealed members in owner custody and create `{{project}}-production-primary-db-url-v1` and `{{project}}-production-supabase-service-role-key-v1`. The API reads mounted files; rotation creates new versioned names before updating the model. |
-| Public build configuration | Build the front end with its declared public site and GraphQL URLs, the Supabase public URL and anonymous key. Public browser values stay outside sealed secret custody. |
+| External secrets | Materialize the sealed members in owner custody and create the `{{project}}-production-<member>-v1` external secret of each declared member. The API reads mounted files; rotation creates new versioned names before updating the model. |
+| Public build configuration | Build the front end with its declared public site, API and GraphQL URLs. Public browser values stay outside sealed secret custody. |
 | Immutable release | Replace the illustrative all-zero application digests in the manifest, model and `.starcistacks/production/infra/swarm/releases/images.lock.yaml` with digests produced by the verified release. Store each rendered release under `/srv/{{project}}/releases/<digest>`. Retain the last accepted record in `.starcistacks/production/infra/swarm/releases/previous.yaml`, then move the current pointer and update `.starcistacks/production/infra/swarm/releases/current.yaml` after verification. |
 | Rollback | Retain the previous model and images, redeploy that model if convergence or health fails, and record the resulting convergence receipt. Database changes follow an expand/contract sequence. |
-| Backup | Provision the manifest's seven days of database PITR and thirty daily encrypted off-host database exports and ingress-volume snapshots. Record the actual destination and encryption custody in `.starcistacks/production/infra/swarm/recovery/restore-proof.md`; the production operator owns both components. |
+| Backup | Provision the manifest's thirty daily encrypted off-host database exports (`starci app db dump`) and ingress-volume snapshots. Record the actual destination and encryption custody in `.starcistacks/production/infra/swarm/recovery/restore-proof.md`; the production operator owns both components. |
 | Restore proof | Perform a restore into isolated infrastructure, verify the restored database and ingress state, and attach a dated receipt with artifact digests to `.starcistacks/production/infra/swarm/recovery/restore-proof.md`. Its initial record is pending; no restore has been run by scaffolding. |
 
 No host scheduler is installed. Scheduled application work belongs to the back-end scheduler or an explicitly declared replicated job.

package/templates/app/skeleton-lite/.starcistacks/production/environment.json

@@ -1,6 +1,6 @@
 {
   "environment": "production",
-  "provider": "supabase",
+  "provider": "postgres",
   "project": "{{project}}",
   "runtime": "docker-swarm"
 }

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/recovery/restore-proof.md

@@ -2,6 +2,6 @@
 
 Status: pending owner execution. No backup or restore has been run by scaffolding.
 
-The production operator owns recovery of the managed Supabase database and both external ingress volumes, `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data`. Provision seven days of provider PITR and thirty daily encrypted off-host database exports. Retain thirty daily encrypted off-host snapshots for both ingress volumes.
+The production operator owns recovery of the db service's volume `{{project}}-production-db-data` and both external ingress volumes, `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data`. Provision thirty daily encrypted off-host database exports through `starci app db dump`. Retain thirty daily encrypted off-host snapshots for both ingress volumes.
 
-Before relying on the backup policy, restore the provider database backup and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored TLS and ingress configuration. Attach the dated result here without credentials.
+Before relying on the backup policy, restore a `starci app db dump` archive and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored TLS and ingress configuration. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/stack.yaml

@@ -8,13 +8,29 @@ services:
       HTTP_SECURITY_ALLOWED_ORIGINS: https://{{project}}.example.invalid
       PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
       PRIMARY_DB_SCHEMA: public
-      SUPABASE_URL: https://{{project}}.supabase.co
-      SUPABASE_SERVICE_ROLE_KEY_FILE: /run/secrets/supabase-service-role-key
+      GOOGLE_CLIENT_ID: REPLACE_WITH_GOOGLE_OAUTH_CLIENT_ID
+      GOOGLE_CLIENT_SECRET_FILE: /run/secrets/google-client-secret
+      GOOGLE_CALLBACK_URL: https://api.{{project}}.example.invalid/auth/google/callback
+      AUTH_JWT_ISSUER: https://api.{{project}}.example.invalid
+      AUTH_JWT_AUDIENCE: {{project}}
+      AUTH_JWT_KEY_ID: production-1
+      AUTH_JWT_PRIVATE_KEY_FILE: /run/secrets/auth-jwt-private-key
+      STORAGE_ENDPOINT: https://storage.{{project}}.example.invalid
+      STORAGE_REGION: us-east-1
+      STORAGE_BUCKET: {{project}}-production
+      STORAGE_ACCESS_KEY_ID_FILE: /run/secrets/storage-access-key-id
+      STORAGE_SECRET_ACCESS_KEY_FILE: /run/secrets/storage-secret-access-key
     secrets:
       - source: primary-db-url
         target: primary-db-url
-      - source: supabase-service-role-key
-        target: supabase-service-role-key
+      - source: google-client-secret
+        target: google-client-secret
+      - source: auth-jwt-private-key
+        target: auth-jwt-private-key
+      - source: storage-access-key-id
+        target: storage-access-key-id
+      - source: storage-secret-access-key
+        target: storage-secret-access-key
     networks: [app]
     healthcheck:
       test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
@@ -66,6 +82,38 @@ services:
       restart_policy:
         condition: on-failure
         delay: 5s
+  db:
+    image: "supabase/postgres:17.11.0.006@sha256:c141fd17ac6a76c4323e90b3aee8ff1a23d2e89e547c2b963cfadc309c079cc2"
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_PASSWORD_FILE: /run/secrets/db-password
+    secrets:
+      - source: db-password
+        target: db-password
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
+      interval: 10s
+      timeout: 5s
+      start_period: 30s
+      retries: 5
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: stop-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
   ingress:
     image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
     configs:
@@ -105,13 +153,28 @@ secrets:
   primary-db-url:
     external: true
     name: "{{project}}-production-primary-db-url-v1"
-  supabase-service-role-key:
+  db-password:
+    external: true
+    name: "{{project}}-production-db-password-v1"
+  google-client-secret:
+    external: true
+    name: "{{project}}-production-google-client-secret-v1"
+  auth-jwt-private-key:
     external: true
-    name: "{{project}}-production-supabase-service-role-key-v1"
+    name: "{{project}}-production-auth-jwt-private-key-v1"
+  storage-access-key-id:
+    external: true
+    name: "{{project}}-production-storage-access-key-id-v1"
+  storage-secret-access-key:
+    external: true
+    name: "{{project}}-production-storage-secret-access-key-v1"
 configs:
   ingress-config:
     file: ./Caddyfile
 volumes:
+  db-data:
+    external: true
+    name: "{{project}}-production-db-data"
   ingress-data:
     external: true
     name: "{{project}}-production-ingress-data"

package/templates/app/skeleton-lite/.starcistacks/production/runtime/env/KEYS.md

@@ -1,6 +1,6 @@
 # Production environment key roster
 
-This inventory declares names, consumers and mounted file paths. Scaffolding generates the two declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set production` after owner provisioning and before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Scaffolding supplies no deployment credential or successful deployment.
+This inventory declares names, consumers and mounted file paths. Scaffolding generates the six declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set production` after owner provisioning and before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Scaffolding supplies no deployment credential or successful deployment.
 
 | Key | Consumer |
 | --- | --- |
@@ -8,14 +8,22 @@ This inventory declares names, consumers and mounted file paths. Scaffolding gen
 | `HTTP_SECURITY_ALLOWED_ORIGINS` | API origin allowlist |
 | `PRIMARY_DB_URL` | API least-privilege database connection; reads `PRIMARY_DB_URL_FILE` at `/run/secrets/primary-db-url` |
 | `PRIMARY_DB_SCHEMA` | API primary database schema |
-| `SUPABASE_URL` | API Auth and Storage integration |
-| `SUPABASE_SERVICE_ROLE_KEY` | API Auth and Storage integration; reads `SUPABASE_SERVICE_ROLE_KEY_FILE` at `/run/secrets/supabase-service-role-key` |
+| `POSTGRES_PASSWORD` | The db service's superuser password; reads `POSTGRES_PASSWORD_FILE` at `/run/secrets/db-password` |
+| `GOOGLE_CLIENT_ID` | API Google OAuth client |
+| `GOOGLE_CLIENT_SECRET` | API Google OAuth client; reads `GOOGLE_CLIENT_SECRET_FILE` at `/run/secrets/google-client-secret` |
+| `GOOGLE_CALLBACK_URL` | API Google OAuth callback door |
+| `AUTH_JWT_ISSUER` | API access-token issuer |
+| `AUTH_JWT_AUDIENCE` | API access-token audience |
+| `AUTH_JWT_KEY_ID` | API signing key id, published in the JWKS |
+| `AUTH_JWT_PRIVATE_KEY` | API ES256 signing key; reads `AUTH_JWT_PRIVATE_KEY_FILE` at `/run/secrets/auth-jwt-private-key` |
+| `STORAGE_ENDPOINT` | API S3-compatible storage endpoint |
+| `STORAGE_REGION` | API storage signing region |
+| `STORAGE_BUCKET` | API storage bucket |
+| `STORAGE_ACCESS_KEY_ID` | API storage credential; reads `STORAGE_ACCESS_KEY_ID_FILE` at `/run/secrets/storage-access-key-id` |
+| `STORAGE_SECRET_ACCESS_KEY` | API storage credential; reads `STORAGE_SECRET_ACCESS_KEY_FILE` at `/run/secrets/storage-secret-access-key` |
+| `DATABASE_URL` | `starci app db` verbs (migrate, dump, plan) and `contract:emit`, from the operator's environment |
 | `NEXT_PUBLIC_SITE_URL` | Front-end site URL |
+| `NEXT_PUBLIC_API_URL` | Front-end auth doors of the API |
 | `NEXT_PUBLIC_GRAPHQL_URL` | Front-end GraphQL transport |
-| `NEXT_PUBLIC_SUPABASE_URL` | Browser Auth client |
-| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Browser Auth client public key |
-| `SUPABASE_ACCESS_TOKEN` | Production database deployment |
-| `SUPABASE_DB_PASSWORD` | Production database deployment |
-| `SUPABASE_PROJECT_ID` | Production database deployment |
 
-Public front-end configuration is supplied at build time and stays outside sealed custody. Set real values in `.starcistacks/production/secrets/primary-db-url.enc` and `.starcistacks/production/secrets/supabase-service-role-key.enc` at the declared paths. Versioned external application secrets are `{{project}}-production-primary-db-url-v1` and `{{project}}-production-supabase-service-role-key-v1`. Seal deployment-only credentials separately under `.starcistacks/production/secrets/*.enc`; they never enter an API container.
+Public front-end configuration is supplied at build time and stays outside sealed custody. Set real values in the six `.starcistacks/production/secrets/*.enc` members at the declared paths; their versioned external secrets are `{{project}}-production-<member>-v1`. The database deploy workflow reads `DATABASE_URL` from the sealed `database-url` member of its environment; it never enters an API container.

package/templates/app/skeleton-lite/README.md

@@ -1,20 +1,20 @@
 # {{project}}
 
-One StarCi lite app: a Nest API in `be/`, one Next web app in `fe/`, and Supabase as the schema authority.
+One StarCi lite app: a Nest API in `be/`, one Next web app in `fe/`, and its own PostgreSQL with SQL migrations in `db/` as the schema authority.
 
 ## Overview
 
-The starter keeps one deployable API and one web app, with the same code structure as a full app: the web app calls the API over GraphQL (`fe/apps/web/src/modules/api`, SWR hooks under `fe/apps/web/src/hooks/swr`) and uses Supabase only for Auth in the browser (`fe/apps/web/src/modules/auth`); every data read and write goes through the API, which verifies the access token.
+The starter keeps one deployable API and one web app, with the same code structure as a full app: the web app calls the API over GraphQL (`fe/apps/web/src/modules/api`, SWR hooks under `fe/apps/web/src/hooks/swr`) and signs in only through the API's own auth doors (`fe/apps/web/src/modules/auth`, which holds the access token in memory while the refresh token stays in an httpOnly cookie); every data read and write goes through the API, which verifies the access token against its own keys.
 
 ## Stack
 
-TypeScript everywhere, NestJS in `be/`, Next.js with next-intl in `fe/`, Supabase for Auth and PostgreSQL, npm workspaces, and Turbo for front-end tasks.
+TypeScript everywhere, NestJS in `be/`, Next.js with next-intl in `fe/`, PostgreSQL (the `db` service, image supabase/postgres), Passport for Google and password sign-in, S3-compatible storage (MinIO), npm workspaces, and Turbo for front-end tasks.
 
 ## Repository layout
 
-- `supabase/`: local configuration, forward-only SQL migrations, seed data, and generated database types.
-- `be/`: the API, shared platform capabilities, verified identity admission, and privileged Supabase integrations.
-- `fe/`: the web app; the only Supabase client is the Auth client of `fe/apps/web/src/modules/auth`, data goes through `fe/apps/web/src/modules/api`.
+- `db/`: forward-only SQL migrations, seed data, and generated database types.
+- `be/`: the API, shared platform capabilities, verified identity admission, and the passport and storage integrations.
+- `fe/`: the web app; it holds no credential, signs in through `fe/apps/web/src/modules/auth` and reaches data through `fe/apps/web/src/modules/api`.
 - `.starcistacks/`: value-free environment metadata and encrypted-secret custody.
 - `.starciwork/`: `.gitignore`, `.starciwork/workspace.yaml` project metadata and repo roles, and optional brand drawing records, references, and assets.
 
@@ -24,7 +24,7 @@ Declare `ci.github.repository` and `ci.github.defaultBranch` in `.starcistacks/a
 
 ## Development
 
-Every development dependency runs in Docker Linux containers. Start local Supabase with `npm run db:start` through the Supabase CLI; start any other declared dependency through its managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts or the declared container model. Compose is an implementation detail. Configure the local environment and start the API and web app using the package scripts for the declared development profile. In production, the app and its dependencies run on Docker Swarm, except Supabase, which is a hosted service; Supabase pgvector owns vector search.
+Every development dependency runs in Docker Linux containers. Create the local database once with `npm run db:create`, start it with `npm run db:start` (one container of the pinned `db` image, on 127.0.0.1:54322), export `DATABASE_URL=postgresql://supabase_admin@127.0.0.1:54322/postgres` and apply `db/bootstrap.sql` and the migrations with `npm run db:push`; start any other declared dependency through its managed `<dep>:create`, `<dep>:start` and `<dep>:stop` scripts or the declared container model. Compose is an implementation detail. Configure the local environment and start the API and web app using the package scripts for the declared development profile. In production, the app and its dependencies, the database included, run on Docker Swarm; pgvector owns vector search.
 
 ```sh
 npm install
@@ -36,17 +36,17 @@ npm run build:be
 npm run build:fe
 ```
 
-The API reads `PORT`, `HTTP_SECURITY_ALLOWED_ORIGINS`, `PRIMARY_DB_URL`, `PRIMARY_DB_SCHEMA`, `SUPABASE_URL`, and `SUPABASE_SERVICE_ROLE_KEY`. The web app reads `NEXT_PUBLIC_SITE_URL`, `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, and, once the first GraphQL operation exists, `NEXT_PUBLIC_GRAPHQL_URL`. Missing configuration stops the relevant process with a named error; no template supplies credential defaults.
+The API reads `PORT`, `HTTP_SECURITY_ALLOWED_ORIGINS`, `PRIMARY_DB_URL`, `PRIMARY_DB_SCHEMA`, the Google OAuth keys `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` and `GOOGLE_CALLBACK_URL`, its own token keys `AUTH_JWT_ISSUER`, `AUTH_JWT_AUDIENCE`, `AUTH_JWT_KEY_ID` and `AUTH_JWT_PRIVATE_KEY`, and the storage keys `STORAGE_ENDPOINT`, `STORAGE_REGION`, `STORAGE_BUCKET`, `STORAGE_ACCESS_KEY_ID` and `STORAGE_SECRET_ACCESS_KEY`. The database tooling reads `DATABASE_URL`. The web app reads `NEXT_PUBLIC_SITE_URL`, `NEXT_PUBLIC_API_URL`, and, once the first GraphQL operation exists, `NEXT_PUBLIC_GRAPHQL_URL`. Missing configuration stops the relevant process with a named error; no template supplies credential defaults.
 
-Production browser build values live in `.starcistacks/application-stacks.yaml` under `environments.production.deploy.images.web.buildArgs.values`. Before building deployment images, replace the placeholders with your site's public origin, your Supabase project's public URL, and its public anonymous key. These values reach every browser; keep the service role key in sealed runtime custody.
+Production browser build values live in `.starcistacks/application-stacks.yaml` under `environments.production.deploy.images.web.buildArgs.values`. Before building deployment images, replace the placeholders with your site's and your API's public origins. These values reach every browser; every credential stays in sealed runtime custody.
 
-`npm test` runs the back end's unit specs with per-file coverage. Optional integration specs run with `npm run test:integration` against the local Supabase stack (`npm run db:start`); a lite app has no e2e world.
+`npm test` runs the back end's unit specs with per-file coverage. Optional integration specs run with `npm run test:integration` against the local database (`npm run db:start`, then `npm run db:push`); a lite app has no e2e world.
 
 The public runtime template tracks only sealed member names. Scaffolding creates this app's own age recipient and encrypts generated placeholder values into the declared `.starcistacks/<environment>/secrets/*.enc` members. Keep the matching host age identity in untracked local custody, then use `starci app secret set` to replace each placeholder with an actual value before deployment. Product apps retain sealed member custody. Runtime specs use disposable copies with ephemeral identities and remove them afterwards.
 
 ## Database changes
 
-Create a forward-only migration under `supabase/migrations`, keep each table's RLS policies and grants beside the table, and run `npm run contract:emit` to refresh `supabase/types/database.types.ts`. `starci app add table <name> --fe` adds the table with its GraphQL feature on the API and its operations and SWR hooks in the web app; `npm run codegen:graphql` regenerates the web app's wire types from `be/contracts/<app>/schema.graphql`.
+Create a forward-only migration with `npm run db:new -- <kebab-name>` (it lands in `db/migrations`), keep each table's RLS policies and grants beside the table, apply it with `npm run db:push`, and run `npm run contract:emit` to refresh `db/types/database.types.ts`. `starci app add table <name> --fe` adds the table with its GraphQL feature on the API and its operations and SWR hooks in the web app; `npm run codegen:graphql` regenerates the web app's wire types from `be/contracts/<app>/schema.graphql`.
 
 ## Work
 

package/templates/app/skeleton-lite/{supabase → db}/migrations/__timestamp___baseline.sql

@@ -6,7 +6,7 @@ begin
 end;
 $$;
 
--- The attributes a Supabase migration role may change: SUPERUSER and BYPASSRLS stay as create role set them (the role migration owner is no superuser).
+-- The attributes a migration may change: SUPERUSER and BYPASSRLS stay as create role set them.
 alter role app_be login noinherit nocreatedb nocreaterole;
 
 create schema if not exists private;
@@ -24,6 +24,26 @@ begin
 end;
 $$;
 
+-- The rotating refresh sessions of integrations/passport (auth.users comes from db/bootstrap.sql).
+-- One row per issued refresh token, stored by its sha256 only. A family is one sign-in; rotation revokes the presented row
+-- and inserts its successor, and presenting a revoked row revokes the whole family (reuse detection).
+create table auth.refresh_sessions (
+    id uuid primary key default gen_random_uuid(),
+    family_id uuid not null,
+    user_id uuid not null references auth.users (id) on delete cascade,
+    token_hash char(64) not null unique,
+    expires_at timestamptz not null,
+    revoked_at timestamptz,
+    created_at timestamptz not null default now()
+);
+
+create index refresh_sessions_family_idx on auth.refresh_sessions (family_id);
+
+grant usage on schema auth to app_be;
+grant select, insert, update on table auth.users to app_be;
+grant select, insert on table auth.identities to app_be;
+grant select, insert, update on table auth.refresh_sessions to app_be;
+
 create table public.profiles (
     id uuid primary key references auth.users (id) on delete cascade,
     display_name text not null check (char_length(display_name) between 1 and 120),

package/templates/app/tool-config-lite/prettierignore

@@ -1,2 +1 @@
 {{> app/tool-config/prettierignore}}
-supabase/types/

package/templates/be/inbox/database-client.spec.ts.tpl

@@ -1,15 +1,19 @@
 import { mockEntityManager } from "@starci/jest-preset"
 import type { EntityManager } from "typeorm"
-import { sql } from "./database.sql"
 import { DatabaseErrorCode } from "./errors/database.error"
-import { recordWebhookDelivery } from "./webhook-inbox.client"
+import { recordWebhookDelivery, webhookReceiptInsert } from "./webhook-inbox.client"
 
-// The caller owns the conflict-safe pending-row insert; an opaque function call stands in for it here.
-const INSERT = sql`SELECT id FROM record_spec_inbox($1, $2, $3::jsonb)`
+const INSERT = webhookReceiptInsert("spec_inbox")
 const PAYLOAD = { id: "delivery-1" }
 
 const record = (manager: EntityManager, deliveryId: string | undefined) =>
-    recordWebhookDelivery({ manager, insert: INSERT, provider: "spec", deliveryId, payload: PAYLOAD })
+    recordWebhookDelivery({ manager, table: "spec_inbox", provider: "spec", deliveryId, payload: PAYLOAD })
+
+describe("webhookReceiptInsert", () => {
+    it("refuses a table name that is not a lowercase identifier", () => {
+        expect(() => webhookReceiptInsert("spec; drop table x")).toThrow(TypeError)
+    })
+})
 
 describe("recordWebhookDelivery", () => {
     it("records a new delivery through the caller's transaction manager", async () => {

package/templates/be/inbox/database-client.ts.tpl

@@ -1,10 +1,10 @@
 import type { EntityManager } from "typeorm"
 import { DatabaseError, DatabaseErrorCode } from "./errors/database.error"
-import type { SqlText } from "./database.sql"
 
 interface RecordWebhookDelivery {
     readonly manager: EntityManager
-    readonly insert: SqlText
+    /** The provider inbox table under public, created by its db migration. */
+    readonly table: string
     readonly provider: string
     readonly deliveryId: string | undefined
     readonly payload: object
@@ -12,13 +12,22 @@ interface RecordWebhookDelivery {
 
 type WebhookReceiptId = string | undefined
 
+/** A provider inbox table name: a lowercase identifier, never a value. */
+const TABLE = /^[a-z_][a-z0-9_]*$/
+
+/** The conflict-safe insert of one pending delivery into `public.<table>`, answering its id only to the winning transaction. */
+export const webhookReceiptInsert = (table: string): string => {
+    if (!TABLE.test(table)) throw new TypeError(`${table} is not a provider inbox table name`)
+    return `INSERT INTO public.${table} (provider, delivery_id, payload) VALUES ($1, $2, $3::jsonb) ON CONFLICT (provider, delivery_id) DO NOTHING RETURNING id`
+}
+
 /**
  * Records one pending delivery using the intake's transaction manager and returns its durable receipt identity.
  * Business processing and the completion marker belong to the reactor or job that consumes the committed row.
  */
 export const recordWebhookDelivery = async ({
     manager,
-    insert,
+    table,
     provider,
     deliveryId,
     payload,
@@ -27,7 +36,7 @@ export const recordWebhookDelivery = async ({
     if (!normalizedDeliveryId) {
         throw new DatabaseError({ code: DatabaseErrorCode.WebhookDeliveryIdRequired })
     }
-    const rows: Array<{ readonly id: string }> = await manager.query(insert, [
+    const rows: Array<{ readonly id: string }> = await manager.query(webhookReceiptInsert(table), [
         provider,
         normalizedDeliveryId,
         JSON.stringify(payload),

package/templates/be/inbox/platform/client-operation-outcomes.sql.tpl

@@ -16,3 +16,50 @@ on public.inbox for delete to app_be
 using (source like 'client:%' and request_fingerprint is not null and outcome is not null);
 
 grant update, delete on table public.inbox to app_be;
+
+-- The client claim, its saved outcome and the bounded retention sweep, called through callDbFunction of platform/database (R334).
+-- A conflicting claim locks the existing row and returns its committed fingerprint and outcome after the winner commits.
+create function public.inbox_claim_client(p_source text, p_event_id text, p_fingerprint varchar, p_claimed_at timestamptz)
+returns table (request_fingerprint varchar, outcome jsonb, incomplete boolean)
+language sql
+as $$
+    insert into public.inbox as i (source, event_id, request_fingerprint, claimed_at)
+    values (p_source, p_event_id, p_fingerprint, p_claimed_at)
+    on conflict (source, event_id) do update set outcome = coalesce(i.outcome, '{}'::jsonb)
+    returning i.request_fingerprint, i.outcome,
+        (i.outcome is not null and (jsonb_typeof(i.outcome) <> 'object' or not (i.outcome ? 'value')))
+$$;
+
+create function public.inbox_save_client_outcome(p_source text, p_event_id text, p_outcome jsonb)
+returns table (outcome jsonb)
+language sql
+as $$
+    update public.inbox as i set outcome = p_outcome
+     where i.source = p_source and i.event_id = p_event_id
+    returning i.outcome
+$$;
+
+-- Retention never deletes delivery rows or an incomplete claim; its bounded batch skips rows held by active retries.
+create function public.inbox_sweep_clients(p_cutoff timestamptz, p_limit integer)
+returns table (deleted_count integer)
+language sql
+as $$
+    with expired as (
+        select source, event_id from public.inbox
+         where source like 'client:%' and request_fingerprint is not null and outcome is not null
+           and jsonb_typeof(outcome) = 'object' and outcome ? 'value' and claimed_at < p_cutoff
+         order by claimed_at, source, event_id limit p_limit for update skip locked
+    ), deleted as (
+        delete from public.inbox as claims using expired
+         where claims.source = expired.source and claims.event_id = expired.event_id
+        returning claims.event_id
+    )
+    select count(*)::integer from deleted
+$$;
+
+revoke all on function public.inbox_claim_client(text, text, varchar, timestamptz) from public;
+grant execute on function public.inbox_claim_client(text, text, varchar, timestamptz) to app_be;
+revoke all on function public.inbox_save_client_outcome(text, text, jsonb) from public;
+grant execute on function public.inbox_save_client_outcome(text, text, jsonb) to app_be;
+revoke all on function public.inbox_sweep_clients(timestamptz, integer) from public;
+grant execute on function public.inbox_sweep_clients(timestamptz, integer) to app_be;

package/templates/be/inbox/platform/event-bus/event-bus.service.spec.ts.tpl

@@ -3,7 +3,9 @@ import { fakeTransaction, mockEntityManager } from "@starci/jest-preset"
 import { EventBusErrorCode } from "./errors/event-bus.error"
 import { BaseEvent } from "./event-bus.contracts"
 import { EventBusService } from "./event-bus.service"
-import { INSERT_OUTBOX_EVENT } from "./persistence/event-bus.sql"
+
+// The statement callDbFunction of platform/database sends for event_bus_write.
+const INSERT_OUTBOX_EVENT = "SELECT * FROM event_bus_write($1, $2, $3, $4)"
 
 class ReceiptRecordedEvent extends BaseEvent {
     readonly eventId = "receipt-1"

package/templates/be/inbox/platform/event-bus/event-bus.service.ts.tpl

@@ -4,7 +4,7 @@ import { isCorrelationId } from "@modules/platform/logging"
 import { EventBusError, EventBusErrorCode } from "./errors/event-bus.error"
 import type { BaseEvent, EventEnvelope } from "./event-bus.contracts"
 import type { EventBus } from "./event-bus.port"
-import { INSERT_OUTBOX_EVENT } from "./persistence/event-bus.sql"
+import { callDbFunction } from "@modules/platform/database"
 
 @Injectable()
 /** Writes a receipt event into the same transaction as its inbox receipt, without running any consumer. */
@@ -18,6 +18,6 @@ export class EventBusService implements EventBus {
             eventName: event.eventName,
             payload: event.payload,
         }
-        await tx.query(INSERT_OUTBOX_EVENT, [event.eventId, event.eventName, JSON.stringify(envelope), correlationId])
+        await callDbFunction(tx, "event_bus_write", [event.eventId, event.eventName, JSON.stringify(envelope), correlationId])
     }
 }

package/templates/be/inbox/platform/inbox/inbox.service.spec.ts.tpl

@@ -7,7 +7,12 @@ import { CLOCK } from "@modules/platform/clock"
 import { InboxError, InboxErrorCode } from "./errors/inbox.error"
 import { requestFingerprint } from "./request-fingerprint.policy"
 import { PostgresInbox } from "./inbox.service"
-import { CLAIM_CLIENT, CLAIM_EVENT, SAVE_CLIENT_OUTCOME, SWEEP_CLIENTS } from "./persistence/inbox.sql"
+
+// The statements callDbFunction of platform/database sends for each inbox function.
+const CLAIM_EVENT = "SELECT * FROM inbox_claim_event($1, $2)"
+const CLAIM_CLIENT = "SELECT * FROM inbox_claim_client($1, $2, $3, $4)"
+const SAVE_CLIENT_OUTCOME = "SELECT * FROM inbox_save_client_outcome($1, $2, $3)"
+const SWEEP_CLIENTS = "SELECT * FROM inbox_sweep_clients($1, $2)"
 
 const runClient = <T>(
     inbox: PostgresInbox,