Advance fullstack Gate 0 and alpha.4 (#1003)

Implements the first fullstack completion batch for #1002, including redundancy removal, Supabase-backed recipes, auth/admin/rate-limit hardening, and expanded provider smoke coverage.

Author: SisyphusZheng

.github/workflows/fullstack-deploy-smoke.yml

@@ -34,11 +34,7 @@ jobs:
           SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
           SUPABASE_ANON_KEY: ${{ secrets.SUPABASE_ANON_KEY }}
         run: >-
-          deno run -A npm:wrangler@latest deploy .output-workers/server/index.mjs
-          --name openelement-ref-starter
-          --assets .output-workers/public
-          --compatibility-date 2026-08-16
-          --compatibility-flags nodejs_compat
+          deno run -A npm:wrangler@latest deploy --config wrangler.jsonc
           --var "SUPABASE_URL:$SUPABASE_URL" "SUPABASE_ANON_KEY:$SUPABASE_ANON_KEY"
 
       - name: Smoke the live worker

.github/workflows/supabase-project-smoke.yml

@@ -69,12 +69,14 @@ jobs:
         run: |
           set -euo pipefail
           source .smoke/smoke.env
-          curl -sf -o /dev/null -X POST "$SUPABASE_URL/rest/v1/notes" \
+          response=$(curl -sf -X POST "$SUPABASE_URL/rest/v1/notes" \
             -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
             -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
             -H "Content-Type: application/json" \
-            -H "Prefer: return=minimal" \
-            -d "{\"user_id\":\"$A_ID\",\"title\":\"smoke\",\"body\":\"$MARKER\"}"
+            -H "Prefer: return=representation" \
+            -d "{\"user_id\":\"$A_ID\",\"title\":\"smoke\",\"body\":\"$MARKER\"}")
+          NOTE_ID=$(echo "$response" | jq -er '.[0].id')
+          echo "NOTE_ID=$NOTE_ID" >> .smoke/smoke.env
           echo "seeded note with run-unique marker"
 
       - name: Build and start the reference starter
@@ -122,6 +124,17 @@ jobs:
           echo "$page_a" | grep -q "signed-in:$A_EMAIL"
           record user-a-sees-own-row pass
 
+          # 3b. The application write action stamps user A, persists, and PRG redirects.
+          CREATED_MARKER="created-$MARKER"
+          code=$(curl -s -o /dev/null -w '%{http_code}' -b .smoke/jar-a \
+            -X POST "$BASE/notes?/create" \
+            -H 'Content-Type: application/x-www-form-urlencoded' \
+            --data-urlencode "title=created by smoke" \
+            --data-urlencode "body=$CREATED_MARKER")
+          [ "$code" = "303" ]
+          curl -s -b .smoke/jar-a "$BASE/notes" | grep -q "$CREATED_MARKER"
+          record user-a-creates-note-via-action pass
+
           # 4. User B sees none of A's rows (cross-user RLS).
           code=$(curl -s -o /dev/null -w '%{http_code}' -c .smoke/jar-b \
             -X POST "$BASE/login" \
@@ -137,6 +150,43 @@ jobs:
           fi
           record user-b-isolated-from-a pass
 
+          # 4b. Exercise database RLS directly with user B's JWT: attempts to
+          # update/delete A's known row must affect zero rows.
+          token_b=$(curl -sf -X POST "$SUPABASE_URL/auth/v1/token?grant_type=password" \
+            -H "apikey: $SUPABASE_ANON_KEY" -H 'Content-Type: application/json' \
+            -d "{\"email\":\"$B_EMAIL\",\"password\":\"$B_PASSWORD\"}" | jq -er '.access_token')
+          changed=$(curl -sf -X PATCH "$SUPABASE_URL/rest/v1/notes?id=eq.$NOTE_ID" \
+            -H "apikey: $SUPABASE_ANON_KEY" -H "Authorization: Bearer $token_b" \
+            -H 'Content-Type: application/json' -H 'Prefer: return=representation' \
+            -d '{"body":"cross-user overwrite"}')
+          [ "$(echo "$changed" | jq 'length')" = "0" ]
+          deleted=$(curl -sf -X DELETE "$SUPABASE_URL/rest/v1/notes?id=eq.$NOTE_ID" \
+            -H "apikey: $SUPABASE_ANON_KEY" -H "Authorization: Bearer $token_b" \
+            -H 'Prefer: return=representation')
+          [ "$(echo "$deleted" | jq 'length')" = "0" ]
+          record user-b-update-delete-a-denied pass
+
+          # 4c. Anonymous REST reads cannot observe any notes.
+          anonymous_rows=$(curl -sf "$SUPABASE_URL/rest/v1/notes?select=id&limit=1" \
+            -H "apikey: $SUPABASE_ANON_KEY")
+          [ "$(echo "$anonymous_rows" | jq 'length')" = "0" ]
+          record anonymous-direct-rest-denied pass
+
+          # 4d. Storage action is owner-scoped and collision-safe.
+          printf 'smoke attachment' > .smoke/attachment.txt
+          code=$(curl -s -o /dev/null -w '%{http_code}' -b .smoke/jar-a \
+            -X POST "$BASE/upload?/upload" -F 'file=@.smoke/attachment.txt;type=text/plain')
+          [ "$code" = "303" ]
+          curl -s -b .smoke/jar-a "$BASE/upload" | grep -q 'attachment.txt'
+          duplicate=$(curl -s -o .smoke/duplicate.html -w '%{http_code}' -b .smoke/jar-a \
+            -X POST "$BASE/upload?/upload" -F 'file=@.smoke/attachment.txt;type=text/plain')
+          [ "$duplicate" = "422" ]
+          if curl -s -b .smoke/jar-b "$BASE/upload" | grep -q 'attachment.txt'; then
+            record user-b-storage-isolated fail
+            exit 1
+          fi
+          record storage-owner-and-collision-boundary pass
+
           # 5. Logout clears the session: the next /notes read is denied again.
           # The action entry parses a form body unconditionally, so the POST
           # needs a form content type even with an empty body.

deno.json

@@ -33,6 +33,7 @@
   "nodeModulesDir": "manual",
   "tasks": {
     "dev": "cd www && deno run --allow-read --allow-write --allow-net --allow-env --allow-ffi --allow-sys npm:vite --config vite.config.ts",
+    "www:dev-smoke": "deno run --allow-net --allow-run tools/smoke-www-dev.ts",
     "build": "deno task generate:ui-manifest && (cd www && deno run --config ../deno.json --allow-read --allow-write --allow-net --allow-env --allow-ffi --allow-sys --allow-run ../packages/adapter-vite/src/cli/build.ts) && deno task www:pagefind && deno task www:check-artifact-truth",
     "www:pagefind": "cd www && deno run --config ../deno.json --allow-read --allow-write --allow-run --allow-env --allow-net --allow-ffi --allow-sys build-pagefind.ts",
     "preview": "cd www && deno run --allow-read --allow-write --allow-net --allow-env --allow-ffi npm:vite preview --config vite.config.ts",
@@ -44,10 +45,11 @@
     "docs:check-strategy": "deno run --allow-read tools/check-docs-truth.ts --check=strategic",
     "docs:check-current": "deno run --allow-read tools/check-docs-truth.ts --check=current",
     "docs:check-claims": "deno run --allow-read tools/check-docs-truth.ts --check=claims",
+    "docs:check-recipe-parity": "deno run --allow-read tools/check-supabase-recipe-parity.ts",
     "release:evidence:check": "deno run --allow-read --allow-run=git tools/check-docs-truth.ts --check=evidence",
     "release:state-machine:check": "deno run --allow-read --allow-run=git tools/check-release-state-machine.ts",
     "docs:check-version-anchors": "deno run --allow-read tools/check-version-anchors.ts",
-    "docs:truth": "deno run --allow-read --allow-run=git tools/check-docs-truth.ts && deno task docs:check-version-anchors",
+    "docs:truth": "deno run --allow-read --allow-run=git tools/check-docs-truth.ts && deno task docs:check-version-anchors && deno task docs:check-recipe-parity",
     "www:check-current-truth": "deno run --allow-read tools/check-docs-truth.ts --check=www",
     "www:check-theme-tokens": "deno run --allow-read tools/check-www-theme-tokens.ts",
     "www:check-artifact-truth": "deno run --allow-read tools/check-docs-truth.ts --check=www --artifacts",

deno.lock

@@ -0,0 +1,45 @@
+# ADR-0130: Retire the Duplicate `/_data` Loader Endpoint
+
+- Status: Accepted
+- Date: 2026-08-17
+- Amends: ADR-0122 §2/§4
+- Related: #987, #1002
+
+## Context
+
+The generated request-time entry contained two ways to execute a page loader:
+the canonical page GET handler and a generated `/_data/<route>` handler. The
+browser router does not consume the latter; it imports the route module and
+invokes the same loader through its in-process request cache. No maintained
+consumer, public recipe, or compatibility test uses `/_data`.
+
+Keeping an unused second endpoint duplicated route matching and loader dispatch
+inside the ADR-0122 frozen entry generator. It also created an attractive but
+false protocol surface whose params, Cookie propagation, redirects, problem
+responses and cache headers would have needed permanent parity coverage.
+
+## Decision
+
+Remove generation and orchestration of the private `/_data` route map and
+endpoint. There is no replacement network endpoint. Browser navigation keeps
+using the existing in-process loader path; request-time/native navigation keeps
+using the canonical page GET handler.
+
+This amendment changes only the set of generated internal endpoints. It does
+not change ADR-0122's frozen contracts:
+
+- loader/action signatures and `fail()`/`redirect()` algebra are unchanged;
+- action negotiation, PRG revalidation and native/enhanced symmetry are unchanged;
+- CSRF defaults and POST dispatch are unchanged;
+- Cookie/response-header propagation and cache behavior remain on canonical handlers;
+- pure-static projects and the documented `build` then `start` path are unchanged.
+
+## Consequences
+
+- One loader has one maintained request-time network representation.
+- Generated output must not contain `/_data` or `__dataRouteMap`; a regression
+  test pins this absence.
+- A future serialized loader-data endpoint is a new public protocol proposal,
+  not permission to restore the retired private implementation.
+- Removing any other generated route under the frozen entry pipeline requires
+  its own compatibility analysis; this amendment is intentionally narrow.

docs/adr/ADR-0130-retire-duplicate-data-endpoint.md

@@ -172,6 +172,7 @@ git history.
 | 0121 | 0.42 Action Protocol Hardening Amendment (Audit Round 1)                                                                             | Accepted                                         |
 | 0122 | 0.42.0 Stable Scope Freeze — WC Light Fullstack                                                                                      | Proposed (TP-6)                                  |
 | 0123 | Standards as Seams — Evolution Plan                                                                                                  | Proposed (alpha.13)                              |
+| 0130 | Retire the Duplicate `/_data` Loader Endpoint                                                                                        | Accepted                                         |
 
 ## Superseded / Historical
 

docs/adr/README.md

@@ -2,10 +2,11 @@
 
 > Current source package line: `v0.43.0-alpha.1`\
 > Current npm registry line: `v0.43.0-alpha.1` (published 2026-08-15, dist-tag `alpha`)\
-> In-flight work: the 0.43.0-alpha.1 foundation train on the `v0.43.0`
-> line; TP-6 closed 2026-08-14 with ADR-0122 accepted (#962) and the WC
-> light-fullstack stable cut shipped\
-> Active release target: `v0.43.0-alpha.1`\
+> Latest landed train: `v0.43.0-alpha.2` (admission visibility, on main)\
+> Active release target: `v0.43.0-alpha.2`\
+> Next planned train: `v0.43.0-alpha.3`\
+> In-flight work: close the alpha.2 Gate 0 correctness set and release
+> evidence while the fullstack production plan proceeds under #1002\
 > Planning release target: `v0.43.0` (Universal WC SSR — this plan)\
 > Next release line: `v0.44.0` (production runtime)\
 > Current maturity stage: stable (the 0.42 line, WC light fullstack frozen