@starci/hfs 4.11.22 → 4.12.0

package/runtime/engine/secrets.mjs

@@ -1,134 +1,202 @@
 import fs from 'node:fs';
 import path from 'node:path';
-
 /** The host-local credential filename, resolved only against a verified runtime main root. */
-export const SECRET_ENV_FILE='secret.env';
+export const SECRET_ENV_FILE = 'secret.env';
 /** The configured credential variable grammar shared by validation and secret resolution. */
-export const ENV_NAME=/^[A-Z_][A-Z0-9_]{0,63}$/;
-export const CREDENTIAL_FILE_MAX_BYTES=1024*1024;
+export const ENV_NAME = /^[A-Z_][A-Z0-9_]{0,63}$/;
+export const CREDENTIAL_FILE_MAX_BYTES = 1024 * 1024;
 const resolvedValues = new Set();
-const remember = value => {
-  if (typeof value === 'string' && value.length >= 6) resolvedValues.add(value);
-  return value;
+const remember = (value) => {
+    if (typeof value === 'string' && value.length >= 6)
+        resolvedValues.add(value);
+    return value;
 };
-
 /** Filter credentials resolved by this process; the values never leave their resolution owner. */
 export function redactResolvedSecrets(text) {
-  let clean = text;
-  for (const value of resolvedValues) if (clean.includes(value)) clean = clean.split(value).join('[redacted:resolved-secret]');
-  return clean;
+    let clean = text;
+    for (const value of resolvedValues)
+        if (clean.includes(value))
+            clean = clean.split(value).join('[redacted:resolved-secret]');
+    return clean;
 }
-
 /** Check lexical availability only; blank and conventional template markers never prove provider validity. */
-export function credentialPresent(value){
-  if(typeof value!=='string'||!value.trim())return false;
-  return !/^(?:CHANGE_ME|REPLACE_ME|PLACEHOLDER|TODO|<[^>]*>|YOUR_[A-Z0-9_]+)$/i.test(value.trim());
+export function credentialPresent(value) {
+    if (typeof value !== 'string' || !value.trim())
+        return false;
+    return !/^(?:CHANGE_ME|REPLACE_ME|PLACEHOLDER|TODO|<[^>]*>|YOUR_[A-Z0-9_]+)$/i.test(value.trim());
 }
-
 /** Read one configured credential file with a finite byte budget; no effects beyond the read. */
-export function readSecretBytes(file){
-  const before=fs.lstatSync(file);
-  if(!before.isFile()||before.isSymbolicLink())throw new Error('credential file must be a regular file');
-  if(before.size>CREDENTIAL_FILE_MAX_BYTES)throw new Error('credential file exceeds the byte budget');
-  const fd=fs.openSync(file,fs.constants.O_RDONLY|(fs.constants.O_NOFOLLOW??0));
-  let bytes;
-  try{
-    const stat=fs.fstatSync(fd);
-    if(!stat.isFile()||stat.dev!==before.dev||stat.ino!==before.ino)throw new Error('credential file changed during resolution');
-    bytes=Buffer.alloc(CREDENTIAL_FILE_MAX_BYTES+1);
-    let count=0;
-    while(count<bytes.length){const n=fs.readSync(fd,bytes,count,bytes.length-count,null);if(n===0){break;}count+=n;}
-    if(count>CREDENTIAL_FILE_MAX_BYTES)throw new Error('credential file exceeds the byte budget');
-    return bytes.subarray(0,count);
-  }catch(error){bytes?.fill(0);throw error;}finally{fs.closeSync(fd);}
+export function readSecretBytes(file) {
+    const before = fs.lstatSync(file);
+    if (!before.isFile() || before.isSymbolicLink())
+        throw new Error('credential file must be a regular file');
+    if (before.size > CREDENTIAL_FILE_MAX_BYTES)
+        throw new Error('credential file exceeds the byte budget');
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    let bytes;
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino)
+            throw new Error('credential file changed during resolution');
+        bytes = Buffer.alloc(CREDENTIAL_FILE_MAX_BYTES + 1);
+        let count = 0;
+        while (count < bytes.length) {
+            const n = fs.readSync(fd, bytes, count, bytes.length - count, null);
+            if (n === 0) {
+                break;
+            }
+            count += n;
+        }
+        if (count > CREDENTIAL_FILE_MAX_BYTES)
+            throw new Error('credential file exceeds the byte budget');
+        return bytes.subarray(0, count);
+    }
+    catch (error) {
+        bytes?.fill(0);
+        throw error;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
 }
-
-const readCredentialFile = file => { const bytes=readSecretBytes(file); try{return bytes.toString('utf8');}finally{bytes.fill(0);} };
-
-const DOTENV_LINE_PARTS = [String.raw`^\s*`, String.raw`(?:export\s+)?`, String.raw`([A-Za-z_]\w*)`, String.raw`\s*=\s*`, String.raw`([^\r\n\u2028\u2029]*)`, String.raw`\s*$`];
+const readCredentialFile = (file) => { const bytes = readSecretBytes(file); try {
+    return bytes.toString('utf8');
+}
+finally {
+    bytes.fill(0);
+} };
+const DOTENV_LINE_PARTS = [String.raw `^\s*`, String.raw `(?:export\s+)?`, String.raw `([A-Za-z_]\w*)`, String.raw `\s*=\s*`, String.raw `([^\r\n\u2028\u2029]*)`, String.raw `\s*$`];
 const DOTENV_LINE = new RegExp(DOTENV_LINE_PARTS.join(''));
-
 /** Parse a dotenv file (KEY=VALUE lines, # comments, optional export/quotes). An absent file is {}. */
-export function readDotenv(file){
-  let text='';try{text=readCredentialFile(file);}catch(error){if(error?.code==='ENOENT'){return {};}throw error;}
-  const out={};
-  for(const line of text.split(/\r?\n/)){
-    const m=DOTENV_LINE.exec(line);
-    if(!m)continue;
-    let value=m[2].trimEnd();
-    if(value.length>=2&&(value.startsWith('"')||value.startsWith("'"))&&value.at(-1)===value[0])value=value.slice(1,-1);
-    out[m[1]]=value;
-  }
-  return out;
+export function readDotenv(file) {
+    let text = '';
+    try {
+        text = readCredentialFile(file);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return {};
+        }
+        throw error;
+    }
+    const out = {};
+    for (const line of text.split(/\r?\n/)) {
+        const m = DOTENV_LINE.exec(line);
+        if (!m)
+            continue;
+        const name = m[1];
+        let value = m[2].trimEnd();
+        if (value.length >= 2 && (value.startsWith('"') || value.startsWith("'")) && value.at(-1) === value[0])
+            value = value.slice(1, -1);
+        out[name] = value;
+    }
+    return out;
 }
-
 /**
  * Resolve a configured variable or its supported NAME_FILE custody pointer. An explicitly supplied
  * blank variable disables the value; it must not resurrect a file value. Never print the result.
  */
-export function connectorSecret(name,env=process.env){
-  if(typeof name!=='string'||!ENV_NAME.test(name))return null;
-  if(Object.hasOwn(env,name))return typeof env[name]==='string'?remember(env[name].trim()||null):null;
-  const pointer=typeof env[`${name}_FILE`]==='string'?env[`${name}_FILE`].trim():'';
-  if(!pointer)return null;
-  try{const value=readCredentialFile(pointer).trim();return remember(value||null);}catch{return null;}
+export function connectorSecret(name, env = process.env) {
+    if (typeof name !== 'string' || !ENV_NAME.test(name))
+        return null;
+    const direct = env[name];
+    if (Object.hasOwn(env, name))
+        return typeof direct === 'string' ? remember(direct.trim() || null) : null;
+    const filePointer = env[`${name}_FILE`];
+    const pointer = typeof filePointer === 'string' ? filePointer.trim() : '';
+    if (!pointer)
+        return null;
+    try {
+        const value = readCredentialFile(pointer).trim();
+        return remember(value || null);
+    }
+    catch {
+        return null;
+    }
 }
-
 /**
  * Load the verified runtime main's local credentials below the actual environment without mutating
  * either input. The caller owns repository identity; this base-tier reader never infers a root from cwd.
  * Absence is allowed so the action-specific gate can name only the credentials that action requires.
  */
-export function secretEnv(verifiedRuntimeRoot,env=process.env){
-  if(typeof verifiedRuntimeRoot!=='string'||!path.isAbsolute(verifiedRuntimeRoot))
-    throw new TypeError('secretEnv requires an absolute verified runtime root');
-  if(env===null||typeof env!=='object'||Array.isArray(env))throw new TypeError('secretEnv requires an environment mapping');
-  const root=fs.lstatSync(verifiedRuntimeRoot);
-  if(!root.isDirectory()||root.isSymbolicLink())throw new Error('secretEnv runtime root must be a regular directory');
-  const file=path.join(verifiedRuntimeRoot,SECRET_ENV_FILE);
-  let stat;
-  try{stat=fs.lstatSync(file);}catch(error){if(error?.code==='ENOENT'){return {...env};}throw error;}
-  if(!stat.isFile()||stat.isSymbolicLink())throw new Error('secret.env must be a regular file');
-  const local = readDotenv(file);
-  const resolved = {...local,...env};
-  for (const name of Object.keys(local)) if (typeof resolved[name] === 'string') remember(resolved[name]);
-  return resolved;
+export function secretEnv(verifiedRuntimeRoot, env = process.env) {
+    if (typeof verifiedRuntimeRoot !== 'string' || !path.isAbsolute(verifiedRuntimeRoot))
+        throw new TypeError('secretEnv requires an absolute verified runtime root');
+    if (env === null || typeof env !== 'object' || Array.isArray(env))
+        throw new TypeError('secretEnv requires an environment mapping');
+    const root = fs.lstatSync(verifiedRuntimeRoot);
+    if (!root.isDirectory() || root.isSymbolicLink())
+        throw new Error('secretEnv runtime root must be a regular directory');
+    const file = path.join(verifiedRuntimeRoot, SECRET_ENV_FILE);
+    let stat;
+    try {
+        stat = fs.lstatSync(file);
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return { ...env };
+        }
+        throw error;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('secret.env must be a regular file');
+    const local = readDotenv(file);
+    const resolved = { ...local, ...env };
+    for (const name of Object.keys(local))
+        if (typeof resolved[name] === 'string')
+            remember(resolved[name]);
+    return resolved;
 }
-
-const sopsRefuse=(reason,message)=>{
-  const error=new Error(`SOPS identity [${reason}]: ${message}`);
-  error.name='SopsIdentityRefusal';error.identityRefusal=reason;
-  return {mode:'refused',env:null,error};
+const sopsRefuse = (reason, message) => {
+    const error = new Error(`SOPS identity [${reason}]: ${message}`);
+    error.name = 'SopsIdentityRefusal';
+    error.identityRefusal = reason;
+    return { mode: 'refused', env: null, error };
 };
-const sopsInlineIdentity=(env,name)=>{
-  if(!credentialPresent(env[name]))return sopsRefuse('disabled-inline','SOPS_AGE_KEY is explicitly empty or invalid');
-  remember(env[name].trim());
-  return {...sopsRefuse('inline-context-unqualified','the supplied SOPS_AGE_KEY awaits an owned selected-identity isolation capability; no SOPS process was launched'),inlineName:name};
+const sopsInlineIdentity = (env, name) => {
+    const inline = env[name];
+    if (!credentialPresent(inline))
+        return sopsRefuse('disabled-inline', 'SOPS_AGE_KEY is explicitly empty or invalid');
+    remember(inline.trim());
+    return { ...sopsRefuse('inline-context-unqualified', 'the supplied SOPS_AGE_KEY awaits an owned selected-identity isolation capability; no SOPS process was launched'), inlineName: name };
 };
-const sopsFileIdentity=(env,file)=>{
-  if(!credentialPresent(file))return sopsRefuse('invalid-file','the original identity file selection is empty or invalid');
-  if(!path.isAbsolute(file))return sopsRefuse('identity-file-location-unqualified','select the original identity by its absolute path; caller and SOPS working directories may differ');
-  try{
-    const stat=fs.lstatSync(file);
-    if(!stat.isFile()||stat.isSymbolicLink())return sopsRefuse('identity-file-unavailable','the explicitly selected original identity must be a regular non-symlink file');
-  }catch{return sopsRefuse('identity-file-unavailable','the explicitly selected original identity file is unavailable');}
-  return {mode:'file',env:{...env,SOPS_AGE_KEY_FILE:file},error:null};
+const sopsFileIdentity = (env, file) => {
+    if (!credentialPresent(file))
+        return sopsRefuse('invalid-file', 'the original identity file selection is empty or invalid');
+    if (!path.isAbsolute(file))
+        return sopsRefuse('identity-file-location-unqualified', 'select the original identity by its absolute path; caller and SOPS working directories may differ');
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return sopsRefuse('identity-file-unavailable', 'the explicitly selected original identity must be a regular non-symlink file');
+    }
+    catch {
+        return sopsRefuse('identity-file-unavailable', 'the explicitly selected original identity file is unavailable');
+    }
+    return { mode: 'file', env: { ...env, SOPS_AGE_KEY_FILE: file }, error: null };
 };
 /** Select a supplied age identity without inventing custody or running a key tool. Inline execution awaits its owned isolation capability. */
-export function sopsIdentityEnv(env,{identity=null,required=false,platform=process.platform}={}){
-  if(!env||typeof env!=='object'||Array.isArray(env))return sopsRefuse('invalid-environment','an environment mapping is required');
-  const names=name=>Object.keys(env).filter(key=>platform==='win32'?key.toUpperCase()===name:key===name);
-  const inline=names('SOPS_AGE_KEY'),files=names('SOPS_AGE_KEY_FILE');
-  if(inline.length>1||files.length>1)return sopsRefuse('ambiguous-environment','multiple Windows aliases select an age identity');
-  if(inline.length)return sopsInlineIdentity(env,inline[0]);
-  let file=identity;
-  if(files.length){
-    const value=env[files[0]];
-    if(!credentialPresent(value))return sopsRefuse('disabled-file','SOPS_AGE_KEY_FILE is explicitly empty or invalid');
-    if(identity!==null&&identity!==undefined&&identity!==value)return sopsRefuse('conflicting-files','two different original identity files were explicitly selected');
-    file=value;
-  }
-  if(file!==null&&file!==undefined)return sopsFileIdentity(env,file);
-  if(required)return sopsRefuse('identity-not-supplied','supply SOPS_AGE_KEY locally or select the original SOPS_AGE_KEY_FILE; no home default was inferred');
-  return {mode:'public-recipient',env:{...env},error:null};
+export function sopsIdentityEnv(env, { identity = null, required = false, platform = process.platform } = {}) {
+    if (!env || typeof env !== 'object' || Array.isArray(env))
+        return sopsRefuse('invalid-environment', 'an environment mapping is required');
+    const names = (name) => Object.keys(env).filter(key => platform === 'win32' ? key.toUpperCase() === name : key === name);
+    const inline = names('SOPS_AGE_KEY'), files = names('SOPS_AGE_KEY_FILE');
+    if (inline.length > 1 || files.length > 1)
+        return sopsRefuse('ambiguous-environment', 'multiple Windows aliases select an age identity');
+    if (inline.length)
+        return sopsInlineIdentity(env, inline[0]);
+    let file = identity;
+    if (files.length) {
+        const value = env[files[0]];
+        if (!credentialPresent(value))
+            return sopsRefuse('disabled-file', 'SOPS_AGE_KEY_FILE is explicitly empty or invalid');
+        if (identity !== null && identity !== undefined && identity !== value)
+            return sopsRefuse('conflicting-files', 'two different original identity files were explicitly selected');
+        file = value;
+    }
+    if (file !== null && file !== undefined)
+        return sopsFileIdentity(env, file);
+    if (required)
+        return sopsRefuse('identity-not-supplied', 'supply SOPS_AGE_KEY locally or select the original SOPS_AGE_KEY_FILE; no home default was inferred');
+    return { mode: 'public-recipient', env: { ...env }, error: null };
 }

package/runtime/engine/sonar-config.d.mts

@@ -0,0 +1,10 @@
+/** The validated config.yaml `sonar` block. */
+export interface SonarBlock {
+    organization?: string | null;
+}
+/**
+ * config.yaml `sonar` - {organization?}: the key of the SonarCloud organization the release's Sonar proof of the example apps analyses in
+ * (the project key is <organization>_<key the example declares>). It is configuration, not a secret; the environment variable
+ * SONAR_ORGANIZATION wins over it, the repository variable of the same name is what CI reads. Null or absent means "not set yet".
+ */
+export declare function validateSonar(sonar: unknown): void;

package/runtime/engine/sonar-config.mjs

@@ -1,21 +1,24 @@
-import {isPlainObject as plain} from './plain-object.mjs';
-import {invalid} from './invalid-config.mjs';
-
+import { isPlainObject as plain } from './plain-object.mjs';
+import { invalid } from './invalid-config.mjs';
 /** The keys of the sonar block. */
-const SONAR_KEYS=Object.freeze(['organization']);
+const SONAR_KEYS = Object.freeze(['organization']);
 /** A SonarCloud organization key: lowercase letters, digits, hyphens and underscores, starting with a letter or a digit. */
-const ORGANIZATION=/^[a-z0-9][a-z0-9_-]*$/;
-
+const ORGANIZATION = /^[a-z0-9][a-z0-9_-]*$/;
 /**
  * config.yaml `sonar` - {organization?}: the key of the SonarCloud organization the release's Sonar proof of the example apps analyses in
  * (the project key is <organization>_<key the example declares>). It is configuration, not a secret; the environment variable
  * SONAR_ORGANIZATION wins over it, the repository variable of the same name is what CI reads. Null or absent means "not set yet".
  */
-export function validateSonar(sonar){
-  if(sonar===null)return;
-  const bad=invalid('sonar');
-  if(!plain(sonar))bad(' must be {organization?: <SonarCloud organization key>} or null.');
-  for(const key of Object.keys(sonar))if(!SONAR_KEYS.includes(key))bad(` has unknown key ${key} (allowed: ${SONAR_KEYS.join(', ')}).`);
-  const value=sonar.organization;
-  if(value!==undefined&&value!==null&&!(typeof value==='string'&&ORGANIZATION.test(value)))bad('.organization must be a SonarCloud organization key (lowercase letters, digits, - and _) or null.');
+export function validateSonar(sonar) {
+    if (sonar === null)
+        return;
+    const bad = invalid('sonar');
+    if (!plain(sonar))
+        return bad(' must be {organization?: <SonarCloud organization key>} or null.');
+    for (const key of Object.keys(sonar))
+        if (!SONAR_KEYS.includes(key))
+            bad(` has unknown key ${key} (allowed: ${SONAR_KEYS.join(', ')}).`);
+    const value = sonar.organization;
+    if (value !== undefined && value !== null && !(typeof value === 'string' && ORGANIZATION.test(value)))
+        bad('.organization must be a SonarCloud organization key (lowercase letters, digits, - and _) or null.');
 }

package/runtime/engine/temp-root.d.mts

@@ -0,0 +1,17 @@
+import type { OwnerConfig } from './config.mjs';
+export declare const TEMP_ROOT_ENV = "STARCI_TEMP_ROOT";
+/** The operating-system temp directory of `env`: TEMP, TMP, TMPDIR, else os.tmpdir(). */
+export declare const osTempDir: (env?: NodeJS.ProcessEnv) => string;
+/** The one temp root: env STARCI_TEMP_ROOT, then the owner config `roots.temp`, else the OS temp directory. Resolved, not created. */
+export declare function tempRoot({ env, config }?: {
+    env?: NodeJS.ProcessEnv;
+    config?: OwnerConfig | null | undefined;
+}): string;
+/** `env` (default: the process environment) as a copy whose TEMP, TMP and TMPDIR name the temp root. */
+export declare function tempChildEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** The spawn options with `env` replaced by tempChildEnv of the options' own env (default: the process environment). */
+export declare const withTempEnv: <O extends {
+    env?: NodeJS.ProcessEnv | undefined;
+}>(options?: O) => O & {
+    env: NodeJS.ProcessEnv;
+};

package/runtime/engine/temp-root.mjs

@@ -8,25 +8,19 @@
 import os from 'node:os';
 import path from 'node:path';
 import { loadConfig } from './config.mjs';
-
 export const TEMP_ROOT_ENV = 'STARCI_TEMP_ROOT';
-
 /** The owner's `roots.temp` (config.yaml, validated by engine/invalid-config.mjs), or null. `config` is the owner config (default: loadConfig(), whose error for an invalid config.yaml propagates: the OS directory never replaces a root the owner set wrongly). */
 const ownerTemp = (config) => (config === undefined ? loadConfig() : config)?.roots?.temp ?? null;
-
 /** The operating-system temp directory of `env`: TEMP, TMP, TMPDIR, else os.tmpdir(). */
 export const osTempDir = (env = process.env) => path.resolve(String(env?.TEMP || env?.TMP || env?.TMPDIR || os.tmpdir()));
-
 /** The one temp root: env STARCI_TEMP_ROOT, then the owner config `roots.temp`, else the OS temp directory. Resolved, not created. */
 export function tempRoot({ env = process.env, config = undefined } = {}) {
-  return path.resolve(String(env?.[TEMP_ROOT_ENV] || ownerTemp(config) || osTempDir(env)));
+    return path.resolve(String(env?.[TEMP_ROOT_ENV] || ownerTemp(config) || osTempDir(env)));
 }
-
 /** `env` (default: the process environment) as a copy whose TEMP, TMP and TMPDIR name the temp root. */
 export function tempChildEnv(env = process.env) {
-  const root = tempRoot({ env });
-  return { ...env, TEMP: root, TMP: root, TMPDIR: root };
+    const root = tempRoot({ env });
+    return { ...env, TEMP: root, TMP: root, TMPDIR: root };
 }
-
 /** The spawn options with `env` replaced by tempChildEnv of the options' own env (default: the process environment). */
 export const withTempEnv = (options = {}) => ({ ...options, env: tempChildEnv(options.env ?? process.env) });

package/runtime/engine/yaml.d.mts

@@ -0,0 +1,9 @@
+// yaml.d.mts - the types of yaml.mjs, the vendored yaml@2.9.0 bundle with the runtime's parseYaml/stringifyYaml wrapper.
+// That file is generated and frozen (esbuild output, see its header), so it stays JavaScript; this declaration is its TypeScript surface.
+
+/** Parses a YAML 1.2 core-schema document (at most 4 MiB, no aliases, unique keys); throws on invalid or unsupported YAML. */
+// reason: a parsed YAML document read from disk (parsed-input boundary); callers narrow or index it by its contract shape.
+export function parseYaml(source: string): any;
+
+/** Serializes a value as YAML (line width 100, no aliases). */
+export const stringifyYaml: (value: unknown) => string;

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -17,7 +17,7 @@ pins:
   # --- @starci packages. Every @starci package is a PUBLISHED npm package (install: registry): a product repository
   # installs the exact pinned version from the npm registry in the root and every workspace package.json, never `file:`.
   '@starci/heroicons':
-    version: 0.3.4
+    version: 0.3.5
     group: starci
     install: registry
     side: fe
@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.34
+    version: 0.16.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.8.21
+    version: 3.9.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.23
+    version: 9.6.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.34
+    version: 0.16.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.34
+    version: 0.16.0
     group: starci
     install: registry
     side: fe
@@ -85,28 +85,28 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.5.2
+    version: 2.5.3
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
     why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeQueryBuilder, queueQueryBuilders, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
-    version: 1.3.2
+    version: 1.3.3
     group: starci
     install: registry
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. A fake declared https (defineHttpFake) serves TLS with the run''s ephemeral in-memory fake CA and publishes its PEM as w.fake.<name>.ca for the app''s own client to trust; verification is never turned off. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/ai-router':
-    version: 0.4.0
+    version: 0.4.1
     group: starci
     install: registry
     side: be
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.11.22
+    version: 4.12.0
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/ci-standard.yaml

@@ -9,7 +9,7 @@ title: The one StarCi CI standard
 #   runtime        the runtime repository's own workflows (.github/workflows/*.yml), checked by the same rules, not rendered
 # Enforcers: rule R301 CI_STANDARD (scripts/hfs/rules/ci-standard.mjs over app-ci in the app check and the example apps, scripts/hfs/runtime-rules/runtime-ci-standard.mjs
 # over the runtime's own workflows) checks every item marked `check: ci-standard`; the other items are owned by the rule or render named in `by`.
-# Apps get the standard only through `starci app sync`: the managed CI files are sync targets, and `starci app sync --check` / the app check refuse drift.
+# Apps get the standard only through `starci app sync`: the managed CI files are sync targets, and `starci app sync` (the dry run) / the app check refuse drift.
 
 # The jobs of the managed app CI (job ids, in this order), per edition; `sonar` exists when the Sonar service is enabled.
 jobs:
@@ -54,7 +54,7 @@ items:
     check: ci-standard
   - id: sonar-lint-per-side
     title: the Sonar lint runs per side
-    requires: "a lint with a Sonar import (--sonar) names its side (--side be|fe); the reports are merged into reports/lint.sonar.json afterwards; no combined lint with Sonar"
+    requires: "a lint with a Sonar import (--out) names its side (--side be|fe); the reports are merged into reports/lint.sonar.json afterwards; no combined lint with Sonar"
     covers: [app-ci, runtime]
     check: ci-standard
   - id: test-sharding