@starci/eslint-grammar-core 0.15.34 → 0.16.0

package/runtime/engine/orca-config.mjs

@@ -1,6 +1,5 @@
-import {isPlainObject as plain} from './plain-object.mjs';
-import {invalid} from './invalid-config.mjs';
-
+import { isPlainObject as plain } from './plain-object.mjs';
+import { invalid } from './invalid-config.mjs';
 /**
  * config.yaml `orca` — the owner's Orca app settings the runtime must know. maxWorkerDepth is the deepest worker Orca
  * lets start under the owner's chat (chat = depth 0, a Kernel or the [Supervisor] 1, an op or a [Worker] 2, the draw
@@ -9,21 +8,27 @@ import {invalid} from './invalid-config.mjs';
  * deeper than it before worker-start (worker-depth-exceeded), and `start --check` with STARCI_ORCA_LIVE=1 compares it with
  * a measured probe (scripts/agent/depth-probe.mjs).
  */
-export const ORCA_DEFAULTS=Object.freeze({maxWorkerDepth:4});
+export const ORCA_DEFAULTS = Object.freeze({ maxWorkerDepth: 4 });
 /** The keys of the orca block. */
-export const ORCA_KEYS=Object.freeze(Object.keys(ORCA_DEFAULTS));
-export const MAX_WORKER_DEPTH_CEILING=16;
-export function validateOrca(orca){
-  if(orca===null)return;
-  const bad=invalid('orca');
-  if(!plain(orca))bad(' must be {maxWorkerDepth?} or null.');
-  for(const key of Object.keys(orca))if(!ORCA_KEYS.includes(key))bad(` has unknown key ${key} (allowed: ${ORCA_KEYS.join(', ')}).`);
-  const v=orca.maxWorkerDepth;
-  if(v!==undefined&&v!==null&&!(Number.isInteger(v)&&v>=1&&v<=MAX_WORKER_DEPTH_CEILING))bad(`.maxWorkerDepth must be an integer from 1 to ${MAX_WORKER_DEPTH_CEILING} equal to the Orca app's worker depth setting (default ${ORCA_DEFAULTS.maxWorkerDepth}), or null.`);
+export const ORCA_KEYS = Object.freeze(Object.keys(ORCA_DEFAULTS));
+export const MAX_WORKER_DEPTH_CEILING = 16;
+export function validateOrca(orca) {
+    if (orca === null)
+        return;
+    const bad = invalid('orca');
+    if (!plain(orca))
+        return bad(' must be {maxWorkerDepth?} or null.');
+    for (const key of Object.keys(orca))
+        if (!ORCA_KEYS.includes(key))
+            bad(` has unknown key ${key} (allowed: ${ORCA_KEYS.join(', ')}).`);
+    const v = orca.maxWorkerDepth;
+    if (v !== undefined && v !== null && !(typeof v === 'number' && Number.isInteger(v) && v >= 1 && v <= MAX_WORKER_DEPTH_CEILING))
+        bad(`.maxWorkerDepth must be an integer from 1 to ${MAX_WORKER_DEPTH_CEILING} equal to the Orca app's worker depth setting (default ${ORCA_DEFAULTS.maxWorkerDepth}), or null.`);
 }
 /** The owner's Orca settings: {maxWorkerDepth, source: 'orca'|'default'}. An absent or null block or key is the default. */
-export function orcaSettings(config){
-  if(config?.orca!==undefined)validateOrca(config.orca);
-  const value=plain(config?.orca)?config.orca.maxWorkerDepth:null;
-  return Number.isInteger(value)?{maxWorkerDepth:value,source:'orca'}:{maxWorkerDepth:ORCA_DEFAULTS.maxWorkerDepth,source:'default'};
+export function orcaSettings(config) {
+    if (config?.orca !== undefined)
+        validateOrca(config.orca);
+    const value = plain(config?.orca) ? config.orca.maxWorkerDepth : null;
+    return typeof value === 'number' && Number.isInteger(value) ? { maxWorkerDepth: value, source: 'orca' } : { maxWorkerDepth: ORCA_DEFAULTS.maxWorkerDepth, source: 'default' };
 }

package/runtime/engine/release-config.mjs

@@ -1,28 +1,32 @@
-import {isPlainObject as plain} from './plain-object.mjs';
-import {invalid} from './invalid-config.mjs';
-
+import { isPlainObject as plain } from './plain-object.mjs';
+import { invalid } from './invalid-config.mjs';
 /** The keys of the release block. */
-export const RELEASE_KEYS=Object.freeze(['suite']);
+export const RELEASE_KEYS = Object.freeze(['suite']);
 /** Where the full test suite of a release is judged: `local` (the release cut also runs the L4 rows before it tags, the shipped default) or `ci` (the GitHub workflows judge EVERY row on each push to main; the cut runs none). */
-export const SUITE_MODES=Object.freeze(['local','ci']);
-const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
-
+export const SUITE_MODES = Object.freeze(['local', 'ci']);
+const RELEASE_DEFAULTS = Object.freeze({ suite: 'local' });
 /**
  * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped default: `starci release cut` also runs the
  * L4 rows on this host before it tags. `ci` is the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): the full suite runs on GitHub only, on every push
  * to main; the cut runs no row and the verdict is read with `starci release ci-status`. The push of main needs neither mode: it needs a green scoped check.
  * `none` is refused: the suite does not vanish, it moves to CI, and the value says so.
  */
-export function validateRelease(release){
-  if(release===null)return;
-  const bad=invalid('release');
-  if(!plain(release))bad(` must be {suite?: ${SUITE_MODES.join(' | ')}} or null.`);
-  for(const key of Object.keys(release))if(!RELEASE_KEYS.includes(key))bad(` has unknown key ${key} (allowed: ${RELEASE_KEYS.join(', ')}).`);
-  const value=release.suite;
-  if(value===undefined||value===null)return;
-  if(value==='none')bad('.suite: "none" is not a mode: write "ci" (no local full suite, CI judges) or "local".');
-  if(!SUITE_MODES.includes(value))bad(`.suite must be ${SUITE_MODES.join(' or ')}, or null.`);
+export function validateRelease(release) {
+    if (release === null)
+        return;
+    const bad = invalid('release');
+    if (!plain(release))
+        return bad(` must be {suite?: ${SUITE_MODES.join(' | ')}} or null.`);
+    for (const key of Object.keys(release))
+        if (!RELEASE_KEYS.includes(key))
+            bad(` has unknown key ${key} (allowed: ${RELEASE_KEYS.join(', ')}).`);
+    const value = release.suite;
+    if (value === undefined || value === null)
+        return;
+    if (value === 'none')
+        bad('.suite: "none" is not a mode: write "ci" (no local full suite, CI judges) or "local".');
+    if (typeof value !== 'string' || !SUITE_MODES.includes(value))
+        bad(`.suite must be ${SUITE_MODES.join(' or ')}, or null.`);
 }
-
 /** The suite mode a validated owner config names; an absent block or key is the shipped default. */
-export const releaseSuiteMode=config=>config?.release?.suite??RELEASE_DEFAULTS.suite;
+export const releaseSuiteMode = (config) => config?.release?.suite ?? RELEASE_DEFAULTS.suite;

package/runtime/engine/removed-vocabulary.mjs

@@ -1,26 +1,27 @@
 import fs from 'node:fs';
-import {fileURLToPath} from 'node:url';
-import {parseYaml} from './yaml.mjs';
-
-const FILE=fileURLToPath(new URL('../modules/kernel/removed-vocabulary.yaml',import.meta.url));
-
-let cache=null;
-function loaded(){
-  let stat;try{stat=fs.statSync(FILE);}catch{throw new Error('Missing modules/kernel/removed-vocabulary.yaml');}
-  const version=`${stat.mtimeMs}:${stat.size}`;
-  if(cache?.version!==version)cache={version,doc:parseYaml(fs.readFileSync(FILE,'utf8'))};
-  return cache.doc;
+import { fileURLToPath } from 'node:url';
+import { parseYaml } from './yaml.mjs';
+const FILE = fileURLToPath(new URL('../modules/kernel/removed-vocabulary.yaml', import.meta.url));
+let cache = null;
+function loaded() {
+    let stat;
+    try {
+        stat = fs.statSync(FILE);
+    }
+    catch {
+        throw new Error('Missing modules/kernel/removed-vocabulary.yaml');
+    }
+    const version = `${stat.mtimeMs}:${stat.size}`;
+    if (cache?.version !== version)
+        cache = { version, doc: parseYaml(fs.readFileSync(FILE, 'utf8')) };
+    return cache.doc;
 }
-
-
 /** modules/kernel/removed-vocabulary.yaml: the one list of spellings the runtime refuses, each with its replacement and the release that removed it. */
-export const removedVocabulary=()=>loaded().removed;
-
+export const removedVocabulary = () => loaded().removed;
 /** The removed spellings of one kind. */
-export const removedOfKind=kind=>removedVocabulary().filter(entry=>entry.kind===kind);
-
+export const removedOfKind = (kind) => removedVocabulary().filter(entry => entry.kind === kind);
 /** `<name> is removed (<replacement>)` for a removed spelling of the kind, or undefined when the name is not one. */
-export function removedNotice(kind,name){
-  const entry=removedOfKind(kind).find(candidate=>candidate.name===name);
-  return entry?`${entry.name} is removed (${entry.use})`:undefined;
+export function removedNotice(kind, name) {
+    const entry = removedOfKind(kind).find(candidate => candidate.name === name);
+    return entry ? `${entry.name} is removed (${entry.use})` : undefined;
 }

package/runtime/engine/resources-config.mjs

@@ -1,6 +1,5 @@
-import {isPlainObject as plain} from './plain-object.mjs';
-import {invalid} from './invalid-config.mjs';
-
+import { isPlainObject as plain } from './plain-object.mjs';
+import { invalid } from './invalid-config.mjs';
 /**
  * config.yaml `resources` — the owner's host-capacity floors, which override the shipped numbers of
  * modules/models/runtimes.yaml `allocation.resources`. minFreeDiskGb: the free space a drive holding the temp root or the
@@ -8,45 +7,53 @@ import {invalid} from './invalid-config.mjs';
  * percentage of the drive's size; when both are set the larger requirement applies. minFreeRamPct: the free-RAM floor below
  * which no new heavy op starts. A null or absent key leaves the shipped number.
  */
-const FLOOR_LIMITS=Object.freeze({minFreeDiskGb:Infinity,minFreeDiskPct:100,minFreeRamPct:100});
-const inRange=(value,limit)=>typeof value==='number'&&Number.isFinite(value)&&value>0&&value<=limit;
-
+const FLOOR_LIMITS = Object.freeze({ minFreeDiskGb: Infinity, minFreeDiskPct: 100, minFreeRamPct: 100 });
+const inRange = (value, limit) => typeof value === 'number' && Number.isFinite(value) && value > 0 && value <= limit;
 /** The keys of the resources block. */
-export const RESOURCE_KEYS=Object.freeze(Object.keys(FLOOR_LIMITS));
-
-export function validateResources(resources){
-  if(resources===null)return;
-  const bad=invalid('resources');
-  const keys=RESOURCE_KEYS;
-  const shape=keys.map(key=>`${key}?`).join(', ');
-  if(!plain(resources))bad(` must be {${shape}} or null.`);
-  for(const key of Object.keys(resources))if(!keys.includes(key))bad(` has unknown key ${key} (allowed: ${keys.join(', ')}).`);
-  for(const key of keys){
-    const value=resources[key];
-    if(value!==undefined&&value!==null&&!inRange(value,FLOOR_LIMITS[key])){
-      const cap=FLOOR_LIMITS[key]===Infinity?'':` and at most ${FLOOR_LIMITS[key]}`;
-      bad(`.${key} must be a number above 0${cap}, or null.`);
+export const RESOURCE_KEYS = Object.freeze(Object.keys(FLOOR_LIMITS));
+const isFloorKey = (key) => Object.hasOwn(FLOOR_LIMITS, key);
+export function validateResources(resources) {
+    if (resources === null)
+        return;
+    const bad = invalid('resources');
+    const keys = RESOURCE_KEYS;
+    const shape = keys.map(key => `${key}?`).join(', ');
+    if (!plain(resources))
+        return bad(` must be {${shape}} or null.`);
+    for (const key of Object.keys(resources))
+        if (!keys.includes(key))
+            bad(` has unknown key ${key} (allowed: ${keys.join(', ')}).`);
+    for (const key of keys) {
+        if (!isFloorKey(key))
+            continue;
+        const value = resources[key];
+        if (value !== undefined && value !== null && !inRange(value, FLOOR_LIMITS[key])) {
+            const cap = FLOOR_LIMITS[key] === Infinity ? '' : ` and at most ${FLOOR_LIMITS[key]}`;
+            bad(`.${key} must be a number above 0${cap}, or null.`);
+        }
     }
-  }
 }
-
-const declared=(block,key,source)=>{
-  const value=block?.[key];
-  if(value===undefined||value===null)return null;
-  if(!inRange(value,FLOOR_LIMITS[key]))throw new Error(`${source}.${key} must be a number above 0 (at most ${FLOOR_LIMITS[key]})`);
-  return value;
+const declared = (block, key, source) => {
+    const value = block?.[key];
+    if (value === undefined || value === null)
+        return null;
+    if (!inRange(value, FLOOR_LIMITS[key]))
+        throw new Error(`${source}.${key} must be a number above 0 (at most ${FLOOR_LIMITS[key]})`);
+    return value;
 };
-
 /**
  * The floors in force: the owner's `resources` (config.yaml) over the shipped `allocation.resources`.
  * {minFreeDiskGb, minFreeDiskPct (null when unset), minFreeRamPct}. The shipped policy owns the default numbers: when it
  * omits or misspells minFreeDiskGb or minFreeRamPct this refuses, there is no fallback constant.
  */
-export function hostFloors(shipped,owner=null){
-  const source='modules/models/runtimes.yaml allocation.resources';
-  const base={minFreeDiskGb:declared(shipped,'minFreeDiskGb',source),minFreeDiskPct:declared(shipped,'minFreeDiskPct',source),minFreeRamPct:declared(shipped,'minFreeRamPct',source)};
-  for(const key of ['minFreeDiskGb','minFreeRamPct'])if(base[key]===null)throw new Error(`${source}.${key} must declare a positive number`);
-  if(owner!==null&&owner!==undefined)validateResources(owner);
-  const pick=key=>declared(owner,key,'config.yaml resources')??base[key];
-  return {minFreeDiskGb:pick('minFreeDiskGb'),minFreeDiskPct:pick('minFreeDiskPct'),minFreeRamPct:pick('minFreeRamPct')};
+export function hostFloors(shipped, owner = null) {
+    const source = 'modules/models/runtimes.yaml allocation.resources';
+    const base = { minFreeDiskGb: declared(shipped, 'minFreeDiskGb', source), minFreeDiskPct: declared(shipped, 'minFreeDiskPct', source), minFreeRamPct: declared(shipped, 'minFreeRamPct', source) };
+    for (const key of ['minFreeDiskGb', 'minFreeRamPct'])
+        if (base[key] === null)
+            throw new Error(`${source}.${key} must declare a positive number`);
+    if (owner !== null && owner !== undefined)
+        validateResources(owner);
+    const pick = (key) => declared(owner, key, 'config.yaml resources') ?? base[key];
+    return { minFreeDiskGb: pick('minFreeDiskGb'), minFreeDiskPct: pick('minFreeDiskPct'), minFreeRamPct: pick('minFreeRamPct') };
 }

package/runtime/engine/runtime-root.mjs

@@ -1,8 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import {fileURLToPath} from 'node:url';
-import {parseYaml} from './yaml.mjs';
-
+import { fileURLToPath } from 'node:url';
+import { parseYaml } from './yaml.mjs';
 /**
  * Runtime root helper. The runtime reads this source tree directly. `skillRoot` is the
  * directory containing `package.json` (this module's parent) — the checkout, or the copy of it
@@ -13,7 +12,6 @@ import {parseYaml} from './yaml.mjs';
  * path under `skillRoot` and parses the file by its extension.
  */
 const moduleRoot = path.dirname(fileURLToPath(new URL('../package.json', import.meta.url)));
-
 /** The runtime root: this source tree (or an immutable sealed payload of it). */
 export const skillRoot = moduleRoot;
 /**
@@ -21,7 +19,6 @@ export const skillRoot = moduleRoot;
  * holding this runtime checkout. Parameterized over `env`, so a spec can inject a fixture Source.
  */
 export const starciSourceRoot = (env = process.env) => (env.STARCI_SOURCE_ROOT ? path.resolve(env.STARCI_SOURCE_ROOT) : path.dirname(skillRoot));
-
 /** Overrides the per-host state base wholesale (debug probes, spec trees); the one seam starciLocalRoot reads. */
 export const LOCAL_ROOT_ENV = 'STARCI_LOCAL_ROOT';
 /** The host-data directory of a runtime root. Git-ignored and never packed; the example fixtures under examples/.runtimes are a separate, public exception. */
@@ -38,17 +35,18 @@ export const runtimeStateDir = (root = skillRoot) => path.join(root, RUNTIME_STA
  * LOCAL_ROOT_ENV replaces it wholesale. Nothing is read from or moved out of the earlier %LOCALAPPDATA%/StarCi and ~/.starci locations.
  */
 export const starciLocalRoot = (env = process.env, root = skillRoot) => (env[LOCAL_ROOT_ENV] ? path.resolve(env[LOCAL_ROOT_ENV]) : runtimeStateDir(root));
-
 /**
  * Read a runtime contract document. `parts` are path segments under `skillRoot`
  * (e.g. readModuleJson('modules', 'models', 'kinds.yaml')).
  */
+// reason: a parsed YAML/JSON contract document read from disk (parsed-input boundary); callers index into it by contract shape.
 export function readModuleJson(...parts) {
-  const rel = parts.join('/');
-  const file = path.join(skillRoot, rel);
-  if (!(file.startsWith(skillRoot) && fs.existsSync(file) && fs.statSync(file).isFile()))
-    throw new Error(`Required contract not found for ${rel} under ${skillRoot}`);
-  const text = fs.readFileSync(file, 'utf8');
-  if (/\.ya?ml$/i.test(file)) return parseYaml(text);
-  return JSON.parse(text);
+    const rel = parts.join('/');
+    const file = path.join(skillRoot, rel);
+    if (!(file.startsWith(skillRoot) && fs.existsSync(file) && fs.statSync(file).isFile()))
+        throw new Error(`Required contract not found for ${rel} under ${skillRoot}`);
+    const text = fs.readFileSync(file, 'utf8');
+    if (/\.ya?ml$/i.test(file))
+        return parseYaml(text);
+    return JSON.parse(text);
 }

package/runtime/engine/secrets.mjs

@@ -1,134 +1,202 @@
 import fs from 'node:fs';
 import path from 'node:path';
-
 /** The host-local credential filename, resolved only against a verified runtime main root. */
-export const SECRET_ENV_FILE='secret.env';
+export const SECRET_ENV_FILE = 'secret.env';
 /** The configured credential variable grammar shared by validation and secret resolution. */
-export const ENV_NAME=/^[A-Z_][A-Z0-9_]{0,63}$/;
-export const CREDENTIAL_FILE_MAX_BYTES=1024*1024;
+export const ENV_NAME = /^[A-Z_][A-Z0-9_]{0,63}$/;
+export const CREDENTIAL_FILE_MAX_BYTES = 1024 * 1024;
 const resolvedValues = new Set();
-const remember = value => {
-  if (typeof value === 'string' && value.length >= 6) resolvedValues.add(value);
-  return value;
+const remember = (value) => {
+    if (typeof value === 'string' && value.length >= 6)
+        resolvedValues.add(value);
+    return value;
 };
-
 /** Filter credentials resolved by this process; the values never leave their resolution owner. */
 export function redactResolvedSecrets(text) {
-  let clean = text;
-  for (const value of resolvedValues) if (clean.includes(value)) clean = clean.split(value).join('[redacted:resolved-secret]');
-  return clean;
+    let clean = text;
+    for (const value of resolvedValues)
+        if (clean.includes(value))
+            clean = clean.split(value).join('[redacted:resolved-secret]');
+    return clean;
 }
-
 /** Check lexical availability only; blank and conventional template markers never prove provider validity. */
-export function credentialPresent(value){
-  if(typeof value!=='string'||!value.trim())return false;
-  return !/^(?:CHANGE_ME|REPLACE_ME|PLACEHOLDER|TODO|<[^>]*>|YOUR_[A-Z0-9_]+)$/i.test(value.trim());
+export function credentialPresent(value) {
+    if (typeof value !== 'string' || !value.trim())
+        return false;
+    return !/^(?:CHANGE_ME|REPLACE_ME|PLACEHOLDER|TODO|<[^>]*>|YOUR_[A-Z0-9_]+)$/i.test(value.trim());
 }
-
 /** Read one configured credential file with a finite byte budget; no effects beyond the read. */
-export function readSecretBytes(file){
-  const before=fs.lstatSync(file);
-  if(!before.isFile()||before.isSymbolicLink())throw new Error('credential file must be a regular file');
-  if(before.size>CREDENTIAL_FILE_MAX_BYTES)throw new Error('credential file exceeds the byte budget');
-  const fd=fs.openSync(file,fs.constants.O_RDONLY|(fs.constants.O_NOFOLLOW??0));
-  let bytes;
-  try{
-    const stat=fs.fstatSync(fd);
-    if(!stat.isFile()||stat.dev!==before.dev||stat.ino!==before.ino)throw new Error('credential file changed during resolution');
-    bytes=Buffer.alloc(CREDENTIAL_FILE_MAX_BYTES+1);
-    let count=0;
-    while(count<bytes.length){const n=fs.readSync(fd,bytes,count,bytes.length-count,null);if(n===0){break;}count+=n;}
-    if(count>CREDENTIAL_FILE_MAX_BYTES)throw new Error('credential file exceeds the byte budget');
-    return bytes.subarray(0,count);
-  }catch(error){bytes?.fill(0);throw error;}finally{fs.closeSync(fd);}
+export function readSecretBytes(file) {
+    const before = fs.lstatSync(file);
+    if (!before.isFile() || before.isSymbolicLink())
+        throw new Error('credential file must be a regular file');
+    if (before.size > CREDENTIAL_FILE_MAX_BYTES)
+        throw new Error('credential file exceeds the byte budget');
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    let bytes;
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino)
+            throw new Error('credential file changed during resolution');
+        bytes = Buffer.alloc(CREDENTIAL_FILE_MAX_BYTES + 1);
+        let count = 0;
+        while (count < bytes.length) {
+            const n = fs.readSync(fd, bytes, count, bytes.length - count, null);
+            if (n === 0) {
+                break;
+            }
+            count += n;
+        }
+        if (count > CREDENTIAL_FILE_MAX_BYTES)
+            throw new Error('credential file exceeds the byte budget');
+        return bytes.subarray(0, count);
+    }
+    catch (error) {
+        bytes?.fill(0);
+        throw error;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
 }
-
-const readCredentialFile = file => { const bytes=readSecretBytes(file); try{return bytes.toString('utf8');}finally{bytes.fill(0);} };
-
-const DOTENV_LINE_PARTS = [String.raw`^\s*`, String.raw`(?:export\s+)?`, String.raw`([A-Za-z_]\w*)`, String.raw`\s*=\s*`, String.raw`([^\r\n\u2028\u2029]*)`, String.raw`\s*$`];
+const readCredentialFile = (file) => { const bytes = readSecretBytes(file); try {
+    return bytes.toString('utf8');
+}
+finally {
+    bytes.fill(0);
+} };
+const DOTENV_LINE_PARTS = [String.raw `^\s*`, String.raw `(?:export\s+)?`, String.raw `([A-Za-z_]\w*)`, String.raw `\s*=\s*`, String.raw `([^\r\n\u2028\u2029]*)`, String.raw `\s*$`];
 const DOTENV_LINE = new RegExp(DOTENV_LINE_PARTS.join(''));
-
 /** Parse a dotenv file (KEY=VALUE lines, # comments, optional export/quotes). An absent file is {}. */
-export function readDotenv(file){
-  let text='';try{text=readCredentialFile(file);}catch(error){if(error?.code==='ENOENT'){return {};}throw error;}
-  const out={};
-  for(const line of text.split(/\r?\n/)){
-    const m=DOTENV_LINE.exec(line);
-    if(!m)continue;
-    let value=m[2].trimEnd();
-    if(value.length>=2&&(value.startsWith('"')||value.startsWith("'"))&&value.at(-1)===value[0])value=value.slice(1,-1);
-    out[m[1]]=value;
-  }
-  return out;
+export function readDotenv(file) {
+    let text = '';
+    try {
+        text = readCredentialFile(file);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return {};
+        }
+        throw error;
+    }
+    const out = {};
+    for (const line of text.split(/\r?\n/)) {
+        const m = DOTENV_LINE.exec(line);
+        if (!m)
+            continue;
+        const name = m[1];
+        let value = m[2].trimEnd();
+        if (value.length >= 2 && (value.startsWith('"') || value.startsWith("'")) && value.at(-1) === value[0])
+            value = value.slice(1, -1);
+        out[name] = value;
+    }
+    return out;
 }
-
 /**
  * Resolve a configured variable or its supported NAME_FILE custody pointer. An explicitly supplied
  * blank variable disables the value; it must not resurrect a file value. Never print the result.
  */
-export function connectorSecret(name,env=process.env){
-  if(typeof name!=='string'||!ENV_NAME.test(name))return null;
-  if(Object.hasOwn(env,name))return typeof env[name]==='string'?remember(env[name].trim()||null):null;
-  const pointer=typeof env[`${name}_FILE`]==='string'?env[`${name}_FILE`].trim():'';
-  if(!pointer)return null;
-  try{const value=readCredentialFile(pointer).trim();return remember(value||null);}catch{return null;}
+export function connectorSecret(name, env = process.env) {
+    if (typeof name !== 'string' || !ENV_NAME.test(name))
+        return null;
+    const direct = env[name];
+    if (Object.hasOwn(env, name))
+        return typeof direct === 'string' ? remember(direct.trim() || null) : null;
+    const filePointer = env[`${name}_FILE`];
+    const pointer = typeof filePointer === 'string' ? filePointer.trim() : '';
+    if (!pointer)
+        return null;
+    try {
+        const value = readCredentialFile(pointer).trim();
+        return remember(value || null);
+    }
+    catch {
+        return null;
+    }
 }
-
 /**
  * Load the verified runtime main's local credentials below the actual environment without mutating
  * either input. The caller owns repository identity; this base-tier reader never infers a root from cwd.
  * Absence is allowed so the action-specific gate can name only the credentials that action requires.
  */
-export function secretEnv(verifiedRuntimeRoot,env=process.env){
-  if(typeof verifiedRuntimeRoot!=='string'||!path.isAbsolute(verifiedRuntimeRoot))
-    throw new TypeError('secretEnv requires an absolute verified runtime root');
-  if(env===null||typeof env!=='object'||Array.isArray(env))throw new TypeError('secretEnv requires an environment mapping');
-  const root=fs.lstatSync(verifiedRuntimeRoot);
-  if(!root.isDirectory()||root.isSymbolicLink())throw new Error('secretEnv runtime root must be a regular directory');
-  const file=path.join(verifiedRuntimeRoot,SECRET_ENV_FILE);
-  let stat;
-  try{stat=fs.lstatSync(file);}catch(error){if(error?.code==='ENOENT'){return {...env};}throw error;}
-  if(!stat.isFile()||stat.isSymbolicLink())throw new Error('secret.env must be a regular file');
-  const local = readDotenv(file);
-  const resolved = {...local,...env};
-  for (const name of Object.keys(local)) if (typeof resolved[name] === 'string') remember(resolved[name]);
-  return resolved;
+export function secretEnv(verifiedRuntimeRoot, env = process.env) {
+    if (typeof verifiedRuntimeRoot !== 'string' || !path.isAbsolute(verifiedRuntimeRoot))
+        throw new TypeError('secretEnv requires an absolute verified runtime root');
+    if (env === null || typeof env !== 'object' || Array.isArray(env))
+        throw new TypeError('secretEnv requires an environment mapping');
+    const root = fs.lstatSync(verifiedRuntimeRoot);
+    if (!root.isDirectory() || root.isSymbolicLink())
+        throw new Error('secretEnv runtime root must be a regular directory');
+    const file = path.join(verifiedRuntimeRoot, SECRET_ENV_FILE);
+    let stat;
+    try {
+        stat = fs.lstatSync(file);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return { ...env };
+        }
+        throw error;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('secret.env must be a regular file');
+    const local = readDotenv(file);
+    const resolved = { ...local, ...env };
+    for (const name of Object.keys(local))
+        if (typeof resolved[name] === 'string')
+            remember(resolved[name]);
+    return resolved;
 }
-
-const sopsRefuse=(reason,message)=>{
-  const error=new Error(`SOPS identity [${reason}]: ${message}`);
-  error.name='SopsIdentityRefusal';error.identityRefusal=reason;
-  return {mode:'refused',env:null,error};
+const sopsRefuse = (reason, message) => {
+    const error = new Error(`SOPS identity [${reason}]: ${message}`);
+    error.name = 'SopsIdentityRefusal';
+    error.identityRefusal = reason;
+    return { mode: 'refused', env: null, error };
 };
-const sopsInlineIdentity=(env,name)=>{
-  if(!credentialPresent(env[name]))return sopsRefuse('disabled-inline','SOPS_AGE_KEY is explicitly empty or invalid');
-  remember(env[name].trim());
-  return {...sopsRefuse('inline-context-unqualified','the supplied SOPS_AGE_KEY awaits an owned selected-identity isolation capability; no SOPS process was launched'),inlineName:name};
+const sopsInlineIdentity = (env, name) => {
+    const inline = env[name];
+    if (!credentialPresent(inline))
+        return sopsRefuse('disabled-inline', 'SOPS_AGE_KEY is explicitly empty or invalid');
+    remember(inline.trim());
+    return { ...sopsRefuse('inline-context-unqualified', 'the supplied SOPS_AGE_KEY awaits an owned selected-identity isolation capability; no SOPS process was launched'), inlineName: name };
 };
-const sopsFileIdentity=(env,file)=>{
-  if(!credentialPresent(file))return sopsRefuse('invalid-file','the original identity file selection is empty or invalid');
-  if(!path.isAbsolute(file))return sopsRefuse('identity-file-location-unqualified','select the original identity by its absolute path; caller and SOPS working directories may differ');
-  try{
-    const stat=fs.lstatSync(file);
-    if(!stat.isFile()||stat.isSymbolicLink())return sopsRefuse('identity-file-unavailable','the explicitly selected original identity must be a regular non-symlink file');
-  }catch{return sopsRefuse('identity-file-unavailable','the explicitly selected original identity file is unavailable');}
-  return {mode:'file',env:{...env,SOPS_AGE_KEY_FILE:file},error:null};
+const sopsFileIdentity = (env, file) => {
+    if (!credentialPresent(file))
+        return sopsRefuse('invalid-file', 'the original identity file selection is empty or invalid');
+    if (!path.isAbsolute(file))
+        return sopsRefuse('identity-file-location-unqualified', 'select the original identity by its absolute path; caller and SOPS working directories may differ');
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return sopsRefuse('identity-file-unavailable', 'the explicitly selected original identity must be a regular non-symlink file');
+    }
+    catch {
+        return sopsRefuse('identity-file-unavailable', 'the explicitly selected original identity file is unavailable');
+    }
+    return { mode: 'file', env: { ...env, SOPS_AGE_KEY_FILE: file }, error: null };
 };
 /** Select a supplied age identity without inventing custody or running a key tool. Inline execution awaits its owned isolation capability. */
-export function sopsIdentityEnv(env,{identity=null,required=false,platform=process.platform}={}){
-  if(!env||typeof env!=='object'||Array.isArray(env))return sopsRefuse('invalid-environment','an environment mapping is required');
-  const names=name=>Object.keys(env).filter(key=>platform==='win32'?key.toUpperCase()===name:key===name);
-  const inline=names('SOPS_AGE_KEY'),files=names('SOPS_AGE_KEY_FILE');
-  if(inline.length>1||files.length>1)return sopsRefuse('ambiguous-environment','multiple Windows aliases select an age identity');
-  if(inline.length)return sopsInlineIdentity(env,inline[0]);
-  let file=identity;
-  if(files.length){
-    const value=env[files[0]];
-    if(!credentialPresent(value))return sopsRefuse('disabled-file','SOPS_AGE_KEY_FILE is explicitly empty or invalid');
-    if(identity!==null&&identity!==undefined&&identity!==value)return sopsRefuse('conflicting-files','two different original identity files were explicitly selected');
-    file=value;
-  }
-  if(file!==null&&file!==undefined)return sopsFileIdentity(env,file);
-  if(required)return sopsRefuse('identity-not-supplied','supply SOPS_AGE_KEY locally or select the original SOPS_AGE_KEY_FILE; no home default was inferred');
-  return {mode:'public-recipient',env:{...env},error:null};
+export function sopsIdentityEnv(env, { identity = null, required = false, platform = process.platform } = {}) {
+    if (!env || typeof env !== 'object' || Array.isArray(env))
+        return sopsRefuse('invalid-environment', 'an environment mapping is required');
+    const names = (name) => Object.keys(env).filter(key => platform === 'win32' ? key.toUpperCase() === name : key === name);
+    const inline = names('SOPS_AGE_KEY'), files = names('SOPS_AGE_KEY_FILE');
+    if (inline.length > 1 || files.length > 1)
+        return sopsRefuse('ambiguous-environment', 'multiple Windows aliases select an age identity');
+    if (inline.length)
+        return sopsInlineIdentity(env, inline[0]);
+    let file = identity;
+    if (files.length) {
+        const value = env[files[0]];
+        if (!credentialPresent(value))
+            return sopsRefuse('disabled-file', 'SOPS_AGE_KEY_FILE is explicitly empty or invalid');
+        if (identity !== null && identity !== undefined && identity !== value)
+            return sopsRefuse('conflicting-files', 'two different original identity files were explicitly selected');
+        file = value;
+    }
+    if (file !== null && file !== undefined)
+        return sopsFileIdentity(env, file);
+    if (required)
+        return sopsRefuse('identity-not-supplied', 'supply SOPS_AGE_KEY locally or select the original SOPS_AGE_KEY_FILE; no home default was inferred');
+    return { mode: 'public-recipient', env: { ...env }, error: null };
 }