@starci/hfs 5.1.0 → 5.2.0

package/templates/fe/skeleton/packages/__project__-ui/src/composites/NotFoundNotice/index.tsx

@@ -1,4 +1,4 @@
-import { Heading, TextAction } from "@starci/grammar/common"
+import { Link, Page } from "@starci/grammar/common"
 
 /** The words of a page that does not exist and the way back. */
 type NotFoundNoticeProps = {
@@ -10,10 +10,7 @@ type NotFoundNoticeProps = {
 
 /** A missing page: the message and the way back to the app's front door. */
 export const NotFoundNotice = (props: NotFoundNoticeProps) => (
-    <>
-        <Heading level={1}>{props.title}</Heading>
-        <TextAction appearance="inline" href={props.homeHref}>
-            {props.homeLabel}
-        </TextAction>
-    </>
+    <Page header={{ title: props.title }} measure="reading">
+        <Link href={props.homeHref}>{props.homeLabel}</Link>
+    </Page>
 )

package/templates/fe/skeleton/packages/__project__-ui/src/frames/SiteShell/index.tsx

@@ -1,6 +1,5 @@
 import type { ReactNode } from "react"
-import { GrammarRoot, PageContainer, TextAction, TopBar, WorkspaceShell } from "@starci/grammar/common"
-import { siteShellClassNames } from "./classNames"
+import { GrammarRoot, Link, TopBar, WorkspaceShell } from "@starci/grammar/common"
 
 /** What an app's chrome hands the shell: the brand, its home link and the routed body. */
 type SiteShellProps = {
@@ -14,6 +13,6 @@ type SiteShellProps = {
 
 /**
  * The document chrome both apps share: Grammar's Common boundary, the brand header (the top bar carrying the wordmark that links
- * home), then the routed body in the shell's main landmark at reading measure.
+ * home), then the routed body in the shell's main landmark (each page draws its own measure).
  */
 {{> fe/common/site-shell.tsx.partial}}

package/templates/fe/skeleton-lite/apps/web/src/components/composites/NotFoundNotice/index.tsx

@@ -1,4 +1,4 @@
-import { Heading, TextAction } from "@starci/grammar/common"
+import { Link, Page } from "@starci/grammar/common"
 
 /** The words of a missing page and the way home. */
 type NotFoundNoticeProps = {
@@ -9,10 +9,7 @@ type NotFoundNoticeProps = {
 
 /** A missing page with one destination back to the app's front door. */
 export const NotFoundNotice = (props: NotFoundNoticeProps) => (
-    <>
-        <Heading level={1}>{props.title}</Heading>
-        <TextAction appearance="inline" href={props.homeHref}>
-            {props.homeLabel}
-        </TextAction>
-    </>
+    <Page header={{ title: props.title }} measure="reading">
+        <Link href={props.homeHref}>{props.homeLabel}</Link>
+    </Page>
 )

package/templates/fe/skeleton-lite/apps/web/src/components/frames/SiteShell/index.tsx

@@ -1,6 +1,5 @@
 import type { ReactNode } from "react"
-import { GrammarRoot, PageContainer, TextAction, TopBar, WorkspaceShell } from "@starci/grammar/common"
-import { siteShellClassNames } from "./classNames"
+import { GrammarRoot, Link, TopBar, WorkspaceShell } from "@starci/grammar/common"
 
 /** What the app chrome hands the shell. */
 type SiteShellProps = {

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/Caddyfile

@@ -1,16 +0,0 @@
-{
-    admin 127.0.0.1:2019
-    auto_https off
-}
-
-http://dev.{{project}}.example.invalid {
-    handle /graphql* {
-        reverse_proxy api:3001
-    }
-    handle /health/* {
-        reverse_proxy api:3001
-    }
-    handle {
-        reverse_proxy web:3000
-    }
-}

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/owner-actions.md

@@ -1,11 +0,0 @@
-# Development prerequisite record
-
-Status: pending owner execution. This record states intended configuration and contains no completed operational receipt.
-
-## DNS
-
-The development operator replaces `dev.{{project}}.example.invalid` with a locally owned development name, updates the manifest, Caddyfile and public configuration together, and resolves the name to the Swarm node. Record the actual resolver mapping and dated verification here.
-
-## TLS
-
-The local development route uses HTTP on ingress port 80 with `auto_https off`. The development operator owns this local-only choice and both external ingress volumes. Record any change to locally issued TLS, certificate custody and verification here before exposing the development stack outside the local network.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/recovery/restore-proof.md

@@ -1,7 +0,0 @@
-# Development recovery record
-
-Status: pending owner execution. No backup or restore has been run by scaffolding.
-
-The development operator owns recovery of the db service's volume `{{project}}-dev-db-data` and both external ingress volumes, `{{project}}-dev-ingress-data` and `{{project}}-dev-ingress-config-data`. Retain seven daily encrypted off-host exports or snapshots for each target.
-
-Before relying on the backup policy, restore a database export and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored ingress configuration and state. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/current.yaml

@@ -1,6 +0,0 @@
-schema: starci/release-pointer@1
-environment: dev
-status: pending-owner-release
-release: null
-verification: null
-# Write a real release digest and dated health receipt only after convergence and verification.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/images.lock.yaml

@@ -1,8 +0,0 @@
-# Illustrative inventory only. Replace application digests with verified published images.
-schema: starci/images-lock@1
-environment: dev
-status: pending-owner-release
-images:
-  api: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-  web: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-  ingress: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/previous.yaml

@@ -1,6 +0,0 @@
-schema: starci/release-pointer@1
-environment: dev
-status: no-previous-release
-release: null
-verification: null
-# Before moving current, retain the last accepted release here for rollback.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/stack.yaml

@@ -1,186 +0,0 @@
-# Illustrative development model. Replace all-zero application digests with verified published release digests before use.
-services:
-  api:
-    image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-    environment:
-      NODE_ENV: development
-      PORT: "3001"
-      HTTP_SECURITY_ALLOWED_ORIGINS: http://dev.{{project}}.example.invalid
-      PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
-      PRIMARY_DB_SCHEMA: public
-      GOOGLE_CLIENT_ID: REPLACE_WITH_GOOGLE_OAUTH_CLIENT_ID
-      GOOGLE_CLIENT_SECRET_FILE: /run/secrets/google-client-secret
-      GOOGLE_CALLBACK_URL: http://dev.{{project}}.example.invalid/auth/google/callback
-      AUTH_JWT_ISSUER: http://dev.{{project}}.example.invalid
-      AUTH_JWT_AUDIENCE: {{project}}
-      AUTH_JWT_KEY_ID: dev-1
-      AUTH_JWT_PRIVATE_KEY_FILE: /run/secrets/auth-jwt-private-key
-      STORAGE_ENDPOINT: https://storage.{{project}}.example.invalid
-      STORAGE_REGION: us-east-1
-      STORAGE_BUCKET: {{project}}-dev
-      STORAGE_ACCESS_KEY_ID_FILE: /run/secrets/storage-access-key-id
-      STORAGE_SECRET_ACCESS_KEY_FILE: /run/secrets/storage-secret-access-key
-    secrets:
-      - source: primary-db-url
-        target: primary-db-url
-      - source: google-client-secret
-        target: google-client-secret
-      - source: auth-jwt-private-key
-        target: auth-jwt-private-key
-      - source: storage-access-key-id
-        target: storage-access-key-id
-      - source: storage-secret-access-key
-        target: storage-secret-access-key
-    networks: [app]
-    healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
-      interval: 30s
-      timeout: 5s
-      start_period: 20s
-      retries: 3
-    deploy:
-      replicas: 1
-      placement:
-        constraints: ["node.labels.{{project}} == dev"]
-      update_config:
-        parallelism: 1
-        order: start-first
-        failure_action: rollback
-        monitor: 30s
-      # Stateless and served behind the ingress: roll back start-first so the serving task stays up until the old release is healthy.
-      rollback_config:
-        parallelism: 1
-        order: start-first
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-  web:
-    image: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-    environment:
-      NODE_ENV: development
-      PORT: "3000"
-      HOSTNAME: 0.0.0.0
-      NEXT_PUBLIC_SITE_URL: http://dev.{{project}}.example.invalid
-    networks: [app]
-    healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
-      interval: 30s
-      timeout: 5s
-      start_period: 20s
-      retries: 3
-    deploy:
-      replicas: 1
-      placement:
-        constraints: ["node.labels.{{project}} == dev"]
-      update_config:
-        parallelism: 1
-        order: start-first
-        failure_action: rollback
-        monitor: 30s
-      # Stateless and served behind the ingress: roll back start-first so the serving task stays up until the old release is healthy.
-      rollback_config:
-        parallelism: 1
-        order: start-first
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-  db:
-    image: "{{project}}/db:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-    environment:
-      POSTGRES_DB: postgres
-      POSTGRES_PASSWORD_FILE: /run/secrets/db-password
-    secrets:
-      - source: db-password
-        target: db-password
-    volumes:
-      - db-data:/var/lib/postgresql/data
-    networks: [app]
-    healthcheck:
-      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
-      interval: 10s
-      timeout: 5s
-      start_period: 30s
-      retries: 5
-    deploy:
-      replicas: 1
-      placement:
-        constraints: ["node.labels.{{project}} == dev"]
-      update_config:
-        parallelism: 1
-        order: stop-first
-        failure_action: rollback
-        monitor: 30s
-      # The database owns a data volume and is single-writer: never run two at once, so rollback stays stop-first.
-      rollback_config:
-        parallelism: 1
-        order: stop-first
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-  ingress:
-    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
-    configs:
-      - source: ingress-config
-        target: /etc/caddy/Caddyfile
-    ports:
-      - { target: 80, published: 80, protocol: tcp, mode: ingress }
-    volumes:
-      - ingress-data:/data
-      - ingress-config-data:/config
-    networks: [app]
-    healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    deploy:
-      replicas: 1
-      placement:
-        constraints: ["node.labels.{{project}} == dev"]
-      update_config:
-        parallelism: 1
-        order: stop-first
-        failure_action: rollback
-        monitor: 30s
-      # The ingress owns published ports and a certificate volume: never run two at once, so rollback stays stop-first.
-      rollback_config:
-        parallelism: 1
-        order: stop-first
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-networks:
-  app:
-    driver: overlay
-secrets:
-  primary-db-url:
-    external: true
-    name: "{{project}}-dev-primary-db-url-v1"
-  db-password:
-    external: true
-    name: "{{project}}-dev-db-password-v1"
-  google-client-secret:
-    external: true
-    name: "{{project}}-dev-google-client-secret-v1"
-  auth-jwt-private-key:
-    external: true
-    name: "{{project}}-dev-auth-jwt-private-key-v1"
-  storage-access-key-id:
-    external: true
-    name: "{{project}}-dev-storage-access-key-id-v1"
-  storage-secret-access-key:
-    external: true
-    name: "{{project}}-dev-storage-secret-access-key-v1"
-configs:
-  ingress-config:
-    file: ./Caddyfile
-volumes:
-  db-data:
-    external: true
-    name: "{{project}}-dev-db-data"
-  ingress-data:
-    external: true
-    name: "{{project}}-dev-ingress-data"
-  ingress-config-data:
-    external: true
-    name: "{{project}}-dev-ingress-config-data"

package/templates/be/skeleton-lite/src/modules/integrations/object-storage/object-storage.client.spec.ts

@@ -1,22 +0,0 @@
-import { Secret } from "@modules/platform/config"
-import { createObjectStorage } from "./object-storage.client"
-
-const options = {
-    endpoint: "http://127.0.0.1:9000",
-    region: "us-east-1",
-    bucket: "app",
-    accessKeyId: new Secret("access"),
-    secretAccessKey: new Secret("secret"),
-    presignTtlSeconds: 300,
-}
-
-describe("createObjectStorage", () => {
-    it("presigns a path-style PUT of one key in the bucket, valid for the configured lifetime", async () => {
-        const storage = createObjectStorage(options, () => new Date("2026-10-29T00:00:00.000Z"))
-        const request = await storage.presignPut("users/u1/avatar.png", "image/png")
-
-        expect(new URL(request.url).pathname).toBe("/app/users/u1/avatar.png")
-        expect(new URL(request.url).searchParams.get("X-Amz-Expires")).toBe("300")
-        expect(request.expiresAt).toBe("2026-10-29T00:05:00.000Z")
-    })
-})

package/templates/be/skeleton-lite/src/modules/integrations/object-storage/object-storage.client.ts

@@ -1,25 +0,0 @@
-import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3"
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner"
-import type { ObjectStorage, PresignedRequest, ObjectStorageOptions } from "./object-storage.options"
-
-/** The one S3 client of the app over S3-compatible storage (path-style, as MinIO serves it). */
-export const createObjectStorage = (options: ObjectStorageOptions, now: () => Date = () => new Date()): ObjectStorage => {
-    const client = new S3Client({
-        endpoint: options.endpoint,
-        region: options.region,
-        forcePathStyle: true,
-        credentials: { accessKeyId: options.accessKeyId.reveal(), secretAccessKey: options.secretAccessKey.reveal() },
-    })
-    const expiresAt = (): string => new Date(now().getTime() + options.presignTtlSeconds * 1000).toISOString()
-    const presign = async (command: PutObjectCommand | GetObjectCommand): Promise<PresignedRequest> => ({
-        url: await getSignedUrl(client, command, { expiresIn: options.presignTtlSeconds }),
-        expiresAt: expiresAt(),
-    })
-    return {
-        presignPut: (key, contentType) => presign(new PutObjectCommand({ Bucket: options.bucket, Key: key, ContentType: contentType })),
-        presignGet: (key) => presign(new GetObjectCommand({ Bucket: options.bucket, Key: key })),
-        remove: async (key) => {
-            await client.send(new DeleteObjectCommand({ Bucket: options.bucket, Key: key }))
-        },
-    }
-}

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.cookie.spec.ts

@@ -1,104 +0,0 @@
-import { Test } from "@nestjs/testing"
-import type { Request, Response } from "express"
-import { mock } from "@starci/jest-preset"
-import { clearRefreshCookie, newRefreshToken, refreshTokenHash, setRefreshCookie } from "./passport.cookie"
-import { CookieStateStore } from "./strategies/oauth-state.store"
-
-const COOKIE: unique symbol = Symbol("passport.cookie")
-
-const OPTIONS = { name: "refresh", path: "/auth/refresh", ttlSeconds: 600 }
-
-const build = async () => {
-    const moduleRef = await Test.createTestingModule({
-        providers: [{ provide: COOKIE, useValue: { clearRefreshCookie, newRefreshToken, refreshTokenHash, setRefreshCookie } }],
-    }).compile()
-    return moduleRef.get<{
-        clearRefreshCookie: typeof clearRefreshCookie
-        newRefreshToken: typeof newRefreshToken
-        refreshTokenHash: typeof refreshTokenHash
-        setRefreshCookie: typeof setRefreshCookie
-    }>(COOKIE)
-}
-
-describe("refresh tokens", () => {
-    it("stores the sha256 of a token, never the token", async () => {
-        const subject = await build()
-
-        expect(subject.refreshTokenHash("abc")).toBe("ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad")
-    })
-
-    it("mints a 256-bit base64url token paired with its own hash", async () => {
-        const subject = await build()
-        const minted = subject.newRefreshToken()
-
-        expect(Buffer.from(minted.token, "base64url")).toHaveLength(32)
-        expect(minted.hash).toBe(subject.refreshTokenHash(minted.token))
-        expect(subject.newRefreshToken().token).not.toBe(minted.token)
-    })
-})
-
-describe("refresh cookie", () => {
-    it("sets the rotated token httpOnly, Secure, SameSite=Strict on the refresh path for its lifetime", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.setRefreshCookie(response, OPTIONS, "token-1")
-
-        expect(response.cookie).toHaveBeenCalledWith("refresh", "token-1", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh", maxAge: 600_000 })
-    })
-
-    it("clears the cookie with the attributes it was set with", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.clearRefreshCookie(response, OPTIONS)
-
-        expect(response.clearCookie).toHaveBeenCalledWith("refresh", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh" })
-    })
-
-    it("stays host-only: no Domain attribute is set or cleared when no cookie domain is configured", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.setRefreshCookie(response, OPTIONS, "token-1")
-        subject.clearRefreshCookie(response, OPTIONS)
-
-        expect(response.cookie).toHaveBeenCalledWith("refresh", "token-1", expect.not.objectContaining({ domain: expect.anything() }))
-        expect(response.clearCookie).toHaveBeenCalledWith("refresh", expect.not.objectContaining({ domain: expect.anything() }))
-    })
-
-    it("sets the rotated token with Domain=<cookieDomain> so a sibling host can forward it", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.setRefreshCookie(response, { ...OPTIONS, cookieDomain: "example.com" }, "token-1")
-
-        expect(response.cookie).toHaveBeenCalledWith("refresh", "token-1", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh", domain: "example.com", maxAge: 600_000 })
-    })
-
-    it("clears the cookie with the same Domain it was set with, or the browser keeps it", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.clearRefreshCookie(response, { ...OPTIONS, cookieDomain: "example.com" })
-
-        expect(response.clearCookie).toHaveBeenCalledWith("refresh", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh", domain: "example.com" })
-    })
-})
-
-describe("oauth state cookie", () => {
-    const request = (response: Response): Request => ({ res: response, headers: {} }) as unknown as Request
-
-    it("is host-only without a cookie domain and carries Domain=<cookieDomain> with one, on set and on clear", () => {
-        const hostOnly = mock<Response>()
-        const shared = mock<Response>()
-
-        new CookieStateStore("/auth/google/callback").store(request(hostOnly), "verifier", undefined, undefined, () => undefined)
-        new CookieStateStore("/auth/google/callback", "example.com").store(request(shared), "verifier", undefined, undefined, () => undefined)
-        new CookieStateStore("/auth/google/callback", "example.com").verify(request(shared), "state", () => undefined)
-
-        expect(hostOnly.cookie).toHaveBeenCalledWith("oauth_state", expect.stringMatching(/^[A-Za-z0-9_-]{32}[.]verifier$/), expect.not.objectContaining({ domain: expect.anything() }))
-        expect(shared.cookie).toHaveBeenCalledWith("oauth_state", expect.stringMatching(/^[A-Za-z0-9_-]{32}[.]verifier$/), expect.objectContaining({ domain: "example.com" }))
-        expect(shared.clearCookie).toHaveBeenCalledWith("oauth_state", expect.objectContaining({ domain: "example.com" }))
-    })
-})

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.cookie.ts

@@ -1,34 +0,0 @@
-import { createHash, randomBytes } from "node:crypto"
-import type { CookieOptions, Response } from "express"
-import type { RefreshCookieOptions } from "./passport.options"
-
-/** A fresh opaque refresh token (256 bits) and the sha256 the session store keeps instead of it. */
-export const newRefreshToken = (): { readonly token: string; readonly hash: string } => {
-    const token = randomBytes(32).toString("base64url")
-    return { token, hash: refreshTokenHash(token) }
-}
-
-/** The sha256 a refresh token is stored and looked up by; the token itself is never stored. */
-export const refreshTokenHash = (token: string): string => createHash("sha256").update(token).digest("hex")
-
-/** `Domain=<cookieDomain>` when the app configured one; absent (host-only) otherwise. Setting and clearing must agree on it. */
-export const domainAttribute = (cookieDomain: string | undefined): Pick<CookieOptions, "domain"> =>
-    cookieDomain === undefined ? {} : { domain: cookieDomain }
-
-const attributes = (options: RefreshCookieOptions): CookieOptions => ({
-    httpOnly: true,
-    secure: true,
-    sameSite: "strict",
-    path: options.path,
-    ...domainAttribute(options.cookieDomain),
-})
-
-/** Sets the rotated refresh token: httpOnly, Secure, SameSite=Strict and sent to the refresh door only. */
-export const setRefreshCookie = (response: Response, options: RefreshCookieOptions, token: string): void => {
-    response.cookie(options.name, token, { ...attributes(options), maxAge: options.ttlSeconds * 1000 })
-}
-
-/** Clears the refresh cookie on sign-out or on a detected reuse. */
-export const clearRefreshCookie = (response: Response, options: RefreshCookieOptions): void => {
-    response.clearCookie(options.name, attributes(options))
-}

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.password.spec.ts

@@ -1,28 +0,0 @@
-import { Test } from "@nestjs/testing"
-import { hashPassword, verifyPassword } from "./passport.password"
-
-const PASSWORD: unique symbol = Symbol("passport.password")
-
-const build = async () => {
-    const moduleRef = await Test.createTestingModule({
-        providers: [{ provide: PASSWORD, useValue: { hashPassword, verifyPassword } }],
-    }).compile()
-    return moduleRef.get<{ hashPassword: typeof hashPassword; verifyPassword: typeof verifyPassword }>(PASSWORD)
-}
-
-describe("hashPassword and verifyPassword", () => {
-    it("hashes at bcrypt cost 12 and verifies only the password it hashed", async () => {
-        const subject = await build()
-        const stored = await subject.hashPassword("correct horse")
-
-        expect(stored.slice(0, 7)).toBe("$2b$12$")
-        expect(await subject.verifyPassword("correct horse", stored)).toBe(true)
-        expect(await subject.verifyPassword("wrong horse", stored)).toBe(false)
-    })
-
-    it("never matches an account that has no password hash", async () => {
-        const subject = await build()
-
-        expect(await subject.verifyPassword("correct horse", null)).toBe(false)
-    })
-})

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.password.ts

@@ -1,11 +0,0 @@
-import { compare, hash } from "bcryptjs"
-
-/** The bcrypt cost of a new password hash; existing `$2a$`/`$2b$` hashes (auth.users.encrypted_password) verify at their own cost. */
-const COST = 12
-
-/** Hashes a new password with bcrypt. */
-export const hashPassword = (password: string): Promise<string> => hash(password, COST)
-
-/** True when `password` matches the stored bcrypt hash; a missing hash never matches. */
-export const verifyPassword = async (password: string, stored: string | null): Promise<boolean> =>
-    stored === null ? false : compare(password, stored)

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.tokens.spec.ts

@@ -1,88 +0,0 @@
-import { Test } from "@nestjs/testing"
-import { exportPKCS8, generateKeyPair, SignJWT } from "jose"
-import { Secret } from "@modules/platform/config"
-import { PassportErrorCode } from "./errors/passport.error"
-import { createTokenKit, tokenKit } from "./passport.tokens"
-
-const TOKENS: unique symbol = Symbol("passport.tokens")
-
-type SigningKey = Awaited<ReturnType<typeof generateKeyPair>>["privateKey"]
-
-const ISSUER = "https://api.example.test"
-const AUDIENCE = "app"
-
-const build = async () => {
-    const moduleRef = await Test.createTestingModule({
-        providers: [{ provide: TOKENS, useValue: { createTokenKit, tokenKit } }],
-    }).compile()
-    return moduleRef.get<{ createTokenKit: typeof createTokenKit; tokenKit: typeof tokenKit }>(TOKENS)
-}
-
-const keyPair = async () => {
-    const { privateKey } = await generateKeyPair("ES256", { extractable: true })
-    return { privateKey, options: { issuer: ISSUER, audience: AUDIENCE, privateKey: new Secret(await exportPKCS8(privateKey)), keyId: "k1", accessTtlSeconds: 60 } }
-}
-
-/** A token the kit's own key signs with the given claims, so only the claim checks can refuse it. */
-const ownSigned = (privateKey: SigningKey, claims: Record<string, unknown>, { subject = "user-1", expires = true } = {}) => {
-    const jwt = new SignJWT(claims).setProtectedHeader({ alg: "ES256", kid: "k1" }).setIssuer(ISSUER).setAudience(AUDIENCE).setIssuedAt()
-    if (subject !== "") jwt.setSubject(subject)
-    if (expires) jwt.setExpirationTime("60s")
-    return jwt.sign(privateKey)
-}
-
-describe("createTokenKit", () => {
-    it("verifies its own token with an email against its own key set and publishes only the public key", async () => {
-        const subject = await build()
-        const { options } = await keyPair()
-        const kit = await subject.createTokenKit(options)
-
-        expect(await kit.verify(await kit.issue({ id: "user-1", email: "a@example.test" }))).toEqual({ kind: "ok", value: { id: "user-1", role: "authenticated", email: "a@example.test" } })
-        expect(kit.jwks.keys).toHaveLength(1)
-        expect(kit.jwks.keys[0]).toMatchObject({ kid: "k1", alg: "ES256", use: "sig", kty: "EC", crv: "P-256" })
-        expect(kit.jwks.keys[0]).not.toHaveProperty("d")
-    })
-
-    it("issues a token without an email claim for a user who has none", async () => {
-        const subject = await build()
-        const { options } = await keyPair()
-        const kit = await subject.createTokenKit(options)
-
-        expect(await kit.verify(await kit.issue({ id: "user-2" }))).toEqual({ kind: "ok", value: { id: "user-2", role: "authenticated" } })
-    })
-
-    it("refuses a token another key signed, naming the failed signature", async () => {
-        const subject = await build()
-        const kit = await subject.createTokenKit((await keyPair()).options)
-        const other = await subject.createTokenKit((await keyPair()).options)
-
-        expect(await kit.verify(await other.issue({ id: "user-1" }))).toEqual({
-            kind: "refused",
-            code: PassportErrorCode.AccessTokenInvalid,
-            params: { cause: "JWSSignatureVerificationFailed: signature verification failed" },
-        })
-    })
-
-    it("refuses a correctly signed token whose subject, expiry or role is not the one it issues", async () => {
-        const subject = await build()
-        const { privateKey, options } = await keyPair()
-        const kit = await subject.createTokenKit(options)
-        const invalid = { kind: "refused", code: PassportErrorCode.AccessTokenInvalid }
-
-        expect(await kit.verify(await ownSigned(privateKey, { role: "authenticated" }, { subject: "" }))).toEqual(invalid)
-        expect(await kit.verify(await ownSigned(privateKey, { role: "authenticated" }, { expires: false }))).toEqual(invalid)
-        expect(await kit.verify(await ownSigned(privateKey, { role: "service_role" }))).toEqual(invalid)
-        expect(await kit.verify(await ownSigned(privateKey, { role: "authenticated", email: 7 }))).toEqual({ kind: "ok", value: { id: "user-1", role: "authenticated" } })
-    })
-})
-
-describe("tokenKit", () => {
-    it("signs, verifies and publishes through the one key import it starts", async () => {
-        const subject = await build()
-        const { options } = await keyPair()
-        const kit = subject.tokenKit(options)
-
-        expect(await kit.verify(await kit.issue({ id: "user-3", email: "c@example.test" }))).toEqual({ kind: "ok", value: { id: "user-3", role: "authenticated", email: "c@example.test" } })
-        expect((await kit.jwks()).keys.map((key) => key.kid)).toEqual(["k1"])
-    })
-})