@starci/hfs 4.7.11 → 4.7.12

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 4.7.12 - 2026-10-19
+- Fixed: bundled source analysis uses explicit nullable contracts, unary callback arguments and grouped regular-expression alternatives while preserving refusal paths; canon pins follow the matching package cohort.
+
 ## 4.7.11 - 2026-10-19
 - Changed: app release and Sonar adapters use native target binding, with local database migration and Docker transport preserving the declared stack target.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.11",
+  "version": "4.7.12",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/engine/digest.mjs

@@ -0,0 +1,16 @@
+// digest.mjs — the one SHA-256 the runtime hashes with. A leaf: every file's integrity digest,
+// every ledger input ref and every stamped asset is this function, so a byte stream and a file
+// never disagree about what their digest is.
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+
+/** The lowercase hex SHA-256 of `value` (string, Buffer or TypedArray). */
+export const sha256 = (value) => createHash('sha256').update(value).digest('hex');
+/** The SHA-256 of the file's exact bytes; throws when the file cannot be read. */
+export function sha256File(file){
+  // A numeric descriptor belongs to the caller; positional reads preserve its offset.
+  const owned=typeof file!=='number',fd=owned?fs.openSync(file,'r'):file;
+  const hash=createHash('sha256'),buffer=Buffer.alloc(1024*1024);
+  try{let at=0,n;while((n=fs.readSync(fd,buffer,0,buffer.length,at))>0){hash.update(buffer.subarray(0,n));at+=n;}return hash.digest('hex');}
+  finally{if(owned)fs.closeSync(fd);}
+}

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.17
+    version: 3.4.18
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.17
+    version: 8.4.18
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.11
+    version: 1.7.12
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.11
+    version: 4.7.12
     group: starci
     install: registry
     side: both

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "c357c5a34782ec5039dba046ba98d9d3342881fb600501dd1b9d86bad5fb2cd2",
+  "hash": "8913c2eedad972f96410ed412622ca511f32f9a4f2b5fb8104b745e310007ac5",
   "global": [
     {
       "name": "json",
@@ -10894,7 +10894,8 @@ export const CATALOG = {
             "starci supabase start --cwd <app>"
           ],
           "editions": [
-            "full"
+            "full",
+            "lite"
           ],
           "impl": {
             "module": "scripts/machine/supabase-stack.mjs",
@@ -10931,7 +10932,8 @@ export const CATALOG = {
             "starci supabase status --cwd <app> --json"
           ],
           "editions": [
-            "full"
+            "full",
+            "lite"
           ],
           "impl": {
             "module": "scripts/machine/supabase-stack.mjs",
@@ -10973,7 +10975,8 @@ export const CATALOG = {
             "starci supabase stop --cwd <app> --no-backup"
           ],
           "editions": [
-            "full"
+            "full",
+            "lite"
           ],
           "impl": {
             "module": "scripts/machine/supabase-stack.mjs",

package/runtime/scripts/api/fs/is-link-like.mjs

@@ -15,6 +15,7 @@ import { realpathOr } from '../../lib/fs-kind.mjs';
 export function isLinkLike(p, { parentReal = null, stat = null } = {}) {
   let st = stat;
   if (!st) { try { st = fs.lstatSync(p); } catch { return false; } }
+  if (!st) return false;
   if (st.isSymbolicLink()) return true;
   if (!st.isDirectory()) return false;
   try { fs.readlinkSync(p); return true; } catch { /* not a link readlink can read */ }

package/runtime/scripts/api/sops/lib.mjs

@@ -104,7 +104,11 @@ export const SELECTED_AGE_VERSIONS = new Set(['1.2.1', '1.3.1']);
 const IDENTITY_TIMEOUT_MS = 20_000;
 const CONTROLLED_ENV = new Set(['SOPS_AGE_KEY', 'SOPS_AGE_KEY_FILE', 'SOPS_AGE_KEY_CMD', 'SOPS_AGE_SSH_PRIVATE_KEY_FILE', 'SOPS_AGE_SSH_PRIVATE_KEY_CMD', 'SOPS_AGE_RECIPIENT', 'SOPS_KEYSERVICE', 'SOPS_ENABLE_LOCAL_KEYSERVICE', 'SOPS_DECRYPTION_ORDER', 'SOPS_KMS_ARN', 'SOPS_GCP_KMS_IDS', 'SOPS_HUAWEICLOUD_KMS_IDS', 'SOPS_AZURE_KEYVAULT_URLS', 'SOPS_VAULT_URIS', 'SOPS_PGP_FP', 'SOPS_AGE_RECIPIENTS', 'HOME', 'USERPROFILE', 'APPDATA', 'XDG_CONFIG_HOME']);
 
-/** Construct only the child map; empty desktop roots make Go return directory errors, not fallback paths. */
+/**
+ * Construct only the child map; empty desktop roots make Go return directory errors, not fallback paths.
+ * @param {object} env The admitted caller environment.
+ * @param {string|null} inlineName Selected inline identity name, or null to omit every identity.
+ */
 function isolatedSopsEnv(env, inlineName = 'SOPS_AGE_KEY') {
   const out = Object.fromEntries(Object.entries(env).filter(([name]) => !CONTROLLED_ENV.has(name.toUpperCase())));
   out.HOME = ''; out.USERPROFILE = ''; out.APPDATA = ''; out.XDG_CONFIG_HOME = '';

package/runtime/scripts/hfs/architecture/i18n-keys.mjs

@@ -65,7 +65,7 @@ function templatePatternOf(node) {
   return [node.head.text, ...node.templateSpans.map(span => span.literal.text)].join('\u0000').split('.').map(segment => {
     if (!segment.includes('\u0000')) return segment;
     const parts = segment.split('\u0000');
-    return parts.every(part => part === '') ? '*' : new RegExp(`^${parts.map(escapeRegExp).join('.*')}$`, 'su');
+    return parts.every(part => part === '') ? '*' : new RegExp(`^${parts.map((part) => escapeRegExp(part)).join('.*')}$`, 'su');
   });
 }
 

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -72,8 +72,7 @@ function stronglyConnected(adjacency) {
   for (const start of adjacency.keys()) {
     if (state.index.has(start)) continue;
     startTraversal(state, adjacency, start);
-    while (state.work.length) {
-      const frame = state.work.at(-1);
+    for (let frame = state.work.at(-1); frame; frame = state.work.at(-1)) {
       const next = frame.iterator.next();
       if (next.done) {
         finishFrame(state, frame);

package/runtime/scripts/hfs/db-plan-verb.mjs

@@ -1,7 +1,7 @@
 // app db plan: compare migration-owned state without fetching commands or Vault values.
 import fs from 'node:fs';
 import path from 'node:path';
-import { createHash } from 'node:crypto';
+import { sha256 } from '../../engine/digest.mjs';
 import pg from 'libpg-query';
 import { parse as parseToml } from 'smol-toml';
 import { invocationDir } from '../lib/roots.mjs';
@@ -19,12 +19,11 @@ const PRESENCE_SQL = `select
   pg_catalog.to_regclass('vault.secrets') is not null as vault;`;
 const INVENTORIES = {
   migrations: 'select version from supabase_migrations.schema_migrations order by version;',
-  cron: 'select jobname as name, schedule, pg_catalog.md5(command) as "commandHash", active from cron.job order by jobid;',
+  cron: 'select jobname as name, schedule, pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(command, \'UTF8\')), \'hex\') as "commandHash", active from cron.job order by jobid;',
   queues: 'select queue_name as name from pgmq.meta order by queue_name;',
   vault: 'select name from vault.secrets order by name;',
 };
 const names = (nodes) => sqlStringParts(nodes).join('.');
-const hash = (command) => createHash('md5').update(command).digest('hex');
 const OWNERSHIP_CALLS = new Set(['pgmq.create', 'pgmq.drop_queue', 'cron.schedule', 'cron.unschedule', 'cron.schedule_in_database', 'cron.alter_job']);
 
 const parseSql = sqlParser(pg, () => { throw new DbVerbError('migration SQL could not be inventoried safely'); });
@@ -45,7 +44,7 @@ function inventoryCall(state, call) {
     const job = requiredLiteral(call, 0, ['job_name']);
     const schedule = requiredLiteral(call, 1, ['schedule']);
     const command = requiredLiteral(call, 2, ['command']);
-    state.cron.set(job, { schedule, commandHash: hash(command), active: true });
+    state.cron.set(job, { schedule, commandHash: sha256(command), active: true });
   } else if (name === 'cron.unschedule') {
     state.cron.delete(requiredLiteral(call, 0, ['job_name']));
   } else if (name === 'cron.schedule_in_database' || name === 'cron.alter_job') {
@@ -224,7 +223,7 @@ function compare(expected, actual, kind) {
   for (const row of actual) {
     const key = kind === 'migrations' ? row.version : row.name;
     if (key !== null && (typeof key !== 'string' || key.length === 0)) throw new DbVerbError('Supabase returned an invalid inventory identifier');
-    if (kind === 'cron' && (typeof row.schedule !== 'string' || !/^[a-f0-9]{32}$/.test(row.commandHash ?? '') || typeof row.active !== 'boolean')) throw new DbVerbError('Supabase returned invalid cron metadata');
+    if (kind === 'cron' && (typeof row.schedule !== 'string' || !/^[a-f0-9]{64}$/.test(row.commandHash ?? '') || typeof row.active !== 'boolean')) throw new DbVerbError('Supabase returned invalid cron metadata');
     if (!unmatched.delete(key)) unexpected += 1;
     else if (kind === 'cron') {
       const desired = expected.get(key);

package/runtime/scripts/hfs/rule-catalog.mjs

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
 import { parseYamlCached } from '../lib/yaml-cached.mjs';
 import { jsonClone } from '../lib/json-clone.mjs';
+import { byCodeUnit } from '../lib/list.mjs';
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { SEMVER } from './manifest-shape.mjs';
 import { enforcerJudgedInEdition, judgedInEdition, ruleEditionProblems } from './edition-slots.mjs';
@@ -39,7 +40,7 @@ function relativePathProblem(value, label, bad, anchor = false) {
   const parts = typeof value === 'string' ? value.split('#') : [];
   const file = parts[0];
   const valid = typeof value === 'string' && value.trim() === value && value.length > 0
-    && !/[\r\n\u0000\\]/.test(value) && !/^(?:\/|[a-z][a-z0-9+.-]*:)/i.test(value) && !file.includes(':')
+    && !value.includes('\0') && !/[\r\n\\]/.test(value) && !/^(?:\/|[a-z][a-z0-9+.-]*:)/i.test(value) && !file.includes(':')
     && !file.split('/').some((part) => ['', '.', '..'].includes(part))
     && (parts.length === 1 || (anchor && parts.length === 2 && /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(parts[1])));
   if (!valid) bad.push(`${label} must be a repository-relative path${anchor ? ' with an optional #anchor' : ''}`);
@@ -51,7 +52,7 @@ function unknownKeys(item, allowed, label, bad) {
 
 function nonEmptyList(value, label, bad) {
   if (!Array.isArray(value) || !value.length) { bad.push(`${label} must be a non-empty list`); return false; }
-  const normalized = value.map((value) => JSON.stringify(value, (_key, item) => isPlainObject(item) ? Object.fromEntries(Object.keys(item).sort().map((key) => [key, item[key]])) : item));
+  const normalized = value.map((value) => JSON.stringify(value, (_key, item) => isPlainObject(item) ? Object.fromEntries(Object.keys(item).sort(byCodeUnit).map((key) => [key, item[key]])) : item));
   if (new Set(normalized).size !== value.length) bad.push(`${label} repeats a value`);
   return true;
 }

package/runtime/scripts/hfs/rules/deploy-scan.mjs

@@ -8,7 +8,7 @@ const DEPLOY = /(?:^|\/)deploy\//;
 const SCRIPT = /(?:^|\/)scripts\//;
 const COMPOSE = /(?:^|\/)(?:docker-)?compose(?:[.-][^/]*)?\.ya?ml$/;
 const DOCKERFILE = /(?:^|\/)Dockerfile(?:\.[^/]*)?$/;
-const CREDENTIAL_FILE = /(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/)|\.enc$/i;
+const CREDENTIAL_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/))|(?:\.enc$)/i;
 const HOST_CRON = /\b(?:crontab|anacron|crond|supercronic)\b|\/etc\/cron(?:\b|[./])|\bcron\.d\b|\/var\/spool\/cron\b|@(?:reboot|yearly|annually|monthly|weekly|daily|midnight|hourly)\b|\b[\w.@-]+\.timer\b|\bOn(?:Calendar|BootSec|UnitActiveSec|ActiveSec)\s*=|(?:^|[\s;|&"'])at\s+(?:(?:-[a-z]+\s+)*)((?:-[ft]\b)|now\b|tomorrow\b|\d{1,2}:\d{2}\b|midnight\b|noon\b)/im;
 const HOST_CRON_PATH = /(?:^|\/)(?:crontab(?:$|\/)|cron\.d(?:\/|$)|[^/]+\.(?:timer|crontab)$)/;
 const CRON_NUMERIC_FIELD = /^[\d*,/-]+$/;

package/runtime/scripts/hfs/rules/doc-fresh.mjs

@@ -228,7 +228,7 @@ function injectionTokens(repoRoot, tracked) {
   const ts = loadTypescript(repoRoot, path.dirname(fileURLToPath(import.meta.url)));
   if (!ts) return tokens;
   for (const file of tracked) {
-    if (!/\.[cm]?[jt]sx?$/.test(file) || /(?:^|\/)(?:tests?|__tests__)\/|(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/.test(file)) continue;
+    if (!/\.[cm]?[jt]sx?$/.test(file) || /(?:(?:^|\/)(?:tests?|__tests__)\/)|(?:(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$)/.test(file)) continue;
     const text = readText(repoRoot, file) ?? '';
     declaredTokens(ts, ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true), tokens);
   }

package/runtime/scripts/hfs/rules/frontend-tree.mjs

@@ -37,7 +37,7 @@ function wireSchemaDigest(repoRoot, snapshots) {
   for (const snapshot of [...snapshots].sort(byCodeUnit)) {
     let source;
     try { source = fs.readFileSync(path.join(repoRoot, snapshot), 'utf8'); } catch { return null; }
-    hash.update(`${snapshot}\0${source.replace(/\r\n/g, '\n')}\0`);
+    hash.update(`${snapshot}\0${source.replaceAll('\r\n', '\n')}\0`);
   }
   return hash.digest('hex');
 }

package/runtime/scripts/hfs/rules/release-provenance.mjs

@@ -79,7 +79,7 @@ function refProof(value) {
   if (typeof value !== 'string') return 0;
   const expression = unwrap(workflowExpression(value));
   const alternatives = splitBoolean(expression, '||');
-  if (alternatives.length > 1) return alternatives.map(refProof).reduce((a, b) => a & b);
+  if (alternatives.length > 1) return alternatives.map(refProof).reduce((a, b) => a & b, RELEASE_REF);
   const conjuncts = splitBoolean(expression, '&&');
   if (conjuncts.length > 1) return conjuncts.map(refProof).reduce((a, b) => a | b, 0);
   if (/^startsWith\(\s*github\.ref\s*,\s*(['"])refs\/tags\/v\1\s*\)$/.test(expression)) return RELEASE_REF;

package/runtime/scripts/hfs/rules/script-hygiene.mjs

@@ -7,7 +7,7 @@ const PLAINTEXT_LOAD = 'HFS_SCRIPT_PLAINTEXT_LOAD';
 const XTRACE = 'HFS_SCRIPT_XTRACE';
 const SERVICE_ROLE = 'HFS_SERVICE_ROLE_SCOPE';
 const SUPABASE_OWNER = 'be.integrations.supabase';
-const SECRET_FILE = /(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|\.nivo-lite(?:\/|$))|\.enc$/iu;
+const SECRET_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|\.nivo-lite(?:\/|$)))|(?:\.enc$)/iu;
 const EXCLUDED_TREE = /(?:^|\/)(?:node_modules|\.git|\.claude|\.secrets|secrets|tests?|__tests__|docs|coverage|dist|build)(?:\/|$)/u;
 const TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/u;
 const SOURCE = /\.(?:[cm]?[jt]sx?|sh|bash|zsh|ksh|ps1|psm1|bat|cmd|py|rb|pl)$/iu;

package/runtime/scripts/hfs/rules/stack-tooling.mjs

@@ -13,7 +13,7 @@ const SCRIPTS_DIR = /(?:^|\/)scripts\//;
 const PACKAGE_JSON = /(?:^|\/)package\.json$/;
 const SOURCE_FILE = /(?:^|\/)[^/.]+$|\.(?:sh|bash|zsh|mjs|cjs|js|ts|mts|py|ya?ml)$/;
 const TEST_FILE = /\.(?:spec|test)\.[cm]?[jt]s$/;
-const CREDENTIAL_FILE = /(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/)|\.enc$/i;
+const CREDENTIAL_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/))|(?:\.enc$)/i;
 const VERB_FILE = /^(render|provision|converge|verify|prune|rollback|release|backup|prepare|doctor|jobs|public)\.(?:mjs|js|cjs|sh)$/;
 const COMMENT_LINE = /^[ \t]*(?:#|\/\/).*$/gm;
 const LINE_CONTINUATION = /\\\r?\n\s*/g;

package/runtime/scripts/hfs/rules/stacks-release.mjs

@@ -26,7 +26,7 @@ const DECLARATION = '.starcistacks/application-stacks.yaml';
 const MAX_BYTES = 1024 * 1024;
 const SOURCE = /^(?:be\/)?(?:src|apps)\/.*\.[cm]?[jt]s$/;
 const TEST = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]s$|\/(?:tests|__tests__)\//;
-const SECRET = /(?:^|\/)(?:secrets|\.claude|\.aws|\.codex)(?:\/|$)|(?:^|\/)\.env(?:\.|$)|\.(?:enc|pem|key|p12|pfx)$/i;
+const SECRET = /(?:(?:^|\/)(?:secrets|\.claude|\.aws|\.codex)(?:\/|$))|(?:(?:^|\/)\.env(?:\.|$))|(?:\.(?:enc|pem|key|p12|pfx)$)/i;
 const CLI_ENTRY = /^(?:be\/)?dist\/apps\/cli\/[A-Za-z0-9_./-]+\.(?:js|mjs|cjs)$/;
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());

package/runtime/scripts/hfs/rules/stacks-swarm.mjs

@@ -16,7 +16,7 @@ const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());
 const VERSION = /^[1-9][0-9]*$/;
 const VERSIONED_SECRET = /-v[1-9][0-9]*$/;
-const SENSITIVE_KEY = /password|passwd|secret|token|credential|private[_-]?key|api[_-]?key|service[_-]?role|(?:^|_)key$/i;
+const SENSITIVE_KEY = /password|passwd|secret|token|credential|private[_-]?key|api[_-]?key|service[_-]?role|(?:(?:^|_)key$)/i;
 const SOURCE = /^be\/(?:apps|src)\/.*\.[cm]?[jt]sx?$/;
 const TEST_SOURCE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$|\/tests\//;
 const REALTIME_SOURCE = /^be\/src\/features\/realtime\/[^/]+\//;

package/runtime/scripts/hfs/rules/supply-chain.mjs

@@ -32,6 +32,7 @@ function appendShellCommand(commands, state, next) {
 }
 
 function shellLineCommands(line, commands) {
+  /** @type {{quote: string | null, command: string, separator: string | null}} */
   const state = { quote: null, command: '', separator: null };
   for (let i = 0; i < line.length; i++) {
     const char = line[i];

package/runtime/scripts/hfs/rules/workflow-contexts.mjs

@@ -76,7 +76,7 @@ function expressions(value) {
 
 /** Source markers travel inside parsed scalar expressions, preserving flow maps, quoted keys and repeated values without matching comments. */
 export function workflowContextFindings({ path: file, text }) {
-  const marked = text.replace(/\$\{\{/g, (match, offset) => `${match} __hfs_context_line_${text.slice(0, offset).split('\n').length}__ `);
+  const marked = text.replaceAll('${{', (match, offset) => `${match} __hfs_context_line_${text.slice(0, offset).split('\n').length}__ `);
   const findings = [];
   function inspect(value, keys) {
     const allowed = allowedContexts(keys);

package/runtime/scripts/hfs/secret-bootstrap-crypto.mjs

@@ -22,7 +22,7 @@ function checksumStep(checksum, value) {
 function checksumWords(prefix, words) {
   const codes = [...prefix].map((character) => character.codePointAt(0));
   const expanded = [...codes.map((code) => code >>> 5), 0, ...codes.map((code) => code & 31)];
-  return [...expanded, ...words].reduce(checksumStep, 1);
+  return [...expanded, ...words].reduce((checksum, value) => checksumStep(checksum, value), 1);
 }
 
 function convertBits(input, from, to, pad) {

package/runtime/scripts/lib/path-key.mjs

@@ -40,6 +40,8 @@ export const pathsOverlap = (a, b) => sameOrUnder(a, b) || sameOrUnder(b, a);
  * `trim` blanks at the ends, `collapse` folds '//' runs to '/', `dot` drops a leading './',
  * `glob` strips a trailing glob ('star': '*'/'**' with their slash, 'double': a '/**' only),
  * `fold` lowercases. A trailing '/' always goes. Null reads as ''.
+ * @param {unknown} p
+ * @param {{trim?: boolean, collapse?: boolean, dot?: boolean, glob?: string|null, fold?: boolean}} [options]
  */
 export const normPath = (p, { trim = false, collapse = false, dot = false, glob = null, fold = false } = {}) => {
   let s = String(p ?? '');

package/runtime/scripts/lib/secret-patterns.mjs

@@ -173,7 +173,7 @@ function readmeBadgeText(text, manifestText) {
 
 /** Whole-file secret judgement exempts only declared public badge values and preserves original line numbers and every provider shape. */
 export function secretHitsInFile(file, fullText, { manifestText } = {}) {
-  const normalized = file.replace(/\\/g, '/');
+  const normalized = file.replaceAll('\\', '/');
   let text = fullText;
   if (/(?:^|\/)\.starcistacks\/application-stacks\.yaml$/.test(normalized)) text = manifestBadgeText(text);
   if (/(?:^|\/)README\.md$/.test(normalized)) text = readmeBadgeText(text, manifestText);

package/runtime/scripts/lib/ts-analysis.mjs

@@ -1,9 +1,13 @@
 /** The expression under the wrappers selected by an AST check's contract. */
 export function unwrapExpression(ts, expression, { awaitExpressions = false, typeAssertions = true, nonNullExpressions = true, satisfiesExpressions = true } = {}) {
-  while (expression && (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression)
-    || (typeAssertions && ts.isTypeAssertionExpression(expression)) || (nonNullExpressions && ts.isNonNullExpression(expression))
-    || (satisfiesExpressions && (ts.isSatisfiesExpression?.(expression) ?? false))
-    || (awaitExpressions && ts.isAwaitExpression(expression)))) expression = expression.expression;
+  while (expression) {
+    const wrapper = ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression)
+      || (typeAssertions && ts.isTypeAssertionExpression(expression)) || (nonNullExpressions && ts.isNonNullExpression(expression))
+      || (satisfiesExpressions && (ts.isSatisfiesExpression?.(expression) ?? false))
+      || (awaitExpressions && ts.isAwaitExpression(expression));
+    if (!wrapper) break;
+    expression = expression.expression;
+  }
   return expression;
 }