@starci/hfs 4.0.7 → 4.0.9

package/runtime/scripts/lib/safe-remove.mjs

@@ -1,275 +0,0 @@
-// safe-remove.mjs — the ONE way the runtime deletes a directory tree (nivo-fe inc-c8fbf76aa499).
-//
-// At 05:47 on 2026-09-25 D:/Repositories/nivo-fe lost 674 tracked working-tree files and its node_modules: a
-// recursive delete of a scratch tree followed directory links (Windows junctions) into the live repository.
-// Git for Windows' `git worktree remove --force` follows a junction inside the worktree and empties its target
-// (proven on this host, git 2.52), and a PowerShell/cmd/third-party recursive delete may do the same. A tree
-// that holds links to live checkouts is exactly what the runtime makes (node_modules junctions in land and
-// worker staging checkouts, push-mains scratch worktrees, dependency mirrors).
-//
-// safeRemoveTree walks the tree itself with lstat and NEVER descends into a link: every symlink, junction or
-// other reparse point is unlinked as a link (the link only, never what it points at) and verified gone. A
-// directory counts as a link when lstat says so, when readlink resolves it, or when its real path is not
-// its own path under its parent's real path (any name-surrogate reparse point). A link that cannot be
-// unlinked stops the removal of everything above it; nothing is ever deleted through it.
-//
-// safeRemoveWorktree removes a git worktree: every link removed as a link first (found without following one), zero
-// links asserted, only then `git worktree remove --force`, and the main checkout asserted untouched afterwards.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { sleepSync } from './sleep-sync.mjs';
-import { samePath } from './path-key.mjs';
-import { gitSpawn } from '../api/git/lib.mjs';
-import { rmdirLink } from '../api/fs/rmdir-link.mjs';
-import { artifactHoldReason } from './artifact-hold.mjs';
-import { realpathOr } from './fs-kind.mjs';
-
-const WIN = process.platform === 'win32';
-const same = samePath;
-
-/**
- * True when `p` is a link of any kind: a symlink, a junction, or another reparse point that redirects it.
- * `parentReal` (the real path of p's parent, when the caller walked to it through real directories) lets the
- * real-path test catch a reparse point lstat and readlink do not report. A missing path is not a link.
- */
-export function isLinkLike(p, { parentReal = null, stat = null } = {}) {
-  let st = stat;
-  if (!st) { try { st = fs.lstatSync(p); } catch { return false; } }
-  if (st.isSymbolicLink()) return true;
-  if (!st.isDirectory()) return false;
-  try { fs.readlinkSync(p); return true; } catch { /* not a link readlink can read */ }
-  const parent = parentReal ?? realpathOr(path.dirname(p));
-  const real = realpathOr(p);
-  if (!parent || !real) return true; // cannot prove it is a plain directory: treat it as a link
-  return !same(real, path.join(parent, path.basename(p)));
-}
-
-/** Remove a link itself, never its target. True when nothing is left at `p`. */
-/** Every link (symlink, junction, other reparse point) under root, found with lstat; the walk never enters one. */
-export function linksUnder(root) {
-  const found = [];
-  const visit = (p, parentReal) => {
-    let stat;
-    try { stat = fs.lstatSync(p); } catch { return; }
-    if (isLinkLike(p, { parentReal, stat })) { found.push(p); return; }
-    if (!stat.isDirectory()) return;
-    let real, names;
-    try { real = fs.realpathSync.native(p); names = fs.readdirSync(p); } catch { return; }
-    for (const name of names) visit(path.join(p, name), real);
-  };
-  visit(path.resolve(root), null);
-  return found;
-}
-
-export function unlinkOnly(p) {
-  try { fs.lstatSync(p); } catch (error) { return error?.code === 'ENOENT'; }
-  try { fs.unlinkSync(p); } catch { try { fs.rmdirSync(p); } catch { /* verified below */ } }
-  try { fs.lstatSync(p); return false; } catch (error) { return error?.code === 'ENOENT'; }
-}
-
-const retrying = (fn, retries) => {
-  for (let attempt = 0; ; attempt += 1) {
-    try { fn(); return null; } catch (error) {
-      if (error?.code === 'ENOENT') return null;
-      if (attempt >= retries || !['EBUSY', 'EPERM', 'EACCES', 'ENOTEMPTY'].includes(error?.code)) return error;
-      sleepSync(25 * (attempt + 1));
-    }
-  }
-};
-const removeFile = (p, retries) => retrying(() => {
-  try { fs.unlinkSync(p); } catch (error) {
-    if (WIN && (error?.code === 'EPERM' || error?.code === 'EACCES')) { fs.chmodSync(p, 0o666); fs.unlinkSync(p); } else throw error;
-  }
-}, retries);
-
-const SKILL_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-/**
- * True when `p` sits strictly below `root` by real path: no link on the way, not `root` itself. The one place a
- * primary checkout may be removed is a disposable fixture a caller names by its temp root (hk-tmp).
- */
-export function strictlyInsideReal(p, root) {
-  if (!root) return false;
-  const rel = path.relative(path.resolve(root), path.resolve(p));
-  if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) return false;
-  const real = realpathOr(p);
-  const rootReal = realpathOr(root);
-  // Its real path must be the same relative place under the root's real path: no link between them.
-  return Boolean(real && rootReal) && same(real, path.join(rootReal, rel));
-}
-
-/**
- * A path the runtime must never remove whole: a filesystem root, the home or temp directory, the runtime, the
- * repository that hosts it, the repositories root, or a primary git checkout (its .git is a directory; the
- * scratch trees the runtime removes are temp directories and linked worktrees, whose .git is a file).
- * `checkoutsUnder` names a disposable root (hk-tmp's temp root): a checkout strictly inside it by real path
- * is a spec fixture, not a live repository, and is not refused for its .git. Every other refusal stands.
- * A tree holding an indexed job artifact, or inside an evidence directory holding one, is refused whatever the
- * workflow's phase (artifact-hold.mjs).
- */
-export function forbiddenRoot(p, { checkoutsUnder = null } = {}) {
-  const resolved = path.resolve(p);
-  if (path.parse(resolved).root === resolved || same(path.dirname(resolved), resolved)) return 'a filesystem root';
-  for (const [name, dir] of [['the home directory', os.homedir()], ['the temp directory', os.tmpdir()], ['the runtime', SKILL_ROOT],
-    ['the repository hosting the runtime', path.dirname(SKILL_ROOT)], ['the repositories root', path.dirname(path.dirname(SKILL_ROOT))]]) {
-    if (dir && same(path.resolve(dir), resolved)) return name;
-  }
-  const held = artifactHoldReason(resolved);
-  if (held) return held;
-  let checkout = false;
-  try { checkout = fs.lstatSync(path.join(resolved, '.git')).isDirectory(); } catch { /* no .git directory */ }
-  if (checkout && !strictlyInsideReal(resolved, checkoutsUnder)) return 'a git checkout';
-  return null;
-}
-
-/**
- * Remove `root` and everything under it without ever following a link. Links are unlinked (the link only);
- * plain files and directories are deleted bottom-up. `checkoutsUnder` is forbiddenRoot's disposable root. Returns {ok, root, removed: {files, dirs, links},
- * errors: [{path, code, message}]}; ok is true only when `root` is gone. A missing root is ok.
- */
-export function safeRemoveTree(root, { retries = 5, checkoutsUnder = null } = {}) {
-  const target = path.resolve(String(root ?? ''));
-  const out = { ok: false, root: target, removed: { files: 0, dirs: 0, links: 0 }, errors: [] };
-  const fail = (p, error) => { out.errors.push({ path: p, code: error?.code ?? 'ERROR', message: String(error?.message ?? error) }); };
-  const refused = root ? forbiddenRoot(target, { checkoutsUnder }) : 'no path';
-  if (refused) { fail(target, { code: 'REFUSED', message: `refusing to remove ${refused}` }); return out; }
-  let st;
-  try { st = fs.lstatSync(target); } catch (error) {
-    if (error?.code === 'ENOENT') { out.ok = true; return out; }
-    fail(target, error); return out;
-  }
-  // CONTAINMENT (the .claude/node_modules wipe, 2026-09-28): nothing is ever deleted whose real path is not
-  // the root itself or strictly under the root's real path. A link is unlinked above (the link only); any other
-  // entry that resolves outside the tree is refused, whatever made it look like a plain entry.
-  const rootReal = realpathOr(target);
-  const insideRoot = (p) => { const real = realpathOr(p); if (!real || !rootReal) return false; if (same(real, rootReal)) return true;
-    const rel = path.relative(rootReal, real); return Boolean(rel) && !rel.startsWith('..') && !path.isAbsolute(rel); };
-  const walk = (dir, st, parentReal) => {
-    if (isLinkLike(dir, { parentReal, stat: st })) {
-      if (unlinkOnly(dir)) { out.removed.links += 1; return true; }
-      fail(dir, { code: 'LINK_STUCK', message: 'a link could not be unlinked; nothing above it is removed' });
-      return false;
-    }
-    if (!insideRoot(dir)) {
-      fail(dir, { code: 'OUTSIDE_ROOT', message: `refusing to delete ${dir}: its real path ${realpathOr(dir) ?? '?'} is outside ${rootReal ?? target}` });
-      return false;
-    }
-    if (!st.isDirectory()) {
-      const error = removeFile(dir, retries);
-      if (error) { fail(dir, error); return false; }
-      out.removed.files += 1; return true;
-    }
-    const real = realpathOr(dir);
-    if (!real) { fail(dir, { code: 'REALPATH', message: 'cannot resolve the directory' }); return false; }
-    let entries;
-    try { entries = fs.readdirSync(dir); } catch (error) { fail(dir, error); return false; }
-    let clear = true;
-    for (const name of entries) {
-      const child = path.join(dir, name);
-      let childStat;
-      try { childStat = fs.lstatSync(child); } catch (error) { if (error?.code !== 'ENOENT') { fail(child, error); clear = false; } continue; }
-      if (!walk(child, childStat, real)) clear = false;
-    }
-    if (!clear) return false;
-    const error = retrying(() => fs.rmdirSync(dir), retries);
-    if (error) { fail(dir, error); return false; }
-    out.removed.dirs += 1; return true;
-  };
-  walk(target, st, null);
-  out.ok = !fs.existsSync(target) && (() => { try { fs.lstatSync(target); return false; } catch { return true; } })();
-  return out;
-}
-
-/** Remove one link as a link, never its target: `cmd /c rmdir <link>` on Windows (no /s), then unlinkOnly. */
-export function removeLink(p) {
-  if (WIN) {
-    let st = null;
-    try { st = fs.lstatSync(p); } catch { return true; }
-    if (st.isDirectory() || st.isSymbolicLink()) rmdirLink(p);
-  }
-  return unlinkOnly(p);
-}
-
-/** The main checkout's state a removal must never change: its tracked deletions and its node_modules entry counts. */
-export function mainCheckoutGuard(mainRoot, { git = null } = {}) {
-  const run = git ?? ((args, opts) => gitSpawn('git', args, { cwd: opts.cwd, maxBuffer: 64 * 1024 * 1024 }));
-  const count = (rel) => { try { return fs.readdirSync(path.join(mainRoot, rel)).length; } catch { return null; } };
-  // porcelain v2 ("1 <XY> <sub> <mH> <mI> <mW> <hH> <hI> <path>"): no leading blank a runner's trim could eat.
-  const st = run(['status', '--porcelain=v2', '--untracked-files=no'], { cwd: mainRoot });
-  const text = String(st?.stdout ?? st?.out ?? '');
-  const ok = st?.ok ?? (!st?.error && st?.status === 0);
-  const deleted = text.split(/\r?\n/).map((l) => l.trim().split(' ')).filter((f) => f[0] === '1' && f.length >= 9 && f[1].includes('D')).map((f) => f.slice(8).join(' '));
-  return { ok: Boolean(ok), deleted: new Set(deleted),
-    nodeModules: count('node_modules'), packagesNodeModules: count(path.join('packages', 'node_modules')) };
-}
-/** What changed in the main checkout between two guards: [] when nothing. */
-export function mainCheckoutDamage(before, after) {
-  const out = [];
-  if (before.ok && after.ok) for (const f of after.deleted) if (!before.deleted.has(f)) out.push(`tracked file deleted: ${f}`);
-  if (before.nodeModules !== after.nodeModules) out.push(`node_modules entries ${before.nodeModules} -> ${after.nodeModules}`);
-  if (before.packagesNodeModules !== after.packagesNodeModules) out.push(`packages/node_modules entries ${before.packagesNodeModules} -> ${after.packagesNodeModules}`);
-  return out;
-}
-
-/**
- * The link step of every worktree removal (git's here, Orca's in scripts/api/orca/worktree-remove.mjs removeOrcaWorktree): every link
- * under `target` found WITHOUT following one (linksUnder), each removed as a link (removeLink: `cmd /c rmdir <link>`, never
- * /s), outermost first, then a re-scan that must find ZERO. {ok, links, errors: [{path, code, message}]}; ok false: a link
- * is stuck and the caller removes nothing.
- */
-export function removeLinksUnder(target) {
-  const out = { ok: false, links: 0, errors: [] };
-  if (!fs.existsSync(target)) { out.ok = true; return out; }
-  for (const link of linksUnder(target)) { if (removeLink(link)) out.links += 1; else out.errors.push({ path: link, code: 'LINK_STUCK', message: 'a link could not be removed' }); }
-  for (const l of linksUnder(target)) if (!out.errors.some((e) => e.path === l)) out.errors.push({ path: l, code: 'LINK_STUCK', message: 'a link is still there after removal' });
-  out.ok = out.errors.length === 0;
-  return out;
-}
-
-/**
- * Remove a git worktree (the one algorithm; the 490-file .claude incident and nivo-fe inc-c8fbf76aa499):
- *   1. enumerate every link in it WITHOUT following one (linksUnder);
- *   2. remove each as a link (removeLink: `cmd /c rmdir <link>`, never /s), outermost first;
- *   3. re-scan the same way and refuse (link-stuck, nothing deleted) unless ZERO links remain;
- *   4. only then `git worktree remove --force` (a link-free tree: git cannot walk out of it); a directory git does not know
- *      goes through safeRemoveTree (never follows a link); `git worktree prune`;
- *   5. assert the main checkout is untouched: no new tracked deletion, node_modules and packages/node_modules entry counts
- *      unchanged - a violation is {ok:false, fatal:true, reason:'main-checkout-damaged'}: the caller (the GC) stops.
- * Never robocopy, rm -rf or rmdir /s. `git(args, {cwd})` is the caller's git runner; `repo` any checkout of the repository.
- * {ok, root, links, removed, errors, damage?}
- */
-export function safeRemoveWorktree(worktree, { repo, git = null, retries = 5 } = {}) {
-  const target = path.resolve(String(worktree ?? ''));
-  const run = git ?? ((args, opts) => gitSpawn('git', args, { cwd: opts.cwd, maxBuffer: 64 * 1024 * 1024 }));
-  const out = { ok: false, root: target, links: 0, removed: { files: 0, dirs: 0, links: 0 }, errors: [] };
-  const list = repo ? String((run(['worktree', 'list', '--porcelain'], { cwd: repo }) ?? {}).stdout ?? '') : '';
-  const trees = list.split(/\r?\n/).filter((l) => l.startsWith('worktree ')).map((l) => path.resolve(l.slice(9).trim()));
-  const mainRoot = trees[0] ?? null;
-  if (mainRoot && same(mainRoot, target)) { out.errors.push({ path: target, code: 'REFUSED', message: 'refusing to remove the main checkout' }); return out; }
-  const refused = forbiddenRoot(target);
-  if (refused) { out.errors.push({ path: target, code: 'REFUSED', message: `refusing to remove ${refused}` }); return out; }
-  const before = mainRoot ? mainCheckoutGuard(mainRoot, { git: run }) : null;
-  if (fs.existsSync(target)) {
-    const unlinked = removeLinksUnder(target);
-    out.links = unlinked.links;
-    if (!unlinked.ok) { out.errors.push(...unlinked.errors); out.reason = 'link-stuck'; return out; }
-    out.removed.links = out.links;
-    const registered = trees.some((t) => same(t, target));
-    if (registered && repo) run(['worktree', 'remove', '--force', target], { cwd: repo });
-    if (fs.existsSync(target)) {
-      if (linksUnder(target).length) { out.errors.push({ path: target, code: 'LINK_STUCK', message: 'a link appeared during removal' }); out.reason = 'link-stuck'; return out; }
-      const rm = safeRemoveTree(target, { retries });
-      out.removed.files += rm.removed.files; out.removed.dirs += rm.removed.dirs;
-      out.errors.push(...rm.errors);
-    }
-  }
-  if (repo) { try { run(['worktree', 'prune'], { cwd: repo }); } catch { /* the registration is pruned on the next prune */ } }
-  if (before) {
-    const damage = mainCheckoutDamage(before, mainCheckoutGuard(mainRoot, { git: run }));
-    if (damage.length) { out.damage = damage; out.fatal = true; out.reason = 'main-checkout-damaged'; out.errors.push({ path: mainRoot, code: 'main-checkout-damaged', message: damage.join('; ') }); return out; }
-  }
-  out.ok = !fs.existsSync(target) && (() => { try { fs.lstatSync(target); return false; } catch { return true; } })();
-  if (!out.ok && !out.reason) out.reason = 'remove-failed';
-  return out;
-}

package/runtime/scripts/lib/test-secrets.mjs

@@ -1,116 +0,0 @@
-#!/usr/bin/env node
-// test-secrets.mjs — test credentials follow the product repository's own `.starcistacks` convention (owner ruling
-// push-scan-test-secrets-encrypted, 2026-09-28: they work exactly like the stack custody and a plaintext password is never pushed).
-// There is no store of the runtime's own: a test credential lives at `<repo>/.starcistacks/<stack>/secrets/test/<name>`,
-// its plaintext git-ignored by the repo's `.starcistacks/**` rules and only the sops-encrypted twin `<name>.enc`
-// committed. It is written with the repository's existing command (`node scripts/stack-secret.mjs set
-// <stack>/secrets/test/<name>`, npm run secret:set), which encrypts against the recipients `.sops.yaml` names and
-// removes the plaintext; this module only READS: the local plaintext when present, else the `.enc` decrypted by sops
-// with the shared age identity (SOPS_AGE_KEY_FILE, default ~/.starci/master.identity) into memory.
-// A credential that need not be stable across runs (a disposable account registered per run) is generated per run
-// and stored nowhere. A value is never logged.
-//
-//   node scripts/lib/test-secrets.mjs get <name> --repo <path> [--stack dev] [--reveal]   prints nothing unless --reveal
-//
-// In a script:  import { testSecret } from '<runtime>/scripts/lib/test-secrets.mjs';
-//               const password = testSecret('login-capture-password', { repo });
-// The push secret scan (scripts/supervisor/push-mains.mjs) passes a `.enc` only when isSopsEnvelope holds.
-import fs from 'node:fs';
-import path from 'node:path';
-import { sopsDecrypt } from '../api/sops/decrypt.mjs';
-import { fileURLToPath } from 'node:url';
-import { parseYaml } from '../../engine/yaml.mjs';
-
-const NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
-const STACK = /^[a-z0-9][a-z0-9-]{0,31}$/;
-/** One sops-encrypted leaf: `ENC[AES256_GCM,data:...,iv:...,tag:...,type:...]` (data may be empty). */
-const SOPS_VALUE = /^ENC\[AES256_GCM,data:[A-Za-z0-9+/=]*,iv:[A-Za-z0-9+/=]+,tag:[A-Za-z0-9+/=]+,type:[a-z]+\]$/;
-
-/** Where test credential `name` of `stack` lives in `repo`: {plain, enc, rel}. `rel` is the path the repo's
- *  `stack-secret.mjs set` takes. */
-export function testSecretPaths(name, { repo, stack = 'dev' } = {}) {
-  if (!NAME.test(String(name ?? ''))) throw new Error(`test secret name must match ${NAME} (got ${JSON.stringify(name)})`);
-  if (!STACK.test(String(stack ?? ''))) throw new Error(`stack must match ${STACK} (got ${JSON.stringify(stack)})`);
-  if (!repo) throw new Error('test secret needs {repo}: the product repository whose .starcistacks holds it');
-  const rel = `${stack}/secrets/test/${name}`;
-  const plain = path.join(path.resolve(String(repo)), '.starcistacks', stack, 'secrets', 'test', name);
-  return { plain, enc: `${plain}.enc`, rel };
-}
-
-/** The command that stores a test credential, in the product repository's own tooling. */
-export const setCommand = (name = '<name>', stack = 'dev') => `node scripts/stack-secret.mjs set ${stack}/secrets/test/${name}`;
-
-/** sops' format for a plaintext path, as the repository's stack-secret.mjs formatFor decides it. */
-export const sopsFormatFor = (file) => (file.endsWith('.env') ? 'dotenv' : /\.json$/.test(file) ? 'json' : /\.(ya?ml|kubeconfig)$/.test(file) ? 'yaml' : 'binary');
-
-/** The sops binary: PATH, then winget's Links and Packages (spawn without a shell ignores PATHEXT). */
-export function resolveSops(env = process.env) {
-  const win = process.platform === 'win32';
-  const names = win ? ['sops.exe', 'sops'] : ['sops'];
-  const dirs = String(env.PATH ?? '').split(win ? ';' : ':').filter(Boolean);
-  if (win && env.LOCALAPPDATA) {
-    const winget = path.join(env.LOCALAPPDATA, 'Microsoft', 'WinGet');
-    dirs.push(path.join(winget, 'Links'));
-    const packages = path.join(winget, 'Packages');
-    try { for (const e of fs.readdirSync(packages)) if (/sops/i.test(e)) dirs.push(path.join(packages, e)); } catch { /* none */ }
-  }
-  for (const dir of dirs) for (const n of names) { const f = path.join(dir, n); try { if (fs.statSync(f).isFile()) return f; } catch { /* next */ } }
-  return null;
-}
-
-/** Read test credential `name`: the local plaintext when present, else its committed `.enc` through sops. */
-export function testSecret(name, { repo, stack = 'dev', env = process.env, sops = null } = {}) {
-  const { plain, enc, rel } = testSecretPaths(name, { repo, stack });
-  if (fs.existsSync(plain)) return fs.readFileSync(plain, 'utf8').replace(/\r?\n$/, '');
-  if (!fs.existsSync(enc)) throw new Error(`test secret ${name} is not in .starcistacks/${rel}.enc; store it with \`${setCommand(name, stack)}\` in ${repo}`);
-  const bin = sops ?? resolveSops(env);
-  if (!bin) throw new Error('sops is not installed (Windows: winget install Mozilla.SOPS)');
-  const format = sopsFormatFor(plain);
-  const r = sopsDecrypt(bin, ['--decrypt', '--input-type', format, '--output-type', format, enc], { cwd: path.resolve(String(repo)), env, maxBuffer: 1024 * 1024 });
-  if (r.status !== 0) throw new Error(`test secret ${name}: sops could not decrypt .starcistacks/${rel}.enc (${String(r.stderr ?? r.error?.message ?? '').trim().split(/\r?\n/).pop()})`);
-  return String(r.stdout).replace(/\r?\n$/, '');
-}
-
-/** Every leaf outside the `sops` block is an ENC[...] value (or null); the block itself carries a mac. */
-const allEncrypted = (node) => {
-  if (node === null) return true;
-  if (Array.isArray(node)) return node.every(allEncrypted);
-  if (typeof node === 'object') return Object.values(node).every(allEncrypted);
-  return typeof node === 'string' && SOPS_VALUE.test(node);
-};
-const sopsTree = (doc) => !!doc && typeof doc === 'object' && !Array.isArray(doc) && !!doc.sops && typeof doc.sops === 'object'
-  && typeof doc.sops.mac === 'string' && SOPS_VALUE.test(doc.sops.mac)
-  && Object.keys(doc).length > 1 && Object.entries(doc).every(([k, v]) => k === 'sops' || allEncrypted(v));
-
-/**
- * True only for a sops-encrypted file with no plaintext value: binary/json form ({"data": ENC[...], "sops": {...}}),
- * yaml form (every value ENC[...] plus the sops block) or dotenv form (KEY=ENC[...] lines plus sops_* metadata).
- * The sops metadata must carry its mac. A key kept plaintext through `unencrypted_suffix` does not pass.
- */
-export function isSopsEnvelope(text) {
-  const src = String(text ?? '').replace(/^/, '');
-  if (!src.trim()) return false;
-  try { return sopsTree(JSON.parse(src)); } catch { /* not JSON */ }
-  const lines = src.split(/\r?\n/).filter((l) => l.trim() && !/^\s*#/.test(l));
-  if (lines.length && lines.every((l) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(l))) {
-    const pairs = lines.map((l) => [l.slice(0, l.indexOf('=')), l.slice(l.indexOf('=') + 1)]);
-    const meta = pairs.filter(([k]) => k.startsWith('sops_'));
-    const vals = pairs.filter(([k]) => !k.startsWith('sops_'));
-    return vals.length > 0 && vals.every(([, v]) => SOPS_VALUE.test(v)) && meta.some(([k, v]) => k === 'sops_mac' && SOPS_VALUE.test(v));
-  }
-  try { return sopsTree(parseYaml(src)); } catch { return false; }
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  const [cmd, name, ...rest] = process.argv.slice(2);
-  const opt = (f) => { const i = rest.indexOf(f); return i >= 0 ? rest[i + 1] : undefined; };
-  try {
-    if (cmd === 'get') {
-      const value = testSecret(name, { repo: opt('--repo'), stack: opt('--stack') ?? 'dev' });
-      if (rest.includes('--reveal')) process.stdout.write(`${value}\n`);
-    } else {
-      console.error(`usage: test-secrets.mjs get <name> --repo <path> [--stack dev] [--reveal]\nstore one with the product repo's own command: ${setCommand()}`);
-      process.exitCode = 2;
-    }
-  } catch (error) { console.error(String(error?.message ?? error)); process.exitCode = 1; }
-}

package/templates/fe/skeleton/apps/__app__/next.config.ts

@@ -1,11 +0,0 @@
-import type { NextConfig } from "next"
-import createNextIntlPlugin from "next-intl/plugin"
-
-const withNextIntl = createNextIntlPlugin("./src/modules/i18n/request.ts")
-
-/** Next config of the {{app}} app: next-intl wired to the request config, Turbopack rooted at the repository. */
-const nextConfig: NextConfig = {
-    turbopack: { root: process.cwd() },
-}
-
-export default withNextIntl(nextConfig)

package/templates/fe/skeleton/apps/__app__/src/app/[locale]/layout.tsx

@@ -1,20 +0,0 @@
-import type { Metadata } from "next"
-import type { ReactNode } from "react"
-import { LocaleShell, localeMetadata } from "@/features/layouts/LocaleShell"
-import "../globals.css"
-
-type LayoutProps = {
-    readonly children: ReactNode
-    readonly params: Promise<{ readonly locale: string }>
-}
-
-/** The localized document title of this route segment. */
-export const generateMetadata = async (props: LayoutProps): Promise<Metadata> =>
-    localeMetadata((await props.params).locale)
-
-/** The locale segment's layout slot: it mounts the locale shell around the segment. */
-const Layout = async (props: LayoutProps) => (
-    <LocaleShell lang={(await props.params).locale}>{props.children}</LocaleShell>
-)
-
-export default Layout

package/templates/fe/skeleton/apps/__app__/src/app/[locale]/page.tsx

@@ -1,9 +0,0 @@
-import { HomePage, homeMetadata } from "@/features/pages/HomePage"
-
-/** The document title of this page, from the catalog of the requested locale. */
-export const generateMetadata = homeMetadata
-
-/** The locale root's page slot: it mounts the home page and nothing else. */
-const Page = () => <HomePage />
-
-export default Page

package/templates/fe/skeleton/apps/__app__/src/components/composites/FailureScreen/index.tsx

@@ -1,28 +0,0 @@
-import { Button, GrammarRoot, Heading, PageContainer, WorkspaceShell } from "@starci/grammar/common"
-
-/** Props for {@link FailureScreen}. */
-type FailureScreenProps = {
-    /** What failed, said to the reader. */
-    readonly title: string
-    /** The label of the one recovery action. */
-    readonly retryLabel: string
-    /** Runs the recovery: the boundary re-renders what failed. */
-    readonly onRetry: () => void
-}
-
-/** A whole-screen failure with its one recovery action: the drawing both error boundaries share. */
-export const FailureScreen = (props: FailureScreenProps) => (
-    <GrammarRoot>
-        <WorkspaceShell
-            primaryLabel={props.title}
-            primary={
-                <PageContainer measure="reading">
-                    <Heading level={1}>{props.title}</Heading>
-                    <Button variant="danger" onPress={props.onRetry}>
-                        {props.retryLabel}
-                    </Button>
-                </PageContainer>
-            }
-        />
-    </GrammarRoot>
-)

package/templates/fe/skeleton/apps/__app__/src/features/layouts/LocaleShell/index.tsx

@@ -1,35 +0,0 @@
-import type { Metadata } from "next"
-import { notFound } from "next/navigation"
-import { hasLocale, NextIntlClientProvider } from "next-intl"
-import { getMessages, getTranslations, setRequestLocale } from "next-intl/server"
-import type { ReactNode } from "react"
-import { siteUrl } from "@/modules/config"
-import { routing } from "@/modules/i18n"
-
-type LocaleShellProps = {
-    readonly lang: string
-    readonly children: ReactNode
-}
-
-/** The document title and the absolute base of every metadata URL, for the language in the address. */
-export const localeMetadata = async (lang: string): Promise<Metadata> => {
-    if (!hasLocale(routing.locales, lang)) notFound()
-    const t = await getTranslations({ locale: lang, namespace: "app" })
-    return { title: t("title"), metadataBase: new URL(siteUrl()) }
-}
-
-/** The document of one route language: `<html lang>` from the address and the catalog handed to client components. */
-export const LocaleShell = async (props: LocaleShellProps) => {
-    if (!hasLocale(routing.locales, props.lang)) notFound()
-    setRequestLocale(props.lang)
-    const messages = await getMessages()
-    return (
-        <html lang={props.lang}>
-            <body className="min-h-dvh">
-                <NextIntlClientProvider locale={props.lang} messages={messages}>
-                    {props.children}
-                </NextIntlClientProvider>
-            </body>
-        </html>
-    )
-}

package/templates/fe/skeleton/apps/__app__/src/features/pages/ErrorPage/component.tsx

@@ -1,21 +0,0 @@
-import { FailureScreen } from "@/components/composites/FailureScreen"
-
-/** Props for {@link ErrorPageBase}. */
-export type ErrorPageBaseProps = {
-    /** Whole-screen situations this surface settles; the error page only ever shows the failure. */
-    readonly state: "failed"
-    /** The words the failure shows. */
-    readonly props: {
-        readonly title: string
-        readonly retryLabel: string
-    }
-    /** What the surface reports upward. */
-    readonly on: {
-        readonly retry: () => void
-    }
-}
-
-/** Draw the failure of the locale segment with its one recovery action. */
-export const ErrorPageBase = (props: ErrorPageBaseProps) => (
-    <FailureScreen title={props.props.title} retryLabel={props.props.retryLabel} onRetry={props.on.retry} />
-)

package/templates/fe/skeleton/apps/__app__/src/features/pages/ErrorPage/index.tsx

@@ -1,17 +0,0 @@
-import { useTranslations } from "next-intl"
-import { ErrorPageBase } from "./component"
-
-/** The public props of the locale error page: the boundary hands it the retry. */
-type ErrorPageProps = { readonly onRetry: () => void }
-
-/** A render failure of the locale segment shows this instead of a blank page; retry re-renders the segment. */
-export const ErrorPage = (props: ErrorPageProps) => {
-    const t = useTranslations("errors.page")
-    return (
-        <ErrorPageBase
-            state="failed"
-            props={{ title: t("title"), retryLabel: t("retry") }}
-            on={{ retry: props.onRetry }}
-        />
-    )
-}

package/templates/fe/skeleton/apps/__app__/src/features/pages/GlobalErrorPage/component.tsx

@@ -1,26 +0,0 @@
-import { FailureScreen } from "@/components/composites/FailureScreen"
-
-/** Props for {@link GlobalErrorPageBase}. */
-export type GlobalErrorPageBaseProps = {
-    /** Whole-screen situations this surface settles; the global error page only ever shows the failure. */
-    readonly state: "failed"
-    /** The language of the document and the words the failure shows. */
-    readonly props: {
-        readonly lang: string
-        readonly title: string
-        readonly retryLabel: string
-    }
-    /** What the surface reports upward. */
-    readonly on: {
-        readonly retry: () => void
-    }
-}
-
-/** Draw the whole document, because this boundary replaces the root layout that would have drawn it. */
-export const GlobalErrorPageBase = (props: GlobalErrorPageBaseProps) => (
-    <html lang={props.props.lang}>
-        <body>
-            <FailureScreen title={props.props.title} retryLabel={props.props.retryLabel} onRetry={props.on.retry} />
-        </body>
-    </html>
-)

package/templates/fe/skeleton/apps/__app__/src/features/pages/GlobalErrorPage/index.tsx

@@ -1,15 +0,0 @@
-import { DEFAULT_LOCALE } from "@/modules/i18n"
-import messages from "@/modules/i18n/messages/vi.json"
-import { GlobalErrorPageBase } from "./component"
-
-/** The public props of the last-resort error page: the boundary hands it the retry. */
-type GlobalErrorPageProps = { readonly onRetry: () => void }
-
-/** The last-resort boundary above the locale layout: it has no provider, so it reads the default catalog directly. */
-export const GlobalErrorPage = (props: GlobalErrorPageProps) => (
-    <GlobalErrorPageBase
-        state="failed"
-        props={{ lang: DEFAULT_LOCALE, title: messages.errors.global.title, retryLabel: messages.errors.global.retry }}
-        on={{ retry: props.onRetry }}
-    />
-)

package/templates/fe/skeleton/apps/__app__/src/features/pages/HomePage/component.tsx

@@ -1,25 +0,0 @@
-import { GrammarRoot, Heading, PageContainer, WorkspaceShell } from "@starci/grammar/common"
-
-/** Props for {@link HomePageBase}. */
-export type HomePageBaseProps = {
-    /** Whole-screen situations this surface settles; the home page only ever shows its title. */
-    readonly state: "ready"
-    /** The words the page shows. */
-    readonly props: { readonly title: string }
-    /** What the surface reports upward; the page reports nothing. */
-    readonly on: Record<never, never>
-}
-
-/** Draw the front door of the app. */
-export const HomePageBase = (props: HomePageBaseProps) => (
-    <GrammarRoot>
-        <WorkspaceShell
-            primaryLabel={props.props.title}
-            primary={
-                <PageContainer measure="reading">
-                    <Heading level={1}>{props.props.title}</Heading>
-                </PageContainer>
-            }
-        />
-    </GrammarRoot>
-)

package/templates/fe/skeleton/apps/__app__/src/features/pages/HomePage/index.tsx

@@ -1,15 +0,0 @@
-import type { Metadata } from "next"
-import { getTranslations } from "next-intl/server"
-import { HomePageBase } from "./component"
-
-/** The document title of the home page, from the catalog of the requested locale. */
-export const homeMetadata = async (): Promise<Metadata> => {
-    const t = await getTranslations("home")
-    return { title: t("title") }
-}
-
-/** The first page of the app: a server component, so no catalog is shipped for it. */
-export const HomePage = async () => {
-    const t = await getTranslations("home")
-    return <HomePageBase state="ready" props={{ title: t("title") }} on={{}} />
-}