@starci/eslint-canon-fe 9.5.13 → 9.5.14

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 9.5.14 - 2026-10-29
+
+- Changed: the bundled `runtime/scripts/lib/sops-envelope.mjs` admits an age set of one or more recipients for the selected-identity decrypt (`selectedAgeEnvelope`): the selected recipient must be one of the set, an empty entry or gap (`invalid-age-entry`) and a recipient named twice (`duplicate-age-recipient`) are refused, a dotenv envelope reads every `sops_age__list_<n>__` entry; the bundled canon pins name hfs 4.11.13, eslint-canon-be 3.8.12, eslint-canon-fe 9.5.14 and the Grammar family 0.15.25. No rule changed.
+
 ## 9.5.13 - 2026-10-29
 
 - Changed: the bundled canon pins name hfs 4.11.12, eslint-canon-be 3.8.11, eslint-canon-fe 9.5.13 and the Grammar family 0.15.24; the bundled slot judgement (`runtime/scripts/hfs/path-findings.mjs`) admits the one file a file slot names by its path, as eslint-canon-be does.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.5.13",
+  "version": "9.5.14",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.24
+    version: 0.15.25
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.8.11
+    version: 3.8.12
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.13
+    version: 9.5.14
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.24
+    version: 0.15.25
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.24
+    version: 0.15.25
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.11.12
+    version: 4.11.13
     group: starci
     install: registry
     side: both

package/runtime/scripts/lib/sops-envelope.mjs

@@ -62,13 +62,17 @@ export function isSopsEnvelope(text) {
   try { return sopsTree(parseYaml(src)); } catch { return false; }
 }
 
-/** Admit one flat age envelope for the native selected-identity invocation; this is shape admission, never cryptographic proof. */
+/** A refused admission, named by its reason. */
 const refusal = (reason) => ({ ok: false, reason });
 
+const DOTENV_AGE_FIELD = /^age__list_(0|[1-9]\d{0,2})__map_(recipient|enc)$/u;
+
 function dotenvMetadataValue(meta, age, key, value) {
-  if (key === 'age__list_0__map_recipient') age.recipient = value;
-  else if (key === 'age__list_0__map_enc') age.enc = value;
-  else if (key === 'mac_only_encrypted') {
+  const field = DOTENV_AGE_FIELD.exec(key);
+  if (field) {
+    const entry = (age[Number(field[1])] ??= {});
+    entry[field[2]] = value;
+  } else if (key === 'mac_only_encrypted') {
     if (value !== 'false') return 'partial-mac';
     meta[key] = false;
   } else if (key.includes('__')) return 'unsupported-key-group';
@@ -88,13 +92,14 @@ function readDotenvMetadata(text) {
     pairs.set(name, line.slice(at + 1).replaceAll(String.raw`\n`, '\n'));
   }
   const meta = {};
-  const age = {};
+  const age = [];
   for (const [name, value] of pairs) {
     if (!name.startsWith('sops_')) continue;
     const reason = dotenvMetadataValue(meta, age, name.slice('sops_'.length), value);
     if (reason) return { refusal: reason };
   }
-  meta.age = [age];
+  // A gap in the list indices is an entry sops never wrote: refused as an empty entry, never skipped.
+  meta.age = Array.from(age, (entry) => entry ?? null);
   return { meta };
 }
 
@@ -142,15 +147,35 @@ function validateAgeMetadata(meta, text, recipient) {
   const fields = new Set([...providers, 'age', 'lastmodified', 'mac', 'version', 'unencrypted_suffix', 'encrypted_suffix', 'unencrypted_regex', 'encrypted_regex', 'unencrypted_comment_regex', 'encrypted_comment_regex', 'mac_only_encrypted']);
   if (Object.keys(meta).some(name => !fields.has(name))) return refusal('unknown-metadata');
   if (Object.hasOwn(meta, 'mac_only_encrypted') && meta.mac_only_encrypted !== false) return refusal('partial-mac');
-  if (!Array.isArray(meta.age) || meta.age.length !== 1) return refusal('unsupported-age-set');
-  const entry = meta.age[0];
-  if (!isAgeEntry(entry)) return refusal('invalid-age-entry');
-  if (typeof entry.recipient !== 'string' || entry.recipient !== recipient) return refusal('recipient-mismatch');
-  if (!hasValidAgePayload(entry)) return refusal('invalid-age-entry');
+  const set = ageSet(meta.age);
+  if (!set.ok) return set;
+  if (!set.recipients.includes(recipient)) return refusal('recipient-mismatch');
   if (!hasValidEnvelopeVersion(meta)) return refusal('invalid-envelope');
   return { ok: true };
 }
 
+const AGE_RECIPIENT = /^age1[ac-hj-np-z02-9]+$/u;
+
+/**
+ * The age set of an envelope: one or more entries (the owner key and an environment's server key are the standard pair), each a
+ * well-formed recipient with its wrapped data key; an empty entry or a recipient named twice is refused.
+ */
+function ageSet(entries) {
+  if (!Array.isArray(entries) || entries.length === 0) return refusal('unsupported-age-set');
+  const recipients = [];
+  for (const entry of entries) {
+    if (!isAgeEntry(entry) || typeof entry.recipient !== 'string' || !AGE_RECIPIENT.test(entry.recipient) || !hasValidAgePayload(entry))
+      return refusal('invalid-age-entry');
+    if (recipients.includes(entry.recipient)) return refusal('duplicate-age-recipient');
+    recipients.push(entry.recipient);
+  }
+  return { ok: true, recipients };
+}
+
+/**
+ * Admit one flat age envelope for the native selected-identity invocation when `recipient` (the selected identity's public key) is
+ * one of its age set. Shape admission, never cryptographic proof.
+ */
 export function selectedAgeEnvelope(text, format, recipient) {
   if (!['binary', 'json', 'yaml', 'dotenv'].includes(format)) return refusal('unsupported-format');
   const parsed = readAgeMetadata(text, format);