@starci/hfs 4.7.10 → 4.7.12

package/runtime/packages/cli/src/validate-args.mjs

@@ -120,6 +120,16 @@ const defaultArgs = (locals, values) => {
   return args;
 };
 
+/** Select the catalogued action policy; a missing policy refuses before runtime or provider dispatch. */
+const operationPolicyOf = (verb, positionals) => {
+  if (verb.operationPolicy === undefined) return null;
+  const policy = verb.operationPolicy?.[positionals[0]];
+  if (!policy || typeof policy.action !== 'string' || !Array.isArray(policy.credentials)) {
+    throw new Error('the selected action has no executable operation policy');
+  }
+  return policy;
+};
+
 /**
  * Validate the arguments after a catalog group and verb.
  *
@@ -166,7 +176,8 @@ export function validateArgs(argv, verb, globalFlags = []) {
     requiredCheck(locals, values);
     checkPositionals(verb, positionals, passthrough);
     checkGlobals(verb, global);
-    return { ok: true, values, args: defaultArgs(locals, values), global, localArgs, positionals };
+    const operationPolicy = operationPolicyOf(verb, positionals);
+    return { ok: true, values, args: defaultArgs(locals, values), global, localArgs, positionals, operationPolicy };
   } catch (error) {
     return { ok: false, code: 2, error: String(error?.message ?? error) };
   }

package/runtime/scripts/api/fs/is-link-like.mjs

@@ -15,6 +15,7 @@ import { realpathOr } from '../../lib/fs-kind.mjs';
 export function isLinkLike(p, { parentReal = null, stat = null } = {}) {
   let st = stat;
   if (!st) { try { st = fs.lstatSync(p); } catch { return false; } }
+  if (!st) return false;
   if (st.isSymbolicLink()) return true;
   if (!st.isDirectory()) return false;
   try { fs.readlinkSync(p); return true; } catch { /* not a link readlink can read */ }

package/runtime/scripts/api/sops/lib.mjs

@@ -104,7 +104,11 @@ export const SELECTED_AGE_VERSIONS = new Set(['1.2.1', '1.3.1']);
 const IDENTITY_TIMEOUT_MS = 20_000;
 const CONTROLLED_ENV = new Set(['SOPS_AGE_KEY', 'SOPS_AGE_KEY_FILE', 'SOPS_AGE_KEY_CMD', 'SOPS_AGE_SSH_PRIVATE_KEY_FILE', 'SOPS_AGE_SSH_PRIVATE_KEY_CMD', 'SOPS_AGE_RECIPIENT', 'SOPS_KEYSERVICE', 'SOPS_ENABLE_LOCAL_KEYSERVICE', 'SOPS_DECRYPTION_ORDER', 'SOPS_KMS_ARN', 'SOPS_GCP_KMS_IDS', 'SOPS_HUAWEICLOUD_KMS_IDS', 'SOPS_AZURE_KEYVAULT_URLS', 'SOPS_VAULT_URIS', 'SOPS_PGP_FP', 'SOPS_AGE_RECIPIENTS', 'HOME', 'USERPROFILE', 'APPDATA', 'XDG_CONFIG_HOME']);
 
-/** Construct only the child map; empty desktop roots make Go return directory errors, not fallback paths. */
+/**
+ * Construct only the child map; empty desktop roots make Go return directory errors, not fallback paths.
+ * @param {object} env The admitted caller environment.
+ * @param {string|null} inlineName Selected inline identity name, or null to omit every identity.
+ */
 function isolatedSopsEnv(env, inlineName = 'SOPS_AGE_KEY') {
   const out = Object.fromEntries(Object.entries(env).filter(([name]) => !CONTROLLED_ENV.has(name.toUpperCase())));
   out.HOME = ''; out.USERPROFILE = ''; out.APPDATA = ''; out.XDG_CONFIG_HOME = '';

package/runtime/scripts/hfs/architecture/i18n-keys.mjs

@@ -65,7 +65,7 @@ function templatePatternOf(node) {
   return [node.head.text, ...node.templateSpans.map(span => span.literal.text)].join('\u0000').split('.').map(segment => {
     if (!segment.includes('\u0000')) return segment;
     const parts = segment.split('\u0000');
-    return parts.every(part => part === '') ? '*' : new RegExp(`^${parts.map(escapeRegExp).join('.*')}$`, 'su');
+    return parts.every(part => part === '') ? '*' : new RegExp(`^${parts.map((part) => escapeRegExp(part)).join('.*')}$`, 'su');
   });
 }
 

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -72,8 +72,7 @@ function stronglyConnected(adjacency) {
   for (const start of adjacency.keys()) {
     if (state.index.has(start)) continue;
     startTraversal(state, adjacency, start);
-    while (state.work.length) {
-      const frame = state.work.at(-1);
+    for (let frame = state.work.at(-1); frame; frame = state.work.at(-1)) {
       const next = frame.iterator.next();
       if (next.done) {
         finishFrame(state, frame);

package/runtime/scripts/hfs/db-plan-verb.mjs

@@ -1,7 +1,7 @@
 // app db plan: compare migration-owned state without fetching commands or Vault values.
 import fs from 'node:fs';
 import path from 'node:path';
-import { createHash } from 'node:crypto';
+import { sha256 } from '../../engine/digest.mjs';
 import pg from 'libpg-query';
 import { parse as parseToml } from 'smol-toml';
 import { invocationDir } from '../lib/roots.mjs';
@@ -19,12 +19,11 @@ const PRESENCE_SQL = `select
   pg_catalog.to_regclass('vault.secrets') is not null as vault;`;
 const INVENTORIES = {
   migrations: 'select version from supabase_migrations.schema_migrations order by version;',
-  cron: 'select jobname as name, schedule, pg_catalog.md5(command) as "commandHash", active from cron.job order by jobid;',
+  cron: 'select jobname as name, schedule, pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(command, \'UTF8\')), \'hex\') as "commandHash", active from cron.job order by jobid;',
   queues: 'select queue_name as name from pgmq.meta order by queue_name;',
   vault: 'select name from vault.secrets order by name;',
 };
 const names = (nodes) => sqlStringParts(nodes).join('.');
-const hash = (command) => createHash('md5').update(command).digest('hex');
 const OWNERSHIP_CALLS = new Set(['pgmq.create', 'pgmq.drop_queue', 'cron.schedule', 'cron.unschedule', 'cron.schedule_in_database', 'cron.alter_job']);
 
 const parseSql = sqlParser(pg, () => { throw new DbVerbError('migration SQL could not be inventoried safely'); });
@@ -45,7 +44,7 @@ function inventoryCall(state, call) {
     const job = requiredLiteral(call, 0, ['job_name']);
     const schedule = requiredLiteral(call, 1, ['schedule']);
     const command = requiredLiteral(call, 2, ['command']);
-    state.cron.set(job, { schedule, commandHash: hash(command), active: true });
+    state.cron.set(job, { schedule, commandHash: sha256(command), active: true });
   } else if (name === 'cron.unschedule') {
     state.cron.delete(requiredLiteral(call, 0, ['job_name']));
   } else if (name === 'cron.schedule_in_database' || name === 'cron.alter_job') {
@@ -224,7 +223,7 @@ function compare(expected, actual, kind) {
   for (const row of actual) {
     const key = kind === 'migrations' ? row.version : row.name;
     if (key !== null && (typeof key !== 'string' || key.length === 0)) throw new DbVerbError('Supabase returned an invalid inventory identifier');
-    if (kind === 'cron' && (typeof row.schedule !== 'string' || !/^[a-f0-9]{32}$/.test(row.commandHash ?? '') || typeof row.active !== 'boolean')) throw new DbVerbError('Supabase returned invalid cron metadata');
+    if (kind === 'cron' && (typeof row.schedule !== 'string' || !/^[a-f0-9]{64}$/.test(row.commandHash ?? '') || typeof row.active !== 'boolean')) throw new DbVerbError('Supabase returned invalid cron metadata');
     if (!unmatched.delete(key)) unexpected += 1;
     else if (kind === 'cron') {
       const desired = expected.get(key);

package/runtime/scripts/hfs/rule-catalog.mjs

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
 import { parseYamlCached } from '../lib/yaml-cached.mjs';
 import { jsonClone } from '../lib/json-clone.mjs';
+import { byCodeUnit } from '../lib/list.mjs';
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { SEMVER } from './manifest-shape.mjs';
 import { enforcerJudgedInEdition, judgedInEdition, ruleEditionProblems } from './edition-slots.mjs';
@@ -39,7 +40,7 @@ function relativePathProblem(value, label, bad, anchor = false) {
   const parts = typeof value === 'string' ? value.split('#') : [];
   const file = parts[0];
   const valid = typeof value === 'string' && value.trim() === value && value.length > 0
-    && !/[\r\n\u0000\\]/.test(value) && !/^(?:\/|[a-z][a-z0-9+.-]*:)/i.test(value) && !file.includes(':')
+    && !value.includes('\0') && !/[\r\n\\]/.test(value) && !/^(?:\/|[a-z][a-z0-9+.-]*:)/i.test(value) && !file.includes(':')
     && !file.split('/').some((part) => ['', '.', '..'].includes(part))
     && (parts.length === 1 || (anchor && parts.length === 2 && /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(parts[1])));
   if (!valid) bad.push(`${label} must be a repository-relative path${anchor ? ' with an optional #anchor' : ''}`);
@@ -51,7 +52,7 @@ function unknownKeys(item, allowed, label, bad) {
 
 function nonEmptyList(value, label, bad) {
   if (!Array.isArray(value) || !value.length) { bad.push(`${label} must be a non-empty list`); return false; }
-  const normalized = value.map((value) => JSON.stringify(value, (_key, item) => isPlainObject(item) ? Object.fromEntries(Object.keys(item).sort().map((key) => [key, item[key]])) : item));
+  const normalized = value.map((value) => JSON.stringify(value, (_key, item) => isPlainObject(item) ? Object.fromEntries(Object.keys(item).sort(byCodeUnit).map((key) => [key, item[key]])) : item));
   if (new Set(normalized).size !== value.length) bad.push(`${label} repeats a value`);
   return true;
 }

package/runtime/scripts/hfs/rules/deploy-scan.mjs

@@ -8,7 +8,7 @@ const DEPLOY = /(?:^|\/)deploy\//;
 const SCRIPT = /(?:^|\/)scripts\//;
 const COMPOSE = /(?:^|\/)(?:docker-)?compose(?:[.-][^/]*)?\.ya?ml$/;
 const DOCKERFILE = /(?:^|\/)Dockerfile(?:\.[^/]*)?$/;
-const CREDENTIAL_FILE = /(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/)|\.enc$/i;
+const CREDENTIAL_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/))|(?:\.enc$)/i;
 const HOST_CRON = /\b(?:crontab|anacron|crond|supercronic)\b|\/etc\/cron(?:\b|[./])|\bcron\.d\b|\/var\/spool\/cron\b|@(?:reboot|yearly|annually|monthly|weekly|daily|midnight|hourly)\b|\b[\w.@-]+\.timer\b|\bOn(?:Calendar|BootSec|UnitActiveSec|ActiveSec)\s*=|(?:^|[\s;|&"'])at\s+(?:(?:-[a-z]+\s+)*)((?:-[ft]\b)|now\b|tomorrow\b|\d{1,2}:\d{2}\b|midnight\b|noon\b)/im;
 const HOST_CRON_PATH = /(?:^|\/)(?:crontab(?:$|\/)|cron\.d(?:\/|$)|[^/]+\.(?:timer|crontab)$)/;
 const CRON_NUMERIC_FIELD = /^[\d*,/-]+$/;

package/runtime/scripts/hfs/rules/doc-fresh.mjs

@@ -228,7 +228,7 @@ function injectionTokens(repoRoot, tracked) {
   const ts = loadTypescript(repoRoot, path.dirname(fileURLToPath(import.meta.url)));
   if (!ts) return tokens;
   for (const file of tracked) {
-    if (!/\.[cm]?[jt]sx?$/.test(file) || /(?:^|\/)(?:tests?|__tests__)\/|(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/.test(file)) continue;
+    if (!/\.[cm]?[jt]sx?$/.test(file) || /(?:(?:^|\/)(?:tests?|__tests__)\/)|(?:(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$)/.test(file)) continue;
     const text = readText(repoRoot, file) ?? '';
     declaredTokens(ts, ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true), tokens);
   }

package/runtime/scripts/hfs/rules/frontend-tree.mjs

@@ -37,7 +37,7 @@ function wireSchemaDigest(repoRoot, snapshots) {
   for (const snapshot of [...snapshots].sort(byCodeUnit)) {
     let source;
     try { source = fs.readFileSync(path.join(repoRoot, snapshot), 'utf8'); } catch { return null; }
-    hash.update(`${snapshot}\0${source.replace(/\r\n/g, '\n')}\0`);
+    hash.update(`${snapshot}\0${source.replaceAll('\r\n', '\n')}\0`);
   }
   return hash.digest('hex');
 }

package/runtime/scripts/hfs/rules/release-provenance.mjs

@@ -79,7 +79,7 @@ function refProof(value) {
   if (typeof value !== 'string') return 0;
   const expression = unwrap(workflowExpression(value));
   const alternatives = splitBoolean(expression, '||');
-  if (alternatives.length > 1) return alternatives.map(refProof).reduce((a, b) => a & b);
+  if (alternatives.length > 1) return alternatives.map(refProof).reduce((a, b) => a & b, RELEASE_REF);
   const conjuncts = splitBoolean(expression, '&&');
   if (conjuncts.length > 1) return conjuncts.map(refProof).reduce((a, b) => a | b, 0);
   if (/^startsWith\(\s*github\.ref\s*,\s*(['"])refs\/tags\/v\1\s*\)$/.test(expression)) return RELEASE_REF;

package/runtime/scripts/hfs/rules/script-hygiene.mjs

@@ -7,7 +7,7 @@ const PLAINTEXT_LOAD = 'HFS_SCRIPT_PLAINTEXT_LOAD';
 const XTRACE = 'HFS_SCRIPT_XTRACE';
 const SERVICE_ROLE = 'HFS_SERVICE_ROLE_SCOPE';
 const SUPABASE_OWNER = 'be.integrations.supabase';
-const SECRET_FILE = /(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|\.nivo-lite(?:\/|$))|\.enc$/iu;
+const SECRET_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|\.nivo-lite(?:\/|$)))|(?:\.enc$)/iu;
 const EXCLUDED_TREE = /(?:^|\/)(?:node_modules|\.git|\.claude|\.secrets|secrets|tests?|__tests__|docs|coverage|dist|build)(?:\/|$)/u;
 const TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/u;
 const SOURCE = /\.(?:[cm]?[jt]sx?|sh|bash|zsh|ksh|ps1|psm1|bat|cmd|py|rb|pl)$/iu;

package/runtime/scripts/hfs/rules/stack-tooling.mjs

@@ -13,7 +13,7 @@ const SCRIPTS_DIR = /(?:^|\/)scripts\//;
 const PACKAGE_JSON = /(?:^|\/)package\.json$/;
 const SOURCE_FILE = /(?:^|\/)[^/.]+$|\.(?:sh|bash|zsh|mjs|cjs|js|ts|mts|py|ya?ml)$/;
 const TEST_FILE = /\.(?:spec|test)\.[cm]?[jt]s$/;
-const CREDENTIAL_FILE = /(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/)|\.enc$/i;
+const CREDENTIAL_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/))|(?:\.enc$)/i;
 const VERB_FILE = /^(render|provision|converge|verify|prune|rollback|release|backup|prepare|doctor|jobs|public)\.(?:mjs|js|cjs|sh)$/;
 const COMMENT_LINE = /^[ \t]*(?:#|\/\/).*$/gm;
 const LINE_CONTINUATION = /\\\r?\n\s*/g;

package/runtime/scripts/hfs/rules/stacks-release.mjs

@@ -26,7 +26,7 @@ const DECLARATION = '.starcistacks/application-stacks.yaml';
 const MAX_BYTES = 1024 * 1024;
 const SOURCE = /^(?:be\/)?(?:src|apps)\/.*\.[cm]?[jt]s$/;
 const TEST = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]s$|\/(?:tests|__tests__)\//;
-const SECRET = /(?:^|\/)(?:secrets|\.claude|\.aws|\.codex)(?:\/|$)|(?:^|\/)\.env(?:\.|$)|\.(?:enc|pem|key|p12|pfx)$/i;
+const SECRET = /(?:(?:^|\/)(?:secrets|\.claude|\.aws|\.codex)(?:\/|$))|(?:(?:^|\/)\.env(?:\.|$))|(?:\.(?:enc|pem|key|p12|pfx)$)/i;
 const CLI_ENTRY = /^(?:be\/)?dist\/apps\/cli\/[A-Za-z0-9_./-]+\.(?:js|mjs|cjs)$/;
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());

package/runtime/scripts/hfs/rules/stacks-swarm.mjs

@@ -16,7 +16,7 @@ const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());
 const VERSION = /^[1-9][0-9]*$/;
 const VERSIONED_SECRET = /-v[1-9][0-9]*$/;
-const SENSITIVE_KEY = /password|passwd|secret|token|credential|private[_-]?key|api[_-]?key|service[_-]?role|(?:^|_)key$/i;
+const SENSITIVE_KEY = /password|passwd|secret|token|credential|private[_-]?key|api[_-]?key|service[_-]?role|(?:(?:^|_)key$)/i;
 const SOURCE = /^be\/(?:apps|src)\/.*\.[cm]?[jt]sx?$/;
 const TEST_SOURCE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$|\/tests\//;
 const REALTIME_SOURCE = /^be\/src\/features\/realtime\/[^/]+\//;

package/runtime/scripts/hfs/rules/supply-chain.mjs

@@ -32,6 +32,7 @@ function appendShellCommand(commands, state, next) {
 }
 
 function shellLineCommands(line, commands) {
+  /** @type {{quote: string | null, command: string, separator: string | null}} */
   const state = { quote: null, command: '', separator: null };
   for (let i = 0; i < line.length; i++) {
     const char = line[i];

package/runtime/scripts/hfs/rules/workflow-contexts.mjs

@@ -76,7 +76,7 @@ function expressions(value) {
 
 /** Source markers travel inside parsed scalar expressions, preserving flow maps, quoted keys and repeated values without matching comments. */
 export function workflowContextFindings({ path: file, text }) {
-  const marked = text.replace(/\$\{\{/g, (match, offset) => `${match} __hfs_context_line_${text.slice(0, offset).split('\n').length}__ `);
+  const marked = text.replaceAll('${{', (match, offset) => `${match} __hfs_context_line_${text.slice(0, offset).split('\n').length}__ `);
   const findings = [];
   function inspect(value, keys) {
     const allowed = allowedContexts(keys);

package/runtime/scripts/hfs/secret-bootstrap-crypto.mjs

@@ -22,7 +22,7 @@ function checksumStep(checksum, value) {
 function checksumWords(prefix, words) {
   const codes = [...prefix].map((character) => character.codePointAt(0));
   const expanded = [...codes.map((code) => code >>> 5), 0, ...codes.map((code) => code & 31)];
-  return [...expanded, ...words].reduce(checksumStep, 1);
+  return [...expanded, ...words].reduce((checksum, value) => checksumStep(checksum, value), 1);
 }
 
 function convertBits(input, from, to, pad) {

package/runtime/scripts/lib/path-key.mjs

@@ -40,6 +40,8 @@ export const pathsOverlap = (a, b) => sameOrUnder(a, b) || sameOrUnder(b, a);
  * `trim` blanks at the ends, `collapse` folds '//' runs to '/', `dot` drops a leading './',
  * `glob` strips a trailing glob ('star': '*'/'**' with their slash, 'double': a '/**' only),
  * `fold` lowercases. A trailing '/' always goes. Null reads as ''.
+ * @param {unknown} p
+ * @param {{trim?: boolean, collapse?: boolean, dot?: boolean, glob?: string|null, fold?: boolean}} [options]
  */
 export const normPath = (p, { trim = false, collapse = false, dot = false, glob = null, fold = false } = {}) => {
   let s = String(p ?? '');

package/runtime/scripts/lib/secret-patterns.mjs

@@ -173,7 +173,7 @@ function readmeBadgeText(text, manifestText) {
 
 /** Whole-file secret judgement exempts only declared public badge values and preserves original line numbers and every provider shape. */
 export function secretHitsInFile(file, fullText, { manifestText } = {}) {
-  const normalized = file.replace(/\\/g, '/');
+  const normalized = file.replaceAll('\\', '/');
   let text = fullText;
   if (/(?:^|\/)\.starcistacks\/application-stacks\.yaml$/.test(normalized)) text = manifestBadgeText(text);
   if (/(?:^|\/)README\.md$/.test(normalized)) text = readmeBadgeText(text, manifestText);

package/runtime/scripts/lib/ts-analysis.mjs

@@ -1,9 +1,13 @@
 /** The expression under the wrappers selected by an AST check's contract. */
 export function unwrapExpression(ts, expression, { awaitExpressions = false, typeAssertions = true, nonNullExpressions = true, satisfiesExpressions = true } = {}) {
-  while (expression && (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression)
-    || (typeAssertions && ts.isTypeAssertionExpression(expression)) || (nonNullExpressions && ts.isNonNullExpression(expression))
-    || (satisfiesExpressions && (ts.isSatisfiesExpression?.(expression) ?? false))
-    || (awaitExpressions && ts.isAwaitExpression(expression)))) expression = expression.expression;
+  while (expression) {
+    const wrapper = ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression)
+      || (typeAssertions && ts.isTypeAssertionExpression(expression)) || (nonNullExpressions && ts.isNonNullExpression(expression))
+      || (satisfiesExpressions && (ts.isSatisfiesExpression?.(expression) ?? false))
+      || (awaitExpressions && ts.isAwaitExpression(expression));
+    if (!wrapper) break;
+    expression = expression.expression;
+  }
   return expression;
 }
 

package/stack/cli.mjs

@@ -7,6 +7,7 @@ import { stackContext } from './context.mjs';
 import { loadDeployConfig } from './config.mjs';
 import { withDockerTransport } from './docker-transport.mjs';
 import { StackError, EXIT, refusal } from './errors.mjs';
+import { parseTargetBinding, bindStackTarget, nativeToolEnvironment } from './target-binding.mjs';
 
 /** The actions that drive the docker CLI of the operator machine (pointed at the manager by docker-transport.mjs when the key is sealed). */
 const DOCKER_ACTIONS = new Set(['deploy', 'accept', 'converge', 'verify', 'rollback', 'prune']);
@@ -14,7 +15,7 @@ const DOCKER_ACTIONS = new Set(['deploy', 'accept', 'converge', 'verify', 'rollb
 export const ACTIONS = Object.freeze(['prepare', 'doctor', 'connect', 'disconnect', 'build-args', 'render', 'deploy', 'converge', 'verify', 'rollback', 'prune', 'backup', 'jobs', 'task', 'ingress', 'retire', 'build', 'accept']);
 
 const BOOLEAN = new Set(['--execute', '--json', '--swarm-state', '--init-swarm', '--owner-approved', '--fix-live-restore', '--skip-public', '--skip-internal', '--allow-unpinned', '--push']);
-const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out', '--release', '--since', '--timeout', '--retry', '--keep', '--app', '--ssh-cmd', '--extra-compose', '--project']);
+const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out', '--release', '--since', '--timeout', '--retry', '--keep', '--app', '--ssh-cmd', '--extra-compose', '--project', '--target-binding']);
 const REPEAT = new Set(['--image', '--keep', '--extra-compose', '--project']);
 
 /** Splits argv into { flags, positional }; an unknown flag or a flag without its value is a refusal. */
@@ -107,6 +108,12 @@ function print(ctx, action, flags, result) {
   else for (const line of result.lines ?? []) ctx.stdout(`${line}\n`);
 }
 
+function nativeToolContext(ctx, binding) {
+  if (!binding) return ctx;
+  return Object.create(ctx, { spawn: { value: (command, args, options = {}) => ctx.spawn(command, args,
+    { ...options, env: nativeToolEnvironment(options.env ?? ctx.env) }) } });
+}
+
 /** Runs one action; returns the exit code. `io.importer` lets a spec load fake action modules. */
 export async function stackMain(argv, io = {}) {
   const ctx = stackContext(io);
@@ -114,12 +121,16 @@ export async function stackMain(argv, io = {}) {
     const { flags, positional } = parseFlags(argv.slice(1));
     const action = argv[0];
     if (!ACTIONS.includes(action)) throw refusal('STACK_USAGE', `starci app stack takes ${[...ACTIONS, 'up', 'down', 'status'].join(', ')}`);
-    const config = loadDeployConfig({ repoRoot: ctx.cwd, env: flags.env ?? 'production' });
+    const binding = parseTargetBinding(flags['target-binding'], 'docker-swarm');
+    if (binding && (!['deploy', 'verify'].includes(action) || flags['ssh-cmd'] || flags['skip-public'] || flags['skip-internal']))
+      throw refusal('STACK_USAGE', 'the bound native consumer supports only complete deploy or verify');
+    const config = bindStackTarget(ctx, loadDeployConfig({ repoRoot: ctx.cwd, env: flags.env ?? 'production' }), binding);
     const options = OPTIONS[action]({ flags, positional, cwd: ctx.cwd });
     const handler = await handlerOf(action, io.importer ?? ((file) => import(file)));
     const sshCmd = flags['ssh-cmd'] ?? null;
     const call = (context) => handler(context, config, { ...options, sshCmd });
-    const result = DOCKER_ACTIONS.has(action) ? await withDockerTransport(ctx, config, { sshCmd }, call) : await call(ctx);
+    const toolContext = nativeToolContext(ctx, binding);
+    const result = DOCKER_ACTIONS.has(action) ? await withDockerTransport(toolContext, config, { sshCmd }, call) : await call(toolContext);
     print(ctx, action, flags, result);
     return result.ok ? EXIT.ok : EXIT.failed;
   } catch (error) {

package/stack/docker-transport.mjs

@@ -17,6 +17,7 @@ const controlLines = (controlPath) => controlSettings(configPath(controlPath)).m
 
 /** True when the operator's docker CLI has to be pointed at the manager by this module. */
 function needed(ctx, config, sshCmd) {
+  if (config.nativeTarget) return true;
   if (sshCmd || ctx.env.DOCKER_HOST || ctx.env.GITHUB_ACTIONS === 'true' || ctx.env.STARCI_STACK_SEALED_SSH === '0') return false;
   const { sealed } = config.remote;
   if (!sealed) return false;
@@ -27,6 +28,7 @@ function sshConfig(session, controlPath, windows) {
   const at = session.account.lastIndexOf('@');
   return [
     `Host ${ALIAS}`, `  HostName ${session.account.slice(at + 1)}`, `  User ${session.account.slice(0, at)}`,
+    ...(session.port ? [`  Port ${session.port}`] : []),
     `  IdentityFile ${configPath(session.keyFile)}`, '  IdentitiesOnly yes', `  UserKnownHostsFile ${configPath(session.knownFile)}`,
     `  StrictHostKeyChecking ${session.strict}`, '  BatchMode yes', '  ConnectTimeout 20',
     ...(windows ? [] : controlLines(controlPath)), '',
@@ -102,7 +104,7 @@ export async function withDockerTransport(ctx, config, { sshCmd = null } = {}, b
     const baseEnv = session ? dockerEnvironment(ctx, session, controlPath) : ctx.env;
     const { env, executable } = privateSshEnvironment(ctx, baseEnv, dir, controlPath);
     const configFile = path.join(env.HOME ?? '', '.ssh', 'config');
-    const options = ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=20'];
+    const options = ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=20', ...(session?.port ? ['-p', String(session.port)] : [])];
     const argv = session || executable !== 'ssh' ? [executable, ...options, '-F', configFile, '--', alias] : ['ssh', ...options, '--', alias];
     connection = createSshSession(ctx, { argv, env, controlPath, cleanup });
     const spawn = dockerSpawn(ctx, connection, env, alias);

package/stack/remote.mjs

@@ -14,6 +14,7 @@ import { tool } from './context.mjs';
 import { restrictToUser, writePrivate } from './private-file.mjs';
 import { refusal } from './errors.mjs';
 import { createSshSession, sessionDirectory } from './ssh-session.mjs';
+import { assertStackAccount } from './target-binding.mjs';
 
 const ACCOUNT = /^[A-Za-z0-9._@-]+$/u;
 const CI_VARIABLES = ['VPS_SSH_KEY', 'VPS_KNOWN_HOSTS', 'VPS_HOST', 'VPS_USER'];
@@ -92,9 +93,12 @@ function writeWithMode(file, text, mode) {
 export function openSealedSession(ctx, config) {
   const { sealed } = config.remote;
   const account = opsAccount(ctx, config);
+  if (config.nativeTarget && account !== `${config.nativeTarget.user}@${config.nativeTarget.host}`)
+    throw refusal('STACK_REMOTE_OPS', 'the sealed SSH account differs from the accepted native target');
   const key = binaryMember(ctx, config, sealed.sshKey, ['privateKey', 'key']);
   if (!key.includes('PRIVATE KEY')) throw refusal('STACK_REMOTE_KEY', `${sealed.sshKey} does not hold a PEM private key`);
   const known = binaryMember(ctx, config, sealed.knownHosts, ['knownHosts', 'known_hosts']).trim();
+  assertStackAccount(config.nativeTarget, account, known);
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'stack-ssh-'));
   const keyFile = path.join(dir, 'id');
   const knownFile = path.join(dir, 'known_hosts');
@@ -113,13 +117,14 @@ export function openSealedSession(ctx, config) {
     throw error;
   }
   const notes = known ? [] : ['owner-machine session without known_hosts: the host key is accepted on first contact (accept-new); verify it, CI never does this'];
-  return { account, dir, keyFile, knownFile, strict: known ? 'yes' : 'accept-new', notes, cleanup };
+  return { account, dir, keyFile, knownFile, strict: known ? 'yes' : 'accept-new', notes, cleanup,
+    ...(config.nativeTarget ? { port: config.nativeTarget.port } : {}) };
 }
 
 /** The owner-machine runner over that session. */
 function sealedRunner(ctx, config) {
   const session = openSealedSession(ctx, config);
-  const argv = ['ssh', '-T', '-i', session.keyFile, '-o', 'IdentitiesOnly=yes', '-o', `UserKnownHostsFile=${session.knownFile}`, '-o', `StrictHostKeyChecking=${session.strict}`, '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=20', session.account];
+  const argv = ['ssh', '-T', ...(session.port ? ['-p', String(session.port)] : []), '-i', session.keyFile, '-o', 'IdentitiesOnly=yes', '-o', `UserKnownHostsFile=${session.knownFile}`, '-o', `StrictHostKeyChecking=${session.strict}`, '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=20', session.account];
   return sessionRunner(ctx, argv, session.dir, session.cleanup, session.notes);
 }
 
@@ -143,6 +148,7 @@ function sshRunner(ctx, config, { sshCmd = null } = {}) {
  */
 function withOwnerTransport(ctx, config, { sshCmd = null } = {}) {
   const { sealed } = config.remote;
+  if (config.nativeTarget) return Object.create(ctx, { env: { value: { ...ctx.env, STARCI_STACK_SEALED_SSH: '1' }, enumerable: true } });
   if (sshCmd || !sealed || ctx.env.GITHUB_ACTIONS === 'true' || ctx.env.STARCI_STACK_SEALED_SSH !== undefined) return ctx;
   const present = [sealed.ops, sealed.sshKey, sealed.knownHosts].every((slug) => fs.existsSync(path.join(config.secretsDir, `${slug}.enc`)));
   if (!present) return ctx;

package/stack/target-binding.mjs

@@ -0,0 +1,125 @@
+// Public endpoint assertions for admitted native consumers; this module never opens custody.
+import fs from 'node:fs';
+import path from 'node:path';
+import { refusal } from './errors.mjs';
+
+const slug = value => typeof value === 'string' && /^[a-z][a-z0-9-]*$/.test(value);
+const label = value => typeof value === 'string' && /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/.test(value);
+const host = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(value);
+const port = value => Number.isInteger(value) && value > 0 && value <= 65535;
+const denied = () => { throw refusal('STACKS_DEPLOY_CONFIG_INVALID', 'the native endpoint binding is invalid or differs from the selected owner target'); };
+const exact = (value, fields) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).length === fields.length && fields.every(key => Object.hasOwn(value, key));
+
+function ordinaryInput(root, file) {
+  if (typeof root !== 'string' || !path.isAbsolute(root)) denied();
+  const relative = path.relative(root, file);
+  if (!relative || path.isAbsolute(relative) || relative.split(path.sep).includes('..')) denied();
+  let current = root;
+  const parts = relative.split(path.sep);
+  for (let index = 0; index <= parts.length; index += 1) {
+    let stat;
+    try { stat = fs.lstatSync(current); } catch { denied(); }
+    if (stat.isSymbolicLink() || (index === parts.length ? !stat.isFile() || stat.nlink !== 1 : !stat.isDirectory())) denied();
+    if (index < parts.length) current = path.join(current, parts[index]);
+  }
+}
+
+/** A bound native owner opens only an ordinary envelope below its actual app, without ancestor links. */
+export const assertBoundCustody = (root, file) => ordinaryInput(root, file);
+
+/** Bound database commands require the app-local launcher; they cannot discover a global replacement. */
+export function boundSupabaseLauncher(root) {
+  const launcher = path.join(root, 'node_modules', 'supabase', 'dist', 'supabase.js');
+  ordinaryInput(root, launcher);
+  return launcher;
+}
+
+/** Native custody can use AGE; tools that do not decrypt custody must not inherit that identity. */
+export function nativeToolEnvironment(env) {
+  return Object.fromEntries(Object.entries(env).filter(([key]) => !/^SOPS_/i.test(key)));
+}
+
+/** Bound database tools receive only their selected private password and native routing, without ambient libpq or provider credentials. */
+export function nativeDatabaseEnvironment(env, binding, selected = {}, omit = []) {
+  const omitted = new Set(omit.filter(value => typeof value === 'string').map(value => value.toUpperCase()));
+  return { ...Object.fromEntries(Object.entries(nativeToolEnvironment(env)).filter(([key]) => !/^(?:PG[A-Z_]*|SUPABASE_)/i.test(key) && !omitted.has(key.toUpperCase()))),
+    'SUPABASE_ENV': binding.environment, ...selected };
+}
+
+/** Preserve a logical linked project while selecting a fixed native SQL endpoint without the CLI's linked Management finalizer. */
+export function boundLinkedDatabaseUrl(binding, savedPooler = null) {
+  if (!binding || binding.mode !== 'linked' || !/^[a-z0-9]{20}$/.test(binding.projectRef)) denied();
+  if (savedPooler === null) return `postgresql://postgres@db.${binding.projectRef}.supabase.co:5432/postgres?sslmode=require`;
+  let url;
+  try {
+    if (typeof savedPooler !== 'string' || savedPooler.length > 8192) denied();
+    url = new URL(savedPooler.trim());
+    if (!['postgres:', 'postgresql:'].includes(url.protocol) || !/^[A-Za-z0-9.-]+\.pooler\.supabase\.com$/.test(url.hostname)
+      || decodeURIComponent(url.username) !== `postgres.${binding.projectRef}` || url.pathname !== '/postgres'
+      || url.port && !['5432', '6543'].includes(url.port) || url.hash
+      || [...url.searchParams].some(([key, value]) => key !== 'sslmode' || !['require', 'verify-full'].includes(value))) denied();
+  } catch { denied(); }
+  url.password = '';
+  url.port = '5432';
+  if (!url.searchParams.has('sslmode')) url.searchParams.set('sslmode', 'require');
+  return url.toString();
+}
+
+/** Parse the internal public binding; ordinary commands without this flag retain their native behavior. */
+export function parseTargetBinding(text, kind) {
+  if (text === undefined) return null;
+  let binding;
+  try { if (typeof text !== 'string' || text.length > 4096) denied(); binding = JSON.parse(text); } catch { denied(); }
+  if (binding?.kind !== kind || !slug(binding.environment)) denied();
+  if (kind === 'docker-swarm') {
+    if (!exact(binding, ['kind', 'environment', 'stack', 'host', 'user', 'port']) || !slug(binding.stack)
+      || !host(binding.host) || !label(binding.user) || binding.port !== 22) denied();
+  } else if (kind === 'supabase-db') {
+    if (binding.mode === 'local') {
+      if (!exact(binding, ['kind', 'mode', 'environment', 'localProject', 'port']) || !label(binding.localProject) || !port(binding.port)) denied();
+    } else if (binding.mode === 'linked') {
+      if (!exact(binding, ['kind', 'mode', 'environment', 'projectRef']) || !/^[a-z0-9]{20}$/.test(binding.projectRef ?? '')) denied();
+    } else if (binding.mode === 'url-env') {
+      if (!exact(binding, ['kind', 'mode', 'environment', 'urlEnv', 'host', 'port', 'database', 'user'])
+        || !/^[A-Z][A-Z0-9_]*$/.test(binding.urlEnv ?? '') || !host(binding.host) || !port(binding.port)
+        || !label(binding.database) || !label(binding.user)) denied();
+    } else denied();
+  } else denied();
+  return Object.freeze(binding);
+}
+
+/** Require the selected sealed transport before any fallback can reach an operator's Docker or SSH context. */
+export function bindStackTarget(ctx, config, binding) {
+  if (!binding) return config;
+  if (binding.kind !== 'docker-swarm' || binding.environment !== config.env || binding.stack !== config.stack
+    || !config.remote.sealed || ctx.env.DOCKER_HOST || ctx.env.DOCKER_CONTEXT || ctx.env.GITHUB_ACTIONS
+    || ctx.env.STARCI_STACK_SEALED_SSH !== undefined) denied();
+  for (const member of Object.values(config.remote.sealed)) {
+    const file = path.join(config.secretsDir, `${member}.enc`);
+    assertBoundCustody(config.repoRoot, file);
+  }
+  return { ...config, nativeTarget: binding };
+}
+
+/** Compare the effective private SSH account before key files, sessions or network effects exist. */
+export function assertStackAccount(binding, account, knownHosts) {
+  if (!binding) return;
+  if (account !== `${binding.user}@${binding.host}` || binding.port !== 22 || !knownHosts.trim()) denied();
+}
+
+/** Compare the effective local Supabase identity after its existing config/environment resolver. */
+export function assertLocalDatabase(binding, target) {
+  if (binding && (binding.mode !== 'local' || binding.localProject !== target.project || binding.port !== target.port)) denied();
+}
+
+/** Refuse a selected URL unless its non-secret endpoint exactly matches the accepted target. */
+export function assertUrlDatabase(binding, value) {
+  if (!binding) return;
+  let url;
+  try { url = new URL(value); } catch { denied(); }
+  if (binding.mode !== 'url-env' || !['postgres:', 'postgresql:'].includes(url.protocol)
+    || url.hostname !== binding.host || Number(url.port || '5432') !== binding.port
+    || decodeURIComponent(url.username) !== binding.user || decodeURIComponent(url.pathname.slice(1)) !== binding.database
+    || url.search || url.hash || !url.password) denied();
+}