@starci/hfs 4.11.22 → 4.12.0

package/runtime/scripts/hfs/rules/database-baseline.mjs

@@ -7,136 +7,136 @@ import { sameText } from '../../lib/same-text.mjs';
 import { found, readText } from './read.mjs';
 import { migrationStamp } from './database-migrations.mjs';
 import { DB_BASELINE_SHAPE, DB_ARCHIVE_MUTATED, MIGRATIONS_DIR, MIGRATIONS_ARCHIVE_DIR } from './database-constants.mjs';
-
 const ACTIVE = /^db\/migrations\/\d{14}_[^/]+\.sql$/;
 const ARCHIVED = /^db\/migrations\/archive\/\d{14}_[^/]+\.sql$/;
 const stampOf = (file) => /(?:^|\/)(\d{14})_/.exec(file)?.[1] ?? null;
-
 /** Header comments only: SQL literals and later comments cannot impersonate a baseline marker. */
 export function baselineMarkers(text) {
-  const lines = String(text ?? '').replace(/^\uFEFF/, '').split(/\r?\n/);
-  const header = [];
-  for (const line of lines) {
-    if (line.trim() && !/^\s*--/.test(line)) break;
-    header.push(line);
-  }
-  return header.flatMap((line) => {
-    const marker = /^\s*--\s*starci:baseline\s+(\d{14})\s*$/.exec(line);
-    return marker ? [marker[1]] : [];
-  });
+    const lines = String(text ?? '').replace(/^\uFEFF/, '').split(/\r?\n/);
+    const header = [];
+    for (const line of lines) {
+        if (line.trim() && !/^\s*--/.test(line))
+            break;
+        header.push(line);
+    }
+    return header.flatMap((line) => {
+        const marker = /^\s*--\s*starci:baseline\s+(\d{14})\s*$/.exec(line);
+        return marker ? [marker[1]] : [];
+    });
 }
-
 function explicitRestamp(text, archiveBoundary, newStamp) {
-  const header = String(text ?? '').split(/\r?\n/).findIndex((line) => line.trim() && !/^\s*--/.test(line));
-  const lines = String(text ?? '').split(/\r?\n/).slice(0, header < 0 ? undefined : header);
-  return lines.some((line) => {
-    const marker = /^\s*--\s*starci:restamp\s+(\d{14})\s+(\d{14})\s*$/.exec(line);
-    return marker && migrationStamp(marker[1]) !== null && marker[1] >= archiveBoundary && marker[2] === newStamp;
-  });
+    const header = String(text ?? '').split(/\r?\n/).findIndex((line) => line.trim() && !/^\s*--/.test(line));
+    const lines = String(text ?? '').split(/\r?\n/).slice(0, header < 0 ? undefined : header);
+    return lines.some((line) => {
+        const marker = /^\s*--\s*starci:restamp\s+(\d{14})\s+(\d{14})\s*$/.exec(line);
+        return marker && migrationStamp(marker[1]) !== null && marker[1] >= archiveBoundary && marker[2] === newStamp;
+    });
 }
-
 /** Synchronous git seam: (args, {cwd}) -> {ok, stdout}; no diff or blob containing SQL is printed. */
 function baselineGit(args, { cwd }) {
-  const [verb, ...rest] = args;
-  if (verb === 'merge-base') {
-    const sha = mergeBase(cwd, rest[0], rest[1]);
-    return { ok: sha !== null, stdout: sha ?? '' };
-  }
-  const result = (verb === 'ls-tree' ? lsTree : show)(rest, { cwd, env: withoutGitLocalEnv(process.env), maxBuffer: 64 * 1024 * 1024 });
-  return { ok: !result.error && result.status === 0, stdout: String(result.stdout ?? '') };
+    const [verb, ...rest] = args;
+    if (verb === 'merge-base') {
+        const sha = mergeBase(cwd, rest[0], rest[1]);
+        return { ok: sha !== null, stdout: sha ?? '' };
+    }
+    const result = (verb === 'ls-tree' ? lsTree : show)(rest, { cwd, env: withoutGitLocalEnv(process.env), maxBuffer: 64 * 1024 * 1024 });
+    return { ok: !result.error && result.status === 0, stdout: String(result.stdout ?? '') };
 }
-
 function snapshot(repoRoot, git, base) {
-  let revision = null;
-  for (const ref of base ? [base] : ['origin/main', 'main']) {
-    const result = git(['merge-base', 'HEAD', ref], { cwd: repoRoot });
-    if (result?.ok && result.stdout.trim()) { revision = result.stdout.trim(); break; }
-  }
-  // An unconfigured repository still has a committed archive that must remain immutable.
-  revision ??= 'HEAD';
-  const result = git(['ls-tree', '-r', '--name-only', '-z', revision, '--', MIGRATIONS_DIR], { cwd: repoRoot });
-  return result?.ok ? { revision, files: result.stdout.split('\0').filter(Boolean) } : null;
+    let revision = null;
+    for (const ref of base ? [base] : ['origin/main', 'main']) {
+        const result = git(['merge-base', 'HEAD', ref], { cwd: repoRoot });
+        if (result?.ok && result.stdout.trim()) {
+            revision = result.stdout.trim();
+            break;
+        }
+    }
+    // An unconfigured repository still has a committed archive that must remain immutable.
+    revision ??= 'HEAD';
+    const result = git(['ls-tree', '-r', '--name-only', '-z', revision, '--', MIGRATIONS_DIR], { cwd: repoRoot });
+    return result?.ok ? { revision, files: result.stdout.split('\0').filter(Boolean) } : null;
 }
-
 const oldText = (repoRoot, git, revision, file) => {
-  const result = git(['show', `${revision}:./${file}`], { cwd: repoRoot });
-  return result?.ok ? String(result.stdout) : null;
+    const result = git(['show', `${revision}:./${file}`], { cwd: repoRoot });
+    return result?.ok ? String(result.stdout) : null;
 };
-
 function shapeFindings(repoRoot, active, archived) {
-  const marked = active.flatMap((file) => baselineMarkers(readText(repoRoot, file)).map((stamp) => ({ file, stamp })));
-  if (!archived.length) return { findings: [], marked };
-  const findings = [];
-  if (marked.length !== 1) {
-    findings.push(found(DB_BASELINE_SHAPE, MIGRATIONS_DIR, 'a nonempty archive requires exactly one active -- starci:baseline <archived-last-stamp> header marker'));
+    const marked = active.flatMap((file) => baselineMarkers(readText(repoRoot, file)).map((stamp) => ({ file, stamp })));
+    if (!archived.length)
+        return { findings: [], marked };
+    const findings = [];
+    if (marked.length !== 1) {
+        findings.push(found(DB_BASELINE_SHAPE, MIGRATIONS_DIR, 'a nonempty archive requires exactly one active -- starci:baseline <archived-last-stamp> header marker'));
+        return { findings, marked };
+    }
+    const latest = archived.map(stampOf).filter((stamp) => stamp && migrationStamp(stamp) !== null).sort((left, right) => left.localeCompare(right)).at(-1);
+    const marker = marked[0];
+    const current = stampOf(marker.file);
+    if (!latest || marker.stamp !== latest || migrationStamp(marker.stamp) === null) {
+        findings.push(found(DB_BASELINE_SHAPE, marker.file, 'the baseline header must identify the last valid archived migration stamp'));
+    }
+    if (!current || migrationStamp(current) === null || (latest && current <= latest && !explicitRestamp(readText(repoRoot, marker.file), latest, current))) {
+        findings.push(found(DB_BASELINE_SHAPE, marker.file, 'the baseline stamp must follow the archive boundary, or document the exact boundary and replacement in a -- starci:restamp <old> <new> header'));
+    }
+    for (const file of archived) {
+        // Archived files are immutable history and never applied: only the name shape is checked, not stamp validity.
+        if (!ARCHIVED.test(file))
+            findings.push(found(DB_BASELINE_SHAPE, file, 'archived migrations retain their original timestamped SQL filename'));
+    }
     return { findings, marked };
-  }
-  const latest = archived.map(stampOf).filter((stamp) => stamp && migrationStamp(stamp) !== null).sort((left, right) => left.localeCompare(right)).at(-1);
-  const marker = marked[0];
-  const current = stampOf(marker.file);
-  if (!latest || marker.stamp !== latest || migrationStamp(marker.stamp) === null) {
-    findings.push(found(DB_BASELINE_SHAPE, marker.file, 'the baseline header must identify the last valid archived migration stamp'));
-  }
-  if (!current || migrationStamp(current) === null || (latest && current <= latest && !explicitRestamp(readText(repoRoot, marker.file), latest, current))) {
-    findings.push(found(DB_BASELINE_SHAPE, marker.file, 'the baseline stamp must follow the archive boundary, or document the exact boundary and replacement in a -- starci:restamp <old> <new> header'));
-  }
-  for (const file of archived) {
-    // Archived files are immutable history and never applied: only the name shape is checked, not stamp validity.
-    if (!ARCHIVED.test(file)) findings.push(found(DB_BASELINE_SHAPE, file, 'archived migrations retain their original timestamped SQL filename'));
-  }
-  return { findings, marked };
 }
-
 function archiveFindings(repoRoot, current, archived, marked, prior, git) {
-  if (!prior) return [];
-  const findings = [];
-  const oldFiles = new Set(prior.files);
-  const newBaseline = marked.length === 1 && !oldFiles.has(marked[0].file);
-  for (const file of prior.files.filter((entry) => entry.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`))) {
-    if (!current.has(file) || !sameText(readText(repoRoot, file), oldText(repoRoot, git, prior.revision, file))) {
-      findings.push(found(DB_ARCHIVE_MUTATED, file, 'an archived migration is immutable: restore its committed path and content'));
+    if (!prior)
+        return [];
+    const findings = [];
+    const oldFiles = new Set(prior.files);
+    const newBaseline = marked.length === 1 && !oldFiles.has(marked[0].file);
+    for (const file of prior.files.filter((entry) => entry.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`))) {
+        if (!current.has(file) || !sameText(readText(repoRoot, file), oldText(repoRoot, git, prior.revision, file))) {
+            findings.push(found(DB_ARCHIVE_MUTATED, file, 'an archived migration is immutable: restore its committed path and content'));
+        }
     }
-  }
-  for (const file of archived.filter((entry) => !oldFiles.has(entry))) {
-    const source = `${MIGRATIONS_DIR}/${file.slice(MIGRATIONS_ARCHIVE_DIR.length + 1)}`;
-    const moved = oldFiles.has(source) && !current.has(source);
-    const unchanged = moved && sameText(readText(repoRoot, file), oldText(repoRoot, git, prior.revision, source));
-    if (!newBaseline || !unchanged) {
-      findings.push(found(DB_ARCHIVE_MUTATED, file, 'a new archive entry must move an existing active migration unchanged in the same diff that adds the marked baseline'));
+    for (const file of archived.filter((entry) => !oldFiles.has(entry))) {
+        const source = `${MIGRATIONS_DIR}/${file.slice(MIGRATIONS_ARCHIVE_DIR.length + 1)}`;
+        const moved = oldFiles.has(source) && !current.has(source);
+        const unchanged = moved && sameText(readText(repoRoot, file), oldText(repoRoot, git, prior.revision, source));
+        if (!newBaseline || !unchanged) {
+            findings.push(found(DB_ARCHIVE_MUTATED, file, 'a new archive entry must move an existing active migration unchanged in the same diff that adds the marked baseline'));
+        }
     }
-  }
-  return findings;
+    return findings;
 }
-
 /** A cutover may archive only unchanged, committed source files from the same history the finder judges. */
 export function baselineSourceFindings({ repoRoot, files = [], all = files, git = baselineGit, base }) {
-  const active = all.filter((file) => ACTIVE.test(file));
-  const archived = all.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`));
-  const prior = snapshot(repoRoot, git, base);
-  if (!prior) return [found(DB_BASELINE_SHAPE, MIGRATIONS_DIR, 'a baseline cutover requires readable committed migration history')];
-  const { findings, marked } = shapeFindings(repoRoot, active, archived);
-  const current = new Set(all);
-  findings.push(...archiveFindings(repoRoot, current, archived, marked, prior, git));
-  const oldFiles = new Set(prior.files);
-  for (const file of active) {
-    if (!oldFiles.has(file) || !sameText(readText(repoRoot, file), oldText(repoRoot, git, prior.revision, file))) {
-      findings.push(found(DB_ARCHIVE_MUTATED, file, 'baseline sources must be committed unchanged before they enter the archive'));
+    const active = all.filter((file) => ACTIVE.test(file));
+    const archived = all.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`));
+    const prior = snapshot(repoRoot, git, base);
+    if (!prior)
+        return [found(DB_BASELINE_SHAPE, MIGRATIONS_DIR, 'a baseline cutover requires readable committed migration history')];
+    const { findings, marked } = shapeFindings(repoRoot, active, archived);
+    const current = new Set(all);
+    findings.push(...archiveFindings(repoRoot, current, archived, marked, prior, git));
+    const oldFiles = new Set(prior.files);
+    for (const file of active) {
+        if (!oldFiles.has(file) || !sameText(readText(repoRoot, file), oldText(repoRoot, git, prior.revision, file))) {
+            findings.push(found(DB_ARCHIVE_MUTATED, file, 'baseline sources must be committed unchanged before they enter the archive'));
+        }
+    }
+    for (const file of prior.files.filter((entry) => ACTIVE.test(entry))) {
+        const retired = `${MIGRATIONS_ARCHIVE_DIR}/${file.slice(MIGRATIONS_DIR.length + 1)}`;
+        if (!current.has(file) && !current.has(retired))
+            findings.push(found(DB_ARCHIVE_MUTATED, file, 'restore removed migration history before creating a baseline'));
     }
-  }
-  for (const file of prior.files.filter((entry) => ACTIVE.test(entry))) {
-    const retired = `${MIGRATIONS_ARCHIVE_DIR}/${file.slice(MIGRATIONS_DIR.length + 1)}`;
-    if (!current.has(file) && !current.has(retired)) findings.push(found(DB_ARCHIVE_MUTATED, file, 'restore removed migration history before creating a baseline'));
-  }
-  return findings;
+    return findings;
 }
-
 /** R257 content finder, synchronous in both editions; all paths judge cross-file cutovers even under --fast. */
 export function databaseBaselineFindings({ repoRoot, files = [], all, repo, isRoot, inScope, base, git = baselineGit }) {
-  if (isRoot === false || (repo?.edition && !['lite', 'full'].includes(repo.edition))) return [];
-  const inventory = Array.isArray(all) ? all : files;
-  const active = inventory.filter((file) => ACTIVE.test(file));
-  const archived = inventory.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`));
-  const { findings, marked } = shapeFindings(repoRoot, active, archived);
-  findings.push(...archiveFindings(repoRoot, new Set(inventory), archived, marked, snapshot(repoRoot, git, base), git));
-  return typeof inScope === 'function' ? findings.filter((finding) => inScope(finding.path) || finding.path === MIGRATIONS_DIR || inventory.some((file) => file.startsWith(`${MIGRATIONS_DIR}/`) && inScope(file))) : findings;
+    if (isRoot === false || (repo?.edition && !['lite', 'full'].some((value) => value === repo.edition)))
+        return [];
+    const inventory = Array.isArray(all) ? all : files;
+    const active = inventory.filter((file) => ACTIVE.test(file));
+    const archived = inventory.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`));
+    const { findings, marked } = shapeFindings(repoRoot, active, archived);
+    findings.push(...archiveFindings(repoRoot, new Set(inventory), archived, marked, snapshot(repoRoot, git, base), git));
+    return typeof inScope === 'function' ? findings.filter((finding) => inScope(finding.path) || finding.path === MIGRATIONS_DIR || inventory.some((file) => file.startsWith(`${MIGRATIONS_DIR}/`) && inScope(file))) : findings;
 }

package/runtime/scripts/hfs/rules/database-config.d.mts

@@ -0,0 +1,11 @@
+import type { Parsed, Repo } from './rule-types.mjs';
+/** R259 config/content checks, synchronously judged at the app root for both editions. */
+export declare function databaseConfigFindings({ repoRoot, files, all, repo, manifest, isRoot, inScope }: {
+    repoRoot: string;
+    files?: string[];
+    all?: string[];
+    repo?: Repo;
+    manifest?: Parsed;
+    isRoot: boolean;
+    inScope?: (file: string) => boolean;
+}): any[];

package/runtime/scripts/hfs/rules/database-config.mjs

@@ -1,167 +1,133 @@
 // database-config.mjs - the database content checks of db/ (R259: extensions, custody SQL, destructive migrations, seed data). It starts no
 // database and no Docker process.
 import { found, readText } from './read.mjs';
-import {
-  DB_EXTENSION_ALLOWED, DB_VAULT_WRITE, HFS_SEED_PII, isActiveMigration, SEED_FILE,
-} from './database-constants.mjs';
+import { DB_EXTENSION_ALLOWED, DB_VAULT_WRITE, HFS_SEED_PII, isActiveMigration, SEED_FILE, } from './database-constants.mjs';
 import { databaseExecutableTokens, databaseSqlStatements, databaseSqlTokens, destructiveMigrationFindings } from './database-migrations.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
-
 const DEFAULT_EXTENSIONS = ['pgcrypto', 'pg_trgm', 'vector', 'uuid-ossp', 'unaccent', 'btree_gist', 'pgmq'];
 const word = (token, value) => token?.t === 'word' && token.v === value;
 const identifier = (token) => token && ['word', 'ident'].includes(token.t) ? token.v : null;
-
 function dbParameters(manifest) {
-  const declared = manifest?.ruleParams?.db ?? {};
-  return {
-    extensions: Array.isArray(declared.extensions) ? declared.extensions : DEFAULT_EXTENSIONS,
-  };
+    const declared = manifest?.ruleParams?.db ?? {};
+    return {
+        extensions: Array.isArray(declared.extensions) ? declared.extensions : DEFAULT_EXTENSIONS,
+    };
 }
-
 function qualifiedName(tokens, index) {
-  const name = identifier(tokens[index]);
-  if (name === null) return null;
-  return tokens[index + 1]?.v === '.' && identifier(tokens[index + 2]) !== null
-    ? { schema: name, name: identifier(tokens[index + 2]), next: index + 3 }
-    : { schema: 'public', name, next: index + 1 };
+    const name = identifier(tokens[index]);
+    if (name === null)
+        return null;
+    return tokens[index + 1]?.v === '.' && identifier(tokens[index + 2]) !== null
+        ? { schema: name, name: identifier(tokens[index + 2]), next: index + 3 }
+        : { schema: 'public', name, next: index + 1 };
 }
-
 function extensionFindings(file, tokens, allowed) {
-  const findings = [];
-  for (let index = 0; index < tokens.length; index += 1) {
-    if (!word(tokens[index], 'create') || !word(tokens[index + 1], 'extension')) continue;
-    let at = index + 2;
-    if (word(tokens[at], 'if') && word(tokens[at + 1], 'not') && word(tokens[at + 2], 'exists')) at += 3;
-    const name = identifier(tokens[at]);
-    if (name !== null && !allowed.has(name)) findings.push(found(DB_EXTENSION_ALLOWED, file,
-      `${file}:${tokens[index].line} enables extension ${name}, which ruleParams.db.extensions does not allow`, { line: tokens[index].line, extension: name }));
-  }
-  return findings;
+    const findings = [];
+    for (let index = 0; index < tokens.length; index += 1) {
+        if (!word(tokens[index], 'create') || !word(tokens[index + 1], 'extension'))
+            continue;
+        let at = index + 2;
+        if (word(tokens[at], 'if') && word(tokens[at + 1], 'not') && word(tokens[at + 2], 'exists'))
+            at += 3;
+        const name = identifier(tokens[at]);
+        if (name !== null && !allowed.has(name))
+            findings.push(found(DB_EXTENSION_ALLOWED, file, `${file}:${tokens[index].line} enables extension ${name}, which ruleParams.db.extensions does not allow`, { line: tokens[index].line, extension: name }));
+    }
+    return findings;
 }
-
 function vaultWriteAt(tokens, index) {
-  const token = tokens[index];
-  if (identifier(token) === 'vault' && tokens[index + 1]?.v === '.' && tokens[index + 3]?.v === '(') {
-    return ['create_secret', 'update_secret', 'delete_secret'].includes(identifier(tokens[index + 2]));
-  }
-  let at = null;
-  if (word(token, 'insert') || word(token, 'merge')) at = word(tokens[index + 1], 'into') ? index + 2 : null;
-  if (word(token, 'delete')) at = word(tokens[index + 1], 'from') ? index + 2 : null;
-  if (word(token, 'update')) at = index + 1;
-  if (word(token, 'truncate')) return truncatedVault(tokens, index);
-  if (at === null) return false;
-  if (word(tokens[at], 'only')) at += 1;
-  return qualifiedName(tokens, at)?.schema === 'vault';
+    const token = tokens[index];
+    if (identifier(token) === 'vault' && tokens[index + 1]?.v === '.' && tokens[index + 3]?.v === '(') {
+        return ['create_secret', 'update_secret', 'delete_secret'].includes(identifier(tokens[index + 2]));
+    }
+    let at = null;
+    if (word(token, 'insert') || word(token, 'merge'))
+        at = word(tokens[index + 1], 'into') ? index + 2 : null;
+    if (word(token, 'delete'))
+        at = word(tokens[index + 1], 'from') ? index + 2 : null;
+    if (word(token, 'update'))
+        at = index + 1;
+    if (word(token, 'truncate'))
+        return truncatedVault(tokens, index);
+    if (at === null)
+        return false;
+    if (word(tokens[at], 'only'))
+        at += 1;
+    return qualifiedName(tokens, at)?.schema === 'vault';
 }
-
 function truncatedVault(tokens, index) {
-  let at = word(tokens[index + 1], 'table') ? index + 2 : index + 1;
-  while (at < tokens.length) {
-    if (word(tokens[at], 'only')) at += 1;
-    const name = qualifiedName(tokens, at);
-    if (!name) return false;
-    if (name.schema === 'vault') return true;
-    if (tokens[name.next]?.v !== ',') return false;
-    at = name.next + 1;
-  }
-  return false;
+    let at = word(tokens[index + 1], 'table') ? index + 2 : index + 1;
+    while (at < tokens.length) {
+        if (word(tokens[at], 'only'))
+            at += 1;
+        const name = qualifiedName(tokens, at);
+        if (!name)
+            return false;
+        if (name.schema === 'vault')
+            return true;
+        if (tokens[name.next]?.v !== ',')
+            return false;
+        at = name.next + 1;
+    }
+    return false;
 }
-
 function passwordStatement(statement) {
-  const starts = statement.findIndex((token, index) => (word(token, 'create') || word(token, 'alter'))
-    && (word(statement[index + 1], 'role') || word(statement[index + 1], 'user')));
-  return starts !== -1 && statement.slice(starts + 2).some((token) => word(token, 'password')) ? statement[starts] : null;
+    const starts = statement.findIndex((token, index) => (word(token, 'create') || word(token, 'alter'))
+        && (word(statement[index + 1], 'role') || word(statement[index + 1], 'user')));
+    return starts !== -1 && statement.slice(starts + 2).some((token) => word(token, 'password')) ? statement[starts] : null;
 }
-
 function custodySqlFindings(file, tokens) {
-  const findings = [];
-  for (const statement of databaseSqlStatements(tokens)) {
-    const password = passwordStatement(statement);
-    if (password) findings.push(found(DB_VAULT_WRITE, file,
-      `${file}:${password.line} sets a role password in a migration; provision credentials through sealed secret custody`, { line: password.line, operation: 'role-password' }));
-    const vault = statement.find((token, index) => vaultWriteAt(statement, index));
-    if (vault) findings.push(found(DB_VAULT_WRITE, file,
-      `${file}:${vault.line} writes to vault; migration SQL never provisions secret values`, { line: vault.line, operation: 'vault-write' }));
-  }
-  return findings;
-}
-
-function policyTarget(statement, start) {
-  const on = statement.findIndex((token, index) => index > start && word(token, 'on'));
-  return on === -1 ? null : qualifiedName(statement, on + 1);
-}
-
-function policyRoles(statement) {
-  const to = statement.findIndex((token) => word(token, 'to'));
-  if (to === -1) return null;
-  const end = statement.findIndex((token, index) => index > to && (word(token, 'using') || word(token, 'with')));
-  return statement.slice(to + 1, end === -1 ? undefined : end).map(identifier).filter(Boolean);
-}
-
-function applyPublicReadPolicy(statement, policies) {
-  const at = statement.findIndex((token, index) => ['create', 'alter', 'drop'].some((verb) => word(token, verb)) && word(statement[index + 1], 'policy'));
-  if (at === -1) return;
-  const verb = statement[at].v;
-  let nameAt = at + 2;
-  if (word(statement[nameAt], 'if') && word(statement[nameAt + 1], 'exists')) nameAt += 2;
-  const name = identifier(statement[nameAt]);
-  const target = policyTarget(statement, nameAt);
-  if (!name || !target) return;
-  const key = `${target.schema}.${target.name}.${name}`;
-  if (verb === 'drop') { policies.delete(key); return; }
-  const rename = statement.findIndex((token) => word(token, 'rename'));
-  if (verb === 'alter' && word(statement[rename + 1], 'to')) {
-    const nextName = identifier(statement[rename + 2]);
-    if (nextName && policies.has(key)) {
-      policies.set(`${target.schema}.${target.name}.${nextName}`, { ...policies.get(key), name: nextName });
-      policies.delete(key);
+    const findings = [];
+    for (const statement of databaseSqlStatements(tokens)) {
+        const password = passwordStatement(statement);
+        if (password)
+            findings.push(found(DB_VAULT_WRITE, file, `${file}:${password.line} sets a role password in a migration; provision credentials through sealed secret custody`, { line: password.line, operation: 'role-password' }));
+        const vault = statement.find((_token, index) => vaultWriteAt(statement, index));
+        if (vault)
+            findings.push(found(DB_VAULT_WRITE, file, `${file}:${vault.line} writes to vault; migration SQL never provisions secret values`, { line: vault.line, operation: 'vault-write' }));
     }
-    return;
-  }
-  const roles = policyRoles(statement);
-  if (verb === 'alter') {
-    if (policies.has(key) && roles !== null) policies.set(key, { ...policies.get(key), roles });
-    return;
-  }
-  const forAt = statement.findIndex((token) => word(token, 'for'));
-  policies.set(key, { name, schema: target.schema, select: word(statement[forAt + 1], 'select'), roles: roles ?? ['public'] });
+    return findings;
 }
-
 const EMAIL_LITERAL = /^[A-Z0-9._%+-]+@([A-Z0-9-]+(?:\.[A-Z0-9-]+)+)$/i;
 function piiLiteral(value) {
-  if (value.split(/[^\w.%+@-]+/).some((part) => {
-    const email = EMAIL_LITERAL.exec(part);
-    return email && email[1].toLowerCase() !== 'example.test';
-  })) return true;
-  if (!/^\+?[\d\s().-]+$/.test(value)) return false;
-  const digits = value.replaceAll(/\D/g, '');
-  if (digits.length < 9 || digits.length > 15 || /^\d{4}-\d{2}-\d{2}(?:\s|$)/.test(value)) return false;
-  return value.startsWith('+') || /[()\s]/.test(value) || /^\d{10,15}$/.test(value);
+    if (value.split(/[^\w.%+@-]+/).some((part) => {
+        const email = EMAIL_LITERAL.exec(part);
+        return email && email[1].toLowerCase() !== 'example.test';
+    }))
+        return true;
+    if (!/^\+?[\d\s().-]+$/.test(value))
+        return false;
+    const digits = value.replaceAll(/\D/g, '');
+    if (digits.length < 9 || digits.length > 15 || /^\d{4}-\d{2}-\d{2}(?:\s|$)/.test(value))
+        return false;
+    return value.startsWith('+') || /[()\s]/.test(value) || /^\d{10,15}$/.test(value);
 }
-
 function seedPiiFindings(repoRoot, seeds) {
-  const findings = [];
-  for (const file of seeds) {
-    const text = readText(repoRoot, file);
-    if (text === null) continue;
-    for (const token of databaseSqlTokens(text)) {
-      if (!['string', 'body'].includes(token.t) || !piiLiteral(token.v)) continue;
-      findings.push(found(HFS_SEED_PII, file, `${file}:${token.line} contains an email or phone literal; seed data uses synthetic identities and the example.test domain`, { line: token.line }));
+    const findings = [];
+    for (const file of seeds) {
+        const text = readText(repoRoot, file);
+        if (text === null)
+            continue;
+        for (const token of databaseSqlTokens(text)) {
+            if (!['string', 'body'].includes(token.t) || !piiLiteral(token.v))
+                continue;
+            findings.push(found(HFS_SEED_PII, file, `${file}:${token.line} contains an email or phone literal; seed data uses synthetic identities and the example.test domain`, { line: token.line }));
+        }
     }
-  }
-  return findings;
+    return findings;
 }
-
 /** R259 config/content checks, synchronously judged at the app root for both editions. */
 export function databaseConfigFindings({ repoRoot, files = [], all = files, repo = {}, manifest, isRoot, inScope = () => true }) {
-  if (isRoot === false || ['be', 'fe'].includes(repo.profile)) return [];
-  const parameters = dbParameters(manifest);
-  const migrations = all.filter((file) => isActiveMigration(file) && file.endsWith('.sql')).sort(byCodeUnit);
-  const sources = migrations.map((file) => ({ file, tokens: databaseExecutableTokens(readText(repoRoot, file) ?? '') }));
-  const findings = [];
-  for (const { file, tokens } of sources) findings.push(...extensionFindings(file, tokens, new Set(parameters.extensions)), ...custodySqlFindings(file, tokens));
-  findings.push(...destructiveMigrationFindings({ repoRoot, migrations, files: all }));
-  const seeds = all.filter((file) => file === SEED_FILE || /^\.starcistacks\/[^/]+\/seeds\/.+\.sql$/.test(file));
-  findings.push(...seedPiiFindings(repoRoot, seeds));
-  return findings.filter((finding) => inScope(finding.path));
+    if (isRoot === false || ['be', 'fe'].some((value) => value === repo.profile))
+        return [];
+    const parameters = dbParameters(manifest);
+    const migrations = all.filter((file) => isActiveMigration(file) && file.endsWith('.sql')).sort(byCodeUnit);
+    const sources = migrations.map((file) => ({ file, tokens: databaseExecutableTokens(readText(repoRoot, file) ?? '') }));
+    const findings = [];
+    for (const { file, tokens } of sources)
+        findings.push(...extensionFindings(file, tokens, new Set(parameters.extensions)), ...custodySqlFindings(file, tokens));
+    findings.push(...destructiveMigrationFindings({ repoRoot, migrations, files: all }));
+    const seeds = all.filter((file) => file === SEED_FILE || /^\.starcistacks\/[^/]+\/seeds\/.+\.sql$/.test(file));
+    findings.push(...seedPiiFindings(repoRoot, seeds));
+    return findings.filter((finding) => inScope(finding.path));
 }

package/runtime/scripts/hfs/rules/database-constants.d.mts

@@ -0,0 +1,36 @@
+export declare const DB_MIGRATION_SHAPE = "DB_MIGRATION_SHAPE";
+export declare const DB_RLS_REQUIRED = "DB_RLS_REQUIRED";
+export declare const DB_DYNAMIC_DDL = "DB_DYNAMIC_DDL";
+export declare const DB_POLICY_SHAPE = "DB_POLICY_SHAPE";
+export declare const DB_DEFINER_SAFE = "DB_DEFINER_SAFE";
+export declare const DB_STORAGE_POLICY = "DB_STORAGE_POLICY";
+export declare const LITE_DB_MIGRATION = "LITE_DB_MIGRATION";
+export declare const DB_BASELINE_SHAPE = "DB_BASELINE_SHAPE";
+export declare const DB_ARCHIVE_MUTATED = "DB_ARCHIVE_MUTATED";
+export declare const DB_PGMQ_DECLARED = "DB_PGMQ_DECLARED";
+export declare const DB_EXTENSION_ALLOWED = "DB_EXTENSION_ALLOWED";
+export declare const DB_MIGRATION_DESTRUCTIVE = "DB_MIGRATION_DESTRUCTIVE";
+export declare const HFS_SEED_PII = "HFS_SEED_PII";
+export declare const DB_VAULT_WRITE = "DB_VAULT_WRITE";
+export declare const DB_DIR = "db";
+export declare const MIGRATIONS_DIR = "db/migrations";
+/** The migrations retired at a baseline cutover (slot app.db.migrations.archive): never applied, never judged by L02-L08. */
+export declare const MIGRATIONS_ARCHIVE_DIR = "db/migrations/archive";
+/** True for a migration `starci app db migrate` applies: a path under db/migrations/ outside the archive. */
+export declare const isActiveMigration: (file: string) => boolean;
+export declare const SEED_FILE = "db/seed.sql";
+/** The managed pre-migration bootstrap (slot app.db.bootstrap): `starci app sync` renders it, and `db baseline --squash` owns one marked section. */
+export declare const BOOTSTRAP_FILE = "db/bootstrap.sql";
+export declare const BOOTSTRAP_SQUASH_BEGIN = "-- >>> starci app db baseline --squash: roles, role settings and grants a per-database dump loses (regenerate with the verb; do not edit) >>>";
+export declare const BOOTSTRAP_SQUASH_END = "-- <<< starci app db baseline --squash <<<";
+/**
+ * db/bootstrap.sql split into the part sync renders (`head`) and the squash section (`section`, from its begin line through its end line, or
+ * null). A begin marker without its end marker is no section, so the whole text stays the rendered part and differs from the render.
+ */
+export declare function bootstrapSection(text: string): {
+    head: string;
+    section: null;
+} | {
+    head: string;
+    section: string;
+};

package/runtime/scripts/hfs/rules/database-constants.mjs

@@ -13,7 +13,6 @@ export const DB_EXTENSION_ALLOWED = 'DB_EXTENSION_ALLOWED';
 export const DB_MIGRATION_DESTRUCTIVE = 'DB_MIGRATION_DESTRUCTIVE';
 export const HFS_SEED_PII = 'HFS_SEED_PII';
 export const DB_VAULT_WRITE = 'DB_VAULT_WRITE';
-
 export const DB_DIR = 'db';
 export const MIGRATIONS_DIR = `${DB_DIR}/migrations`;
 /** The migrations retired at a baseline cutover (slot app.db.migrations.archive): never applied, never judged by L02-L08. */
@@ -30,10 +29,11 @@ export const BOOTSTRAP_SQUASH_END = '-- <<< starci app db baseline --squash <<<'
  * null). A begin marker without its end marker is no section, so the whole text stays the rendered part and differs from the render.
  */
 export function bootstrapSection(text) {
-  const start = text.indexOf(BOOTSTRAP_SQUASH_BEGIN);
-  const end = start < 0 ? -1 : text.indexOf(BOOTSTRAP_SQUASH_END, start);
-  if (start < 0 || end < 0 || (start > 0 && text[start - 1] !== '\n')) return { head: text, section: null };
-  const newline = text.indexOf('\n', end);
-  const stop = newline < 0 ? text.length : newline + 1;
-  return { head: text.slice(0, start) + text.slice(stop), section: text.slice(start, stop) };
+    const start = text.indexOf(BOOTSTRAP_SQUASH_BEGIN);
+    const end = start < 0 ? -1 : text.indexOf(BOOTSTRAP_SQUASH_END, start);
+    if (start < 0 || end < 0 || (start > 0 && text[start - 1] !== '\n'))
+        return { head: text, section: null };
+    const newline = text.indexOf('\n', end);
+    const stop = newline < 0 ? text.length : newline + 1;
+    return { head: text.slice(0, start) + text.slice(stop), section: text.slice(start, stop) };
 }