@starci/hfs 4.9.9 → 4.10.0

package/emit/db-types.mjs

@@ -1,271 +0,0 @@
-/**
- * `supabase/types/database.types.ts` (slot `app.supabase.types`): the Database types the Supabase CLI generates from an app's
- * local stack, written by `npm run contract:emit` (`starci app emit`) beside the be contract snapshots and judged for drift
- * by DB_TYPES_DRIFT (L09, scripts/hfs/rules/database.mjs) - the rule compares the committed file with the text `emitTypes()`
- * produces, and `dbTypesEmitter` below is that callback.
- *
- * The text is `supabase gen types typescript --local` run at the app root against the running local stack, narrowed to the
- * schemas `supabase/config.toml` declares under [api]; the CLI reaches Docker, so nothing here runs inside a check that has
- * no stack. `run` is the command runner - `(file, args, {cwd})` answering the spawnSync result `{status, stdout, stderr}` -
- * the default spawns the `supabase` binary with an argument array, never a shell string and never printing env; a spec's fake
- * keeps Docker out of the suite. Before generation, `migration list --local` must prove that the database's applied versions
- * equal the migration filename stamps (HFS_EMIT_DB_TYPES_STALE otherwise). Unreadable history or failed generation throws HFS_EMIT_DB_TYPES_FAILED.
- */
-import { createHash } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { parse as parseToml } from 'smol-toml';
-import { bundledPins } from '../runtime/scripts/hfs/canon-pins.mjs';
-
-/** The repository-relative path of the generated types (the path of slot `app.supabase.types`). */
-export const dbTypesPath = 'supabase/types/database.types.ts';
-
-/** The folder of the app's migrations, and the first line of the committed types: the digest of the migrations they were generated from. */
-const MIGRATIONS_DIR = 'supabase/migrations';
-const TYPES_STAMP = '// migrations-sha256: ';
-
-/**
- * The sha256 of the app's migrations, hex: every `supabase/migrations/*.sql` by name, each as name, NUL, its text with LF line ends,
- * NUL. The offline codegen hook of a lite app (templates/app/codegen-lite) computes the same digest and refuses types stamped with another.
- */
-function migrationsDigest(root) {
-  const dir = path.join(root, MIGRATIONS_DIR);
-  const hash = createHash('sha256');
-  for (const name of (fs.existsSync(dir) ? fs.readdirSync(dir) : []).filter((file) => file.endsWith('.sql')).sort()) {
-    hash.update(`${name}\0${fs.readFileSync(path.join(dir, name), 'utf8').replace(/\r\n/g, '\n')}\0`);
-  }
-  return hash.digest('hex');
-}
-
-/** The slot that owns the generated types; enabled by a connection declaring provider supabase. */
-const DB_TYPES_SLOT = 'app.supabase.types';
-
-/** The config file whose [api] schemas narrow the generation. */
-const CONFIG_FILE = 'supabase/config.toml';
-const SUPABASE_CLI = 'supabase';
-
-/** A types emit refuses unreadable history or failed generation with HFS_EMIT_DB_TYPES_FAILED, and unequal applied versions with HFS_EMIT_DB_TYPES_STALE. */
-class DbTypesError extends Error {
-  constructor(message, details = {}, code = 'HFS_EMIT_DB_TYPES_FAILED') {
-    super(`${code}: ${message}`);
-    this.name = 'DbTypesError';
-    this.code = code;
-    this.details = details;
-  }
-}
-
-const spawn = (file, args, options = {}) => spawnSync(file, args, { encoding: 'utf8', windowsHide: true, maxBuffer: 64 * 1024 * 1024, ...options });
-
-/**
- * The one spawn: an argument array, a hidden window, a bound buffer, never a shell. Specs inject a fake of the same shape. The
- * `supabase` binary is the one on PATH; a machine without it runs the CLI at the canon pin through npx (the pin of knowledge/hfs/canon-pins.yaml).
- */
-const withNpxFallback = (run, platform) => (file, args, options = {}) => {
-  const first = run(file, args, options);
-  if (file !== SUPABASE_CLI || first.error?.code !== 'ENOENT') return first;
-  const version = bundledPins()[SUPABASE_CLI]?.version;
-  if (!version) return first;
-  return platform === 'win32'
-    ? run('cmd.exe', ['/d', '/s', '/c', 'npx', '--yes', `${SUPABASE_CLI}@${version}`, ...args], options)
-    : run('npx', ['--yes', `${SUPABASE_CLI}@${version}`, ...args], options);
-};
-
-/** The first meaningful line of a failure output, for the error a human acts on. */
-const firstLine = (text) => String(text ?? '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean)[0];
-
-const START_TAIL_LINES = 12;
-const START_LINE_CHARS = 300;
-/** The last lines (bounded) of a failed `supabase start`: its cause (42501 permission denied to alter role) sits after the first progress lines, so the first line alone hid it. */
-const startDetail = (started) => {
-  const text = [started?.stderr, started?.stdout, started?.error?.message ?? started?.error].map((part) => String(part ?? '')).find((part) => part.trim()) ?? '';
-  const lines = text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => (line.length > START_LINE_CHARS ? `${line.slice(0, START_LINE_CHARS)}...` : line));
-  return lines.length ? lines.slice(-START_TAIL_LINES).join(' | ') : 'no output';
-};
-
-/**
- * The schemas `supabase/config.toml` exposes under [api] (`[]` when the file or the list is absent - the CLI then reads its
- * own defaults). A config that does not parse is a refusal: L08 reads the same file and the emit must not guess.
- */
-function apiSchemas(root) {
-  const file = path.join(root, CONFIG_FILE);
-  if (!fs.existsSync(file)) return [];
-  let toml;
-  try { toml = parseToml(fs.readFileSync(file, 'utf8')); } catch (error) {
-    throw new DbTypesError(`${CONFIG_FILE} is not readable valid TOML (${firstLine(error?.message ?? error) ?? 'unreadable'}); the types scope comes from its [api] schemas`, { file: CONFIG_FILE });
-  }
-  return (toml?.api?.schemas ?? []).filter((schema) => typeof schema === 'string');
-}
-
-/** CLI JSON and table rows use the remote field for the database history even with --local; local only describes files. */
-function historyVersion(value) {
-  if (value == null || value === '') return null;
-  if (typeof value !== 'string' || !/^\d+$/.test(value)) {
-    throw new DbTypesError('the local migration history contains an unreadable row', { file: dbTypesPath });
-  }
-  return value;
-}
-
-/** JSON must explicitly carry a migrations array; an empty array proves an empty database history. */
-function jsonAppliedVersions(text) {
-  let history;
-  try { history = JSON.parse(text); } catch {
-    throw new DbTypesError('the local migration history contains unreadable JSON', { file: dbTypesPath });
-  }
-  if (!Array.isArray(history?.migrations)) {
-    throw new DbTypesError('the local migration history has no migrations array', { file: dbTypesPath });
-  }
-  const versions = new Set();
-  for (const row of history.migrations) {
-    if (!row || !Object.hasOwn(row, 'local') || !Object.hasOwn(row, 'remote')) {
-      throw new DbTypesError('the local migration history contains an unreadable row', { file: dbTypesPath });
-    }
-    historyVersion(row.local);
-    const applied = historyVersion(row.remote);
-    if (applied) versions.add(applied);
-  }
-  return versions;
-}
-
-/** Optional outer borders do not add columns; pretty output may wrap each table cell in Markdown backticks. */
-const historyCells = (line, bordered) => {
-  const row = bordered ? line.trim().replace(/^\|/, '').replace(/\|$/, '') : line;
-  return row.split('|').map((cell) => cell.trim().replace(/^`(.*)`$/, '$1'));
-};
-
-/** A recognized header, including a header without rows, proves a table history; malformed rows still refuse. */
-function tableAppliedVersions(lines, header) {
-  const versions = new Set();
-  const bordered = /^\s*\|/.test(lines[header]);
-  const width = historyCells(lines[header], bordered).length;
-  for (const line of lines.slice(header + 1)) {
-    if (/^[\s|+-]+$/.test(line)) continue;
-    if (!line.includes('|')) continue;
-    const cells = historyCells(line, bordered);
-    if (cells.length !== width) {
-      throw new DbTypesError('the local migration history contains an unreadable row', { file: dbTypesPath });
-    }
-    historyVersion(cells[0]);
-    const applied = historyVersion(cells[1]);
-    if (applied) versions.add(applied);
-  }
-  return versions;
-}
-
-/** Read either CLI stream, stripping terminal colors, and require an explicit JSON history or Local | Remote [| Time] header. */
-function appliedVersions(result) {
-  for (const output of [result.stdout, result.stderr]) {
-    const text = String(output ?? '').replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').replaceAll('\u2502', '|').trim();
-    const lines = text.split(/\r?\n/);
-    const json = lines.findIndex((line) => line.trimStart().startsWith('{'));
-    if (json >= 0) return jsonAppliedVersions(lines.slice(json).join('\n'));
-    const header = lines.findIndex((line) => /^\s*\|?\s*Local\s*\|\s*Remote\s*(?:\|\s*Time(?:\s*\(UTC\))?\s*)?\|?\s*$/i.test(line));
-    if (header >= 0) return tableAppliedVersions(lines, header);
-  }
-  throw new DbTypesError('the local migration history is unreadable; expected migrations JSON or the Local | Remote migration list', { file: dbTypesPath });
-}
-
-/** Every applied local version must equal a migration filename stamp, including gaps and extra versions even when the heads match. */
-function requireCurrentDatabase(root, run) {
-  const dir = path.join(root, MIGRATIONS_DIR);
-  const expected = new Set();
-  for (const name of (fs.existsSync(dir) ? fs.readdirSync(dir) : []).filter((file) => file.endsWith('.sql'))) {
-    const stamp = /^(\d+)(?:_|\.sql$)/.exec(name)?.[1];
-    if (!stamp) throw new DbTypesError(`${MIGRATIONS_DIR} contains a SQL file without a migration version`, { file: dbTypesPath });
-    expected.add(stamp);
-  }
-  let result;
-  try { result = run(SUPABASE_CLI, ['migration', 'list', '--local'], { cwd: root }); } catch {
-    throw new DbTypesError('supabase migration list --local could not run; the local migration history must be readable before emitting types', { file: dbTypesPath });
-  }
-  if (result?.error || result?.signal || result?.status !== 0) {
-    throw new DbTypesError('supabase migration list --local failed; the local migration history must be readable before emitting types', { file: dbTypesPath });
-  }
-  const applied = appliedVersions(result);
-  if (applied.size !== expected.size || [...expected].some((version) => !applied.has(version))) {
-    const head = (versions) => [...versions].sort().at(-1) ?? 'none';
-    throw new DbTypesError(`the local database is at ${head(applied)}, the migrations folder at ${head(expected)}; inspect "starci app db plan --local", preview "starci app db migrate --local", apply the reviewed local plan with --execute and STARCI_DB_ARMED=1, then run "starci app emit"`, { file: dbTypesPath }, 'HFS_EMIT_DB_TYPES_STALE');
-  }
-}
-
-/**
- * The freshly generated text of `dbTypesPath` for the app at `root`: `supabase gen types typescript --local` (the running
- * local stack), narrowed to the [api] schemas of supabase/config.toml. A failing CLI, a spawn error and an empty answer all
- * raise DbTypesError; the first stderr line names the cause.
- */
-function emitDbTypesWithRunner({ root, run }) {
-  const schemas = apiSchemas(root);
-  requireCurrentDatabase(root, run);
-  const args = ['gen', 'types', 'typescript', '--local', ...(schemas.length ? ['--schema', schemas.join(',')] : [])];
-  const command = `${SUPABASE_CLI} ${args.join(' ')}`;
-  let result;
-  try {
-    result = run(SUPABASE_CLI, args, { cwd: root });
-  } catch (error) {
-    throw new DbTypesError(`\`${command}\` could not run: ${firstLine(error?.message ?? error) ?? 'unknown failure'}; the local Supabase stack must be up (supabase start)`, { file: dbTypesPath });
-  }
-  const stdout = String(result?.stdout ?? '');
-  const stderr = String(result?.stderr ?? '');
-  if (result?.error || result?.status !== 0 || !stdout.trim()) {
-    const cause = firstLine(stderr) ?? firstLine(result?.error?.message ?? result?.error) ?? 'no output';
-    throw new DbTypesError(`\`${command}\` failed${result?.status !== undefined && result?.status !== null ? ` (exit ${result.status})` : ''}: ${cause}; the local Supabase stack must be up (supabase start)`, { file: dbTypesPath, stderr });
-  }
-  // The CLI pads blank lines with spaces; the committed file carries none (git diff --check refuses trailing whitespace).
-  return `${TYPES_STAMP}${migrationsDigest(root)}\n${stdout.replace(/[ \t]+$/gm, '')}`;
-}
-
-export function emitDbTypes({ root, run = spawn, platform = process.platform } = {}) {
-  return emitDbTypesWithRunner({ root, run: withNpxFallback(run, platform) });
-}
-
-/**
- * The types of an app that has no stack yet (a fresh scaffold): start the app's own local stack (its project id and ports from
- * supabase/config.toml; every migration of supabase/migrations is applied on start), emit the types, and stop the stack again when
- * this call started it. The slow, Docker-reaching path `starci app scaffold --edition lite` takes; `emitDbTypes` alone is the fast one for a stack that is up.
- */
-export function generateDbTypes({ root, run = spawn, platform = process.platform } = {}) {
-  const execute = withNpxFallback(run, platform);
-  const started = execute(SUPABASE_CLI, ['start', '-x', 'studio,mailpit,logflare,vector,edge-runtime,imgproxy,supavisor'], { cwd: root });
-  const already = /already (?:running|started)/i.test(`${started?.stderr ?? ''}${started?.stdout ?? ''}`);
-  if (started?.error || (started?.status !== 0 && !already)) {
-    throw new DbTypesError(`\`${SUPABASE_CLI} start\` failed${started?.status != null ? ` (exit ${started.status})` : ''}: ${startDetail(started)} (the last ${START_TAIL_LINES} output lines at most; with no cause among them, Docker must be running)`, { file: dbTypesPath });
-  }
-  try {
-    return emitDbTypesWithRunner({ root, run: execute });
-  } finally {
-    if (!already) execute(SUPABASE_CLI, ['stop', '--no-backup'], { cwd: root });
-  }
-}
-
-/**
- * Writes `emitDbTypes` to `<root>/<dbTypesPath>`, creating `supabase/types/` when needed. Answers `{ path, changed }`:
- * `changed` is false when the committed text already equals the generated one, so a re-run is a no-op on disk.
- */
-export function writeDbTypes({ root, run } = {}) {
-  const text = emitDbTypes({ root, run });
-  const target = path.join(root, dbTypesPath);
-  const committed = fs.existsSync(target) ? fs.readFileSync(target, 'utf8') : null;
-  const changed = committed !== text;
-  if (changed) {
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    fs.writeFileSync(target, text);
-  }
-  return { path: dbTypesPath, changed };
-}
-
-/**
- * Whether the slot `app.supabase.types` is enabled for the app `resolver` views (a connection of the app declares
- * provider: supabase). Read through the slot view, never through a path check: a side-scope resolver holds no app slots
- * and answers false, exactly like an app without a supabase connection.
- */
-export function appHasDbTypes(resolver) {
-  const slot = typeof resolver?.slot === 'function' ? resolver.slot(DB_TYPES_SLOT) : null;
-  return slot != null && typeof resolver?.slotEnabled === 'function' && resolver.slotEnabled(slot) === true;
-}
-
-/**
- * The `emitTypes` callback checkDatabase (L09 DB_TYPES_DRIFT) expects: `({repoRoot, declaration}) -> text`, `repoRoot`
- * being the app root under check; the bound `root` is the fallback for a caller that already knows it. The declared
- * `supabase` block plays no part: the schemas come from supabase/config.toml on disk.
- */
-export const dbTypesEmitter = ({ root = null, run } = {}) => async ({ repoRoot } = {}) => emitDbTypes({ root: repoRoot ?? root, run });

package/runtime/scripts/api/supabase/database-dump.mjs

@@ -1,5 +0,0 @@
-// database-dump.mjs - schema dump for an app's local or linked Supabase database.
-import { supabaseCall } from './lib.mjs';
-
-/** The spawn result of supabase db dump; arguments and runner options remain with the caller. */
-export function databaseDump(...args) { return supabaseCall(['db', 'dump'], ...args); }

package/runtime/scripts/api/supabase/database-push.mjs

@@ -1,5 +0,0 @@
-// database-push.mjs - pending SQL migration push for an app's selected Supabase database.
-import { supabaseCall } from './lib.mjs';
-
-/** The spawn result of supabase db push; target, preview and runner options remain with the owning caller. */
-export function databasePush(...args) { return supabaseCall(['db', 'push'], ...args); }

package/runtime/scripts/api/supabase/database-query.mjs

@@ -1,5 +0,0 @@
-// database-query.mjs - database query for an app's local or linked Supabase database.
-import { supabaseCall } from './lib.mjs';
-
-/** The spawn result of supabase db query; arguments and runner options remain with the caller. */
-export function databaseQuery(...args) { return supabaseCall(['db', 'query'], ...args); }

package/runtime/scripts/api/supabase/lib.mjs

@@ -1,55 +0,0 @@
-// lib.mjs - resolve and spawn the app-local Supabase CLI for this API system, with no shell.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-
-const candidateNames = (platform) => platform === 'win32'
-  ? ['supabase.exe', 'supabase', 'supabase.cmd']
-  : ['supabase'];
-
-/** Resolve the app's installed npm launcher before executable discovery; npm command shims cannot run without a shell. */
-function resolveSupabase(appRoot, { env = process.env, platform = process.platform, exists = fs.existsSync } = {}) {
-  const launcher = path.join(appRoot, 'node_modules', 'supabase', 'dist', 'supabase.js');
-  if (exists(launcher)) return { file: process.execPath, args: [launcher] };
-  const names = candidateNames(platform);
-  const local = path.join(appRoot, 'node_modules', '.bin');
-  for (const name of names) {
-    const file = path.join(local, name);
-    if (exists(file)) return { file, args: [] };
-  }
-  const delimiter = platform === 'win32' ? ';' : ':';
-  for (const directory of String(env.PATH ?? '').split(delimiter).filter(Boolean)) {
-    for (const name of names) {
-      const file = path.join(directory, name);
-      if (exists(file)) return { file, args: [] };
-    }
-  }
-  return { file: 'supabase', args: [] };
-}
-
-/** Run one shell-free Supabase call at the app root; an unusable command shim returns an ENOEXEC spawn failure. */
-export const supabaseSpawn = (appRoot, args, {
-  env = process.env,
-  supabase,
-  timeout = 60_000,
-  run = spawnSync,
-  platform = process.platform,
-  exists = fs.existsSync,
-} = {}) => {
-  const command = supabase === undefined || supabase === null ? resolveSupabase(appRoot, { env, platform, exists }) : { file: supabase, args: [] };
-  if (/\.(?:cmd|bat)$/iu.test(command.file)) return {
-    status: null, stdout: '', stderr: '', signal: null,
-    error: Object.assign(new Error('The Supabase command shim requires a shell; use an executable or the app-local npm launcher.'), { code: 'ENOEXEC' }),
-  };
-  return run(command.file, [...command.args, ...args], {
-    cwd: appRoot,
-    encoding: 'utf8',
-    env,
-    timeout,
-    windowsHide: true,
-  });
-};
-
-/** Invoke one Supabase command prefix with caller arguments and runner options. */
-export const supabaseCall = (prefix, appRoot, args = [], options = {}) =>
-  supabaseSpawn(appRoot, [...prefix, ...args], options);

package/runtime/scripts/api/supabase/migration-repair.mjs

@@ -1,5 +0,0 @@
-// migration-repair.mjs - migration history repair for an app's local or linked Supabase database.
-import { supabaseCall } from './lib.mjs';
-
-/** The spawn result of supabase migration repair; arguments and runner options remain with the caller. */
-export function migrationRepair(...args) { return supabaseCall(['migration', 'repair'], ...args); }

package/runtime/scripts/hfs/architecture/supabase-tables.mjs

@@ -1,50 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
-const CACHE = new Map();
-
-/** A static TypeScript property name, as emitted by `supabase gen types typescript`. */
-const propertyName = (typescript, name) => (typescript.isIdentifier(name) || typescript.isStringLiteralLike(name) ? name.text : null);
-
-/** The type-literal members below property `name`, or null when the generated shape is not statically readable. */
-const propertyMembers = (typescript, members, name) => {
-  const property = members.find(member => typescript.isPropertySignature(member) && propertyName(typescript, member.name) === name);
-  return property?.type && typescript.isTypeLiteralNode(property.type) ? property.type.members : null;
-};
-
-function addTableNames(typescript, members, tables) {
-  if (!members) return;
-  for (const member of members) {
-    if (!typescript.isPropertySignature(member)) continue;
-    const name = propertyName(typescript, member.name);
-    if (name) tables.add(name.toLowerCase());
-  }
-}
-
-function readTableNames(typescript, file, tables) {
-  const source = typescript.createSourceFile(file, fs.readFileSync(file, 'utf8'), typescript.ScriptTarget.Latest, true, typescript.ScriptKind.TS);
-  if (source.parseDiagnostics.length !== 0) return;
-  const database = source.statements.find(statement => typescript.isTypeAliasDeclaration(statement) && statement.name.text === 'Database');
-  const databaseMembers = database && typescript.isTypeLiteralNode(database.type) ? database.type.members : null;
-  const publicMembers = databaseMembers ? propertyMembers(typescript, databaseMembers, 'public') : null;
-  const tableMembers = publicMembers ? propertyMembers(typescript, publicMembers, 'Tables') : null;
-  addTableNames(typescript, tableMembers, tables);
-}
-
-/**
- * The lower-case keys of `Database['public']['Tables']`, parsed with the architecture context's target compiler.
- * An absent, malformed or unreadable contract proves no table. The result is cached once per app root.
- */
-export function supabaseTablesOf(appRoot, typescript) {
-  const root = path.resolve(appRoot);
-  if (CACHE.has(root)) return CACHE.get(root);
-  const tables = new Set();
-  const file = path.join(root, 'supabase', 'types', 'database.types.ts');
-  try {
-    readTableNames(typescript, file, tables);
-  } catch {
-    // Missing and unreadable generated contracts are fail-closed: no table is proven.
-  }
-  CACHE.set(root, tables);
-  return tables;
-}

package/runtime/scripts/hfs/architecture/supabase.mjs

@@ -1,226 +0,0 @@
-import { machineKit } from './machine-ast.mjs';
-import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, jwtPolicyProblems, moduleNameOf, reportAt, supabaseClientType, supabaseDataAccess, SUPABASE_MODULES } from './supabase-ast.mjs';
-import { checkBackendJwt } from './supabase-be.mjs';
-
-/**
- * L10-L16, the slot-driven Supabase machine. On the back end Supabase provides Auth/Storage with one owner,
- * `be.integrations.supabase`. On the front end Supabase is auth only (owner ruling 2026-10-13): `fe.modules.auth` is the one
- * importer of `@supabase/*` and calls only the auth API; data, storage, rpc and realtime go through the back end (modules/api).
- * The checks below recognise provider calls and types by their imported package declarations, not by local variable or type names.
- */
-export const FRONTEND_SUPABASE_RULE_IDS = Object.freeze(['FE_SUPABASE_CLIENT_OWNER', 'FE_SERVICE_ROLE_FORBIDDEN']);
-export const BACKEND_SUPABASE_RULE_IDS = Object.freeze(['BE_SUPABASE_CLIENT_OWNER', 'BE_SUPABASE_JWT_VERIFIED', 'BE_JWT_ALG_PINNED']);
-
-const FE_CLIENT_OWNER = 'FE_SUPABASE_CLIENT_OWNER';
-const BE_CLIENT_OWNER = 'BE_SUPABASE_CLIENT_OWNER';
-const FE_SERVICE_ROLE = 'FE_SERVICE_ROLE_FORBIDDEN';
-const BE_SUPABASE_SLOT = 'be.integrations.supabase';
-const FE_AUTH_SLOT = 'fe.modules.auth';
-/** The front-end provider slot: enabled exactly when a connection declares provider supabase. */
-const FE_SUPABASE_PROVIDER_SLOT = 'fe.route.callback';
-const FE_CONFIG_SLOT = 'fe.modules.config';
-const BE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'functions', 'channel', 'realtime', 'getChannels', 'removeChannel', 'removeAllChannels']);
-/** The members of a Supabase client that read or write data, files or channels: never called from the front end. */
-const FE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'storage', 'functions', 'realtime', 'channel', 'getChannels', 'removeChannel', 'removeAllChannels']);
-const supabaseSlotEnabled = (input, slotId) => {
-  const slot = input.graph.resolver.slot(slotId);
-  return Boolean(slot && input.graph.resolver.slotEnabled(slot));
-};
-
-const CLIENT_FACTORY = /^create(?:Client|ServerClient|BrowserClient)$/u;
-
-function inspectSupabaseImport(scope, node) {
-  const { kit, file, slots, ruleId, violations, counters } = scope;
-  const moduleName = moduleNameOf(kit.ts, node);
-  if (!moduleName || !SUPABASE_MODULES.has(moduleName)) return;
-  counters.imports += 1;
-  if (!slots.has(file.slot)) reportAt(violations, kit, ruleId, file, node, `${moduleName} is imported by ${file.rel}, whose slot is ${file.slot ?? 'unowned'}; Supabase imports belong only to ${[...slots].join(' or ')}.`, { module: moduleName, slot: file.slot ?? null });
-}
-
-function inspectClientTypeReference(scope, node) {
-  const { kit, checker, file, ruleId, violations, counters } = scope;
-  if (!kit.ts.isTypeReferenceNode(node) || !supabaseClientType(kit, checker, node)) return;
-  counters.clients += 1;
-  if (!isDatabaseType(kit.ts, node.typeArguments?.[0])) reportAt(violations, kit, ruleId, file, node, 'SupabaseClient must carry the committed Database type as SupabaseClient<Database>.');
-}
-
-function inspectClientFactoryCall(scope, node) {
-  const { kit, checker, file, ruleId, violations, counters } = scope;
-  const binding = kit.importBinding(checker, node.expression);
-  if (!binding || !SUPABASE_MODULES.has(binding.module) || !CLIENT_FACTORY.test(binding.name)) return;
-  counters.clients += 1;
-  if (!isDatabaseType(kit.ts, node.typeArguments?.[0]) && !contextTypesClient(kit, checker, node)) {
-    reportAt(violations, kit, ruleId, file, node, `${binding.name} creates an untyped Supabase client; create it as ${binding.name}<Database>(...) (or give it the contextual type SupabaseClient<Database>).`);
-  }
-}
-
-function inspectProviderCall(scope, node) {
-  const { kit, checker, file, slots, ruleId, violations, counters, reportedData } = scope;
-  const { ts } = kit;
-  const data = supabaseDataAccess(kit, checker, node, BE_DATA_MEMBERS, { storageAllowed: true });
-  if (data) {
-    if (!reportedData.has(data.node.pos)) {
-      reportedData.add(data.node.pos);
-      reportAt(violations, kit, ruleId, file, data.node, `A Supabase .${data.name} data call is made from ${file.slot ?? 'an unowned path'}; the back-end SDK is Auth/Storage only, including inside ${BE_SUPABASE_SLOT}. Data uses EntityManager as app_be.`, { member: data.name, slot: file.slot ?? null });
-    }
-    if (ts.isCallExpression(node)) counters.calls += 1;
-    return;
-  }
-  if (!isSupabaseCall(kit, checker, node)) return;
-  const properties = chainParts(ts, node);
-  const method = callName(ts, node);
-  if (!properties.includes('auth') && !properties.includes('storage')) return;
-  counters.calls += 1;
-  if (!slots.has(file.slot)) reportAt(violations, kit, ruleId, file, node, `A Supabase ${method ?? 'client'} call is made from ${file.slot ?? 'an unowned path'}; database, auth and storage calls belong only to ${[...slots].join(' or ')}.`, { method, slot: file.slot ?? null });
-}
-
-function inspectOwnershipNode(scope, node) {
-  inspectSupabaseImport(scope, node);
-  inspectClientTypeReference(scope, node);
-  const { ts } = scope.kit;
-  if (!ts.isCallExpression(node) && !ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return;
-  if (ts.isCallExpression(node)) inspectClientFactoryCall(scope, node);
-  inspectProviderCall(scope, node);
-}
-
-function checkClientOwnership(input, { slots, ruleId }) {
-  const kit = machineKit(input);
-  const violations = [];
-  const counters = { imports: 0, clients: 0, calls: 0 };
-  for (const file of input.graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    const scope = { kit, checker, file, slots, ruleId, violations, counters, reportedData: new Set() };
-    kit.walk(file.sourceFile, node => inspectOwnershipNode(scope, node));
-  }
-  return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [...slots] } };
-}
-
-const words = text => String(text).replace(/([a-z0-9])([A-Z])/gu, '$1_$2').toUpperCase();
-const serviceRoleText = text => /(?:^|[^A-Z0-9])SERVICE[_ -]?ROLE(?:[^A-Z0-9]|$)/iu.test(words(text));
-const credentialEnv = name => /(?:^|_)(?:SECRET|PRIVATE|TOKEN|PASSWORD)$/u.test(name) || /(?:^|_)SERVICE_ROLE(?:_|$)/u.test(name);
-const CORE_PUBLIC_ENV = new Set(['NEXT_PUBLIC_SUPABASE_URL', 'NEXT_PUBLIC_SUPABASE_ANON_KEY', 'NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'NEXT_PUBLIC_SITE_URL']);
-
-const envRead = (ts, node) => {
-  if (!ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return null;
-  const object = node.expression;
-  const processEnv = ts.isPropertyAccessExpression(object) && ts.isIdentifier(object.expression) && object.expression.text === 'process' && object.name.text === 'env';
-  const importMetaEnv = ts.isPropertyAccessExpression(object) && object.name.text === 'env' && object.expression.kind === ts.SyntaxKind.MetaProperty;
-  if (!processEnv && !importMetaEnv) return null;
-  if (ts.isPropertyAccessExpression(node)) return node.name.text;
-  return ts.isStringLiteralLike(node.argumentExpression) ? node.argumentExpression.text : null;
-};
-
-/** Reports a SERVICE_ROLE identifier or string literal: the browser and Next process never hold the service role. */
-function inspectServiceRoleText(ts, node, report) {
-  if (ts.isIdentifier(node) && serviceRoleText(node.text)) report(node, 'A SERVICE_ROLE identifier appears in the front end; the browser and Next process never hold the Supabase service role.', node.text);
-  if (ts.isStringLiteralLike(node) && serviceRoleText(node.text)) report(node, 'A service_role string appears in the front end; the service role belongs behind the back-end guard chain.', node.text);
-}
-
-/** Counts an environment read and reports a credential-shaped or product-specific public variable. */
-function inspectEnvironmentRead(state, file, node, name) {
-  state.reads += 1;
-  if (credentialEnv(name)) state.report(node, `${name} is a credential-shaped environment read in the front end; no *_SECRET, *_PRIVATE, *_TOKEN, *_PASSWORD or service-role value enters fe/.`, name);
-  else if (name.startsWith('NEXT_PUBLIC_') && !CORE_PUBLIC_ENV.has(name) && file.slot !== FE_CONFIG_SLOT) {
-    state.report(node, `${name} is not a core Supabase/site public variable and is read outside ${FE_CONFIG_SLOT}; product public configuration is declared by the one config owner.`, name);
-  }
-}
-
-function checkFrontendSecretNames(input) {
-  const kit = machineKit(input);
-  const { ts } = kit;
-  const violations = [];
-  const state = { reads: 0, report: null };
-  for (const file of input.graph.files.values()) {
-    const seen = new Set();
-    state.report = (node, message, name) => {
-      const key = `${node.pos}:${name ?? ''}`;
-      if (seen.has(key)) return;
-      seen.add(key);
-      reportAt(violations, kit, FE_SERVICE_ROLE, file, node, message, name ? { name } : {});
-    };
-    kit.walk(file.sourceFile, node => {
-      inspectServiceRoleText(ts, node, state.report);
-      const name = envRead(ts, node);
-      if (name) inspectEnvironmentRead(state, file, node, name);
-    });
-  }
-  return { violations, coverage: { status: 'checked', envReads: state.reads } };
-}
-
-function inspectFrontendNode(scope, node) {
-  const { kit, checker, file, violations, counters, reportedData } = scope;
-  const { ts } = kit;
-  const moduleName = moduleNameOf(ts, node);
-  if (moduleName?.startsWith('@supabase/')) {
-    counters.imports += 1;
-    if (file.slot !== FE_AUTH_SLOT) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `${moduleName} is imported by ${file.rel}, whose slot is ${file.slot ?? 'unowned'}; on the front end Supabase is auth only and ${FE_AUTH_SLOT} (modules/auth) is its one importer.`, { module: moduleName, slot: file.slot ?? null });
-    return;
-  }
-  if (!ts.isCallExpression(node) && !ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return;
-  const data = supabaseDataAccess(kit, checker, node, FE_DATA_MEMBERS);
-  if (data) {
-    if (!reportedData.has(data.node.pos)) {
-      reportedData.add(data.node.pos);
-      reportAt(violations, kit, FE_CLIENT_OWNER, file, data.node, `A Supabase .${data.name} call is made from the front end; Supabase on the front end is auth only - read and write data, files and realtime through the back end (a modules/api GraphQL operation, an SWR hook, hooks/socketio).`, { member: data.name, slot: file.slot ?? null });
-    }
-    return;
-  }
-  if (!isSupabaseCall(kit, checker, node)) return;
-  counters.calls += 1;
-  const parts = chainParts(ts, node);
-  if (file.slot !== FE_AUTH_SLOT && parts.includes('auth')) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase auth call is made from ${file.slot ?? 'an unowned path'}; the auth client is called only inside ${FE_AUTH_SLOT}, which exports the session and the access token.`, { slot: file.slot ?? null });
-}
-
-function checkFrontendClientOwner(input) {
-  const kit = machineKit(input);
-  const violations = [];
-  const counters = { imports: 0, calls: 0 };
-  for (const file of input.graph.files.values()) {
-    const scope = { kit, checker: kit.checkerOf(file.sourceFile), file, violations, counters, reportedData: new Set() };
-    kit.walk(file.sourceFile, node => inspectFrontendNode(scope, node));
-  }
-  return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [FE_AUTH_SLOT] } };
-}
-
-export function checkFrontendSupabase(input) {
-  const owner = checkFrontendClientOwner(input);
-  if (!supabaseSlotEnabled(input, FE_SUPABASE_PROVIDER_SLOT)) return {
-    violations: owner.violations,
-    coverage: { status: owner.coverage.imports || owner.coverage.calls || owner.violations.length ? 'checked' : 'not-applicable', owner: owner.coverage, reason: 'no connection declares provider supabase; SDK ownership is still checked' },
-  };
-  const secrets = checkFrontendSecretNames(input);
-  return {
-    violations: [...owner.violations, ...secrets.violations],
-    coverage: { status: 'checked', owner: owner.coverage, secrets: secrets.coverage },
-  };
-}
-
-export function checkBackendSupabase(input) {
-  const owner = checkClientOwnership(input, { slots: new Set([BE_SUPABASE_SLOT]), ruleId: BE_CLIENT_OWNER });
-  if (!supabaseSlotEnabled(input, BE_SUPABASE_SLOT)) return {
-    violations: owner.violations,
-    coverage: { status: owner.coverage.imports || owner.coverage.calls || owner.violations.length ? 'checked' : 'not-applicable', owner: owner.coverage, reason: 'the Supabase integration slot is disabled; SDK ownership is still checked' },
-  };
-  const jwt = checkBackendJwt(input);
-  const policy = checkJwtPolicy(input);
-  return {
-    violations: [...owner.violations, ...jwt.violations, ...policy.violations],
-    coverage: { status: 'checked', owner: owner.coverage, jwt: jwt.coverage, jwtPolicy: policy.coverage },
-  };
-}
-
-export function checkJwtPolicy(input) {
-  const kit = machineKit(input);
-  const violations = [];
-  let verifyCalls = 0;
-  for (const file of input.graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    kit.walk(file.sourceFile, node => {
-      if (!kit.ts.isCallExpression(node) || !kit.isImportOf(checker, node.expression, 'jwtVerify', 'jose')) return;
-      verifyCalls += 1;
-      const problems = jwtPolicyProblems(kit.ts, checker, node);
-      if (problems.length) reportAt(violations, kit, 'BE_JWT_ALG_PINNED', file, node, problems.join(' '));
-    });
-  }
-  return { violations, coverage: { status: 'checked', verifyCalls } };
-}