@starci/hfs 4.11.22 → 4.12.0

package/runtime/scripts/hfs/rule-params-shape.d.mts

@@ -0,0 +1,10 @@
+import type { Parsed } from './manifest-shape.mjs';
+/**
+ * True for an absent list or a list of {name, reason} database functions, names unique and schema-qualified; `bare` also admits
+ * a bare name, which only the canon's list (ruleParams.be.dbFunctions) uses, for the pg built-ins its helpers call.
+ */
+export declare const dbFunctionsOk: (list: Parsed, { bare }?: {
+    bare?: boolean;
+}) => boolean;
+/** The shape problems of `m.ruleParams`. */
+export declare function ruleParamsProblems(m: Parsed): string[];

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -1,85 +1,98 @@
-// rule-params-shape.mjs - the shape of `ruleParams` of an app slot manifest (knowledge/hfs/slots.yaml): the parameters both sides
-// share (`common`), the back end's own (`be`) and the front end's overrides (`fe`). Pure: a parsed manifest in, a list of
-// problems out, in the words of modules/schemas/hfs-slots.schema.yaml. scripts/hfs/slots.mjs (loadSlotManifest) is the reader.
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { paramNamesOk } from './param-names.mjs';
 import { kindParamProblems, scenarioProblem } from './declaration-slots.mjs';
 import { NAME, namedMapValid, PACKAGE_NAME, roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
 import { byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
 import { ruleEditionProblems } from './edition-slots.mjs';
-
 const PROFILES = ['be', 'fe'];
 const BE_OWN = ['infraOwners', 'eventBus', 'specDoubles', 'paramNames', 'suffixes', 'bannedSuffixes', 'contractShape', 'unitRoles', 'logicRoles', 'valueRoles', 'thinRoles', 'patternScenarios', 'kindPatterns', 'addKinds', 'backing'];
 const backingEntryOk = (entry) => isPlainObject(entry) && Object.keys(entry).every((key) => ['clients', 'images', 'patterns', 'editions'].includes(key))
-  && nonemptyUniqueList(entry.clients, (name) => PACKAGE_NAME.test(String(name)))
-  && Array.isArray(entry.patterns) && entry.patterns.every((name) => NAME.test(String(name))) && new Set(entry.patterns).size === entry.patterns.length
-  && nonemptyUniqueList(entry.images, (name) => PACKAGE_NAME.test(String(name)))
-  && ruleEditionProblems(entry, 'backing service').length === 0;
+    && nonemptyUniqueList(entry.clients, (name) => PACKAGE_NAME.test(String(name)))
+    && Array.isArray(entry.patterns) && entry.patterns.every((name) => NAME.test(String(name))) && new Set(entry.patterns).size === entry.patterns.length
+    && nonemptyUniqueList(entry.images, (name) => PACKAGE_NAME.test(String(name)))
+    && ruleEditionProblems(entry, 'backing service').length === 0;
 const FORM_NAMES = new Set(['call', 'new', 'curried', 'object', 'primitive', 'array']);
 const blockOk = (v) => isPlainObject(v) && Number.isInteger(v.lines) && v.lines >= 2 && Number.isInteger(v.tokens) && v.tokens >= 1 && Object.keys(v).length === 2;
 const fileLinesOk = (v) => isPlainObject(v) && Number.isInteger(v.soft) && v.soft >= 1 && typeof v.hardGrowth === 'boolean' && Object.keys(v).length === 2;
 const SHARED_PARAMS = {
-  fileLines: fileLinesOk,
-  duplicateBlock: blockOk,
-  functionLines: v => Number.isInteger(v) && v >= 1,
-  featureFiles: v => Number.isInteger(v) && v >= 1,
+    fileLines: fileLinesOk,
+    duplicateBlock: blockOk,
+    functionLines: (v) => Number.isInteger(v) && v >= 1,
+    featureFiles: (v) => Number.isInteger(v) && v >= 1,
 };
 const SHARED_KEYS = Object.keys(SHARED_PARAMS);
 const sharedParam = (key, v) => Object.hasOwn(SHARED_PARAMS, key) && SHARED_PARAMS[key](v);
 const sideOk = (side, own, extra = []) => own.every((k) => side[k] !== undefined) && Object.entries(side).every(([k, v]) => own.includes(k) || extra.includes(k) || sharedParam(k, v));
 const liteKeyOk = (lite, key, keys) => key !== 'lite' && keys.includes(key)
-  && (!['functionLines', 'featureFiles'].includes(key) || sharedParam(key, lite[key]));
+    && (!['functionLines', 'featureFiles'].includes(key) || sharedParam(key, lite[key]));
 const liteOk = (lite, keys) => lite === undefined || (isPlainObject(lite) && Object.keys(lite).length > 0 && Object.keys(lite).every((k) => liteKeyOk(lite, k, keys)));
 const memberMap = (v, allowEmpty) => isPlainObject(v) && Object.keys(v).length > 0 && Object.values(v).every((list) => Array.isArray(list) && (allowEmpty || list.length > 0) && list.every((x) => /^[A-Z][A-Za-z0-9]*$/.test(String(x))) && new Set(list).size === list.length);
 const roleList = (v) => nonemptyUniqueList(v, (role) => NAME.test(String(role)));
 const formsOk = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => FORM_NAMES.has(x)) && new Set(v).size === v.length;
 const doubleOk = (v) => isPlainObject(v) && /^[A-Za-z][A-Za-z0-9]*$/.test(String(v.double)) && formsOk(v.forms);
-const regexOk = (v) => { try { return typeof v === 'string' && v.length > 0 && Boolean(new RegExp(v)); } catch { return false; } };
+const regexOk = (v) => { try {
+    return typeof v === 'string' && v.length > 0 && Boolean(new RegExp(v));
+}
+catch {
+    return false;
+} };
 const dbExtensionsOk = (value) => Array.isArray(value) && value.every((name) => typeof name === 'string' && name.length > 0) && new Set(value).size === value.length;
 const DB_PARAMS = { extensions: dbExtensionsOk };
 const dbParamsOk = (db) => db === undefined || (isPlainObject(db) && Object.entries(db).every(([key, value]) => Object.hasOwn(DB_PARAMS, key) && DB_PARAMS[key](value)));
-
 function beSpecificProblems(be, manifest) {
-  const bad = [];
-  bad.push(...scenarioProblem(be.patternScenarios), ...kindParamProblems(be, manifest.triggerKinds));
-  if (!isPlainObject(be.contractShape) || Object.keys(be.contractShape).length !== 1 || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(String(be.contractShape.helper))) bad.push('ruleParams.be.contractShape must be {helper: <identifier>}');
-  const owners = be.infraOwners;
-  const ownerId = /^(platform|integrations)\/[a-z][a-z0-9-]*$/;
-  if (!isPlainObject(owners) || !Object.keys(owners).length || !Object.entries(owners).every(([key, list]) => key && Array.isArray(list) && list.every((o) => ownerId.test(String(o))) && new Set(list).size === list.length)) bad.push('ruleParams.be.infraOwners must map a non-empty specifier to a list of unique platform/<capability> or integrations/<provider> owners ([] means nowhere)');
-  const eventBus = be.eventBus;
-  if (!isPlainObject(eventBus) || Object.keys(eventBus).sort(byCodeUnit).join() !== 'classes,imports' || !memberMap(eventBus.imports, true) || !memberMap(eventBus.classes, false)) bad.push('ruleParams.be.eventBus must be {imports: {<module>: [unique PascalCase members]}, classes: {<module>: [non-empty unique PascalCase classes]}}');
-  if (!paramNamesOk(be.paramNames)) bad.push('ruleParams.be.paramNames must be a non-empty list of unique {type | typeSuffix, names, nameSuffix?} entries');
-  if (!namedMapValid(be.backing, backingEntryOk)) bad.push('ruleParams.be.backing must map a backing service name to {clients: [unique package names], patterns: [unique pattern names], images: [unique image repositories], editions?: [unique known editions]}');
-  if (!roleList(be.suffixes)) bad.push('ruleParams.be.suffixes must be a non-empty list of unique kebab-case role suffixes');
-  if (!roleList(be.bannedSuffixes)) bad.push('ruleParams.be.bannedSuffixes must be a non-empty list of unique kebab-case suffixes');
-  else if (roleList(be.suffixes) && be.suffixes.some((x) => be.bannedSuffixes.includes(x))) bad.push('ruleParams.be.suffixes and bannedSuffixes must be disjoint');
-  const sd = be.specDoubles;
-  if (!isPlainObject(sd) || Object.keys(sd).sort(byCodeUnit).join() !== 'doubles,fallback,kit' || typeof sd.kit !== 'string' || !sd.kit || !Array.isArray(sd.doubles) || !sd.doubles.length || !sd.doubles.every((e) => doubleOk(e) && regexOk(e.token) && (e.from === undefined || regexOk(e.from)) && Object.keys(e).length === (e.from === undefined ? 3 : 4)) || !doubleOk(sd.fallback) || Object.keys(sd.fallback).length !== 2) bad.push('ruleParams.be.specDoubles must be {kit, doubles: [{token: regex, double, forms}], fallback: {double, forms}} with forms drawn from call, new, curried, object, primitive, array');
-  return bad;
+    const bad = [];
+    bad.push(...scenarioProblem(be.patternScenarios), ...kindParamProblems(be, manifest.triggerKinds));
+    if (!isPlainObject(be.contractShape) || Object.keys(be.contractShape).length !== 1 || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(String(be.contractShape.helper)))
+        bad.push('ruleParams.be.contractShape must be {helper: <identifier>}');
+    const owners = be.infraOwners;
+    const ownerId = /^(platform|integrations)\/[a-z][a-z0-9-]*$/;
+    if (!isPlainObject(owners) || !Object.keys(owners).length || !Object.entries(owners).every(([key, list]) => key && Array.isArray(list) && list.every((o) => ownerId.test(String(o))) && new Set(list).size === list.length))
+        bad.push('ruleParams.be.infraOwners must map a non-empty specifier to a list of unique platform/<capability> or integrations/<provider> owners ([] means nowhere)');
+    const eventBus = be.eventBus;
+    if (!isPlainObject(eventBus) || Object.keys(eventBus).sort(byCodeUnit).join() !== 'classes,imports' || !memberMap(eventBus.imports, true) || !memberMap(eventBus.classes, false))
+        bad.push('ruleParams.be.eventBus must be {imports: {<module>: [unique PascalCase members]}, classes: {<module>: [non-empty unique PascalCase classes]}}');
+    if (!paramNamesOk(be.paramNames))
+        bad.push('ruleParams.be.paramNames must be a non-empty list of unique {type | typeSuffix, names, nameSuffix?} entries');
+    if (!namedMapValid(be.backing, backingEntryOk))
+        bad.push('ruleParams.be.backing must map a backing service name to {clients: [unique package names], patterns: [unique pattern names], images: [unique image repositories], editions?: [unique known editions]}');
+    if (!roleList(be.suffixes))
+        bad.push('ruleParams.be.suffixes must be a non-empty list of unique kebab-case role suffixes');
+    if (!roleList(be.bannedSuffixes))
+        bad.push('ruleParams.be.bannedSuffixes must be a non-empty list of unique kebab-case suffixes');
+    else if (roleList(be.suffixes) && be.suffixes.some((x) => be.bannedSuffixes.includes(x)))
+        bad.push('ruleParams.be.suffixes and bannedSuffixes must be disjoint');
+    const sd = be.specDoubles;
+    if (!isPlainObject(sd) || Object.keys(sd).sort(byCodeUnit).join() !== 'doubles,fallback,kit' || typeof sd.kit !== 'string' || !sd.kit || !Array.isArray(sd.doubles) || !sd.doubles.length || !sd.doubles.every((e) => doubleOk(e) && regexOk(e.token) && (e.from === undefined || regexOk(e.from)) && Object.keys(e).length === (e.from === undefined ? 3 : 4)) || !doubleOk(sd.fallback) || Object.keys(sd.fallback).length !== 2)
+        bad.push('ruleParams.be.specDoubles must be {kit, doubles: [{token: regex, double, forms}], fallback: {double, forms}} with forms drawn from call, new, curried, object, primitive, array');
+    return bad;
 }
-
 /** A database function name (R334): `schema.name` outside pg_catalog, or, where `bare` admits it, a pg built-in named alone. */
 const dbFunctionNameOk = (name, bare) => typeof name === 'string' && (/^[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*$/.test(name) ? !name.startsWith('pg_catalog.') : bare && /^[a-z_][a-z0-9_]*$/.test(name));
-
 /**
  * True for an absent list or a list of {name, reason} database functions, names unique and schema-qualified; `bare` also admits
  * a bare name, which only the canon's list (ruleParams.be.dbFunctions) uses, for the pg built-ins its helpers call.
  */
 export const dbFunctionsOk = (list, { bare = false } = {}) => list === undefined || (Array.isArray(list) && list.every((entry) => isPlainObject(entry) && Object.keys(entry).sort().join() === 'name,reason' && dbFunctionNameOk(entry.name, bare) && typeof entry.reason === 'string' && entry.reason.trim().length > 0) && new Set(list.map((entry) => entry.name)).size === list.length);
-
 /** The shape problems of `m.ruleParams`. */
 export function ruleParamsProblems(m) {
-  const bad = [];
-  const rp = m.ruleParams;
-  if (!isPlainObject(rp) || Object.keys(rp).some((k) => ![...PROFILES, 'common', 'db'].includes(k)) || !isPlainObject(rp.common) || !isPlainObject(rp.be) || (rp.fe !== undefined && !isPlainObject(rp.fe))) return ['ruleParams must be a map with common, be and optionally fe and db'];
-  else {
-    // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
-    // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
-    if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite', 'dbFunctions']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !dbFunctionsOk(rp.be.dbFunctions, { bare: true }) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority', 'dbFunctions'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + '), dbFunctions ([{name, reason}]: a pg built-in bare, every other function schema.name) and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
-    bad.push(...beSpecificProblems(rp.be, m));
-    if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
-    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names)');
-  }
-  return bad;
+    const bad = [];
+    const rp = m.ruleParams;
+    if (!isPlainObject(rp) || Object.keys(rp).some((k) => ![...PROFILES, 'common', 'db'].includes(k)) || !isPlainObject(rp.common) || !isPlainObject(rp.be) || (rp.fe !== undefined && !isPlainObject(rp.fe)))
+        return ['ruleParams must be a map with common, be and optionally fe and db'];
+    else {
+        // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
+        // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
+        if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock))
+            bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
+        if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite', 'dbFunctions']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !dbFunctionsOk(rp.be.dbFunctions, { bare: true }) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority', 'dbFunctions']))
+            bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + '), dbFunctions ([{name, reason}]: a pg built-in bare, every other function schema.name) and lite (overrides of the same keys)');
+        else
+            bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+        bad.push(...beSpecificProblems(rp.be, m));
+        if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS)))
+            bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
+        if (!dbParamsOk(rp.db))
+            bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names)');
+    }
+    return bad;
 }

package/runtime/scripts/hfs/rules/a15-findings.d.mts

@@ -0,0 +1,18 @@
+import { featureFileFindings } from './feature-files.mjs';
+import { assetsFindings } from './assets.mjs';
+import { unusedSymbolFindings } from './unused-symbol.mjs';
+import { databaseBaselineFindings } from './database-baseline.mjs';
+import { databaseConfigFindings } from './database-config.mjs';
+import { docFreshFindings } from './doc-fresh.mjs';
+import { releaseProvenanceFindings } from './release-provenance.mjs';
+import { secretCustodyOnlyFindings } from './secret-custody-only.mjs';
+import { scriptHygieneFindings } from './script-hygiene.mjs';
+import { supplyChainFindings } from './supply-chain.mjs';
+import { liteProofLaneFindings } from './lite-proof-lane.mjs';
+import { feBuildArgsFindings } from './fe-build-args.mjs';
+import type { Parsed } from './rule-types.mjs';
+/** The failure codes the finders above emit, so `starci app check` ships their labels (check.mjs adds them to CHECK_CODES). Append-only; the coordinator regenerates it at merge time. */
+export declare const A15_CODES: string[];
+export declare const FINDERS: (typeof feBuildArgsFindings | typeof featureFileFindings | typeof assetsFindings | typeof unusedSymbolFindings | typeof databaseBaselineFindings | typeof databaseConfigFindings | typeof docFreshFindings | typeof releaseProvenanceFindings | typeof secretCustodyOnlyFindings | typeof scriptHygieneFindings | typeof supplyChainFindings | typeof liteProofLaneFindings)[];
+/** Findings of every alpha.15 content rule over one repository. */
+export declare function a15Findings(context: Parsed): any[];

package/runtime/scripts/hfs/rules/a15-findings.mjs

@@ -33,72 +33,76 @@ import { stacksIngressFindings } from './stacks-ingress.mjs';
 import { stacksLiteBackingFindings } from './stacks-lite-backing.mjs';
 import { stackToolingFindings } from './stack-tooling.mjs';
 import { stacksDeployFindings } from './stacks-deploy.mjs';
+import { stacksAuthCookieDomainFindings } from './stacks-auth-cookie-domain.mjs';
 import { ciCustodyFindings } from './ci-custody.mjs';
 import { workflowContextsFindings } from './workflow-contexts.mjs';
 import { ciStandardAppFindings } from './ci-standard.mjs';
 import { feBuildArgsFindings } from './fe-build-args.mjs';
 // finders-import-end
-
 /** The failure codes the finders above emit, so `starci app check` ships their labels (check.mjs adds them to CHECK_CODES). Append-only; the coordinator regenerates it at merge time. */
 export const A15_CODES = [
-  // codes-begin
-  'FE_STACK_FAMILY_LINT_MISSING',
-  'HFS_TEXT_CORRUPT',
-  'FE_PUBLIC_BUILD_ARG_MISSING',
-  'HFS_WORKFLOW_CONTEXT',
-  'CI_STANDARD',
-  'CI_SECRET_SEALED', 'APP_SECRET_IN_CI', 'CI_DECLARATION_DRIFT',
-  'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BOOT_PROOF_TIMEOUT', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_REDIS_PERSISTENCE', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
-  // codes-end
+    // codes-begin
+    'FE_STACK_FAMILY_LINT_MISSING',
+    'HFS_TEXT_CORRUPT',
+    'FE_PUBLIC_BUILD_ARG_MISSING',
+    'HFS_WORKFLOW_CONTEXT',
+    'CI_STANDARD',
+    'CI_SECRET_SEALED', 'APP_SECRET_IN_CI', 'CI_DECLARATION_DRIFT',
+    'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BOOT_PROOF_TIMEOUT', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_AUTH_COOKIE_DOMAIN_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_REDIS_PERSISTENCE', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
+    // codes-end
 ];
-
 export const FINDERS = [
-  // finders-begin
-  feBuildArgsFindings,
-  workflowContextsFindings,
-  ciStandardAppFindings,
-  featureFileFindings,
-  lexiconFindings,
-  textIntegrityFindings,
-  assetsFindings,
-  unusedSymbolFindings,
-  databaseBaselineFindings,
-  databaseQueuesFindings,
-  databaseConfigFindings,
-  docFreshFindings,
-  releaseProvenanceFindings,
-  feStackAllowlistFindings,
-  appEnvRequiredFindings,
-  ageKeyCustodyFindings,
-  canonCopyDriftFindings,
-  secretCustodyOnlyFindings,
-  bootProofFindings,
-  coverageBelowFindings,
-  deployScanFindings,
-  deployWorkflowFindings,
-  scriptHygieneFindings,
-  supplyChainFindings,
-  envParityFindings,
-  envValueShapeFindings,
-  liteProofLaneFindings,
-  stacksSwarmFindings,
-  stacksReleaseFindings,
-  stacksIngressFindings,
-  stacksLiteBackingFindings,
-  stackToolingFindings,
-  stacksDeployFindings,
-  ciCustodyFindings,
-  // finders-end
+    // finders-begin
+    feBuildArgsFindings,
+    workflowContextsFindings,
+    ciStandardAppFindings,
+    featureFileFindings,
+    lexiconFindings,
+    textIntegrityFindings,
+    assetsFindings,
+    unusedSymbolFindings,
+    databaseBaselineFindings,
+    databaseQueuesFindings,
+    databaseConfigFindings,
+    docFreshFindings,
+    releaseProvenanceFindings,
+    feStackAllowlistFindings,
+    appEnvRequiredFindings,
+    ageKeyCustodyFindings,
+    canonCopyDriftFindings,
+    secretCustodyOnlyFindings,
+    bootProofFindings,
+    coverageBelowFindings,
+    deployScanFindings,
+    deployWorkflowFindings,
+    scriptHygieneFindings,
+    supplyChainFindings,
+    envParityFindings,
+    envValueShapeFindings,
+    liteProofLaneFindings,
+    stacksSwarmFindings,
+    stacksReleaseFindings,
+    stacksIngressFindings,
+    stacksLiteBackingFindings,
+    stackToolingFindings,
+    stacksDeployFindings,
+    stacksAuthCookieDomainFindings,
+    ciCustodyFindings,
+    // finders-end
 ];
-
 /** Findings of every alpha.15 content rule over one repository. */
 export function a15Findings(context) {
-  // `starci app check` always passes the full context; a partial one (a finder spec driving the registry with only the fields its rule reads) must not crash the finders of other rules.
-  const full = Boolean(context.repoRoot && context.repo && context.resolver && context.manifest);
-  return FINDERS.flatMap((finder) => {
-    if (full) return finder(context);
-    try { return finder(context); } catch { return []; }
-  });
+    // `starci app check` always passes the full context; a partial one (a finder spec driving the registry with only the fields its rule reads) must not crash the finders of other rules.
+    const full = Boolean(context.repoRoot && context.repo && context.resolver && context.manifest);
+    return FINDERS.flatMap((finder) => {
+        if (full)
+            return finder(context);
+        try {
+            return finder(context);
+        }
+        catch {
+            return [];
+        }
+    });
 }
-
 // A02: include every deployment and supply-chain finding in the bundled app-check catalog.

package/runtime/scripts/hfs/rules/app-env-required.d.mts

@@ -0,0 +1,9 @@
+import type { Repo } from './rule-types.mjs';
+/** Missing files cannot be visited by ESLint, so the content check owns their presence. */
+export declare function appEnvRequiredFindings({ repoRoot, files, all, repo, inScope }: {
+    repoRoot: string;
+    files: string[];
+    all?: string[];
+    repo: Repo;
+    inScope?: (file: string) => boolean;
+}): import("./rule-types.mjs").Finding[];

package/runtime/scripts/hfs/rules/app-env-required.mjs

@@ -1,20 +1,20 @@
 // R289: every declared back-end app owns a tracked typed environment boundary.
 // ESLint's app-env-required rule checks its interface, reader and bootstrap delegation.
 import { found, readText } from './read.mjs';
-
 const REQUIRED_CODE = 'BE_APP_ENV_REQUIRED';
-
 /** Missing files cannot be visited by ESLint, so the content check owns their presence. */
 export function appEnvRequiredFindings({ repoRoot, files, all = files, repo, inScope = () => true }) {
-  if (repo.profile !== 'be' || !['lite', 'full'].includes(repo.edition ?? 'full')) return [];
-  const tracked = new Set(all);
-  const findings = [];
-  for (const app of repo.apps ?? []) {
-    const file = `apps/${app.name}/src/${app.name}.env.ts`;
-    if (!inScope(file)) continue;
-    if (tracked.has(file) && readText(repoRoot, file) !== null) continue;
-    findings.push(found(REQUIRED_CODE, file,
-      `${app.name} requires a tracked ${file} exporting its environment interface and read<App>Env(env: EnvSource); main.ts builds EnvSource once and delegates environment reads to that boundary`));
-  }
-  return findings;
+    if (repo.profile !== 'be' || !['lite', 'full'].includes(repo.edition ?? 'full'))
+        return [];
+    const tracked = new Set(all);
+    const findings = [];
+    for (const app of repo.apps ?? []) {
+        const file = `apps/${app.name}/src/${app.name}.env.ts`;
+        if (!inScope(file))
+            continue;
+        if (tracked.has(file) && readText(repoRoot, file) !== null)
+            continue;
+        findings.push(found(REQUIRED_CODE, file, `${app.name} requires a tracked ${file} exporting its environment interface and read<App>Env(env: EnvSource); main.ts builds EnvSource once and delegates environment reads to that boundary`));
+    }
+    return findings;
 }

package/runtime/scripts/hfs/rules/app-root.d.mts

@@ -0,0 +1,15 @@
+import type { Parsed, Repo } from './rule-types.mjs';
+import type { Resolver } from '../slots.mjs';
+/**
+ * The findings of the app-root rules: `files` are the root's own tracked paths, `all` every tracked path of the app, `repo` the
+ * resolved app declaration, `resolver` its slot resolver and `pins` the canon pins.
+ */
+export declare function appRootFindings({ repoRoot, files, all, repo, resolver, pins, phase }: {
+    repoRoot: string;
+    files: string[];
+    all: string[];
+    repo: Repo;
+    resolver: Resolver;
+    pins: Parsed;
+    phase: Parsed;
+}): any[];

package/runtime/scripts/hfs/rules/app-root.mjs

@@ -22,30 +22,29 @@ import { sagaFindings } from './saga.mjs';
 import { serviceFindings } from './services.mjs';
 import { stacksFindings } from './stacks.mjs';
 import { testTopologyFindings } from './test-topology.mjs';
-
 /**
  * The findings of the app-root rules: `files` are the root's own tracked paths, `all` every tracked path of the app, `repo` the
  * resolved app declaration, `resolver` its slot resolver and `pins` the canon pins.
  */
 export function appRootFindings({ repoRoot, files, all, repo, resolver, pins, phase }) {
-  return [
-    ...depFindings({ repoRoot, files: all }),
-    ...peerIntegrationFindings({ repoRoot, files: all }),
-    ...monorepoFindings({ repoRoot, files: all, repo }),
-    ...dockerFindings({ repoRoot, files: all, repo }),
-    ...cliFindings({ files: all, repo, resolver }),
-    ...contractCompatFindings({ repoRoot, files: all }),
-    ...eventClassContractFindings({ repoRoot, files: all, repo }),
-    ...patternSpecFindings({ repoRoot, files: all, repo }),
-    ...serviceFindings({ repoRoot, files: all, repo }),
-    ...sagaFindings({ repoRoot, files: all }),
-    ...kindFindings({ files: all, repo }),
-    ...integrationSpecFindings({ repoRoot, files: all }),
-    ...feContractFindings({ repoRoot, files: all }),
-    ...pipelineFindings({ repoRoot, files, pins }),
-    ...testTopologyFindings({ repoRoot, files }),
-    ...proofCommandFindings({ repoRoot, files: all, resolver, sides: Object.keys(repo.sides ?? {}) }),
-    ...appFrontendFindings({ repoRoot, files: all, repo, phase }),
-    ...stacksFindings({ repoRoot, files, resolver }),
-  ];
+    return [
+        ...depFindings({ repoRoot, files: all }),
+        ...peerIntegrationFindings({ repoRoot, files: all }),
+        ...monorepoFindings({ repoRoot, files: all, repo }),
+        ...dockerFindings({ repoRoot, files: all, repo }),
+        ...cliFindings({ files: all, repo, resolver }),
+        ...contractCompatFindings({ repoRoot, files: all }),
+        ...eventClassContractFindings({ repoRoot, files: all, repo }),
+        ...patternSpecFindings({ repoRoot, files: all, repo }),
+        ...serviceFindings({ repoRoot, files: all, repo }),
+        ...sagaFindings({ repoRoot, files: all }),
+        ...kindFindings({ files: all, repo }),
+        ...integrationSpecFindings({ repoRoot, files: all }),
+        ...feContractFindings({ repoRoot, files: all }),
+        ...pipelineFindings({ repoRoot, files, pins }),
+        ...testTopologyFindings({ repoRoot, files }),
+        ...proofCommandFindings({ repoRoot, files: all, resolver, sides: Object.keys(repo.sides ?? {}) }),
+        ...appFrontendFindings({ repoRoot, files: all, repo, phase }),
+        ...stacksFindings({ repoRoot, files, resolver }),
+    ];
 }

package/runtime/scripts/hfs/rules/app-workflow-findings.d.mts

@@ -0,0 +1,12 @@
+import type { Parsed, Repo } from './rule-types.mjs';
+/** Judge tracked workflows only at full/lite app roots, preserving each caller's duplicate-file policy. */
+export declare function appWorkflowFindings({ repoRoot, files, all, repo, isRoot, inScope }: {
+    repoRoot: string;
+    files: string[];
+    all?: string[];
+    repo: Repo;
+    isRoot: boolean;
+    inScope?: (file: string) => boolean;
+}, perWorkflow: Parsed, { dedupe }?: {
+    dedupe?: boolean | undefined;
+}): any[];

package/runtime/scripts/hfs/rules/app-workflow-findings.mjs

@@ -1,10 +1,10 @@
 // app-workflow-findings.mjs - app-root workflow scope shared by deployment and expression-context rules.
 import { workflowFindings } from '../runtime-rules/workflow-source.mjs';
 import { readText } from './read.mjs';
-
 /** Judge tracked workflows only at full/lite app roots, preserving each caller's duplicate-file policy. */
 export function appWorkflowFindings({ repoRoot, files, all = files, repo, isRoot, inScope = () => true }, perWorkflow, { dedupe = false } = {}) {
-  if (isRoot === false || repo?.kind !== 'app' || !['lite', 'full'].includes(repo.edition)) return [];
-  const selected = dedupe ? [...new Set(all)] : all;
-  return workflowFindings({ files: selected.filter((file) => inScope(file)), read: (file) => readText(repoRoot, file) }, perWorkflow);
+    if (isRoot === false || repo?.kind !== 'app' || !['lite', 'full'].some((edition) => edition === repo.edition))
+        return [];
+    const selected = dedupe ? [...new Set(all)] : all;
+    return workflowFindings({ files: selected.filter((file) => inScope(file)), read: (file) => readText(repoRoot, file) }, perWorkflow);
 }

package/runtime/scripts/hfs/rules/assets.d.mts

@@ -0,0 +1,13 @@
+import type { Parsed, Repo } from './rule-types.mjs';
+export declare const HFS_ASSET_OVERSIZE = "HFS_ASSET_OVERSIZE";
+export declare const HFS_ASSET_KIND = "HFS_ASSET_KIND";
+export declare const DEFAULT_ASSET_BYTES = 512000;
+/** Side-relative tracked paths only: the app root and FE are left to their own rules, avoiding duplicate root/side findings. */
+export declare function assetsFindings({ repoRoot, files, repo, manifest, isRoot, inScope }: {
+    repoRoot: string;
+    files?: string[];
+    repo: Repo;
+    manifest?: Parsed;
+    isRoot?: boolean;
+    inScope?: (file: string) => boolean;
+}): import("./rule-types.mjs").Finding[];