@starci/hfs 4.4.0 → 4.4.1

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "757ac9945db2a2b217a5dea8be2cd2c0fcb895230762eb9cd15700b8a44bce49",
+  "hash": "65c712b99fc864f4135df840b2f870d54bf783fc7762eab2232b37557690e9bc",
   "global": [
     {
       "name": "json",
@@ -2073,35 +2073,6 @@ export const CATALOG = {
           },
           "runtimeSide": "tree"
         },
-        "runtime-coverage": {
-          "summary": "run the runtime spec suite under Node coverage and write coverage/lcov.info",
-          "owner": "runtime",
-          "positional": [
-            {
-              "name": "specs",
-              "required": false,
-              "variadic": true
-            }
-          ],
-          "flags": [],
-          "exit": {
-            "0": "the suite is green",
-            "1": "a spec failed",
-            "2": "bad usage"
-          },
-          "json": "none",
-          "examples": [
-            "starci gate runtime-coverage",
-            "starci gate runtime-coverage tests/cli/catalog.spec.mjs"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "script": "scripts/gates/runtime-coverage.mjs"
-          },
-          "runtimeSide": "tree"
-        },
         "sonar": {
           "summary": "inspect, provision, run and start the local Sonar quality gate",
           "owner": "runtime",
@@ -2532,16 +2503,6 @@ export const CATALOG = {
             }
           ],
           "flags": [
-            {
-              "name": "verified",
-              "type": "string",
-              "summary": "an earlier verified tip that must be an ancestor of ref"
-            },
-            {
-              "name": "verified-log",
-              "type": "string",
-              "summary": "the earlier verification log whose prior-red specs must rerun"
-            },
             {
               "name": "dry-run",
               "type": "boolean",
@@ -2556,23 +2517,16 @@ export const CATALOG = {
               "name": "kernel-note",
               "type": "string",
               "summary": "one line, what a Kernel must do differently after this land; the land record carries it and the runtime delivers it verbatim with the Kernels' next wake (absent: no line)"
-            },
-            {
-              "name": "concurrency",
-              "type": "number",
-              "default": 4,
-              "summary": "dependent spec file concurrency"
             }
           ],
           "exit": {
             "0": "the verification passed and local main fast-forwarded, or a dry run passed without moving it",
-            "1": "refused at a named gate, check, spec, lock or fast-forward step",
+            "1": "refused at the verify receipt, a named gate, the check, the lock or the fast-forward step",
             "2": "bad usage"
           },
-          "json": "starci/git-land@1",
+          "json": "starci/git-land@2",
           "examples": [
             "starci git land <worktree> <ref>",
-            "starci git land <worktree> <ref> --verified <sha> --verified-log <file> --concurrency 2",
             "starci git land <worktree> <ref> --dry-run --json",
             "starci git land <worktree> <ref> --kernel-note \"settle needs --evidence now\""
           ],
@@ -2589,10 +2543,10 @@ export const CATALOG = {
             "owner"
           ],
           "conventions": [
-            "land only after starci test run --level L2 --against <ref> is green",
-            "lands are serial and hold the host land lock through the gate, check, specs and local merge",
-            "local main is the only destination; a land never pushes, tags or touches origin",
-            "delta lands use --verified with the matching --verified-log and always rerun prior-red spec files"
+            "land only a tip `starci runtime verify` proved (check, package clean-test, scaffold e2e on that exact commit)",
+            "the runtime has no specs of its own (owner ruling no-runtime-specs)",
+            "lands are serial and hold the host land lock through the receipt, gate, full check and local merge",
+            "local main is the only destination; a land never pushes, tags or touches origin"
           ],
           "runtimeSide": "host"
         },
@@ -7781,7 +7735,7 @@ export const CATALOG = {
           "examples": [
             "starci release cut",
             "starci release cut --plan --tag v1.0.0-alpha.9",
-            "starci release cut --tag v1.0.0-alpha.9 --rows \"npm test,linux-parity\"",
+            "starci release cut --tag v1.0.0-alpha.9 --rows \"npm run test:e2e,linux-parity\"",
             "starci release cut --repo <path> --tag v1.0.0-alpha.9 --json"
           ],
           "editions": [
@@ -7792,43 +7746,6 @@ export const CATALOG = {
           },
           "runtimeSide": "tree"
         },
-        "env-test": {
-          "summary": "run the runtime spec suite under the release cut's own conditions",
-          "owner": "runtime",
-          "flags": [
-            {
-              "name": "lane",
-              "type": "boolean",
-              "summary": "a lane clone is no Orca terminal: leave out STARCI_REQUIRE_ORCA_LIVE and the host check, keep everything else of the cut"
-            },
-            {
-              "name": "reuse-installs",
-              "type": "boolean",
-              "summary": "keep an example app whose node_modules exists instead of a fresh npm ci"
-            }
-          ],
-          "exit": {
-            "0": "the suite is green and no skip fails the evidence rule",
-            "1": "a step is red or a skipped test ran in no leg",
-            "2": "the host lacks a prerequisite of the cut, or bad usage"
-          },
-          "json": "none",
-          "examples": [
-            "starci release env-test",
-            "starci release env-test --lane --reuse-installs"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "script": "scripts/supervisor/release-env-test.mjs"
-          },
-          "conventions": [
-            "the suite is the cut's own spec leg, so a red the cut would find shows here first; it takes minutes to an hour and writes each step to a log",
-            "without --lane it refuses (exit 2) unless the host has an Orca terminal, a reachable Orca and a Docker daemon, the same prerequisites the cut refuses on"
-          ],
-          "runtimeSide": "tree"
-        },
         "images": {
           "summary": "build, run, health-check and tear down the shipped application images",
           "owner": "runtime",
@@ -7891,75 +7808,6 @@ export const CATALOG = {
           ],
           "runtimeSide": "tree"
         },
-        "launch-smoke": {
-          "summary": "prove live nested-agent launch paths on an Orca host",
-          "owner": "runtime",
-          "positional": [
-            {
-              "name": "action",
-              "enum": [
-                "stage",
-                "mark"
-              ],
-              "required": false,
-              "variadic": false
-            }
-          ],
-          "flags": [
-            {
-              "name": "app-repo",
-              "type": "string",
-              "summary": "scratch app main checkout registered in Orca"
-            },
-            {
-              "name": "entry",
-              "type": "string",
-              "summary": "plain entry terminal for the smoke"
-            },
-            {
-              "name": "timeout-ms",
-              "type": "number",
-              "summary": "smoke deadline in milliseconds"
-            },
-            {
-              "name": "out",
-              "type": "string",
-              "summary": "write the smoke result to this file"
-            },
-            {
-              "name": "as",
-              "type": "enum",
-              "enum": [
-                "supervisor",
-                "worker",
-                "kernel",
-                "op",
-                "opFe",
-                "opFail",
-                "critic"
-              ],
-              "summary": "internal smoke role for stage or mark"
-            }
-          ],
-          "exit": {
-            "0": "smoke or role action passed",
-            "1": "smoke or role action failed",
-            "2": "bad usage or no entry terminal"
-          },
-          "json": "always",
-          "examples": [
-            "starci release launch-smoke --app-repo <scratch-app>",
-            "starci release launch-smoke stage --as kernel",
-            "starci release launch-smoke mark --as op"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "script": "scripts/kernel/launch-smoke.mjs"
-          },
-          "runtimeSide": "tree"
-        },
         "notes": {
           "summary": "print or write the release notes of a tag, its CHANGELOG section",
           "owner": "runtime",
@@ -8136,6 +7984,32 @@ export const CATALOG = {
           ],
           "runtimeSide": "tree"
         },
+        "scaffold-e2e": {
+          "summary": "run the scaffold end-to-end proof (full and lite scaffolds installed, built and run for real)",
+          "owner": "runtime",
+          "flags": [],
+          "exit": {
+            "0": "every scaffold e2e test ran and passed",
+            "1": "a scaffold e2e test failed, was cancelled or was skipped",
+            "2": "the run could not start or bad usage"
+          },
+          "json": "none",
+          "examples": [
+            "starci release scaffold-e2e"
+          ],
+          "editions": [
+            "full"
+          ],
+          "impl": {
+            "script": "scripts/gates/scaffold-e2e.mjs"
+          },
+          "conventions": [
+            "With release clean-test, the real test proof of the runtime (owner ruling no-runtime-specs): the runtime has no specs.",
+            "A skipped test is red: every scaffold test must run (Docker, npm and the source canon registry are prerequisites).",
+            "Builds the grammar and heroicons dist first when they are stale, from their own lockfiles: a fresh lane needs no build step."
+          ],
+          "runtimeSide": "tree"
+        },
         "sync-runtime": {
           "summary": "refresh or check package runtime copies and optionally prepare grammar",
           "owner": "runtime",
@@ -8440,7 +8314,7 @@ export const CATALOG = {
             "owner"
           ],
           "conventions": [
-            "refuses unless the source is clean, a fast-forward of the host and its check and affected specs are proven by a receipt on that commit",
+            "refuses unless the source is clean, a fast-forward of the host and its check, package clean-test and scaffold e2e are proven by a receipt on that commit",
             "refuses while a release cut holds the host lock; waits for settles, Critic runs and prepared decisions in flight, stops none",
             "several commits are one revision change, with one fast-forward, installed artefacts migrated, one engine restart, then verified",
             "journals one runtime-deployed event; --plan prints every step and refusal and changes nothing",
@@ -9074,7 +8948,7 @@ export const CATALOG = {
           "runtimeSide": "tree"
         },
         "verify": {
-          "summary": "verify a committed revision - the check AND the affected specs on one commit, one receipt",
+          "summary": "verify a commit - the check, package clean-test and scaffold e2e on one commit, one receipt",
           "owner": "runtime",
           "positional": [],
           "flags": [
@@ -9090,12 +8964,11 @@ export const CATALOG = {
             }
           ],
           "exit": {
-            "0": "verified: check and every affected spec passed on the exact commit, receipt written",
-            "1": "NOT VERIFIED: dirty tree, no base, red check, or a red spec file",
-            "2": "bad usage",
-            "3": "PARTIAL: nothing red, the lane's own specs ran, some were not started inside the budget (fit to land, not to deploy)"
+            "0": "verified: check, package clean-test and scaffold e2e passed on the exact commit, receipt written",
+            "1": "NOT VERIFIED: dirty tree, no base, red check, a red or unrun package, or a failed or skipped scaffold e2e test",
+            "2": "bad usage"
           },
-          "json": "starci/runtime-verify@1",
+          "json": "starci/runtime-verify@2",
           "examples": [
             "starci runtime verify --base <tip>",
             "starci runtime verify --json"
@@ -9116,11 +8989,11 @@ export const CATALOG = {
             "owner"
           ],
           "conventions": [
-            "A branch is verified only by this receipt: check N of N and affected specs N of N for base..tip, on the exact commit.",
-            "A fix lane reports the last line of this verb, not the line of starci runtime check (which never runs a spec).",
+            "A branch is verified only by this receipt: check N of N, the clean-test of every package base..tip touches, the scaffold e2e.",
+            "The runtime has no specs of its own (owner ruling no-runtime-specs): package specs and the scaffold e2e decide.",
+            "A fix lane reports the last line of this verb, not the line of starci runtime check (which runs no test).",
             "Refuses a tree with uncommitted or untracked changes; the receipt binds a commit.",
-            "starci git land accepts a partial receipt (0 failed, the lane's changed specs ran, not-started counted); deploy and release need all of them.",
-            "A spec whose inputs are unchanged since a proven green run is reused; the receipt counts the reused files."
+            "starci git land, starci runtime deploy and the release read the same receipt: every proof passed."
           ],
           "runtimeSide": "tree"
         },
@@ -9864,21 +9737,6 @@ export const CATALOG = {
               "type": "string",
               "summary": "comma-separated commit shas to land"
             },
-            {
-              "name": "specs",
-              "type": "string",
-              "summary": "spec files or touching, direct, all, or none"
-            },
-            {
-              "name": "reason",
-              "type": "string",
-              "summary": "reason required when no spec applies"
-            },
-            {
-              "name": "full-by-push-git",
-              "type": "boolean",
-              "summary": "authorize the full suite from the push flow"
-            },
             {
               "name": "lane",
               "type": "string",
@@ -9914,7 +9772,7 @@ export const CATALOG = {
           "examples": [
             "starci supervisor land --status",
             "starci supervisor land --job <job-id>",
-            "starci supervisor land --commit <sha> --specs touching --lane <name>"
+            "starci supervisor land --commit <sha> --lane <name>"
           ],
           "editions": [
             "full"
@@ -9960,20 +9818,10 @@ export const CATALOG = {
               "type": "string",
               "summary": "source lane name"
             },
-            {
-              "name": "specs",
-              "type": "string",
-              "summary": "comma-separated specs for the land gate"
-            },
-            {
-              "name": "wrongly-blocked",
-              "type": "string",
-              "summary": "spec proving the prior gate was wrong"
-            },
             {
               "name": "reason",
               "type": "string",
-              "summary": "reason when no spec applies"
+              "summary": "why the experiment is landed"
             },
             {
               "name": "wait-ms",
@@ -10937,189 +10785,6 @@ export const CATALOG = {
         }
       }
     },
-    "test": {
-      "summary": "run the bounded L1-L4 test ladder without accidental whole-suite work",
-      "owner": "runtime",
-      "verbs": {
-        "affected": {
-          "summary": "the specs related to the changed functions (--by file: every importer); --run runs each once",
-          "owner": "runtime",
-          "positional": [],
-          "flags": [
-            {
-              "name": "base",
-              "type": "string",
-              "summary": "ref to diff against (default: the merge-base with main, else origin/main)"
-            },
-            {
-              "name": "changed",
-              "type": "list",
-              "summary": "explicit changed repository paths instead of the diff"
-            },
-            {
-              "name": "by",
-              "type": "string",
-              "summary": "symbol (default: the specs related to the changed functions) or file (every spec importing a changed file)"
-            },
-            {
-              "name": "run",
-              "type": "boolean",
-              "summary": "run the selected spec files, one per process, inside the time budget"
-            },
-            {
-              "name": "plan",
-              "type": "boolean",
-              "summary": "print the selected files with the reason each is in the set; run nothing"
-            },
-            {
-              "name": "receipt-file",
-              "type": "string",
-              "summary": "with --run, write the receipt to this file; the answer carries its path (a gate reads the file, not the output)"
-            },
-            {
-              "name": "no-cache",
-              "type": "boolean",
-              "summary": "run every selected file; ignore the per-spec result cache"
-            },
-            {
-              "name": "concurrency",
-              "type": "number",
-              "summary": "override automatic file concurrency with a positive integer"
-            },
-            {
-              "name": "root",
-              "type": "string",
-              "summary": "repository root (default: the command cwd)"
-            }
-          ],
-          "exit": {
-            "0": "selection printed, or every selected file passed",
-            "1": "a selected spec file was red",
-            "2": "no base to diff against, or the time budget ended before every selected file started"
-          },
-          "json": "starci/test-affected@1",
-          "examples": [
-            "starci test affected",
-            "starci test affected --run",
-            "starci test affected --changed scripts/machine/ladder-test.mjs --run"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "module": "scripts/supervisor/affected-test.mjs",
-            "export": "testAffected"
-          },
-          "effect": "host",
-          "roles": [
-            "worker",
-            "lead",
-            "coordinator",
-            "release",
-            "owner"
-          ],
-          "conventions": [
-            "Everyday verification after npm run check; the whole suite is the merged-tree run and the release cut.",
-            "The set is computed - each changed .mjs symbol is followed by name through its importers, callers and CLI verbs.",
-            "What cannot be followed by name (yaml, templates, load-time statements, no base, the depth bound) keeps the file-level rule, named in the report.",
-            "Selection and --plan JSON carry every symbol, its specs and reasons, and file-level fallbacks; the set is never larger than --by file.",
-            "A --run machine answer carries the complete selected set, every result and the receipt; the diagnostic graph remains available through --plan.",
-            "A large set is never refused; it runs in parallel shards inside the printed time budget, and files not started when it ends are listed.",
-            "The --plan flag prints each selected file with the reason it is in the set; a --run answer carries a receipt (base, tip, passed, total) a gate can require.",
-            "A generated output maps to its generator's specs; an append-only change to a data file to the specs that name it or its readers.",
-            "A red file is fixed and run again, then the affected set once; never the whole suite.",
-            "A spec whose key (import closure, data it names, runner) is unchanged since a green run is reused; the receipt counts reused files; --no-cache runs all.",
-            "Each file is its own low-priority node process with the four preloads, at the concurrency of test-concurrency.yaml."
-          ],
-          "runtimeSide": "tree"
-        },
-        "run": {
-          "summary": "run the specs selected for one local ladder level",
-          "owner": "runtime",
-          "positional": [],
-          "flags": [
-            {
-              "name": "level",
-              "type": "enum",
-              "enum": [
-                "L1",
-                "L2",
-                "L3",
-                "L4"
-              ],
-              "required": true,
-              "summary": "bounded local test level"
-            },
-            {
-              "name": "changed",
-              "type": "list",
-              "summary": "changed repository paths used for L1 selection"
-            },
-            {
-              "name": "against",
-              "type": "string",
-              "default": "main",
-              "summary": "local main ref used for L2 and L3 selection"
-            },
-            {
-              "name": "spec",
-              "type": "list",
-              "summary": "explicit spec files at L1 only"
-            },
-            {
-              "name": "concurrency",
-              "type": "number",
-              "summary": "override automatic CPU/RAM file concurrency with a positive integer"
-            },
-            {
-              "name": "root",
-              "type": "string",
-              "summary": "repository root (default is the command cwd)"
-            },
-            {
-              "name": "release-cut",
-              "type": "boolean",
-              "summary": "confirm an owner or release-role L4 release-cut run"
-            }
-          ],
-          "exit": {
-            "0": "selected specs passed",
-            "1": "a check or spec was red",
-            "2": "usage or ladder policy refusal"
-          },
-          "json": "starci/test-run@1",
-          "examples": [
-            "starci test run --level L1 --changed scripts/machine/ladder-test.mjs",
-            "starci test run --level L2 --against main --json",
-            "starci test run --level L3 --against main"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "module": "scripts/machine/ladder-test.mjs",
-            "export": "testRun"
-          },
-          "effect": "host",
-          "roles": [
-            "worker",
-            "lead",
-            "coordinator",
-            "release",
-            "owner"
-          ],
-          "conventions": [
-            "Use L1 while working, L2 before asking for a land, and L3 when an IO slot changed.",
-            "Never run the whole suite outside L4; L4 belongs to starci release cut and L5 belongs to CI.",
-            "L2 and L3 need a clean committed tree, run the full check first, and hold the one host test lock.",
-            "A red L2 or L3 selection is re-run once serially; a green re-run is recorded as a flake, never skipped.",
-            "File concurrency uses fresh idle CPU and free RAM under modules/supervisor/test-concurrency.yaml; --concurrency overrides it.",
-            "The result and spec log retain the concurrency decision and host measurements."
-          ],
-          "runtimeSide": "tree"
-        }
-      }
-    },
     "typecheck": {
       "summary": "typecheck only the projects selected by the test ladder",
       "owner": "runtime",

package/runtime/scripts/api/git/lib.mjs

@@ -20,7 +20,7 @@ import { withTempEnv } from '../../../engine/temp-root.mjs';
  * is a request for raw bytes, not an encoding: spawnSync encodes a string `input` with it and throws
  * ERR_UNKNOWN_ENCODING, so it reaches spawnSync as encoding:null (Buffer output either way).
  */
-export const gitSpawn = (file, args, options = {}) => {
+const gitSpawn = (file, args, options = {}) => {
   assertMutationFence({ kind: 'git-effect', args });
   const spawn = { encoding: 'utf8', windowsHide: true, ...options };
   if (spawn.encoding === 'buffer') spawn.encoding = null;
@@ -76,5 +76,5 @@ export const gitExecutable = (options = null) => {
   return found;
 };
 
-/** The output ceiling of the whole-diff and `cat-file --batch` calls `test affected` batches (a release diff is tens of megabytes). */
-export const BATCH_MAX_BUFFER = 1024 * 1024 * 1024;
+/** The output ceiling of the whole-diff and `cat-file --batch` calls batch (a release diff is tens of megabytes). */
+const BATCH_MAX_BUFFER = 1024 * 1024 * 1024;

package/runtime/scripts/api/sops/lib.mjs

@@ -105,7 +105,7 @@ const IDENTITY_TIMEOUT_MS = 20_000;
 const CONTROLLED_ENV = new Set(['SOPS_AGE_KEY', 'SOPS_AGE_KEY_FILE', 'SOPS_AGE_KEY_CMD', 'SOPS_AGE_SSH_PRIVATE_KEY_FILE', 'SOPS_AGE_SSH_PRIVATE_KEY_CMD', 'SOPS_AGE_RECIPIENT', 'SOPS_KEYSERVICE', 'SOPS_ENABLE_LOCAL_KEYSERVICE', 'SOPS_DECRYPTION_ORDER', 'SOPS_KMS_ARN', 'SOPS_GCP_KMS_IDS', 'SOPS_HUAWEICLOUD_KMS_IDS', 'SOPS_AZURE_KEYVAULT_URLS', 'SOPS_VAULT_URIS', 'SOPS_PGP_FP', 'SOPS_AGE_RECIPIENTS', 'HOME', 'USERPROFILE', 'APPDATA', 'XDG_CONFIG_HOME']);
 
 /** Construct only the child map; empty desktop roots make Go return directory errors, not fallback paths. */
-export function isolatedSopsEnv(env, inlineName = 'SOPS_AGE_KEY') {
+function isolatedSopsEnv(env, inlineName = 'SOPS_AGE_KEY') {
   const out = Object.fromEntries(Object.entries(env).filter(([name]) => !CONTROLLED_ENV.has(name.toUpperCase())));
   out.HOME = ''; out.USERPROFILE = ''; out.APPDATA = ''; out.XDG_CONFIG_HOME = '';
   if (inlineName !== null) out.SOPS_AGE_KEY = env[inlineName];

package/runtime/scripts/hfs/app-wiring.mjs

@@ -24,7 +24,7 @@ const COMPILATION_FAILURE = 'module or proof could not be compiled';
 const WORKER_FAILURE = 'proof worker failed or timed out';
 const SAFE_REASONS = new Set([...DI_FAILURES.values(), COMPILATION_FAILURE]);
 const modulePath = app => `apps/${app}/src/app.module.ts`;
-export const wiringFixturePath = app => `src/tests/fixtures/builders/${app}.builder.ts`;
+const wiringFixturePath = app => `src/tests/fixtures/builders/${app}.builder.ts`;
 
 const refusal = (file, reason) => ({ code: BOOT_PROOF_CODE, level: 'error', path: file,
   message: `${file}: lite boot proof failed (${reason}); compile the real AppModule with explicit fixture options and infrastructure doubles using starci app check --wiring`, reason });
@@ -177,7 +177,7 @@ export function appWiring({ repoRoot, repo = readJson(repoRoot, 'hfs.json'), fil
 }
 
 /** Optional standalone entry; coordinator connects the same seam to app check --wiring. */
-export function appWiringMain(argv, { cwd = invocationDir(), stdout = text => process.stdout.write(text), stderr = text => process.stderr.write(text) } = {}) {
+function appWiringMain(argv, { cwd = invocationDir(), stdout = text => process.stdout.write(text), stderr = text => process.stderr.write(text) } = {}) {
   let directory = cwd, json = false;
   for (let at = 0; at < argv.length; at += 1) {
     if (argv[at] === '--cwd' && argv[at + 1]) directory = path.resolve(cwd, argv[++at]);

package/runtime/scripts/hfs/architecture/config.mjs

@@ -346,4 +346,4 @@ export function loadArchitectureConfig(repositoryRoot, { hfs } = {}) {
   };
 }
 
-export { canonical, enclosingRepository, exactKeys, isInside, slash };
+export { canonical, exactKeys, isInside, slash };

package/runtime/scripts/hfs/architecture/index.mjs

@@ -162,7 +162,7 @@ const machineIds = () => [
  * backend composition and data machine and frontend repository machine. A spec about another rule judges its own
  * report without these (they have their own specs); every one of them is in ARCHITECTURE_RULE_IDS.
  */
-export const HFS_MACHINE_RULE_IDS = Object.freeze((() => {
+const HFS_MACHINE_RULE_IDS = Object.freeze((() => {
   const ordinary = new Set([...COMMON_RULE_IDS, ...BACKEND_RULE_IDS, ...FRONTEND_RULE_IDS, ...OWNER_RULE_IDS, ...GRAMMAR_RULE_IDS, ...REGISTRATION_RULE_IDS,
     ...SWR_DATA_RULE_IDS, SOURCE_LAYOUT_RULE_ID, SOURCE_NAME_RULE_ID, PUBLIC_CONTRACT_RULE_ID, READONLY_BOUNDARY_RULE_ID]);
   return [...new Set(machineIds().filter((id) => !ordinary.has(id)))].sort(byCodeUnit);

package/runtime/scripts/hfs/architecture/supabase.mjs

@@ -209,7 +209,7 @@ export function checkBackendSupabase(input) {
   };
 }
 
-export function checkJwtPolicy(input) {
+function checkJwtPolicy(input) {
   const kit = machineKit(input);
   const violations = [];
   let verifyCalls = 0;

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -67,7 +67,7 @@ function finishFrame(state, frame) {
   if (state.low.get(frame.node) === state.index.get(frame.node)) closeComponent(state, frame);
 }
 
-export function stronglyConnected(adjacency) {
+function stronglyConnected(adjacency) {
   const state = { counter: 0, index: new Map(), low: new Map(), onStack: new Set(), stack: [], result: [], work: [] };
   for (const start of adjacency.keys()) {
     if (state.index.has(start)) continue;

package/runtime/scripts/hfs/architecture.mjs

@@ -26,7 +26,7 @@ function parseArchitectureArgs(argv) {
   return {root, base};
 }
 
-export function architectureMain(argv, {check = checkArchitecture, write = (text) => process.stdout.write(text), fail = (text) => process.stderr.write(text)} = {}) {
+function architectureMain(argv, {check = checkArchitecture, write = (text) => process.stdout.write(text), fail = (text) => process.stderr.write(text)} = {}) {
   let parsed;
   try { parsed = parseArchitectureArgs(argv); } catch (error) { fail(`${error.message}\n`); return 2; }
   let report;

package/runtime/scripts/hfs/coverage-from.mjs

@@ -55,7 +55,7 @@ export function formatCoverageReport(report) {
 }
 
 /** Standalone coordinator entry point: exit 0 proof passed, 2 proof or invocation refused. */
-export function coverageFromMain(argv, { cwd = invocationDir(), stdout = (text) => process.stdout.write(text), stderr = (text) => process.stderr.write(text), run = coverageFrom } = {}) {
+function coverageFromMain(argv, { cwd = invocationDir(), stdout = (text) => process.stdout.write(text), stderr = (text) => process.stderr.write(text), run = coverageFrom } = {}) {
   try {
     const opts = parse(argv);
     const report = run({ repoRoot: path.resolve(cwd, opts.cwd ?? '.'), coverageFrom: opts.coverageFrom });