@starci/hfs 4.0.10 → 4.2.0

package/runtime/scripts/api/sops/lib.mjs

@@ -22,33 +22,50 @@ export function custodyInputType(file, override) {
   return type;
 }
 
+const sopsNames = (env, win, pathext) => {
+  if (!win) return ['sops'];
+  if (!pathext) return ['sops.exe', 'sops'];
+  return String(env.PATHEXT || '.EXE;.CMD;.BAT').split(';').filter(Boolean).map((ext) => `sops${ext}`);
+};
+
+const nestedPackageDirs = (filesystem, paths, directory) => {
+  const dirs = [];
+  try {
+    for (const nested of filesystem.readdirSync(directory, { withFileTypes: true })) {
+      if (nested.isDirectory()) dirs.push(paths.join(directory, nested.name));
+    }
+  } catch { /* unreadable package */ }
+  return dirs;
+};
+
+const wingetPackageDirs = (filesystem, paths, packages, wingetPackageTree) => {
+  const dirs = [];
+  try {
+    for (const entry of filesystem.readdirSync(packages)) {
+      if (!wingetPackageTree && !/sops/i.test(entry)) continue;
+      const directory = paths.join(packages, entry);
+      dirs.push(directory);
+      if (wingetPackageTree) dirs.push(...nestedPackageDirs(filesystem, paths, directory));
+    }
+  } catch { /* no WinGet packages */ }
+  return dirs;
+};
+
+const wingetDirs = (filesystem, paths, env, wingetPackageTree) => {
+  const dirs = [];
+  if (!env.LOCALAPPDATA) return dirs;
+  const winget = paths.join(env.LOCALAPPDATA, 'Microsoft', 'WinGet');
+  dirs.push(paths.join(winget, 'Links'), ...wingetPackageDirs(filesystem, paths, paths.join(winget, 'Packages'), wingetPackageTree));
+  return dirs;
+};
+
 /** Resolve SOPS from PATH and WinGet. Consumers select PATHEXT names and the full package tree for their launcher. */
 export function resolveSops(env = process.env, { platform = process.platform, pathext = false, wingetPackageTree = false, filesystem = fs } = {}) {
   const win = platform === 'win32';
   const paths = win ? path.win32 : path.posix;
-  const names = win
-    ? (pathext ? String(env.PATHEXT || '.EXE;.CMD;.BAT').split(';').filter(Boolean).map((ext) => `sops${ext}`) : ['sops.exe', 'sops'])
-    : ['sops'];
+  const names = sopsNames(env, win, pathext);
   const dirs = String(env.PATH ?? '').split(win ? ';' : ':').filter(Boolean);
-  if (win && env.LOCALAPPDATA) {
-    const winget = paths.join(env.LOCALAPPDATA, 'Microsoft', 'WinGet');
-    dirs.push(paths.join(winget, 'Links'));
-    const packages = paths.join(winget, 'Packages');
-    try {
-      for (const entry of filesystem.readdirSync(packages)) {
-        if (!wingetPackageTree && !/sops/i.test(entry)) continue;
-        const directory = paths.join(packages, entry);
-        dirs.push(directory);
-        if (wingetPackageTree) {
-          try {
-            for (const nested of filesystem.readdirSync(directory, { withFileTypes: true })) {
-              if (nested.isDirectory()) dirs.push(paths.join(directory, nested.name));
-            }
-          } catch { /* unreadable package */ }
-        }
-      }
-    } catch { /* no WinGet packages */ }
-  }
+  if (win) dirs.push(...wingetDirs(filesystem, paths, env, wingetPackageTree));
   for (const directory of dirs) for (const name of names) {
     const file = paths.join(directory, name);
     try { if (filesystem.statSync(file).isFile()) return file; } catch { /* next candidate */ }
@@ -83,7 +100,7 @@ export function runSopsFile(bin, args, operation, options = {}) {
 }
 
 const SELECTED_SOPS_VERSIONS = new Set(['3.13.2', '3.13.3']);
-const SELECTED_AGE_VERSIONS = new Set(['1.2.1', '1.3.1']);
+export const SELECTED_AGE_VERSIONS = new Set(['1.2.1', '1.3.1']);
 const IDENTITY_TIMEOUT_MS = 20_000;
 const CONTROLLED_ENV = new Set(['SOPS_AGE_KEY', 'SOPS_AGE_KEY_FILE', 'SOPS_AGE_KEY_CMD', 'SOPS_AGE_SSH_PRIVATE_KEY_FILE', 'SOPS_AGE_SSH_PRIVATE_KEY_CMD', 'SOPS_AGE_RECIPIENT', 'SOPS_KEYSERVICE', 'SOPS_ENABLE_LOCAL_KEYSERVICE', 'SOPS_DECRYPTION_ORDER', 'SOPS_KMS_ARN', 'SOPS_GCP_KMS_IDS', 'SOPS_HUAWEICLOUD_KMS_IDS', 'SOPS_AZURE_KEYVAULT_URLS', 'SOPS_VAULT_URIS', 'SOPS_PGP_FP', 'SOPS_AGE_RECIPIENTS', 'HOME', 'USERPROFILE', 'APPDATA', 'XDG_CONFIG_HOME']);
 
@@ -119,7 +136,7 @@ const auditAbsent = cwd => {
   try { fs.lstatSync(path.resolve(cwd ?? process.cwd(), '/etc/sops/audit.yaml')); return false; }
   catch (error) { return error.code === 'ENOENT'; }
 };
-const captured = r => r && r.status === 0 && r.signal == null && !r.error && Buffer.isBuffer(r.stdout) && Buffer.isBuffer(r.stderr);
+const captured = r => r?.status === 0 && r.signal == null && !r.error && Buffer.isBuffer(r.stdout) && Buffer.isBuffer(r.stderr);
 const decoded = bytes => new TextDecoder('utf-8', { fatal: true }).decode(bytes);
 const ownedRequest = request => {
   if (request.operation === 'seal') {
@@ -141,115 +158,176 @@ const ownedRequest = request => {
   return { inputType: flags['--input-type'], outputType: flags['--output-type'], file: args.at(-1), recipient: flags['--age'] };
 };
 
+/** The admitted identity key, or the unchanged refusal/failure result (admitted.key is absent then). */
+const selectedAdmission = (selection, spec, invocation, env) => {
+  const fail = () => ({ status: null, stdout: '', stderr: '', error: selection.error });
+  if (!spec || !['binary', 'json', 'yaml', 'dotenv'].includes(spec.inputType) || !['binary', 'json', 'yaml', 'dotenv'].includes(spec.outputType)) return fail();
+  if (!invocation || typeof invocation.runProgram !== 'function' || typeof invocation.resolveRealTool !== 'function') return fail();
+  if (!['win32', 'linux', 'darwin'].includes(process.platform)) return held('unsupported-platform');
+  const key = env[selection.inlineName];
+  if (typeof key !== 'string' || !/^AGE-SECRET-KEY-1[0-9A-Z]+$/.test(key.trim())) return fail();
+  return { key };
+};
+
+const decryptArgs = (file, inputType, outputType) => ['decrypt', '--input-type', inputType, '--output-type', outputType, '--filename-override', file, '--enable-local-keyservice=true', '--decryption-order', 'age'];
+
+const decryptSelected = (run, exe, file, input, spec, recipient) => {
+  const envelope = selectedAgeEnvelope(decoded(input), spec.inputType, recipient);
+  if (!envelope.ok) return held(envelope.reason);
+  const result = run(exe, decryptArgs(file, spec.inputType, spec.outputType), input);
+  if (!captured(result)) return held('selected-decryption-failed');
+  return { status: 0, stdout: decoded(result.stdout), stderr: '', error: null };
+};
+
+const encryptSelected = (run, exe, file, input, spec, recipient) => {
+  if (spec.recipient !== recipient) return held('recipient-mismatch');
+  const args = ['encrypt', '--input-type', spec.inputType, '--output-type', spec.outputType, '--filename-override', file, '--enable-local-keyservice=true', '--age', recipient];
+  const result = run(exe, args, input);
+  if (!captured(result)) return held('selected-encryption-failed');
+  if (result.stdout.length > CREDENTIAL_FILE_MAX_BYTES) return held('document-over-budget');
+  const text = decoded(result.stdout);
+  const envelope = selectedAgeEnvelope(text, spec.outputType, recipient);
+  if (!envelope.ok) return held(envelope.reason);
+  const readback = run(exe, decryptArgs(file, spec.outputType, spec.inputType), result.stdout);
+  if (!captured(readback)) return held('selected-readback-failed');
+  return { status: 0, stdout: text, stderr: '', error: null };
+};
+
+const wipeCaptures = (captures) => {
+  for (const result of captures) {
+    if (Buffer.isBuffer(result?.stdout)) result.stdout.fill(0);
+    if (Buffer.isBuffer(result?.stderr)) result.stderr.fill(0);
+  }
+};
+
+// The one recipient an `age -y` capture names, or null.
+const recipientOf = (stdout) => {
+  const recipients = decoded(stdout).trim().split(/\r?\n/);
+  return recipients.length === 1 && /^age1[ac-hj-np-z02-9]+$/.test(recipients[0]) ? recipients[0] : null;
+};
+
+const toolProfileSupported = (version, ageVersion) => captured(version) && captured(ageVersion)
+  && SELECTED_SOPS_VERSIONS.has(/^sops\s+(\d+\.\d+\.\d+)/.exec(decoded(version.stdout))?.[1])
+  && SELECTED_AGE_VERSIONS.has(/^v?(\d+\.\d+\.\d+)/.exec(decoded(ageVersion.stdout))?.[1]);
+
+const invalidCaptureBudget = (deadline, maxBuffer) => !Number.isInteger(deadline) || deadline < 1 || deadline > 2_147_483_647 || !Number.isInteger(maxBuffer) || maxBuffer < 1;
+
+// The document bytes into `state.input`; the refusal when they are unavailable or over budget, else null.
+const readSelectedInput = (state, request, spec, file) => {
+  try { state.input = request.operation === 'seal' ? Buffer.from(spec.plaintext) : readSecretBytes(file); } catch { return held('actual-document-unavailable'); }
+  return state.input.length > CREDENTIAL_FILE_MAX_BYTES ? held('document-over-budget') : null;
+};
+
+const selectedRunner = (invocation, options, captures, selectedEnv) => (program, args, bytes, childEnv = selectedEnv) => {
+  const result = invocation.runProgram(program, args, { ...options, env: childEnv, input: bytes });
+  captures.push(result); return result;
+};
+
+const performSelected = (state, { bin, request, spec, key, selection, invocation, env, cwd, maxBuffer, timeout }) => {
+  const file = path.resolve(cwd ?? process.cwd(), spec.file);
+  const unavailable = readSelectedInput(state, request, spec, file);
+  if (unavailable) return unavailable;
+  const exe = bin ?? resolveSops(env), age = invocation.resolveRealTool('age-keygen', { env });
+  if (!nativeFile(exe) || !nativeFile(age)) return held('native-tool-unavailable');
+  if (!auditAbsent(cwd)) return held('unsupported-audit-context');
+  const deadline = timeout ?? IDENTITY_TIMEOUT_MS;
+  if (invalidCaptureBudget(deadline, maxBuffer)) return held('invalid-capture-budget');
+  state.selectedEnv = isolatedSopsEnv(env, selection.inlineName);
+  const publicEnv = isolatedSopsEnv(env, null);
+  const options = { cwd, env: state.selectedEnv, shell: false, encoding: 'buffer', windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'], timeout: deadline, maxBuffer };
+  const run = selectedRunner(invocation, options, state.captures, state.selectedEnv);
+  const version = run(exe, ['--disable-version-check', '--version'], undefined, publicEnv);
+  const ageVersion = run(age, ['--version'], undefined, publicEnv);
+  if (!toolProfileSupported(version, ageVersion)) return held('unsupported-tool-profile');
+  state.identity = Buffer.from(key.trim(), 'utf8');
+  const derived = run(age, ['-y'], state.identity, publicEnv);
+  if (!captured(derived)) return held('recipient-unproven');
+  const recipient = recipientOf(derived.stdout);
+  if (recipient === null) return held('recipient-unproven');
+  if (request.operation === 'decrypt') return decryptSelected(run, exe, file, state.input, spec, recipient);
+  return encryptSelected(run, exe, file, state.input, spec, recipient);
+};
+
 /** The domain composes the existing process owner: invocation={runProgram(file,args,options),resolveRealTool(program,{env})}. No API imports another system. */
 export function runSelectedSops(bin, request, { selection, invocation, env, cwd, maxBuffer, timeout } = {}) {
   if (selection?.error?.identityRefusal !== 'inline-context-unqualified' || typeof selection.inlineName !== 'string' || !env || typeof env !== 'object') return held('selected-context-missing');
   const spec = ownedRequest(request);
-  if (!spec || !['binary', 'json', 'yaml', 'dotenv'].includes(spec.inputType) || !['binary', 'json', 'yaml', 'dotenv'].includes(spec.outputType)) return { status: null, stdout: '', stderr: '', error: selection.error };
-  if (!invocation || typeof invocation.runProgram !== 'function' || typeof invocation.resolveRealTool !== 'function') return { status: null, stdout: '', stderr: '', error: selection.error };
-  if (!['win32', 'linux', 'darwin'].includes(process.platform)) return held('unsupported-platform');
-  const key = env[selection.inlineName];
-  if (typeof key !== 'string' || !/^AGE-SECRET-KEY-1[0-9A-Z]+$/.test(key.trim())) return { status: null, stdout: '', stderr: '', error: selection.error };
-  let input, identity, selectedEnv;
-  const captures = [];
+  const admitted = selectedAdmission(selection, spec, invocation, env);
+  if (!admitted.key) return admitted;
+  const state = { input: undefined, identity: undefined, selectedEnv: undefined, captures: [] };
   try {
-    const file = path.resolve(cwd ?? process.cwd(), spec.file);
-    try { input = request.operation === 'seal' ? Buffer.from(spec.plaintext) : readSecretBytes(file); } catch { return held('actual-document-unavailable'); }
-    if (input.length > CREDENTIAL_FILE_MAX_BYTES) return held('document-over-budget');
-    const exe = bin ?? resolveSops(env), age = invocation.resolveRealTool('age-keygen', { env });
-    if (!nativeFile(exe) || !nativeFile(age)) return held('native-tool-unavailable');
-    if (!auditAbsent(cwd)) return held('unsupported-audit-context');
-    const deadline = timeout ?? IDENTITY_TIMEOUT_MS;
-    if (!Number.isInteger(deadline) || deadline < 1 || deadline > 2_147_483_647 || !Number.isInteger(maxBuffer) || maxBuffer < 1) return held('invalid-capture-budget');
-    selectedEnv = isolatedSopsEnv(env, selection.inlineName);
-    const publicEnv = isolatedSopsEnv(env, null);
-    const options = { cwd, env: selectedEnv, shell: false, encoding: 'buffer', windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'], timeout: deadline, maxBuffer };
-    const run = (program, args, bytes, childEnv = selectedEnv) => {
-      const result = invocation.runProgram(program, args, { ...options, env: childEnv, input: bytes });
-      captures.push(result); return result;
-    };
-    const version = run(exe, ['--disable-version-check', '--version'], undefined, publicEnv);
-    const ageVersion = run(age, ['--version'], undefined, publicEnv);
-    if (!captured(version) || !captured(ageVersion) || !SELECTED_SOPS_VERSIONS.has(/^sops\s+([0-9]+\.[0-9]+\.[0-9]+)/.exec(decoded(version.stdout))?.[1]) || !SELECTED_AGE_VERSIONS.has(/^v?([0-9]+\.[0-9]+\.[0-9]+)/.exec(decoded(ageVersion.stdout))?.[1])) return held('unsupported-tool-profile');
-    identity = Buffer.from(key.trim(), 'utf8');
-    const derived = run(age, ['-y'], identity, publicEnv);
-    if (!captured(derived)) return held('recipient-unproven');
-    const recipients = decoded(derived.stdout).trim().split(/\r?\n/);
-    if (recipients.length !== 1 || !/^age1[ac-hj-np-z02-9]+$/.test(recipients[0])) return held('recipient-unproven');
-    const recipient = recipients[0];
-    const decryptArgs = (inputType, outputType) => ['decrypt', '--input-type', inputType, '--output-type', outputType, '--filename-override', file, '--enable-local-keyservice=true', '--decryption-order', 'age'];
-    if (request.operation === 'decrypt') {
-      const envelope = selectedAgeEnvelope(decoded(input), spec.inputType, recipient);
-      if (!envelope.ok) return held(envelope.reason);
-      const result = run(exe, decryptArgs(spec.inputType, spec.outputType), input);
-      if (!captured(result)) return held('selected-decryption-failed');
-      return { status: 0, stdout: decoded(result.stdout), stderr: '', error: null };
-    }
-    if (spec.recipient !== recipient) return held('recipient-mismatch');
-    const args = ['encrypt', '--input-type', spec.inputType, '--output-type', spec.outputType, '--filename-override', file, '--enable-local-keyservice=true', '--age', recipient];
-    const result = run(exe, args, input);
-    if (!captured(result)) return held('selected-encryption-failed');
-    if (result.stdout.length > CREDENTIAL_FILE_MAX_BYTES) return held('document-over-budget');
-    const text = decoded(result.stdout);
-    const envelope = selectedAgeEnvelope(text, spec.outputType, recipient);
-    if (!envelope.ok) return held(envelope.reason);
-    const readback = run(exe, decryptArgs(spec.outputType, spec.inputType), result.stdout);
-    if (!captured(readback)) return held('selected-readback-failed');
-    return { status: 0, stdout: text, stderr: '', error: null };
+    return performSelected(state, { bin, request, spec, key: admitted.key, selection, invocation, env, cwd, maxBuffer, timeout });
   } catch { return held('selected-native-refused'); }
   finally {
-    identity?.fill(0); input?.fill(0);
-    for (const result of captures) { if (Buffer.isBuffer(result?.stdout)) result.stdout.fill(0); if (Buffer.isBuffer(result?.stderr)) result.stderr.fill(0); }
-    if (selectedEnv) delete selectedEnv.SOPS_AGE_KEY;
+    state.identity?.fill(0); state.input?.fill(0);
+    wipeCaptures(state.captures);
+    if (state.selectedEnv) delete state.selectedEnv.SOPS_AGE_KEY;
   }
 }
 
+const identityRequestValid = ({ env, cwd, invocation, assertLease, consume }) =>
+  env && typeof env === 'object' && path.isAbsolute(cwd ?? '') && typeof consume === 'function'
+    && typeof assertLease === 'function' && typeof invocation?.runProgram === 'function'
+    && typeof invocation?.resolveRealTool === 'function';
+const identityLinesValid = (lines, identities) => identities.length === 1 && /^AGE-SECRET-KEY-1[0-9A-Z]+$/.test(identities[0])
+  && !lines.some(line => line.startsWith('#') && !/^# (?:created:|public key:)/.test(line));
+const declaredRecipientMatches = (lines, recipient) => {
+  const declared = lines.filter(line => line.startsWith('# public key:'));
+  return declared.length === 1 && declared[0].slice('# public key:'.length).trim() === recipient;
+};
+const publicationShaped = (publication) => publication && typeof publication.ok === 'boolean' && ['none', 'unknown', 'complete'].includes(publication.effectState);
+const publicationDurable = (publication) => [true, false].includes(publication.created) && ['file-fsync', 'file-and-parent-fsync', 'file-fsync-namespace-unqualified'].includes(publication.durability);
+
+const identityFailure = (reason, generated) => ({ ok: false, reason, captureState: generated ? 'unknown' : 'none', effectState: generated ? 'unknown' : 'none' });
+
+// The outcome of handing the captured identity to the installer's publication.
+const publicationOutcome = (publication, recipient) => {
+  if (!publicationShaped(publication)) return identityFailure('publication-unknown', true);
+  if (!publication.ok || publication.effectState !== 'complete') return { ok: false, captureState: 'generated', effectState: publication.effectState,
+    reason: 'publication-held' };
+  if (!publicationDurable(publication)) return identityFailure('publication-unknown', true);
+  return { ok: true, captureState: 'generated', effectState: 'complete', created: publication.created,
+    durability: publication.durability, publicRecipient: recipient };
+};
+
+// One age-keygen run under the caller's lease, its capture kept for wiping.
+const leasedAgeRunner = (invocation, age, options, captures, assertLease) => (args, input) => {
+  if (assertLease() !== true) throw new Error('initial age lease lost');
+  const result = invocation.runProgram(age, args, { ...options, input });
+  captures.push(result);
+  if (!captured(result) || result.stdout.length > options.maxBuffer || result.stderr.length > options.maxBuffer) throw new Error('initial age capture incomplete');
+  return result;
+};
+
+const generateAndPublish = (state, { env, cwd, invocation, assertLease, consume }) => {
+  const age = invocation.resolveRealTool('age-keygen', { env });
+  if (!nativeFile(age)) return identityFailure('native-tool-unavailable', false);
+  const options = { cwd, env: isolatedSopsEnv(env, null), shell: false, encoding: 'buffer', windowsHide: true,
+    stdio: ['pipe', 'pipe', 'pipe'], timeout: IDENTITY_TIMEOUT_MS, maxBuffer: CREDENTIAL_FILE_MAX_BYTES };
+  const run = leasedAgeRunner(invocation, age, options, state.captures, assertLease);
+  const version = run(['--version']);
+  if (!SELECTED_AGE_VERSIONS.has(/^v?(\d+\.\d+\.\d+)/.exec(decoded(version.stdout))?.[1])) return identityFailure('unsupported-tool-profile', false);
+  if (assertLease() !== true) return identityFailure('lease-lost', false);
+  state.generated = true;
+  const made = run([]), lines = decoded(made.stdout).trim().split(/\r?\n/);
+  const identities = lines.filter(line => line && !line.startsWith('#'));
+  if (!identityLinesValid(lines, identities)) return identityFailure('capture-incomplete', true);
+  state.identity = Buffer.from(identities[0], 'utf8');
+  const recipient = recipientOf(run(['-y'], state.identity).stdout);
+  if (recipient === null) return identityFailure('recipient-unproven', true);
+  if (!declaredRecipientMatches(lines, recipient) || assertLease() !== true) return identityFailure('recipient-unproven', true);
+  return publicationOutcome(consume(state.identity, recipient), recipient);
+};
+
 /** One real private capture for an admitted initial request; the installer owns its durable attempt. */
 export function withGeneratedAgeIdentity({ env, cwd, invocation, assertLease, consume } = {}) {
-  const failure = (reason, generated) => ({ ok: false, reason, captureState: generated ? 'unknown' : 'none', effectState: generated ? 'unknown' : 'none' });
-  if (!env || typeof env !== 'object' || !path.isAbsolute(cwd ?? '') || typeof consume !== 'function'
-    || typeof assertLease !== 'function' || typeof invocation?.runProgram !== 'function'
-    || typeof invocation?.resolveRealTool !== 'function') return failure('invalid-request', false);
-  const captures = [];
-  let generated = false, identity;
+  if (!identityRequestValid({ env, cwd, invocation, assertLease, consume })) return identityFailure('invalid-request', false);
+  const state = { captures: [], generated: false, identity: undefined };
   try {
-    const age = invocation.resolveRealTool('age-keygen', { env });
-    if (!nativeFile(age)) return failure('native-tool-unavailable', false);
-    const options = { cwd, env: isolatedSopsEnv(env, null), shell: false, encoding: 'buffer', windowsHide: true,
-      stdio: ['pipe', 'pipe', 'pipe'], timeout: IDENTITY_TIMEOUT_MS, maxBuffer: CREDENTIAL_FILE_MAX_BYTES };
-    const run = (args, input) => {
-      if (assertLease() !== true) throw new Error('initial age lease lost');
-      const result = invocation.runProgram(age, args, { ...options, input });
-      captures.push(result);
-      if (!captured(result) || result.stdout.length > options.maxBuffer || result.stderr.length > options.maxBuffer) throw new Error('initial age capture incomplete');
-      return result;
-    };
-    const version = run(['--version']);
-    if (!SELECTED_AGE_VERSIONS.has(/^v?([0-9]+\.[0-9]+\.[0-9]+)/.exec(decoded(version.stdout))?.[1])) return failure('unsupported-tool-profile', false);
-    if (assertLease() !== true) return failure('lease-lost', false);
-    generated = true;
-    const made = run([]), lines = decoded(made.stdout).trim().split(/\r?\n/);
-    const identities = lines.filter(line => line && !line.startsWith('#'));
-    if (identities.length !== 1 || !/^AGE-SECRET-KEY-1[0-9A-Z]+$/.test(identities[0])
-      || lines.some(line => line.startsWith('#') && !/^# (?:created:|public key:)/.test(line))) return failure('capture-incomplete', true);
-    identity = Buffer.from(identities[0], 'utf8');
-    const derived = run(['-y'], identity), recipients = decoded(derived.stdout).trim().split(/\r?\n/);
-    if (recipients.length !== 1 || !/^age1[ac-hj-np-z02-9]+$/.test(recipients[0])) return failure('recipient-unproven', true);
-    const recipient = recipients[0], declared = lines.filter(line => line.startsWith('# public key:'));
-    if (declared.length !== 1 || declared[0].slice('# public key:'.length).trim() !== recipient || assertLease() !== true) return failure('recipient-unproven', true);
-    const publication = consume(identity, recipient);
-    if (!publication || typeof publication.ok !== 'boolean' || !['none', 'unknown', 'complete'].includes(publication.effectState)) return failure('publication-unknown', true);
-    if (!publication.ok || publication.effectState !== 'complete') return { ok: false, captureState: 'generated', effectState: publication.effectState,
-      reason: 'publication-held' };
-    if (![true, false].includes(publication.created) || !['file-fsync', 'file-and-parent-fsync', 'file-fsync-namespace-unqualified'].includes(publication.durability)) return failure('publication-unknown', true);
-    return { ok: true, captureState: 'generated', effectState: 'complete', created: publication.created,
-      durability: publication.durability, publicRecipient: recipient };
-  } catch { return failure('capture-or-publication-unknown', generated); }
+    return generateAndPublish(state, { env, cwd, invocation, assertLease, consume });
+  } catch { return identityFailure('capture-or-publication-unknown', state.generated); }
   finally {
-    identity?.fill(0);
-    for (const result of captures) {
-      if (Buffer.isBuffer(result?.stdout)) result.stdout.fill(0);
-      if (Buffer.isBuffer(result?.stderr)) result.stderr.fill(0);
-    }
+    state.identity?.fill(0);
+    wipeCaptures(state.captures);
   }
 }

package/runtime/scripts/hfs/allows.mjs

@@ -36,9 +36,9 @@ export function slotAdmitsFile(resolver, file) {
   if (classified.status === 'no-slot' || classified.status === 'ambiguous' || !classified.slot) return null;
   const slot = resolver.slot(classified.slot);
   const relative = relativeToRoot(classified.path, classified.root);
-  const hit = matchersOf([...(slot.requires ?? []), ...(slot.allows ?? [])], classified.bindings).find(matcher => matcher.expression.test(relative));
-  const forbidden = matchersOf(slot.forbids, classified.bindings).find(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
-  return Boolean(hit) && !forbidden;
+  const hit = matchersOf([...(slot.requires ?? []), ...(slot.allows ?? [])], classified.bindings).some(matcher => matcher.expression.test(relative));
+  const forbidden = matchersOf(slot.forbids, classified.bindings).some(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
+  return hit && !forbidden;
 }
 
 /**

package/runtime/scripts/hfs/architecture/ast-walks.mjs

@@ -1,19 +1,20 @@
 // ast-walks.mjs - AST walks the architecture checkers share (moved out of typescript.mjs, which keeps the program loading and module resolution).
 import { canonical, isInside } from './config.mjs';
-import { sourceLocation } from '../../lib/ts-ast.mjs';
+import { hasAnyFlag, isConstVariable, sourceLocation } from '../../lib/ts-ast.mjs';
 import { UNPROVEN_FRAMEWORK, isUnshadowedCommonJsRequire, relativePath, unwrapExpression } from './typescript.mjs';
 
 /** `expression` unwrapped by the caller's own predicate set (a predicate absent on an older ts reads as never). */
 export function unwrapEach(ts, expression, predicates) {
-  while (expression && predicates.some((predicate) => predicate?.(expression))) expression = expression.expression;
-  return expression;
+  let current = expression;
+  while (current && predicates.some((predicate) => predicate?.(current))) current = current.expression;
+  return current;
 }
 
 /** `value` with every TS alias hop resolved (a re-exported import reads as its target symbol). */
-export function normalizedSymbolValue(ts, checker, value) {
-  let symbol = value ?? null;
+export function normalizedSymbolValue(ts, checker, value = null) {
+  let symbol = value;
   const seen = new Set();
-  while (symbol && (symbol.flags & ts.SymbolFlags.Alias) && !seen.has(symbol)) {
+  while (symbol && hasAnyFlag(symbol.flags, ts.SymbolFlags.Alias) && !seen.has(symbol)) {
     seen.add(symbol);
     const target = checker.getAliasedSymbol(symbol);
     if (!target || target === symbol) break;
@@ -48,7 +49,7 @@ export function valueSymbol(ts, checker, node, seen = new Set(), { unselected =
   seen.add(symbol);
   const declarations = symbol.getDeclarations?.() ?? [];
   if (declarations.length === 1 && ts.isVariableDeclaration(declarations[0]) && declarations[0].initializer
-    && (ts.getCombinedNodeFlags(declarations[0].parent) & ts.NodeFlags.Const)) {
+    && isConstVariable(ts, declarations[0])) {
     return valueSymbol(ts, checker, declarations[0].initializer, seen, { unselected });
   }
   return symbol;
@@ -102,50 +103,59 @@ export function anyDescendant(ts, node, match) {
  * selected node's symbols to a kind (default `targets.get(symbol)`); `shorthandOf` (when set) also resolves
  * shorthand-property declarations and descends property assignments; `newExpression` descends `new X()` callees.
  */
+const addKinds = (target, source) => { for (const kind of source) target.add(kind); };
+
+const kindsFromReturns = (ts, checker, declaration, targets, options) => {
+  const kinds = new Set();
+  for (const returned of returnedExpressions(ts, declaration)) addKinds(kinds, tracedFrameworkKinds(ts, checker, returned, targets, options));
+  return kinds;
+};
+
+const kindsFromDeclaration = (ts, checker, declaration, targets, options, shorthandOf) => {
+  const kinds = new Set();
+  if (ts.isVariableDeclaration(declaration) && declaration.initializer)
+    addKinds(kinds, tracedFrameworkKinds(ts, checker, declaration.initializer, targets, options));
+  if (shorthandOf && ts.isShorthandPropertyAssignment(declaration)) {
+    const target = normalizedSymbolValue(ts, checker, checker.getShorthandAssignmentValueSymbol?.(declaration));
+    const kind = shorthandOf(ts, checker, target, targets);
+    if (kind) kinds.add(kind);
+  }
+  if (shorthandOf && ts.isPropertyAssignment(declaration))
+    addKinds(kinds, tracedFrameworkKinds(ts, checker, declaration.initializer, targets, options));
+  addKinds(kinds, kindsFromReturns(ts, checker, declaration, targets, options));
+  return kinds;
+};
+
+const kindsFromSymbol = (ts, checker, symbol, targets, seen, options) => {
+  const nextSeen = new Set(seen).add(symbol);
+  const declarationOptions = { ...options, seen: nextSeen };
+  const kinds = new Set();
+  for (const declaration of symbol.getDeclarations?.() ?? [])
+    addKinds(kinds, kindsFromDeclaration(ts, checker, declaration, targets, declarationOptions, options.shorthandOf));
+  return kinds;
+};
+
+const defaultDirectOf = (ts, checker, { symbol, targets }) => targets.get(symbol) ?? null;
+
 export function tracedFrameworkKinds(ts, checker, expression, targets,
   { seen = new Set(), depth = 0, directOf = null, shorthandOf = null, newExpression = false } = {}) {
   if (!expression) return new Set();
   if (depth > 10) return new Set([UNPROVEN_FRAMEWORK]);
-  expression = unwrapExpression(ts, expression);
-  const selected = selectedNode(ts, expression);
+  const unwrapped = unwrapExpression(ts, expression);
+  const selected = selectedNode(ts, unwrapped);
   const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
-  const direct = symbol ? (directOf ?? ((ts2, c, { symbol: s, targets: t }) => t.get(s) ?? null))(ts, checker, { symbol, selected, targets }) : null;
+  const direct = symbol ? (directOf ?? defaultDirectOf)(ts, checker, { symbol, selected, targets }) : null;
   if (direct) return new Set([direct]);
-  const opts = { depth: depth + 1, directOf, shorthandOf, newExpression };
-  if (ts.isArrowFunction(expression) || ts.isFunctionExpression(expression)) {
-    const kinds = new Set();
-    for (const returned of returnedExpressions(ts, expression)) {
-      for (const kind of tracedFrameworkKinds(ts, checker, returned, targets, { ...opts, seen })) kinds.add(kind);
-    }
-    return kinds;
-  }
-  if (ts.isCallExpression(expression)) {
-    const kinds = tracedFrameworkKinds(ts, checker, expression.expression, targets, { ...opts, seen });
+  const options = { depth: depth + 1, directOf, shorthandOf, newExpression };
+  if (ts.isArrowFunction(unwrapped) || ts.isFunctionExpression(unwrapped)) return kindsFromReturns(ts, checker, unwrapped, targets, { ...options, seen });
+  if (ts.isCallExpression(unwrapped)) {
+    const kinds = tracedFrameworkKinds(ts, checker, unwrapped.expression, targets, { ...options, seen });
     if (kinds.size) return kinds;
   }
-  if (newExpression && ts.isNewExpression(expression)) {
-    return tracedFrameworkKinds(ts, checker, expression.expression, targets, { ...opts, seen });
-  }
+  if (newExpression && ts.isNewExpression(unwrapped))
+    return tracedFrameworkKinds(ts, checker, unwrapped.expression, targets, { ...options, seen });
   if (!symbol || seen.has(symbol)) return new Set();
-  const nextSeen = new Set(seen).add(symbol);
-  const kinds = new Set();
-  for (const declaration of symbol.getDeclarations?.() ?? []) {
-    if (ts.isVariableDeclaration(declaration) && declaration.initializer) {
-      for (const kind of tracedFrameworkKinds(ts, checker, declaration.initializer, targets, { ...opts, seen: nextSeen })) kinds.add(kind);
-    }
-    if (shorthandOf && ts.isShorthandPropertyAssignment(declaration)) {
-      const target = normalizedSymbolValue(ts, checker, checker.getShorthandAssignmentValueSymbol?.(declaration));
-      const kind = shorthandOf(ts, checker, target, targets);
-      if (kind) kinds.add(kind);
-    }
-    if (shorthandOf && ts.isPropertyAssignment(declaration)) {
-      for (const kind of tracedFrameworkKinds(ts, checker, declaration.initializer, targets, { ...opts, seen: nextSeen })) kinds.add(kind);
-    }
-    for (const returned of returnedExpressions(ts, declaration)) {
-      for (const kind of tracedFrameworkKinds(ts, checker, returned, targets, { ...opts, seen: nextSeen })) kinds.add(kind);
-    }
-  }
-  return kinds;
+  return kindsFromSymbol(ts, checker, symbol, targets, seen, options);
 }
 
 /** 'unproven framework' | 'multiple framework' | the one kind | null, for a decorator whose expression constructs. */
@@ -153,7 +163,8 @@ export function constructedDecoratorKind(ts, checker, decorator, targets, traceO
   const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
   const kinds = tracedFrameworkKinds(ts, checker, callee, targets, traceOpts);
   if (kinds.has(UNPROVEN_FRAMEWORK)) return 'unproven framework';
-  return kinds.size === 1 ? [...kinds][0] : kinds.size ? 'multiple framework' : null;
+  if (kinds.size === 1) return [...kinds][0];
+  return kinds.size ? 'multiple framework' : null;
 }
 
 /** The target a decorator resolves to through a `let`/`var` alias's single initializer, or null. */
@@ -163,7 +174,7 @@ export function mutableDecoratorKind(ts, checker, decorator, targets) {
   const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
   const declarations = symbol?.getDeclarations?.() ?? [];
   if (declarations.length !== 1 || !ts.isVariableDeclaration(declarations[0]) || !declarations[0].initializer
-    || (ts.getCombinedNodeFlags(declarations[0].parent) & ts.NodeFlags.Const)) return null;
+    || isConstVariable(ts, declarations[0])) return null;
   return targets.get(valueSymbol(ts, checker, declarations[0].initializer)) ?? null;
 }
 
@@ -178,11 +189,12 @@ export function decoratorCallee(ts, decorator) {
  * not resolve. Null when the statement names no static specifier.
  */
 export function moduleExportsOf(ts, checker, statement) {
-  const moduleSpecifier = (ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement))
-    && statement.moduleSpecifier && ts.isStringLiteralLike(statement.moduleSpecifier) ? statement.moduleSpecifier : null;
-  const importEquals = ts.isImportEqualsDeclaration(statement) && ts.isExternalModuleReference(statement.moduleReference)
-    && statement.moduleReference.expression && ts.isStringLiteralLike(statement.moduleReference.expression)
-    ? statement.moduleReference.expression : null;
+  let moduleSpecifier = null;
+  if ((ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement))
+    && statement.moduleSpecifier && ts.isStringLiteralLike(statement.moduleSpecifier)) moduleSpecifier = statement.moduleSpecifier;
+  let importEquals = null;
+  if (ts.isImportEqualsDeclaration(statement) && ts.isExternalModuleReference(statement.moduleReference)
+    && statement.moduleReference.expression && ts.isStringLiteralLike(statement.moduleReference.expression)) importEquals = statement.moduleReference.expression;
   const specifierNode = moduleSpecifier ?? importEquals;
   const specifier = specifierNode?.text;
   if (specifier == null) return null;
@@ -208,7 +220,8 @@ export function programSourcesOf(context, checker, localFiles, { root = null } =
  * The CommonJS require() caveat every framework scan reports: each `require('<specifier>')` `accepted` pushes
  * `${filePath} uses a CommonJS <label ?? specifier> <detail>` (the import-shape reasoning cannot prove that binding).
  */
-export function commonJsRequireReasons(ts, checker, sourceFile, accepted, reasons, filePath, detail, label = null) {
+export function commonJsRequireReasons(ts, checker, sourceFile, accepted, reasons, filePath, detail) {
+  const label = arguments[7] ?? null;
   const visit = node => {
     if (ts.isCallExpression(node) && isUnshadowedCommonJsRequire(ts, checker, node.expression)
       && node.arguments.length === 1 && ts.isStringLiteralLike(node.arguments[0]) && accepted(node.arguments[0].text)) {