@starci/hfs 4.7.12 → 4.7.13

package/runtime/scripts/hfs/rules/script-hygiene.mjs

@@ -7,16 +7,32 @@ const PLAINTEXT_LOAD = 'HFS_SCRIPT_PLAINTEXT_LOAD';
 const XTRACE = 'HFS_SCRIPT_XTRACE';
 const SERVICE_ROLE = 'HFS_SERVICE_ROLE_SCOPE';
 const SUPABASE_OWNER = 'be.integrations.supabase';
-const SECRET_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|\.nivo-lite(?:\/|$)))|(?:\.enc$)/iu;
+const SECRET_ENV_FILE = /(?:^|\/)(?:secrets?\.env|\.env)(?:\.[^/]*)?/iu;
+const SECRET_NIVO_FILE = /(?:^|\/)\.nivo-lite(?:\/|$)/iu;
+const SECRET_ENC_FILE = /\.enc$/iu;
+const isSecretFile = (file) => SECRET_ENV_FILE.test(file) || SECRET_NIVO_FILE.test(file) || SECRET_ENC_FILE.test(file);
 const EXCLUDED_TREE = /(?:^|\/)(?:node_modules|\.git|\.claude|\.secrets|secrets|tests?|__tests__|docs|coverage|dist|build)(?:\/|$)/u;
 const TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/u;
 const SOURCE = /\.(?:[cm]?[jt]sx?|sh|bash|zsh|ksh|ps1|psm1|bat|cmd|py|rb|pl)$/iu;
 const WORKFLOW = /(?:^|\/)\.?(?:github\/)?workflows\/[^/]+\.ya?ml$/u;
 const DELIVERY = /(?:^|\/)(?:deploy|scripts|bin)\//u;
 const DOCKER = /(?:^|\/)(?:Dockerfile(?:\.[^/]*)?|(?:docker-)?compose(?:[.-][^/]*)?\.ya?ml)$/iu;
-const SECRET_REFERENCE = /(?:^|[\s/\\'"`(=])(?:secrets?\.env(?:\.[\w.-]+)?|\.env(?:\.[\w.-]+)?|\.nivo-lite(?:[/\\][\w./\\-]*)?)(?=$|[\s/\\'"`),;])/iu;
+const SECRET_REFERENCE_NAME = /(?:secrets?\.env|\.env)(?:\.[\w.-]+)?/;
+const SECRET_REFERENCE_NIVO = /\.nivo-lite(?:[/\\][\w./\\-]*)?/;
+const SECRET_REFERENCE_BEFORE = /(?:^|[\s/\\'"`(=])/;
+const SECRET_REFERENCE_AFTER = /(?=$|[\s/\\'"`),;])/;
+const SECRET_REFERENCE_SOURCE = `${SECRET_REFERENCE_BEFORE.source}(?:${SECRET_REFERENCE_NAME.source}|${SECRET_REFERENCE_NIVO.source})${SECRET_REFERENCE_AFTER.source}`;
+const SECRET_REFERENCE = new RegExp(SECRET_REFERENCE_SOURCE, 'iu');
 const EXAMPLE_REFERENCE = /(?:secrets?\.env|\.env)\.(?:example|sample|template)(?=$|[^\w.-])/giu;
-const LOAD = /(?:^|[\s;&|('"`])(?:source|cat|tac|less|more|head|tail|grep|egrep|fgrep|awk|gawk|sed|base64|Get-Content|gc|Import-DotEnv|env-cmd|load_dotenv|loadEnvFile|readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|dotenv\s*\.\s*(?:config|parse))\b|\b(?:File|IO)\s*\.\s*(?:read|readlines)\b|\.\s*read_(?:text|bytes)\s*\(|(?:^|[\s;&|])\.[\t ]+|(?<!<)<(?!<)/iu;
+const LOAD_SHELL_COMMAND = /(?:^|[\s;&|('"`])(?:source|cat|tac|less|more|head|tail|grep|egrep|fgrep|awk|gawk|sed|base64)\b/iu;
+const LOAD_WINDOWS_COMMAND = /(?:^|[\s;&|('"`])(?:Get-Content|gc|Import-DotEnv|env-cmd|load_dotenv|loadEnvFile)\b/iu;
+const LOAD_READ_CALL = /(?:^|[\s;&|('"`])(?:readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|dotenv\s*\.\s*(?:config|parse))\b/iu;
+const LOAD_FILE_READ = /\b(?:File|IO)\s*\.\s*(?:read|readlines)\b/iu;
+const LOAD_PYTHON_READ = /\.\s*read_(?:text|bytes)\s*\(/iu;
+const LOAD_DOT_SOURCE = /(?:^|[\s;&|])\.[\t ]+/iu;
+const LOAD_REDIRECT = /(?<!<)<(?!<)/iu;
+const LOAD_PATTERNS = [LOAD_SHELL_COMMAND, LOAD_WINDOWS_COMMAND, LOAD_READ_CALL, LOAD_FILE_READ, LOAD_PYTHON_READ, LOAD_DOT_SOURCE, LOAD_REDIRECT];
+const isLoad = (line) => LOAD_PATTERNS.some((pattern) => pattern.test(line));
 const READ_CALL = /\b(?:readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|load_dotenv|loadEnvFile|dotenv\s*\.\s*(?:config|parse))\s*\(/giu;
 const TRACE_COMMAND = /(?:^|[\s;&|('"`]|#!)(?:set|\/?(?:[\w.-]+\/)*(?:bash|sh|dash|zsh|ksh))\s+/giu;
 const SHELL_OPTIONS = /\bSHELLOPTS\s*=\s*['"]?([^\s;'"]*)/giu;
@@ -26,7 +42,7 @@ const SERVICE_ROLE_NAME = /(?:^|[^a-z0-9])(?:[a-z0-9]+[_-])*service[_-]?role(?:[
 function executableText(text) {
   return text.replace(/\/\*[\s\S]*?\*\//gu, '').split(/\r?\n/u)
     .filter((line) => !/^\s*(?:#(?!!)|\/\/)/u.test(line)).join('\n')
-    .replace(/(?:\\|`)\r?\n/gu, ' ');
+    .replace(/[\\`]\r?\n/gu, ' ');
 }
 
 const hasSecretReference = (text) => SECRET_REFERENCE.test(text.replace(EXAMPLE_REFERENCE, 'example-file'));
@@ -37,7 +53,7 @@ function callArguments(text, from) {
   for (let at = from; at < Math.min(text.length, from + 1024); at += 1) {
     const character = text[at];
     if (character === '\\') { at += 1; continue; }
-    if (quote) { if (character === quote) quote = ''; continue; }
+    if (quote) { if (character === quote) { quote = ''; } continue; }
     if (['\'', '"', '`'].includes(character)) { quote = character; continue; }
     if (character === '(') depth += 1;
     if (character === ')' && --depth === 0) return text.slice(from, at);
@@ -81,7 +97,7 @@ function plaintextLoad(text) {
   const lines = text.split(/\r?\n/u);
   const aliases = secretAliases(lines);
   const secretReference = (value) => hasSecretReference(value) || aliases.some((alias) => alias.test(value));
-  return lines.some((line) => LOAD.test(line) && secretReference(line)) || multilineLoad(text, secretReference) || pythonLoad(text);
+  return lines.some((line) => isLoad(line) && secretReference(line)) || multilineLoad(text, secretReference) || pythonLoad(text);
 }
 
 function tracingOptions(source) {
@@ -120,7 +136,7 @@ function integrationOwns(file, resolver) {
 }
 
 function isSource(file) {
-  if (SECRET_FILE.test(file) || EXCLUDED_TREE.test(file) || TEST_FILE.test(file)) return false;
+  if (isSecretFile(file) || EXCLUDED_TREE.test(file) || TEST_FILE.test(file)) return false;
   return SOURCE.test(file) || WORKFLOW.test(file) || DOCKER.test(file)
     || file.endsWith('/package.json') || file === 'package.json'
     || (DELIVERY.test(file) && !/\.[a-z0-9]+$/iu.test(file));

package/runtime/scripts/hfs/rules/stack-tooling.mjs

@@ -13,7 +13,10 @@ const SCRIPTS_DIR = /(?:^|\/)scripts\//;
 const PACKAGE_JSON = /(?:^|\/)package\.json$/;
 const SOURCE_FILE = /(?:^|\/)[^/.]+$|\.(?:sh|bash|zsh|mjs|cjs|js|ts|mts|py|ya?ml)$/;
 const TEST_FILE = /\.(?:spec|test)\.[cm]?[jt]s$/;
-const CREDENTIAL_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/))|(?:\.enc$)/i;
+const CREDENTIAL_ENV_FILE = /(?:^|\/)(?:secrets?\.env|\.env)(?:\.[^/]*)?/i;
+const CREDENTIAL_SECRETS_DIR = /(?:^|\/)secrets\//i;
+const CREDENTIAL_ENC_FILE = /\.enc$/i;
+const isCredentialFile = (file) => CREDENTIAL_ENV_FILE.test(file) || CREDENTIAL_SECRETS_DIR.test(file) || CREDENTIAL_ENC_FILE.test(file);
 const VERB_FILE = /^(render|provision|converge|verify|prune|rollback|release|backup|prepare|doctor|jobs|public)\.(?:mjs|js|cjs|sh)$/;
 const COMMENT_LINE = /^[ \t]*(?:#|\/\/).*$/gm;
 const LINE_CONTINUATION = /\\\r?\n\s*/g;
@@ -57,7 +60,7 @@ function sourceText(file, raw) {
 }
 
 function deploySource(file) {
-  if (MANAGED_WORKFLOW.test(file) || CREDENTIAL_FILE.test(file) || TEST_FILE.test(file)) return false;
+  if (MANAGED_WORKFLOW.test(file) || isCredentialFile(file) || TEST_FILE.test(file)) return false;
   if (PACKAGE_JSON.test(file) || WORKFLOW.test(file)) return true;
   return (DEPLOY_DIR.test(file) || SCRIPTS_DIR.test(file)) && SOURCE_FILE.test(file);
 }

package/runtime/scripts/hfs/rules/stacks-swarm.mjs

@@ -14,8 +14,8 @@ import { stacksDeploymentFindings } from './stacks-runtime.mjs';
 
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());
-const VERSION = /^[1-9][0-9]*$/;
-const VERSIONED_SECRET = /-v[1-9][0-9]*$/;
+const VERSION = /^[1-9]\d*$/;
+const VERSIONED_SECRET = /-v[1-9]\d*$/;
 const SENSITIVE_KEY = /password|passwd|secret|token|credential|private[_-]?key|api[_-]?key|service[_-]?role|(?:(?:^|_)key$)/i;
 const SOURCE = /^be\/(?:apps|src)\/.*\.[cm]?[jt]sx?$/;
 const TEST_SOURCE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$|\/tests\//;
@@ -124,7 +124,7 @@ function traefikHosts(rule) {
 function positiveHostCall(prefix) {
   const scopes = [false];
   let pending = false;
-  for (const token of prefix.match(/"[^"]*"|'[^']*'|`[^`]*`|[()!]|[A-Za-z_][A-Za-z_0-9]*|\S/g) ?? []) {
+  for (const token of prefix.match(/"[^"]*"|'[^']*'|`[^`]*`|[()!]|[A-Za-z_]\w*|\S/g) ?? []) {
     if (token === '!') { pending = !pending; continue; }
     if (token === '(') scopes.push(scopes.at(-1) !== pending);
     if (token === ')' && scopes.length > 1) scopes.pop();
@@ -139,7 +139,7 @@ function labelHosts(service, family) {
   if (family === 'traefik' && labels.some(([key, value]) => key === 'traefik.enable' && String(value) === 'false')) return hosts;
   for (const [key, value] of labels) {
     if (family === 'traefik' && key.startsWith('traefik.http.routers.') && key.endsWith('.rule')) hosts.push(...traefikHosts(value));
-    if (family === 'caddy-docker-proxy' && /^caddy(?:_[0-9]+)?$/.test(key)) hosts.push(...String(value).split(/[\s,]+/).map(hostOf).filter(Boolean));
+    if (family === 'caddy-docker-proxy' && /^caddy(?:_\d+)?$/.test(key)) hosts.push(...String(value).split(/[\s,]+/).map(hostOf).filter(Boolean));
   }
   return hosts;
 }
@@ -282,7 +282,7 @@ function positiveMonitor(value) {
   const units = value.match(/[a-z]+/g) ?? [], quantities = value.split(/[a-z]+/);
   if (quantities.pop() !== '' || !units.length) return false;
   return units.every(unit => ['ns', 'us', 'ms', 's', 'm', 'h'].includes(unit))
-    && quantities.every(quantity => /^[0-9]+(?:\.[0-9]+)?$/.test(quantity)) && /[1-9]/.test(value);
+    && quantities.every(quantity => /^\d+(?:\.\d+)?$/.test(quantity)) && /[1-9]/.test(value);
 }
 
 function updatePolicyIssues(id, service, add) {

package/runtime/scripts/hfs/rules/supply-chain.mjs

@@ -141,12 +141,12 @@ const provenanceEnabled = (value) => asserted(value) || typeof value === 'string
 
 function imageActionEvidence(step) {
   const action = step.uses ?? '';
-  if (/^docker\/build-push-action@/.test(action)) {
+  if (action.startsWith('docker/build-push-action@')) {
     return { sbom: asserted(step.with?.sbom), provenance: provenanceEnabled(step.with?.provenance) };
   }
   return {
-    sbom: /^actions\/attest-sbom@/.test(action) && Boolean(step.with?.['sbom-path']),
-    provenance: /^actions\/attest-build-provenance@/.test(action) && Boolean(step.with?.['subject-path'] || step.with?.['subject-digest']),
+    sbom: action.startsWith('actions/attest-sbom@') && Boolean(step.with?.['sbom-path']),
+    provenance: action.startsWith('actions/attest-build-provenance@') && Boolean(step.with?.['subject-path'] || step.with?.['subject-digest']),
   };
 }
 

package/runtime/scripts/hfs/rules/unused-symbol-properties.mjs

@@ -14,7 +14,7 @@ function mergeProperty(before, after) {
 /** Every possible spread owner must be known before its property provenance is admitted. */
 function spreadProperty(state, expression, name, seen, resolve) {
   const choices = resolve(state, expression, seen).map(owner => ownerProperty(state, owner, name, seen, resolve));
-  if (!choices.length || choices.some(choice => choice === null)) return null;
+  if (!choices.length || choices.includes(null)) return null;
   return { values: choices.flatMap(choice => choice.values), missing: choices.some(choice => choice.missing) };
 }
 

package/runtime/scripts/hfs/rules/unused-symbol.mjs

@@ -12,7 +12,10 @@ import { returnedExpressions, valuesOf } from './unused-symbol-flow.mjs';
 
 export const HFS_UNUSED_SYMBOL = 'HFS_UNUSED_SYMBOL';
 const SOURCE = /\.[cm]?[jt]sx?$/u;
-const EXCLUDED = /(?:^|\/)(?:node_modules|__generated__|_generated|dist|tests?|__tests__|test-support)\/|(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/u;
+const EXCLUDED_DIR = /(?:^|\/)(?:node_modules|__generated__|_generated|dist|tests?|__tests__|test-support)\//u;
+const EXCLUDED_TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/u;
+const EXCLUDED_DECLARATION_FILE = /\.d\.[cm]?ts$/u;
+const isExcluded = (file) => EXCLUDED_DIR.test(file) || EXCLUDED_TEST_FILE.test(file) || EXCLUDED_DECLARATION_FILE.test(file);
 const CATALOG = /(?:\.messages|\.catalog)\.[cm]?[jt]s$/u;
 const JSON_CATALOG = /(?:^|\/)(?:messages|locales)\/[^/]+\.json$|\.catalog\.json$/u;
 const QUEUE_NAME = /(?:^QUEUE(?:_NAME)?$|_QUEUE(?:_NAME)?$)/u;
@@ -29,7 +32,7 @@ function compilerAt(repoRoot, supplied) {
 function sourceFiles(ts, repoRoot, files) {
   const sources = new Map();
   for (const file of files) {
-    if (!SOURCE.test(file) || EXCLUDED.test(file) || !/(?:^|\/)src\//u.test(file)) continue;
+    if (!SOURCE.test(file) || isExcluded(file) || !/(?:^|\/)src\//u.test(file)) continue;
     const text = readText(repoRoot, file);
     if (text !== null) sources.set(slash(path.resolve(repoRoot, file)), ts.createSourceFile(path.resolve(repoRoot, file), text, ts.ScriptTarget.Latest, true));
   }
@@ -259,7 +262,7 @@ function sourceReads(state, sources) {
 }
 
 function jsonCandidates(state, files) {
-  for (const file of files.filter(file => JSON_CATALOG.test(file) && !EXCLUDED.test(file))) {
+  for (const file of files.filter(file => JSON_CATALOG.test(file) && !isExcluded(file))) {
     let json;
     try { json = JSON.parse(readText(state.repoRoot, file)); } catch { continue; }
     const leaves = (value, prefix = '') => {
@@ -316,7 +319,8 @@ export function unusedSymbolFindings({ repoRoot, files, repo = {}, isRoot = fals
   const findings = new Map();
   for (const candidate of state.candidates) {
     if (candidate.used || candidate.kind === 'catalog key' && catalogRead(state, candidate, liveCodes) || !inScope(candidate.path)) continue;
-    const { used: _used, ...extra } = candidate;
+    const extra = { ...candidate };
+    delete extra.used;
     findings.set(`${candidate.path}:${candidate.name}`, found(HFS_UNUSED_SYMBOL, candidate.path, `${candidate.path} declares unused ${candidate.kind} ${candidate.name}; remove it or read it in production source (declarations, metadata maps and tests do not count).`, extra));
   }
   return [...findings.values(), ...ledgerFindings.filter(finding => inScope(finding.path))].sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.name.localeCompare(b.name));

package/runtime/scripts/hfs/sealed-members.mjs

@@ -75,7 +75,7 @@ export function declaredSealedMembers(repoRoot) {
 
 function placeholderValue(key) {
   const generated = randomUUID();
-  if (/DB_URL$/u.test(key)) return `postgresql://app_be:${generated}@db.invalid:5432/app`;
+  if (key.endsWith('_URL') && key.slice(0, -4).endsWith('DB')) return `postgresql://app_be:${generated}@db.invalid:5432/app`;
   if (key.endsWith('_URL')) return `https://example.invalid/${generated}`;
   return generated;
 }

package/runtime/scripts/hfs/secret-bootstrap-crypto.mjs

@@ -163,7 +163,7 @@ function bootstrapEntries(values) {
   const entries = Object.entries(values);
   if (!entries.length) throw new Error('Bootstrap requires at least one value');
   for (const [name, value] of entries) {
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || name.startsWith('sops_') || name.endsWith('_unencrypted')) {
+    if (!/^[A-Za-z_]\w*$/.test(name) || name.startsWith('sops_') || name.endsWith('_unencrypted')) {
       throw new Error('Bootstrap contains an invalid or reserved dotenv key');
     }
     if (typeof value !== 'string' || !value.length) throw new Error('Bootstrap values must be nonempty strings');

package/runtime/scripts/hfs/secret-files.mjs

@@ -61,7 +61,7 @@ export function privateDirectory(repoRoot, directory) {
   const missing = [];
   for (let at = directory; !fs.existsSync(at); at = path.dirname(at))
     missing.push(at);
-  for (const at of missing.reverse()) fs.mkdirSync(at, { mode: 0o700 });
+  for (const at of missing.toReversed()) fs.mkdirSync(at, { mode: 0o700 });
   for (let at = directory; ; at = path.dirname(at)) {
     const stat = fs.lstatSync(at);
     if (!stat.isDirectory() || stat.isSymbolicLink())

package/runtime/scripts/hfs/secret-sops.mjs

@@ -19,7 +19,7 @@ export function defaultSops(
   env = process.env,
   repoRoot = invocationDir(),
   platform = process.platform,
-  tools,
+  tools = undefined,
 ) {
   const { sops: binary } = publicStorage(() => secretTools(env, tools));
   const selectedEnv = ageIdentityEnv(repoRoot, env, tools);

package/runtime/scripts/hfs/stack-deploy-config.mjs

@@ -176,7 +176,10 @@ function configs(c, block, probe) {
     out.push({ name: entry.name, file: entry.file, env: entry.env });
   });
   const seen = new Set();
-  for (const entry of out) { if (seen.has(entry.name)) c.problem('deploy.configs', `config name ${entry.name} is declared twice`); seen.add(entry.name); }
+  for (const entry of out) {
+    if (seen.has(entry.name)) c.problem('deploy.configs', `config name ${entry.name} is declared twice`);
+    seen.add(entry.name);
+  }
   return out;
 }
 
@@ -242,7 +245,7 @@ function tasks(c, block, services) {
   return out;
 }
 
-const REGISTRY_HOST = /^[a-z0-9][a-z0-9.-]*(?::[0-9]{1,5})?$/u;
+const REGISTRY_HOST = /^[a-z0-9][a-z0-9.-]*(?::\d{1,5})?$/u;
 const VISIBILITY = ['public', 'private'];
 
 /** The image registry: host (default ghcr.io) and the visibility the app's packages are meant to have (default public, the canon scaffold writes it and the app owns it afterwards). */

package/runtime/scripts/lib/env.mjs

@@ -15,6 +15,7 @@ export const isSpecRun = (env = process.env) => Boolean(env.NODE_TEST_CONTEXT);
  * would pass red specs from inside a test process. The runner marks the spec files it starts itself, so isSpecRun stays true inside them.
  */
 export function withoutTestRunner(env = process.env) {
-  const { NODE_TEST_CONTEXT: _enclosing, ...rest } = env;
+  const rest = { ...env };
+  delete rest.NODE_TEST_CONTEXT;
   return rest;
 }

package/runtime/scripts/lib/path-key.mjs

@@ -44,7 +44,7 @@ export const pathsOverlap = (a, b) => sameOrUnder(a, b) || sameOrUnder(b, a);
  * @param {{trim?: boolean, collapse?: boolean, dot?: boolean, glob?: string|null, fold?: boolean}} [options]
  */
 export const normPath = (p, { trim = false, collapse = false, dot = false, glob = null, fold = false } = {}) => {
-  let s = String(p ?? '');
+  let s = p == null ? '' : String(p);
   if (trim) s = s.trim();
   s = slash(s);
   if (collapse) s = s.replace(/\/{2,}/g, '/');

package/runtime/scripts/lib/roots.mjs

@@ -17,10 +17,10 @@
 // directory or from the Work directory name outside this module.
 import fs from 'node:fs';
 import path from 'node:path';
-import { skillRoot, starciLocalRoot, starciSourceRoot } from '../../engine/runtime-root.mjs';
-import { tempRoot } from '../../engine/temp-root.mjs';
+import { skillRoot } from '../../engine/runtime-root.mjs';
 
-export { tempRoot, starciLocalRoot, starciSourceRoot };
+export { tempRoot } from '../../engine/temp-root.mjs';
+export { starciLocalRoot, starciSourceRoot } from '../../engine/runtime-root.mjs';
 
 /** The runtime tree this code runs from. */
 const runtimeTree = skillRoot;

package/runtime/scripts/lib/secret-patterns.mjs

@@ -161,7 +161,7 @@ function readmeBadgeText(text, manifestText) {
     let url;
     try { url = new URL(address); } catch { return image; }
     if (!hosts.has(url.host) || url.username || url.password) return image;
-    const badgePath = url.host === 'codecov.io' ? /\/graph\/badge\.svg$/.test(url.pathname) : url.pathname === '/api/project_badges/measure';
+    const badgePath = url.host === 'codecov.io' ? url.pathname.endsWith('/graph/badge.svg') : url.pathname === '/api/project_badges/measure';
     if (!badgePath) return image;
     const fragment = address.indexOf('#');
     const queryEnd = fragment < 0 ? address.length : fragment;

package/runtime/scripts/lib/swarm-stack.mjs

@@ -4,8 +4,10 @@ import { composeEntries } from './compose-values.mjs';
 import { repositoryOf } from './stack-services.mjs';
 
 const PINNED_IMAGE = /@sha256:[a-f0-9]{64}$/i;
-const VERSIONED_SECRET = /-v[1-9][0-9]*$/;
-const BACKING_IMAGE = /^(?:postgres(?:ql)?|postgresql-repmgr|redis(?:-stack(?:-server)?)?|(?:cp-)?kafka(?:-native)?|keycloak|minio|rabbitmq|mysql(?:-server)?|mongo(?:db)?|mongodb-community-server)$/i;
+const VERSIONED_SECRET = /-v[1-9]\d*$/;
+const BACKING_IMAGE_SQL_AND_CACHE = 'postgres(?:ql)?|postgresql-repmgr|redis(?:-stack(?:-server)?)?|mysql(?:-server)?|mongo(?:db)?|mongodb-community-server';
+const BACKING_IMAGE_BROKERS_AND_OTHERS = '(?:cp-)?kafka(?:-native)?|keycloak|minio|rabbitmq';
+const BACKING_IMAGE = new RegExp(`^(?:${BACKING_IMAGE_SQL_AND_CACHE}|${BACKING_IMAGE_BROKERS_AND_OTHERS})$`, 'i');
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());
 const configured = value => Object.keys(mapping(value)).length > 0;