@starci/hfs 4.0.8 → 4.0.10

package/runtime/scripts/lib/redact.mjs

@@ -0,0 +1,161 @@
+// redact.mjs — the ONE redaction module (alpha.3, ARCHITECTURE-DB §4.2). Every blob put of text bytes
+// (report attachments, check stdout/stderr/output, terminal transcripts, CLI sessions) and every log write
+// passes through here first; the harness UI server reuses it. A blob whose bytes went through redactText is
+// stamped blobs.redaction = REDACTION_VERSION; bytes that cannot be filtered (images, video, archives) are
+// stamped 'binary'.
+//
+// It blanks: provider tokens and JWTs (secret-patterns.mjs, the push scan's list), auth headers, URL query
+// secrets, URL credentials (scheme://user:pass@host), PEM private-key blocks (the whole block), KEY=value /
+// KEY: value pairs whose key names a secret (FOO_API_KEY=..., password: ...), and the declared secrets of a
+// product repo's .starcistacks (their env-style names as keys, and their values wherever they appear).
+// Keys and surrounding words stay, so a redacted transcript still reads.
+import fs from 'node:fs';
+import path from 'node:path';
+import { FORBIDDEN_FILES, SECRET_PATTERNS } from './secret-patterns.mjs';
+import { parseYaml } from '../../engine/yaml.mjs';
+import { altOf } from './source-phrases.mjs';
+import { redactResolvedSecrets } from '../../engine/secrets.mjs';
+
+const REDACTION_VERSION = 'v1';
+export const MARK = '[redacted]';
+
+const withGlobal = (re) => new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
+const PATTERNS = SECRET_PATTERNS.filter((rule) => rule.name !== 'private-key-block').map((rule) => ({ ...rule, g: withGlobal(rule.re) }));
+// Words that make an env-style key a secret, matched per `_`-separated segment of the name (FOO_API_KEY,
+// KEYCLOAK_ADMIN_PASSWORD, GH_TOKEN, MINIO_SECRET_KEY, DATABASE_URL is not; TESTS_PASSED is not).
+const SECRET_SEGMENTS = new Set(['PASSWORD', 'PASSWD', 'PWD', 'PASS', 'SECRET', 'SECRETS', 'TOKEN', 'APIKEY', 'KEY', 'CREDENTIAL', 'CREDENTIALS', 'COOKIE', 'OTP', 'DSN', 'PAT']);
+const isSecretEnvName = (name) => String(name).replace(/^export\s+/, '').replace(/_FILE$/, '').split('_').some((seg) => SECRET_SEGMENTS.has(seg));
+const PEM_BLOCK = /-----BEGIN ((?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?)-----[\s\S]*?(?:-----END \1-----|$)/g;
+const RULES = [
+  { name: 'url-credentials', re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s:@/"'<>]+):([^\s@/"'<>]+)@/gi, to: (m, scheme, user) => `${scheme}${user}:${MARK}@` },
+  { name: 'auth-header', re: /\b(Bearer|Basic|Token)(\s+)[A-Za-z0-9._~+/=-]{8,}/gi, to: (m, a, b) => `${a}${b}${MARK}` },
+  { name: 'url-secret', re: /([?&#](?:access_token|refresh_token|id_token|token|key|api_key|apikey|secret|code|password|otp|sig|signature)=)([^&#\s"']+)/gi, to: (m, a) => `${a}${MARK}` },
+  { name: 'otp', re: new RegExp(`\\b(otp|one[-_ ]?time[-_ ]?(?:code|password|pin)|verification[-_ ]?code|2fa[-_ ]?code|${altOf('redact.otpLabel')})(\\s*[:=]?\\s*["']?)(\\d{4,8})\\b`, 'giu'), to: (m, a, b) => `${a}${b}${MARK}` },
+  // ENV_STYLE_KEY=value / ENV_STYLE_KEY: value (shell exports, dotenv, compose, CLI echo).
+  { name: 'env-secret', re: /\b((?:export\s+)?[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*)(\s*[:=]\s*["']?)((?!\[redacted)[^\s"'`]{3,})/g,
+    to: (m, a, b, c) => (isSecretEnvName(a) && !c.startsWith('/run/secrets/') && !c.startsWith('$') ? `${a}${b}${MARK}` : m) },
+  { name: 'keyed-secret', re: /\b(password|passwd|pwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|auth[_-]?token|session[_-]?token|private[_-]?key|otp|pin[_-]?code|cookie|set-cookie)(["']?\s*[:=]\s*["']?)((?!\[redacted)[^\s"',;&}]{3,})/gi, to: (m, a, b) => `${a}${b}${MARK}` },
+];
+
+/** Keys whose value is a secret whatever it looks like; the key stays, the value goes. */
+export const SECRET_KEY = /^(?:password|passwd|pwd|pass|secret|otp|pin|pincode|pin_code|credential|credentials|authorization|cookie|cookies|set-cookie|private[_-]?key|client[_-]?secret|api[_-]?key|apikey|[a-z_-]*token|[a-z_-]*secret)$/i;
+
+// ------------------------------------------------------------------------------ declared stack secrets
+// A product repo's .starcistacks/<stack>/stack.yaml `secrets:` block names each secret and the runtime file
+// that holds its value. Values are refreshed from their declared inputs; values never leave the filter.
+const STACK_DIRS = ['.starcistacks'];
+const secretValues = new Set();
+const secretNames = new Set();
+const envName = (name) => String(name).replace(/[^A-Za-z0-9]+/g, '_').replace(/^_+|_+$/g, '').toUpperCase();
+const readSafe = (file) => { try { return fs.readFileSync(file, 'utf8'); } catch { return null; } };
+const listSafe = (dir) => { try { return fs.readdirSync(dir, { withFileTypes: true }); } catch { return []; } };
+
+/** A value this process must never write out (a secret it resolved itself). Values under 6 chars are ignored. */
+function addSecretValue(value) {
+  const v = typeof value === 'string' ? value.trim() : '';
+  if (v.length >= 6 && !/^\[redacted/.test(v)) secretValues.add(v);
+}
+
+/** Learn the declared secrets of every .starcistacks stack under `repoRoot` (idempotent). */
+export function learnStackSecrets(repoRoot) {
+  if (typeof repoRoot !== 'string' || !repoRoot) return;
+  const root = path.resolve(repoRoot);
+  for (const stackDir of STACK_DIRS) {
+    for (const entry of listSafe(path.join(root, stackDir))) {
+      if (!entry.isDirectory()) continue;
+      const dir = path.join(root, stackDir, entry.name);
+      const text = readSafe(path.join(dir, 'stack.yaml'));
+      let doc = null;
+      try { doc = text ? parseYaml(text) : null; } catch { doc = null; }
+      const secrets = doc && typeof doc.secrets === 'object' && doc.secrets ? doc.secrets : {};
+      for (const [name, spec] of Object.entries(secrets)) {
+        secretNames.add(envName(name));
+        if (spec && typeof spec.file === 'string') addSecretValue(readSafe(path.resolve(dir, spec.file)));
+      }
+      // Plaintext runtime copies of the secrets (git-ignored): their values are secrets too.
+      for (const file of listSafe(path.join(dir, 'runtime', 'files'))) if (file.isFile()) addSecretValue(readSafe(path.join(dir, 'runtime', 'files', file.name)));
+    }
+  }
+}
+
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+let namesRe = null, namesSize = -1;
+const declaredNameRule = () => {
+  if (namesSize !== secretNames.size) {
+    namesSize = secretNames.size;
+    namesRe = secretNames.size ? new RegExp(`\\b((?:${[...secretNames].map(escapeRe).join('|')})(?:_FILE)?)(\\s*[:=]\\s*["']?)((?!\\[redacted)[^\\s"'\`]{3,})`, 'g') : null;
+  }
+  return namesRe;
+};
+
+// --------------------------------------------------------------------------------------------- text
+/**
+ * `text` with every secret value blanked. `repoRoots` (optional) are product repos whose .starcistacks
+ * declarations are learned first.
+ */
+export function redactText(text, { repoRoots = [] } = {}) {
+  if (typeof text !== 'string' || !text) return text;
+  for (const root of repoRoots) learnStackSecrets(root);
+  let out = redactResolvedSecrets(text).replace(PEM_BLOCK, (m, kind) => `[redacted:pem ${kind}]`);
+  for (const value of secretValues) if (out.includes(value)) out = out.split(value).join('[redacted:stack-secret]');
+  for (const rule of PATTERNS) {
+    rule.g.lastIndex = 0;
+    out = out.replace(rule.g, (match, value) => {
+      if (rule.name === 'assigned-secret') return rule.placeholder?.test(value ?? '') ? match : match.replace(value, MARK);
+      return `[redacted:${rule.name}]`;
+    });
+  }
+  const declared = declaredNameRule();
+  if (declared) { declared.lastIndex = 0; out = out.replace(declared, (m, a, b) => `${a}${b}${MARK}`); }
+  for (const rule of RULES) { rule.re.lastIndex = 0; out = out.replace(rule.re, rule.to); }
+  return out;
+}
+
+/** A path that is a secret by being one (an env file, a key file, .secrets/): blanked, its rule named. */
+export function redactPath(p) {
+  if (typeof p !== 'string') return p;
+  const slashed = p.replace(/\\/g, '/');
+  const rule = FORBIDDEN_FILES.find((r) => r.test(slashed));
+  return rule ? `[redacted:${rule.name}]` : redactText(p);
+}
+
+/** A deep copy of `value` with secret-named keys blanked and every string redacted. */
+export function redactData(value, key = null, depth = 0) {
+  if (depth > 8) return '[depth]';
+  if (key && SECRET_KEY.test(key) && value != null && typeof value !== 'object' && typeof value !== 'boolean') return MARK;
+  if (typeof value === 'string') return /(?:path|ref|file)$/i.test(key ?? '') ? redactPath(value) : redactText(value);
+  if (Array.isArray(value)) return value.map((v) => redactData(v, null, depth + 1));
+  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactData(v, k, depth + 1)]));
+  return value;
+}
+
+// -------------------------------------------------------------------------------------------- bytes
+/** True for media types whose bytes are text the filter can read. */
+export const isTextMedia = (mediaType) => /^text\/|[/+](?:json|xml|yaml|x-yaml|javascript|x-ndjson|x-diff|x-patch|csv|sql|x-sh)\b|^application\/(?:json|xml|yaml|javascript|x-ndjson|x-diff|x-patch|sql)$/i
+  .test(String(mediaType ?? ''));
+
+/** The supported text encoding selected by a byte-order mark. */
+export function textEncodingOf(bytes) {
+  if (bytes.length >= 2 && bytes[0] === 0xff && bytes[1] === 0xfe) return 'utf-16le';
+  if (bytes.length >= 2 && bytes[0] === 0xfe && bytes[1] === 0xff) return 'utf-16be';
+  if (bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf) return 'utf-8-bom';
+  return 'utf-8';
+}
+
+/** Decode supported text without accepting malformed bytes as sanitized evidence. */
+export function decodeText(bytes) {
+  const encoding = textEncodingOf(bytes);
+  return new TextDecoder(encoding === 'utf-8-bom' ? 'utf-8' : encoding, { fatal: true }).decode(bytes);
+}
+
+/**
+ * Bytes ready for a blob put: text bytes redacted ({redaction:'v1'}), anything else untouched
+ * ({redaction:'binary'}). The blob sha is then taken over the returned bytes.
+ */
+export function redactBytes(bytes, mediaType, { repoRoots = [] } = {}) {
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+  if (!isTextMedia(mediaType)) return { bytes: buf, redaction: 'binary' };
+  const text = decodeText(buf);
+  const clean = redactText(text, { repoRoots });
+  return { bytes: Buffer.from(clean, 'utf8'), redaction: REDACTION_VERSION };
+}

package/runtime/scripts/lib/regex.mjs

@@ -0,0 +1,4 @@
+// regex.mjs - building a RegExp from text.
+
+/** `text` with every regular-expression metacharacter escaped, so it matches itself literally. */
+export const escapeRegExp = (text) => String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');

package/runtime/scripts/lib/same-text.mjs

@@ -0,0 +1,5 @@
+// same-text.mjs - text equality that ignores the line-ending form and a trailing blank tail (a git runner may trim stdout, a work tree may
+// carry CRLF): the one comparison the database rules use for a committed file against its base or against a regenerated one.
+
+/** True when both texts exist and are equal once CRLF is folded to LF and trailing whitespace at the end is dropped. */
+export const sameText = (a, b) => a !== null && b !== null && a.replace(/\r\n/g, '\n').trimEnd() === b.replace(/\r\n/g, '\n').trimEnd();

package/runtime/scripts/lib/secret-patterns.mjs

@@ -23,11 +23,12 @@ export const SECRET_PATTERNS = [
   { name: 'telegram-bot-token', re: /\b\d{8,10}:AA[0-9A-Za-z_-]{33}\b/ },
   { name: 'stripe-secret', re: /\b(?:sk|rk)_live_[0-9A-Za-z]{20,}\b/ },
   { name: 'jwt', re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  // A value written `env(NAME)` (the Supabase config.toml reference form) names a variable, not a secret.
   // A keyword-assigned value that names itself a stand-in (a test stub's `accessToken: "fixture-..."`) is no
   // candidate; only this heuristic takes the exemption, never a provider-shaped token above.
-  // A spec file's keyword-assigned values are test inputs (nivo-fe AuthenticationPage/index.spec.tsx: the sign-in
-  // form's password and a mocked accessToken refused the push, 2026-09-24): the heuristic skips spec files too.
-  { name: 'assigned-secret', re: /\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|client[_-]?secret)\b\s*[:=]\s*['"]([^'"\s$<{]{12,})['"]/i, placeholder: /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i,
+  // A spec file's keyword-assigned values are test inputs (a spec's sign-in
+  // form password and a mocked accessToken once refused a push): the heuristic skips spec files too.
+  { name: 'assigned-secret', re: /\b(?:password|passwd|secret|api[_-]?key|access[_-]?token|client[_-]?secret)\b\s*[:=]\s*['"](?!env\([A-Z_][A-Z0-9_]*\)['"])([^'"\s$<{]{12,})['"]/i, placeholder: /fixture|stub|fake|dummy|placeholder|example|sample|changeme|redacted|mock/i,
     skipFile: /\.(?:spec|test|e2e-spec)\.[cm]?[jt]sx?$/ },
 ];
 

package/runtime/scripts/lib/sleep-sync.mjs

@@ -6,8 +6,9 @@
  * waiting, counted logically by their callers, not by the wall clock) cost milliseconds and the run no longer
  * depends on machine load. Unset in production.
  */
+import { readEnv } from './env.mjs';
 const scaleOf = () => {
-  const raw = process.env.STARCI_SLEEP_SCALE;
+  const raw = readEnv('STARCI_SLEEP_SCALE');
   if (raw === undefined || raw === '') return 1;
   const value = Number(raw);
   return Number.isFinite(value) && value >= 0 ? value : 1;

package/runtime/scripts/lib/sleep.mjs

@@ -0,0 +1,7 @@
+// sleep.mjs — the waits a loop picks between: `sleep` yields the event loop (async code, polls and
+// backoff in the connectors and the watchdog loops), `sleepSync` blocks the thread for synchronous
+// code (lock polls, rename retry — the blocking twin lives in ./sleep-sync.mjs).
+export { sleepSync } from './sleep-sync.mjs';
+
+/** Resolve after `ms` milliseconds. */
+export const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

package/runtime/scripts/lib/sops-envelope.mjs

@@ -0,0 +1,112 @@
+// sops-envelope.mjs — the pure rules of a test credential (owner ruling push-scan-test-secrets-encrypted, 2026-09-28):
+// where it lives in a product repository's `.starcistacks`, the command that stores it, the sops format of its path, and
+// whether a committed file is a sops envelope with no plaintext value (the push secret scan's test). Reading one is
+// scripts/uat/test-secret.mjs; the sops binary is found by scripts/api/sops/lib.mjs.
+import path from 'node:path';
+import { parseYaml } from '../../engine/yaml.mjs';
+
+const NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const STACK = /^[a-z0-9][a-z0-9-]{0,31}$/;
+/** One sops-encrypted leaf: `ENC[AES256_GCM,data:...,iv:...,tag:...,type:...]` (data may be empty). */
+const SOPS_VALUE = /^ENC\[AES256_GCM,data:[A-Za-z0-9+/=]*,iv:[A-Za-z0-9+/=]+,tag:[A-Za-z0-9+/=]+,type:[a-z]+\]$/;
+
+/** Where test credential `name` of `stack` lives in `repo`: {plain, enc, rel}. `rel` is the path the repo's
+ *  `stack-secret.mjs set` takes. */
+export function testSecretPaths(name, { repo, stack = 'dev' } = {}) {
+  if (!NAME.test(String(name ?? ''))) throw new Error(`test secret name must match ${NAME} (got ${JSON.stringify(name)})`);
+  if (!STACK.test(String(stack ?? ''))) throw new Error(`stack must match ${STACK} (got ${JSON.stringify(stack)})`);
+  if (!repo) throw new Error('test secret needs {repo}: the product repository whose .starcistacks holds it');
+  const rel = `${stack}/secrets/test/${name}`;
+  const plain = path.join(path.resolve(String(repo)), '.starcistacks', stack, 'secrets', 'test', name);
+  return { plain, enc: `${plain}.enc`, rel };
+}
+
+/** The command that stores a test credential, in the product repository's own tooling. */
+export const setCommand = (name = '<name>', stack = 'dev') => `node scripts/stack-secret.mjs set ${stack}/secrets/test/${name}`;
+
+/** sops' format for a plaintext path, as the repository's stack-secret.mjs formatFor decides it. */
+export const sopsFormatFor = (file) => (file.endsWith('.env') ? 'dotenv' : /\.json$/.test(file) ? 'json' : /\.(ya?ml|kubeconfig)$/.test(file) ? 'yaml' : 'binary');
+
+/** Every leaf outside the `sops` block is an ENC[...] value (or null); the block itself carries a mac. */
+const allEncrypted = (node) => {
+  if (node === null) return true;
+  if (Array.isArray(node)) return node.every(allEncrypted);
+  if (typeof node === 'object') return Object.values(node).every(allEncrypted);
+  return typeof node === 'string' && SOPS_VALUE.test(node);
+};
+const sopsTree = (doc) => !!doc && typeof doc === 'object' && !Array.isArray(doc) && !!doc.sops && typeof doc.sops === 'object'
+  && typeof doc.sops.mac === 'string' && SOPS_VALUE.test(doc.sops.mac)
+  && Object.keys(doc).length > 1 && Object.entries(doc).every(([k, v]) => k === 'sops' || allEncrypted(v));
+
+/**
+ * True only for a sops-encrypted file with no plaintext value: binary/json form ({"data": ENC[...], "sops": {...}}),
+ * yaml form (every value ENC[...] plus the sops block) or dotenv form (KEY=ENC[...] lines plus sops_* metadata).
+ * The sops metadata must carry its mac. A key kept plaintext through `unencrypted_suffix` does not pass.
+ */
+export function isSopsEnvelope(text) {
+  const src = String(text ?? '').replace(/^/, '');
+  if (!src.trim()) return false;
+  try { return sopsTree(JSON.parse(src)); } catch { /* not JSON */ }
+  const lines = src.split(/\r?\n/).filter((l) => l.trim() && !/^\s*#/.test(l));
+  if (lines.length && lines.every((l) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(l))) {
+    const pairs = lines.map((l) => [l.slice(0, l.indexOf('=')), l.slice(l.indexOf('=') + 1)]);
+    const meta = pairs.filter(([k]) => k.startsWith('sops_'));
+    const vals = pairs.filter(([k]) => !k.startsWith('sops_'));
+    return vals.length > 0 && vals.every(([, v]) => SOPS_VALUE.test(v)) && meta.some(([k, v]) => k === 'sops_mac' && SOPS_VALUE.test(v));
+  }
+  try { return sopsTree(parseYaml(src)); } catch { return false; }
+}
+
+/** Admit one flat age envelope for the native selected-identity invocation; this is shape admission, never cryptographic proof. */
+export function selectedAgeEnvelope(text, format, recipient) {
+  const refuse = reason => ({ ok: false, reason });
+  if (!['binary', 'json', 'yaml', 'dotenv'].includes(format)) return refuse('unsupported-format');
+  let meta;
+  try {
+    if (format === 'dotenv') {
+      const pairs = new Map();
+      for (const line of String(text).split('\n')) {
+        if (!line || line.startsWith('#')) continue;
+        if (line.includes('\r')) return refuse('unsupported-dotenv');
+        const at = line.indexOf('=');
+        if (at < 1) return refuse('unsupported-dotenv');
+        const name = line.slice(0, at);
+        if (pairs.has(name)) return refuse('duplicate-key');
+        pairs.set(name, line.slice(at + 1).replaceAll('\\n', '\n'));
+      }
+      meta = {};
+      const age = {};
+      for (const [name, value] of pairs) {
+        if (!name.startsWith('sops_')) continue;
+        const key = name.slice('sops_'.length);
+        if (key === 'age__list_0__map_recipient') age.recipient = value;
+        else if (key === 'age__list_0__map_enc') age.enc = value;
+        else if (key === 'mac_only_encrypted') {
+          if (value !== 'false') return refuse('partial-mac');
+          meta[key] = false;
+        } else if (key.includes('__')) return refuse('unsupported-key-group');
+        else meta[key] = value;
+      }
+      meta.age = [age];
+    } else {
+      const doc = parseYaml(String(text));
+      if (format !== 'yaml') JSON.parse(String(text));
+      if (format === 'binary' && (!doc || Object.keys(doc).length !== 2 || !Object.hasOwn(doc, 'data') || !Object.hasOwn(doc, 'sops') || typeof doc.data !== 'string')) return refuse('unsupported-binary-shape');
+      meta = doc?.sops;
+    }
+  } catch { return refuse('invalid-envelope'); }
+  if (!meta || typeof meta !== 'object' || Array.isArray(meta) || !isSopsEnvelope(text)) return refuse('invalid-envelope');
+  if (Object.hasOwn(meta, 'key_groups') || Object.hasOwn(meta, 'shamir_threshold')) return refuse('unsupported-key-group');
+  const providers = ['kms', 'gcp_kms', 'hckms', 'azure_kv', 'hc_vault', 'pgp'];
+  for (const name of providers) if (Object.hasOwn(meta, name) && (!Array.isArray(meta[name]) || meta[name].length)) return refuse('non-age-provider');
+  const fields = new Set([...providers, 'age', 'lastmodified', 'mac', 'version', 'unencrypted_suffix', 'encrypted_suffix', 'unencrypted_regex', 'encrypted_regex', 'unencrypted_comment_regex', 'encrypted_comment_regex', 'mac_only_encrypted']);
+  if (Object.keys(meta).some(name => !fields.has(name))) return refuse('unknown-metadata');
+  if (Object.hasOwn(meta, 'mac_only_encrypted') && meta.mac_only_encrypted !== false) return refuse('partial-mac');
+  if (!Array.isArray(meta.age) || meta.age.length !== 1) return refuse('unsupported-age-set');
+  const entry = meta.age[0];
+  if (!entry || typeof entry !== 'object' || Array.isArray(entry) || Object.keys(entry).some(name => !['recipient', 'enc'].includes(name))) return refuse('invalid-age-entry');
+  if (typeof entry.recipient !== 'string' || entry.recipient !== recipient) return refuse('recipient-mismatch');
+  if (typeof entry.enc !== 'string' || !entry.enc.startsWith('-----BEGIN AGE ENCRYPTED FILE-----\n') || !entry.enc.includes('\n-----END AGE ENCRYPTED FILE-----')) return refuse('invalid-age-entry');
+  if (typeof meta.version !== 'string' || !/^\d+\.\d+\.\d+$/.test(meta.version) || typeof meta.lastmodified !== 'string' || !Number.isFinite(Date.parse(meta.lastmodified))) return refuse('invalid-envelope');
+  return { ok: true };
+}

package/runtime/scripts/lib/source-phrases.mjs

@@ -0,0 +1,34 @@
+// source-phrases.mjs - the Vietnamese phrase lists runtime source matches against owner or product text are DATA,
+// not source: they live in modules/goal/source-phrases.yaml (its leaf keys are declared Vietnamese fields,
+// scripts/lib/language.mjs DECLARED_VIETNAMESE_FIELDS - like the archetypes.yaml phrase lists) so the matchers'
+// source stays English. A list is plain words or regex alternatives, per its comment in the lexicon.
+//
+//   phrasesOf('owed.ownerWord')   -> the list as written (['<owner word>', ...])
+//   altOf('owed.ownerWord')       -> the regex alternation 'a|b|c'; '(?!)' - never matches - when absent
+import fs from 'node:fs';
+import path from 'node:path';
+import { skillRoot } from '../../engine/runtime-root.mjs';
+import { parseYaml } from '../../engine/yaml.mjs';
+
+const SOURCE_PHRASES_FILE = 'modules/goal/source-phrases.yaml';
+
+const cache = new Map();
+
+/** The lexicon's `phrases` map ({<group>: {<list>: string[]}}), cached per root. */
+function sourcePhrases(root = skillRoot) {
+  if (!cache.has(root)) {
+    let doc = null;
+    try { doc = parseYaml(fs.readFileSync(path.join(root, ...SOURCE_PHRASES_FILE.split('/')), 'utf8')); } catch { doc = null; }
+    cache.set(root, doc && typeof doc.phrases === 'object' && doc.phrases ? doc.phrases : {});
+  }
+  return cache.get(root);
+}
+
+/** The phrase list `dotKey` (`<group>.<list>`) of `root`, [] when absent. */
+export function phrasesOf(dotKey, root = skillRoot) {
+  const value = dotKey.split('.').reduce((v, k) => (v && typeof v === 'object' ? v[k] : undefined), sourcePhrases(root));
+  return (Array.isArray(value) ? value : []).map(String);
+}
+
+/** The regex alternation of `dotKey` ('a|b|c'); '(?!)' - a never-match - when the list is empty. */
+export const altOf = (dotKey, root = skillRoot) => phrasesOf(dotKey, root).join('|') || '(?!)';

package/runtime/scripts/lib/sqlite.mjs

@@ -0,0 +1,21 @@
+// sqlite.mjs — the small better-sqlite3 probes the ledger and machine stores share. The handle is the
+// caller's; these helpers prepare statements on it and return its own result shapes.
+
+/** Whether the database holds a table `name` (`views: true` also counts views). */
+export const hasTable = (db, name, { views = false } = {}) =>
+  Boolean(db.prepare(`SELECT 1 FROM sqlite_master WHERE type${views ? " IN ('table','view')" : "='table'"} AND name=?`).get(name));
+
+/**
+ * INSERT the [column, value] `pairs` into `table` (`orIgnore` spells OR IGNORE); returns the statement's
+ * run() result. Column naming and value encoding are the caller's — this is only the statement shape.
+ */
+export const insertPairs = (db, table, pairs, { orIgnore = false } = {}) =>
+  db.prepare(`INSERT ${orIgnore ? 'OR IGNORE ' : ''}INTO ${table}(${pairs.map((p) => p[0]).join(',')}) VALUES(${pairs.map(() => '?').join(',')})`)
+    .run(...pairs.map((p) => p[1]));
+
+/**
+ * The per-store `insertRow`: binds the caller's own [column, value] mapper (`cellsOf` — where the store's
+ * column validation and value encoding live) to an insertPairs statement.
+ */
+export const insertRowWith = (cellsOf) => (db, table, row, { orIgnore = false } = {}) =>
+  insertPairs(db, table, cellsOf(db, table, row), { orIgnore });

package/runtime/scripts/lib/stack-services.mjs

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { parseYaml } from '../../engine/yaml.mjs';
+import { words } from './dockerfile.mjs';
 
 /**
  * The services of a repository's own stack definition, read from `.starcistacks/application-stacks.yaml` and the compose
@@ -14,11 +15,11 @@ import { parseYaml } from '../../engine/yaml.mjs';
  * service and is returned as `proxy`.
  */
 export const STACKS_DIRECTORY = '.starcistacks';
-export const STACKS_FILE = 'application-stacks.yaml';
+const STACKS_FILE = 'application-stacks.yaml';
 export const DEFAULT_ENVIRONMENT = 'dev';
 
 /** Test-only value the `*_FILE` secret variables of a compose service become (the file variable is replaced by the plain variable of the same name). Never a real secret: the test stack listens on loopback only. */
-export const TEST_SECRET_VALUE = 'starci-test-secret';
+const TEST_SECRET_VALUE = 'starci-test-secret';
 
 const NOT_RUN_ROLES = new Set(['service', 'observability']);
 const NOT_RUN_PROFILES = new Set(['app']);
@@ -44,8 +45,6 @@ const KNOWN_IMAGES = Object.freeze({
   clickhouse: { kind: 'database', aliases: ['clickhouse', 'database', 'db'], probe: { tcp: true } },
   kafka: { kind: 'queue', aliases: ['kafka', 'queue', 'broker'], probe: { tcp: true } },
   redpanda: { kind: 'queue', aliases: ['redpanda', 'kafka', 'queue', 'broker'], probe: { tcp: true } },
-  rabbitmq: { kind: 'queue', aliases: ['rabbitmq', 'amqp', 'queue', 'broker'], probe: { tcp: true } },
-  nats: { kind: 'queue', aliases: ['nats', 'queue', 'broker'], probe: { tcp: true } },
   elasticsearch: { kind: 'search', aliases: ['elasticsearch', 'elastic', 'search'], probe: { tcp: true } },
   opensearch: { kind: 'search', aliases: ['opensearch', 'search'], probe: { tcp: true } },
 });
@@ -58,14 +57,14 @@ const KNOWN_IMAGES = Object.freeze({
 export const STATEFUL_KINDS = Object.freeze(new Set(['database', 'cache', 'identity', 'storage', 'mail', 'queue', 'search']));
 
 /** The repository name of an image reference: `quay.io/keycloak/keycloak:26.0` -> `keycloak`. */
-export const repositoryOf = image => {
+const repositoryOf = image => {
   const withoutDigest = image.split('@')[0];
   const lastSegment = withoutDigest.split('/').at(-1) ?? withoutDigest;
   return lastSegment.split(':')[0];
 };
 
 /** The repository path of an image reference without its tag: `quay.io/keycloak/keycloak:26.0` -> `quay.io/keycloak/keycloak`. */
-export const imagePathOf = image => {
+const imagePathOf = image => {
   const withoutDigest = image.split('@')[0];
   const lastSlash = withoutDigest.lastIndexOf('/');
   const colon = withoutDigest.indexOf(':', lastSlash + 1);
@@ -73,30 +72,7 @@ export const imagePathOf = image => {
 };
 
 /** True when the image reference carries a tag or digest (an external image, not a placeholder of the repository's own build). */
-export const isTagged = image => image.includes('@') || image.slice(image.lastIndexOf('/') + 1).includes(':');
-
-/** The shell-like words of a compose `command` string, double and single quotes grouping a word. */
-const words = text => {
-  const out = [];
-  let current = '';
-  let quote = null;
-  let started = false;
-  for (const char of text) {
-    if (quote) {
-      if (char === quote) quote = null;
-      else current += char;
-    } else if (char === '"' || char === "'") {
-      quote = char;
-      started = true;
-    } else if (/\s/u.test(char)) {
-      if (started || current) out.push(current);
-      current = '';
-      started = false;
-    } else current += char;
-  }
-  if (started || current) out.push(current);
-  return out;
-};
+const isTagged = image => image.includes('@') || image.slice(image.lastIndexOf('/') + 1).includes(':');
 
 const asList = value => (Array.isArray(value) ? value : value === undefined || value === null ? [] : [value]);
 
@@ -129,7 +105,7 @@ const mountsOf = (value, directory) => {
       continue;
     }
     const parts = String(entry).split(':');
-    // A Windows drive letter is not a separator: `C:\x:/y` keeps its drive.
+    // A Windows drive letter is not a separator: a `<drive>:<path>:/y` mount keeps its drive.
     const source = /^[A-Za-z]$/u.test(parts[0]) && parts.length > 2 ? `${parts.shift()}:${parts.shift()}` : parts.shift();
     const target = parts.shift();
     if (!source || !target || !(source.startsWith('.') || path.isAbsolute(source))) continue;

package/runtime/scripts/lib/ts-ast.mjs

@@ -0,0 +1,35 @@
+// ts-ast.mjs — the small reads the hfs checks share over TypeScript's own AST: a node's name or
+// literal text, a node's 1-based position, a named property's initializer text. `ts` is the caller's
+// already-resolved compiler (see package-at.mjs loadTypescript); nothing here resolves a package.
+
+/** The text of an identifier or a string-literal-like `node`, or null (property names, literal specifiers). */
+export const nameText = (ts, node) => (node && (ts.isIdentifier(node) || ts.isStringLiteralLike(node)) ? node.text : null);
+
+/** The text of a string-literal-like `node` (a string literal or a no-substitution template), or null. */
+export const literalText = (ts, node) => (node && ts.isStringLiteralLike(node) ? node.text : null);
+
+/** The 1-based {line, column} of `node` in `sourceFile`. */
+export const sourceLocation = (sourceFile, node) => {
+  const position = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+  return { line: position.line + 1, column: position.character + 1 };
+};
+
+/**
+ * The `.text` of `key`'s property initializer in `text` (parsed as `file`): a property assignment
+ * inside an object literal, or — `declaration: true` — a class property declaration. `kind` is
+ * 'string' (a string-literal-like initializer) or 'identifier'. The last match wins; null when none.
+ */
+export function propertyText(ts, text, { file = 'source.ts', key, declaration = false, kind = 'string' } = {}) {
+  const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+  let value = null;
+  const visit = (node) => {
+    const isProp = declaration ? ts.isPropertyDeclaration(node) : ts.isPropertyAssignment(node);
+    if (isProp && node.name && ts.isIdentifier(node.name) && node.name.text === key && node.initializer) {
+      const ok = kind === 'identifier' ? ts.isIdentifier(node.initializer) : ts.isStringLiteralLike(node.initializer);
+      if (ok) value = node.initializer.text;
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return value;
+}

package/runtime/scripts/lib/walk.mjs

@@ -2,10 +2,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
-/** Whether `target` is `root` itself or inside it (filesystem paths, either separator). */
-export function isInside(root, target) {
+/** Whether `target` is `root` itself or inside it (filesystem paths, either separator). `includeSelf: false` excludes `target === root`. */
+export function isInside(root, target, { includeSelf = true } = {}) {
   const relative = path.relative(root, target);
-  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+  if (relative === '') return includeSelf;
+  return !relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative);
 }
 /**
  * Every entry under `dir` that is not a directory, depth-first; `filter` sees the entry name and full