@starci/hfs 4.7.12 → 4.7.14

package/runtime/scripts/hfs/rules/deploy-scan.mjs

@@ -8,17 +8,61 @@ const DEPLOY = /(?:^|\/)deploy\//;
 const SCRIPT = /(?:^|\/)scripts\//;
 const COMPOSE = /(?:^|\/)(?:docker-)?compose(?:[.-][^/]*)?\.ya?ml$/;
 const DOCKERFILE = /(?:^|\/)Dockerfile(?:\.[^/]*)?$/;
-const CREDENTIAL_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/))|(?:\.enc$)/i;
-const HOST_CRON = /\b(?:crontab|anacron|crond|supercronic)\b|\/etc\/cron(?:\b|[./])|\bcron\.d\b|\/var\/spool\/cron\b|@(?:reboot|yearly|annually|monthly|weekly|daily|midnight|hourly)\b|\b[\w.@-]+\.timer\b|\bOn(?:Calendar|BootSec|UnitActiveSec|ActiveSec)\s*=|(?:^|[\s;|&"'])at\s+(?:(?:-[a-z]+\s+)*)((?:-[ft]\b)|now\b|tomorrow\b|\d{1,2}:\d{2}\b|midnight\b|noon\b)/im;
+const CREDENTIAL_FILE_PARTS = [/(?:^|\/)secrets?\.env(?:\.[^/]*)?/, /(?:^|\/)\.env(?:\.[^/]*)?/, /(?:^|\/)secrets\//, /\.enc$/];
+const CREDENTIAL_FILE = new RegExp(CREDENTIAL_FILE_PARTS.map((part) => part.source).join('|'), 'i');
+const AT_JOB_ARGUMENT = /-[ft]\b|now\b|tomorrow\b|\d{1,2}:\d{2}\b|midnight\b|noon\b/.source;
+const HOST_CRON_PARTS = [
+  /\b(?:crontab|anacron|crond|supercronic)\b/,
+  /\/etc\/cron(?:\b|[./])/,
+  /\bcron\.d\b/,
+  /\/var\/spool\/cron\b/,
+  /@(?:reboot|yearly|annually|monthly|weekly|daily|midnight|hourly)\b/,
+  /\b[\w.@-]+\.timer\b/,
+  /\bOn(?:Calendar|BootSec|UnitActiveSec|ActiveSec)\s*=/,
+  new RegExp(String.raw`(?:^|[\s;|&"'])at\s+(?:-[a-z]+\s+)*(?:${AT_JOB_ARGUMENT})`),
+];
+const HOST_CRON = new RegExp(HOST_CRON_PARTS.map((part) => part.source).join('|'), 'im');
 const HOST_CRON_PATH = /(?:^|\/)(?:crontab(?:$|\/)|cron\.d(?:\/|$)|[^/]+\.(?:timer|crontab)$)/;
 const CRON_NUMERIC_FIELD = /^[\d*,/-]+$/;
 const CRON_NAMED_FIELD = /^[\w*,/-]+$/;
-const CRON_CONTAINER = /\bimage\s*:\s*["']?(?:[^\s"']*\/)?(?:cron|crond|supercronic|ofelia)(?=[:@\s"']|$)|\b(?:command|entrypoint)\s*:[^\n]*\b(?:cron|crond|supercronic)\b/i;
-const SLEEP_LOOP = /\b(?:while\s+(?:true|:|\[\s*1\s*\])|for\s*\(\(\s*;\s*;\s*\)\))\s*[;\n][\s\S]{0,4000}?\bsleep\s+/i;
+const CRON_CONTAINER_PARTS = [
+  /\bimage\s*:\s*["']?(?:[^\s"']*\/)?(?:cron|crond|supercronic|ofelia)(?=[:@\s"']|$)/,
+  /\b(?:command|entrypoint)\s*:[^\n]*\b(?:cron|crond|supercronic)\b/,
+];
+const CRON_CONTAINER = new RegExp(CRON_CONTAINER_PARTS.map((part) => part.source).join('|'), 'i');
+const SLEEP_LOOP_HEAD_PARTS = [/while\s+(?:true|:|\[\s*1\s*\])/, /for\s*\(\(\s*;\s*;\s*\)\)/];
+const SLEEP_LOOP_HEAD = new RegExp(String.raw`\b(?:${SLEEP_LOOP_HEAD_PARTS.map((part) => part.source).join('|')})`, 'gi');
+const SLEEP_LOOP_BREAK = /[^\S\n]*[;\n]/y;
+const SLEEP_LOOP_SLEEP = /\bsleep\s+/gi;
+const SLEEP_LOOP_REACH = 4000;
+/** An endless-loop head, a statement break, then a `sleep` within SLEEP_LOOP_REACH characters: searched in steps so no regex backtracks across the pair. */
+const SLEEP_LOOP = {
+  test(text) {
+    for (const head of text.matchAll(SLEEP_LOOP_HEAD)) {
+      SLEEP_LOOP_BREAK.lastIndex = head.index + head[0].length;
+      if (!SLEEP_LOOP_BREAK.test(text)) continue;
+      SLEEP_LOOP_SLEEP.lastIndex = SLEEP_LOOP_BREAK.lastIndex;
+      const sleep = SLEEP_LOOP_SLEEP.exec(text);
+      if (sleep && sleep.index - SLEEP_LOOP_BREAK.lastIndex <= SLEEP_LOOP_REACH) return true;
+    }
+    return false;
+  },
+};
 const INLINE_NODE = /\bnode\b[^\n;&|]*?\s(?:-(?:e|p|pe)\b|--(?:eval|print)(?:\s|=))/;
-const INLINE_SQL_ACTION = /\b(?:insert\s+into|update\s+[\w."']+\s+set|delete\s+from|create\s+(?:table|function|view)|alter\s+table|truncate\s+(?:table\s+)?[\w."'])\b/i;
+const INLINE_SQL_ACTION_PARTS = [
+  /insert\s+into/,
+  /update\s+[\w."']+\s+set/,
+  /delete\s+from/,
+  /create\s+(?:table|function|view)/,
+  /alter\s+table/,
+  /truncate\s+(?:table\s+)?[\w."']/,
+];
+const INLINE_SQL_ACTION = new RegExp(String.raw`\b(?:${INLINE_SQL_ACTION_PARTS.map((part) => part.source).join('|')})\b`, 'i');
 const REMOTE_SHELL = /\b(?:curl|wget)\b[^|\n]*\|\s*(?:sudo\s+)?(?:ba|da|z)?sh\b/i;
-const COMPOSE_COMMAND = /\bdocker(?:\s+(?:--(?:context|host)(?:\s+|=)\S+|-H\s+\S+))*\s+compose\b[^\n;&|]*|\bdocker-compose\b[^\n;&|]*/g;
+const DOCKER_GLOBAL_OPTION = /(?:--(?:context|host)(?:\s+|=)|-H\s+)\S+/.source;
+const DOCKER_COMPOSE_COMMAND = new RegExp(String.raw`\bdocker(?:\s+${DOCKER_GLOBAL_OPTION})*\s+compose\b[^\n;&|]*`).source;
+const DOCKER_COMPOSE_V1_COMMAND = /\bdocker-compose\b[^\n;&|]*/.source;
+const COMPOSE_COMMAND = new RegExp(`${DOCKER_COMPOSE_COMMAND}|${DOCKER_COMPOSE_V1_COMMAND}`, 'g');
 const COMPOSE_OPTIONS = new Set(['-f', '--file', '-p', '--project-name', '--project-directory', '--env-file', '--profile', '--parallel', '--ansi', '--progress']);
 const DEV = /(?:^|[\s/._="'-])(?:dev|development|local)(?=$|[\s/._"'-])/i;
 const NON_DEV = /(?:^|[\s/._="'-])(?:prod|production|staging|stage|vps|preview)(?=$|[\s/._"'-])/i;

package/runtime/scripts/hfs/rules/deploy-workflow.mjs

@@ -59,7 +59,17 @@ const validPermissions = (value) => record(value) || value === 'read-all' || val
 const validConcurrency = (value) => nonempty(value) || (record(value) && nonempty(value.group));
 const deployName = (value) => !/authorize[\s_.-]+deploy[\s_.-]+key/i.test(value) && /(?:^|[\s/_.-])deploy(?:[\s/_.-]|$)/i.test(value);
 const materializeCommand = (script) => commands(script).some(({ text }) => /^starci\s+app\s+secret\s+materialize\b/.test(commandBody(text)));
-const deploymentCommand = (script) => commands(script).some(({ text }) => /^(?:starci\s+(?:app\s+)?(?:deploy|secret\s+materialize)\b|docker\s+stack\s+deploy\b|(?:ba?sh\s+)?(?:\.\/)?deploy\/|(?:ba?sh\s+)?(?:\.\/)?(?:scripts\/)?[\w.-]*deploy[\w.-]*\.sh\b|npm\s+run\s+deploy(?=[:\s]|$))/.test(commandBody(text)));
+const DEPLOYMENT_COMMANDS = [
+  /^starci\s+(?:app\s+)?(?:deploy|secret\s+materialize)\b/,
+  /^docker\s+stack\s+deploy\b/,
+  /^(?:ba?sh\s+)?(?:\.\/)?deploy\//,
+  /^(?:ba?sh\s+)?(?:\.\/)?(?:scripts\/)?[\w.-]*deploy[\w.-]*\.sh\b/,
+  /^npm\s+run\s+deploy(?=[:\s]|$)/,
+];
+const deploymentCommand = (script) => commands(script).some(({ text }) => {
+  const body = commandBody(text);
+  return DEPLOYMENT_COMMANDS.some((pattern) => pattern.test(body));
+});
 
 function hasAgeIdentity(job, doc) {
   const steps = activeSteps(job);

package/runtime/scripts/hfs/rules/doc-fresh.mjs

@@ -52,10 +52,15 @@ function resolvedPath(raw, file, tracked, link, generated, roots) {
   return candidates.some((candidate) => !candidate.startsWith('../') && (trackedPath(candidate, tracked) || generated.has(candidate)));
 }
 
+const ENV_NAME = /[A-Z][A-Z0-9_]*/.source;
+const INLINE_LINK = /\]\(\s*(?:<([^>]+)>|([^\s)]+))(?:\s+['"][^)]*)?\)/.source;
+const REFERENCE_LINK = /^\s*\[[^\]]+\]:\s*(?:<([^>]+)>|(\S+))/.source;
+const MARKDOWN_LINK = new RegExp(`${INLINE_LINK}|${REFERENCE_LINK}`, 'g');
+
 function pathReferences(line) {
   const refs = [];
   // Markdown inline and reference links, including image links. URLs and anchors are excluded later.
-  for (const match of line.matchAll(/\]\(\s*(?:<([^>]+)>|([^\s)]+))(?:\s+['"][^)]*)?\)|^\s*\[[^\]]+\]:\s*(?:<([^>]+)>|(\S+))/g)) {
+  for (const match of line.matchAll(MARKDOWN_LINK)) {
     refs.push({ target: match[1] ?? match[2] ?? match[3] ?? match[4], link: true });
   }
   const masked = line.replace(/\]\([^)]*\)/g, ']');
@@ -171,9 +176,14 @@ function importedFiles(file, text, tracked) {
   });
 }
 
+const READER_CALL = /\b(\w+)\s*\.\s*\w+\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]/.source;
+const PROCESS_ENV_DOT = /\bprocess\.env\.([A-Z][A-Z0-9_]*)/.source;
+const PROCESS_ENV_INDEX = /\bprocess\.env\[['"]([A-Z][A-Z0-9_]*)['"]\]/.source;
+const ENV_READ = new RegExp(`${READER_CALL}|${PROCESS_ENV_DOT}|${PROCESS_ENV_INDEX}`, 'g');
+
 function addReaderKeys(text, keys) {
   const readers = new Set(['env', 'source', ...[...text.matchAll(/\b(\w+)\s*:\s*EnvSource\b/g)].map((match) => match[1])]);
-  for (const match of text.matchAll(/\b(\w+)\s*\.\s*\w+\s*\(\s*['"]([A-Z][A-Z0-9_]*)['"]|\bprocess\.env\.([A-Z][A-Z0-9_]*)|\bprocess\.env\[['"]([A-Z][A-Z0-9_]*)['"]\]/g)) {
+  for (const match of text.matchAll(ENV_READ)) {
     if (match[3] || match[4]) keys.add(match[3] ?? match[4]);
     else if (readers.has(match[1])) keys.add(match[2]);
   }
@@ -242,6 +252,11 @@ function unknownEnvironmentName(name, line, keys, codes, tokens, explicit) {
   return !keys.has(name) && !(name.endsWith('_FILE') && keys.has(name.slice(0, -5)));
 }
 
+const QUOTED_ENV_NAME = `\`(${ENV_NAME})\``;
+const REFERENCED_ENV_NAME = String.raw`\b(?:process\.env\.|\$\{?)(${ENV_NAME})`;
+const ASSIGNED_ENV_NAME = String.raw`\b(${ENV_NAME})\s*=`;
+const ENV_NAME_CITATION = new RegExp(`${QUOTED_ENV_NAME}|${REFERENCED_ENV_NAME}|${ASSIGNED_ENV_NAME}`, 'g');
+
 function nameFindings(file, lines, keys, rules, tokens) {
   const findings = [];
   const codes = new Set(rules.rules.flatMap((rule) => rule.failureCodes));
@@ -249,7 +264,7 @@ function nameFindings(file, lines, keys, rules, tokens) {
     for (const match of line.matchAll(/\bR\d+\b/g)) {
       if (!rules.rule(match[0])) findings.push(found(RULE_UNKNOWN, file, `${file} cites unknown rule ${match[0]}; use an id from the HFS rule catalog`, { line: index + 1, reference: match[0] }));
     }
-    for (const match of line.matchAll(/`([A-Z][A-Z0-9_]*)`|\b(?:process\.env\.|\$\{?)([A-Z][A-Z0-9_]*)|\b([A-Z][A-Z0-9_]*)\s*=/g)) {
+    for (const match of line.matchAll(ENV_NAME_CITATION)) {
       const name = match[1] ?? match[2] ?? match[3];
       if (!unknownEnvironmentName(name, line, keys, codes, tokens, !match[1])) continue;
       findings.push(found(ENV_UNKNOWN, file, `${file} cites unknown environment key ${name}; declare it in a typed environment reader or KEYS.md, or update the documentation`, { line: index + 1, reference: name }));

package/runtime/scripts/hfs/rules/docker-health.mjs

@@ -222,7 +222,10 @@ function masksProbeFailure(body) {
   for (let index = 0; index < body.length; index += 1) {
     const char = body[index];
     if (char === '\\') { index += 1; continue; }
-    if (quote) { if (char === quote) quote = null; continue; }
+    if (quote) {
+      if (char === quote) quote = null;
+      continue;
+    }
     if (char === '"' || char === "'") { quote = char; continue; }
     if (char === ';' || char === '|') return true;
   }

package/runtime/scripts/hfs/rules/env-parity.mjs

@@ -35,12 +35,10 @@ const APP_MAIN = /(?:^|\/)apps\/[^/]+\/src\/main\.ts$/u;
 const SEALED_MEMBER = /^\.starcistacks\/[^/]+\/secrets\/[^/]+\.enc$/u;
 const KEYS_ROSTER = /^\.starcistacks\/[^/]+\/runtime\/env\/KEYS\.md$/u;
 const STACK_YAML = /^\.starcistacks\/.+\.ya?ml$/u;
-const ENV_EXAMPLE = /\.env\.example$/u;
-const PUBLIC_PREFIX = /^NEXT_PUBLIC_/u;
 const KEY_NAME = /^[A-Za-z_]\w*$/u;
 const FILE_SUFFIX = /_FILE$/u;
 const EXAMPLE_LINE = /^[ \t]*(?:export[ \t]+)?([A-Za-z_]\w*)[ \t]*=(.*)$/u;
-const ROSTER_KEY = /`([A-Za-z_][A-Za-z0-9_]*)`/gu;
+const ROSTER_KEY = /`([A-Za-z_]\w*)`/gu;
 
 const REQUIRED_ALWAYS = new Set(['string', 'url', 'secret', 'enum']);
 const FALLBACK_OPTIONAL = new Set(['int', 'bool', 'duration']);
@@ -274,14 +272,17 @@ function declaredYamlEntry(key, value, add) {
 /** The env names one yaml node declares: `environment:`/`env:` keys or `K=V` entries, `runtimeSecrets`, `secrets` and `vars[].name`. */
 function declaredFromYaml(node, add) {
   if (!node || typeof node !== 'object') return;
-  if (Array.isArray(node)) { for (const item of node) declaredFromYaml(item, add); return; }
+  if (Array.isArray(node)) {
+    for (const item of node) declaredFromYaml(item, add);
+    return;
+  }
   for (const [key, value] of Object.entries(node)) declaredYamlEntry(key, value, add);
 }
 
 function addDeclaredKey(declared, name) {
   if (!KEY_NAME.test(name)) return;
   declared.add(name);
-  if (FILE_SUFFIX.test(name)) declared.add(name.replace(FILE_SUFFIX, ''));
+  if (name.endsWith('_FILE')) declared.add(name.replace(FILE_SUFFIX, ''));
 }
 
 function declareKeysFromText(file, text, add) {
@@ -314,7 +315,7 @@ function addRequiredFindings(reads, sealed, declared, findings) {
 
 function sealedMemberFinding(key, member, reads, declared) {
   // The specific public-custody code wins over the generic unread one for a NEXT_PUBLIC_* key.
-  if (PUBLIC_PREFIX.test(key)) {
+  if (key.startsWith('NEXT_PUBLIC_')) {
     return found(ENV_PUBLIC_SEALED, member, `${member} seals the public key ${key}; NEXT_PUBLIC_* values are public configuration and never enter custody`);
   }
   if (!reads.has(key) && !declared.has(key)) {
@@ -347,7 +348,7 @@ function addDuplicateFindings(key, members, findings) {
 }
 
 function addExampleFindings(repoRoot, all, reads, findings) {
-  for (const file of all.filter((rel) => ENV_EXAMPLE.test(rel))) {
+  for (const file of all.filter((rel) => rel.endsWith('.env.example'))) {
     const text = readText(repoRoot, file);
     if (text === null) continue;
     for (const { key } of envExampleEntries(text)) {

package/runtime/scripts/hfs/rules/env-value-shape.mjs

@@ -19,8 +19,6 @@ import { found, readText } from './read.mjs';
 export const ENV_VALUE_SHAPE = 'ENV_VALUE_SHAPE';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
-const FILE_SUFFIX = /_FILE$/u;
-const ENV_EXAMPLE = /\.env\.example$/u;
 const SKIP_DIRECTORY = new Set(['node_modules', 'dist', 'coverage', '.git']);
 
 const SHAPES = Object.freeze({
@@ -61,7 +59,7 @@ function listEnvSourceFiles(repoRoot) {
 function shapeViolations(reads, map) {
   const violations = [];
   for (const [key, value] of Object.entries(map)) {
-    if (FILE_SUFFIX.test(key)) continue;
+    if (key.endsWith('_FILE')) continue;
     const shape = reads.get(key)?.shape;
     if (shape && !shapeOk(shape, value)) violations.push({ key, expected: shapeText(shape) });
   }
@@ -71,7 +69,7 @@ function shapeViolations(reads, map) {
 /** The findings of R249 over the `*.env.example` files of an app judged at its root scope (both editions). */
 export function envValueShapeFindings({ repoRoot, all = [], isRoot }) {
   if (!isRoot) return [];
-  const examples = all.filter((file) => ENV_EXAMPLE.test(file));
+  const examples = all.filter((file) => file.endsWith('.env.example'));
   if (!examples.length) return [];
   const reads = collectEnvReads(repoRoot, all);
   if (reads === null) return [];

package/runtime/scripts/hfs/rules/fe-build-args.mjs

@@ -91,7 +91,7 @@ function requiredNames(root, files, app, ts) {
   const names = new Set();
   for (const file of files.filter(file => file.startsWith(prefix))) {
     const local = file.slice(prefix.length);
-    const source = SOURCE.test(local) && (local.startsWith('src/') || /^next\.config\./u.test(local) || SCHEMA.test(local));
+    const source = SOURCE.test(local) && (local.startsWith('src/') || local.startsWith('next.config.') || SCHEMA.test(local));
     const schema = SCHEMA.test(local) && /\.(?:json|ya?ml)$/u.test(local);
     if (!source && !schema) continue;
     const text = readText(root, file);

package/runtime/scripts/hfs/rules/release-provenance.mjs

@@ -13,7 +13,10 @@ import { found, readJson, readText } from './read.mjs';
 
 export const HFS_RELEASE_TAG_MISMATCH = 'HFS_RELEASE_TAG_MISMATCH';
 export const HFS_DB_DEPLOY_UNGUARDED = 'HFS_DB_DEPLOY_UNGUARDED';
-const SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+const SEMVER_NUMBER = String.raw`(?:0|[1-9]\d*)`;
+const SEMVER_PRERELEASE_ID = String.raw`(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)`;
+const SEMVER_BUILD_ID = '[0-9A-Za-z-]+';
+const SEMVER = new RegExp(String.raw`^${SEMVER_NUMBER}\.${SEMVER_NUMBER}\.${SEMVER_NUMBER}(?:-${SEMVER_PRERELEASE_ID}(?:\.${SEMVER_PRERELEASE_ID})*)?(?:\+${SEMVER_BUILD_ID}(?:\.${SEMVER_BUILD_ID})*)?$`);
 const WORKFLOW = /^\.github\/workflows\/(images|db-deploy)\.ya?ml$/;
 const TAG = 1;
 const VERSION_PREFIX = 2;
@@ -42,7 +45,7 @@ function splitBoolean(expression, operator) {
   let start = 0, depth = 0, quote = '';
   for (let i = 0; i < expression.length; i += 1) {
     const char = expression[i];
-    if (quote) { if (char === quote) quote = ''; continue; }
+    if (quote) { if (char === quote) { quote = ''; } continue; }
     if (char === "'" || char === '"') { quote = char; continue; }
     if (char === '(') depth += 1;
     if (char === ')') depth -= 1;
@@ -56,7 +59,7 @@ function enclosingParentheses(text) {
   let depth = 0, quote = '';
   for (let i = 0; i < text.length - 1; i += 1) {
     const char = text[i];
-    if (quote) { if (char === quote) quote = ''; continue; }
+    if (quote) { if (char === quote) { quote = ''; } continue; }
     if (char === "'" || char === '"') { quote = char; continue; }
     if (char === '(') depth += 1;
     if (char === ')' && --depth === 0) return false;
@@ -109,7 +112,7 @@ function shellTagGuard(step) {
 }
 
 function checkoutPreservesRef(job) {
-  return (job.steps ?? []).filter((step) => /^actions\/checkout@/.test(step.uses ?? '')).every((step) => {
+  return (job.steps ?? []).filter((step) => (step.uses ?? '').startsWith('actions/checkout@')).every((step) => {
     const ref = step.with?.ref;
     return ref === undefined || /^\$\{\{\s*github\.(?:ref|ref_name|sha)\s*\}\}$/.test(String(ref));
   });
@@ -174,7 +177,7 @@ function imageFindings(file, workflow, version) {
   let builds = 0;
   for (const [name, job] of Object.entries(workflow.jobs ?? {})) {
     for (const step of job?.steps ?? []) {
-      if (!/^docker\/build-push-action@/.test(step.uses ?? '')) continue;
+      if (!(step.uses ?? '').startsWith('docker/build-push-action@')) continue;
       builds += 1;
       const guarded = tagOnlyTrigger(workflow) || refProof(job.if) === RELEASE_REF || refProof(step.if) === RELEASE_REF;
       if (!guarded || !checkoutPreservesRef(job) || !imageTagIsRelease(step.with?.tags, version)) findings.push(found(HFS_RELEASE_TAG_MISMATCH, file, `${file} job ${name} must build the checked-out release ref and tag every image with v<package.json version> or github.ref_name under a release-tag guard`, { job: name }));

package/runtime/scripts/hfs/rules/script-hygiene.mjs

@@ -7,16 +7,32 @@ const PLAINTEXT_LOAD = 'HFS_SCRIPT_PLAINTEXT_LOAD';
 const XTRACE = 'HFS_SCRIPT_XTRACE';
 const SERVICE_ROLE = 'HFS_SERVICE_ROLE_SCOPE';
 const SUPABASE_OWNER = 'be.integrations.supabase';
-const SECRET_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|\.nivo-lite(?:\/|$)))|(?:\.enc$)/iu;
+const SECRET_ENV_FILE = /(?:^|\/)(?:secrets?\.env|\.env)(?:\.[^/]*)?/iu;
+const SECRET_NIVO_FILE = /(?:^|\/)\.nivo-lite(?:\/|$)/iu;
+const SECRET_ENC_FILE = /\.enc$/iu;
+const isSecretFile = (file) => SECRET_ENV_FILE.test(file) || SECRET_NIVO_FILE.test(file) || SECRET_ENC_FILE.test(file);
 const EXCLUDED_TREE = /(?:^|\/)(?:node_modules|\.git|\.claude|\.secrets|secrets|tests?|__tests__|docs|coverage|dist|build)(?:\/|$)/u;
 const TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/u;
 const SOURCE = /\.(?:[cm]?[jt]sx?|sh|bash|zsh|ksh|ps1|psm1|bat|cmd|py|rb|pl)$/iu;
 const WORKFLOW = /(?:^|\/)\.?(?:github\/)?workflows\/[^/]+\.ya?ml$/u;
 const DELIVERY = /(?:^|\/)(?:deploy|scripts|bin)\//u;
 const DOCKER = /(?:^|\/)(?:Dockerfile(?:\.[^/]*)?|(?:docker-)?compose(?:[.-][^/]*)?\.ya?ml)$/iu;
-const SECRET_REFERENCE = /(?:^|[\s/\\'"`(=])(?:secrets?\.env(?:\.[\w.-]+)?|\.env(?:\.[\w.-]+)?|\.nivo-lite(?:[/\\][\w./\\-]*)?)(?=$|[\s/\\'"`),;])/iu;
+const SECRET_REFERENCE_NAME = /(?:secrets?\.env|\.env)(?:\.[\w.-]+)?/;
+const SECRET_REFERENCE_NIVO = /\.nivo-lite(?:[/\\][\w./\\-]*)?/;
+const SECRET_REFERENCE_BEFORE = /(?:^|[\s/\\'"`(=])/;
+const SECRET_REFERENCE_AFTER = /(?=$|[\s/\\'"`),;])/;
+const SECRET_REFERENCE_SOURCE = `${SECRET_REFERENCE_BEFORE.source}(?:${SECRET_REFERENCE_NAME.source}|${SECRET_REFERENCE_NIVO.source})${SECRET_REFERENCE_AFTER.source}`;
+const SECRET_REFERENCE = new RegExp(SECRET_REFERENCE_SOURCE, 'iu');
 const EXAMPLE_REFERENCE = /(?:secrets?\.env|\.env)\.(?:example|sample|template)(?=$|[^\w.-])/giu;
-const LOAD = /(?:^|[\s;&|('"`])(?:source|cat|tac|less|more|head|tail|grep|egrep|fgrep|awk|gawk|sed|base64|Get-Content|gc|Import-DotEnv|env-cmd|load_dotenv|loadEnvFile|readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|dotenv\s*\.\s*(?:config|parse))\b|\b(?:File|IO)\s*\.\s*(?:read|readlines)\b|\.\s*read_(?:text|bytes)\s*\(|(?:^|[\s;&|])\.[\t ]+|(?<!<)<(?!<)/iu;
+const LOAD_SHELL_COMMAND = /(?:^|[\s;&|('"`])(?:source|cat|tac|less|more|head|tail|grep|egrep|fgrep|awk|gawk|sed|base64)\b/iu;
+const LOAD_WINDOWS_COMMAND = /(?:^|[\s;&|('"`])(?:Get-Content|gc|Import-DotEnv|env-cmd|load_dotenv|loadEnvFile)\b/iu;
+const LOAD_READ_CALL = /(?:^|[\s;&|('"`])(?:readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|dotenv\s*\.\s*(?:config|parse))\b/iu;
+const LOAD_FILE_READ = /\b(?:File|IO)\s*\.\s*(?:read|readlines)\b/iu;
+const LOAD_PYTHON_READ = /\.\s*read_(?:text|bytes)\s*\(/iu;
+const LOAD_DOT_SOURCE = /(?:^|[\s;&|])\.[\t ]+/iu;
+const LOAD_REDIRECT = /(?<!<)<(?!<)/iu;
+const LOAD_PATTERNS = [LOAD_SHELL_COMMAND, LOAD_WINDOWS_COMMAND, LOAD_READ_CALL, LOAD_FILE_READ, LOAD_PYTHON_READ, LOAD_DOT_SOURCE, LOAD_REDIRECT];
+const isLoad = (line) => LOAD_PATTERNS.some((pattern) => pattern.test(line));
 const READ_CALL = /\b(?:readFile(?:Sync)?|readTextFile(?:Sync)?|ReadAllText|ReadAllLines|load_dotenv|loadEnvFile|dotenv\s*\.\s*(?:config|parse))\s*\(/giu;
 const TRACE_COMMAND = /(?:^|[\s;&|('"`]|#!)(?:set|\/?(?:[\w.-]+\/)*(?:bash|sh|dash|zsh|ksh))\s+/giu;
 const SHELL_OPTIONS = /\bSHELLOPTS\s*=\s*['"]?([^\s;'"]*)/giu;
@@ -26,7 +42,7 @@ const SERVICE_ROLE_NAME = /(?:^|[^a-z0-9])(?:[a-z0-9]+[_-])*service[_-]?role(?:[
 function executableText(text) {
   return text.replace(/\/\*[\s\S]*?\*\//gu, '').split(/\r?\n/u)
     .filter((line) => !/^\s*(?:#(?!!)|\/\/)/u.test(line)).join('\n')
-    .replace(/(?:\\|`)\r?\n/gu, ' ');
+    .replace(/[\\`]\r?\n/gu, ' ');
 }
 
 const hasSecretReference = (text) => SECRET_REFERENCE.test(text.replace(EXAMPLE_REFERENCE, 'example-file'));
@@ -37,7 +53,7 @@ function callArguments(text, from) {
   for (let at = from; at < Math.min(text.length, from + 1024); at += 1) {
     const character = text[at];
     if (character === '\\') { at += 1; continue; }
-    if (quote) { if (character === quote) quote = ''; continue; }
+    if (quote) { if (character === quote) { quote = ''; } continue; }
     if (['\'', '"', '`'].includes(character)) { quote = character; continue; }
     if (character === '(') depth += 1;
     if (character === ')' && --depth === 0) return text.slice(from, at);
@@ -81,7 +97,7 @@ function plaintextLoad(text) {
   const lines = text.split(/\r?\n/u);
   const aliases = secretAliases(lines);
   const secretReference = (value) => hasSecretReference(value) || aliases.some((alias) => alias.test(value));
-  return lines.some((line) => LOAD.test(line) && secretReference(line)) || multilineLoad(text, secretReference) || pythonLoad(text);
+  return lines.some((line) => isLoad(line) && secretReference(line)) || multilineLoad(text, secretReference) || pythonLoad(text);
 }
 
 function tracingOptions(source) {
@@ -120,7 +136,7 @@ function integrationOwns(file, resolver) {
 }
 
 function isSource(file) {
-  if (SECRET_FILE.test(file) || EXCLUDED_TREE.test(file) || TEST_FILE.test(file)) return false;
+  if (isSecretFile(file) || EXCLUDED_TREE.test(file) || TEST_FILE.test(file)) return false;
   return SOURCE.test(file) || WORKFLOW.test(file) || DOCKER.test(file)
     || file.endsWith('/package.json') || file === 'package.json'
     || (DELIVERY.test(file) && !/\.[a-z0-9]+$/iu.test(file));

package/runtime/scripts/hfs/rules/services.mjs

@@ -5,7 +5,8 @@
 //                                   exists only at be/apps/<service>/ (fe/apps/<app>/Dockerfile is a front end's);
 //   R164 HFS_IMAGE_UNPINNED         in a multi-service product every component image of application-stacks.yaml is a digest or an exact
 //                                   version (x.y.z), never a missing tag, `latest`, a branch word or a major/minor-only tag;
-//   R165 HFS_SERVICE_STACK_DECLARATION  each api or worker app of a multi-service product is a `role: service` component of the stack;
+//   R165 HFS_SERVICE_STACK_DECLARATION  each api or worker app of a multi-service product is a `role: service` component of the stack,
+//                                   named after the app or mapped to it by `environments.<env>.deploy.images.<component>.app`;
 //   R166 HFS_EVENT_CONTRACT         the async contract is vendored: `be/contracts/<service>/events.json` equals the provider's
 //                                   `apps/<service>/src/events.ts` table (an event may declare `compensates: "<event>"`), every event a
 //                                   consumer's `apps/<app>/src/consumes.ts` names exists in that snapshot at the same version;
@@ -16,6 +17,7 @@
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { findStackDeclaration } from '../../lib/stack-declaration.mjs';
+import { deployImageApps } from '../stack-deploy-config.mjs';
 import { loadTypescript } from '../../lib/package-at.mjs';
 import { propertyText } from '../../lib/ts-ast.mjs';
 import { folded, readEventClasses, snapshotText } from '../../lib/event-contract.mjs';
@@ -105,7 +107,17 @@ function imagePinFindings({ repoRoot, repo }) {
 
 // ------------------------------------------------------------------------------------------------ R165 stack declaration
 
-/** Findings of R165: each service app of a multi-service product is a `role: service` component. */
+/**
+ * The component names that stand for `app`: the app's own name, then every `environments.<env>.deploy.images` key whose `app` is
+ * the app (the one tie between component and app the declaration states, read by scripts/hfs/stack-deploy-config.mjs). A product
+ * whose deployed service is named after its stack (`shop-api: {app: api}`) keeps that name; renaming it would rename the live
+ * service and put the short app alias on a shared network (R294).
+ */
+function componentNamesOf(doc, app) {
+  return [...new Set([app, ...deployImageApps(doc).filter((tie) => tie.app === app).map((tie) => tie.service)])];
+}
+
+/** Findings of R165: each service app of a multi-service product is a `role: service` component, named after it or mapped to it by deploy.images. */
 function serviceStackFindings({ repoRoot, repo }) {
   const services = servicesOf(repo);
   if (services.length < 2) return [];
@@ -115,9 +127,11 @@ function serviceStackFindings({ repoRoot, repo }) {
   const file = '.starcistacks/application-stacks.yaml';
   const findings = [];
   for (const app of services) {
-    const component = components[app.name];
-    if (component === null || typeof component !== 'object') findings.push(found(SERVICE_STACK_DECLARATION, file, `${file} declares no component \`${app.name}\` for the ${app.kind} app be/apps/${app.name}; every service of a multi-service product is a \`role: service\` component (own image \`<repo>/${app.name}:<exact version>\`, built from be/apps/${app.name}/Dockerfile).`, { app: app.name }));
-    else if (component.role !== 'service') findings.push(found(SERVICE_STACK_DECLARATION, file, `${file} components.${app.name} is the stack's face of be/apps/${app.name} and must be \`role: service\`, not \`${String(component.role)}\`.`, { app: app.name }));
+    const names = componentNamesOf(declaration.doc, app.name);
+    const declared = names.filter((name) => components[name] !== null && typeof components[name] === 'object');
+    if (declared.some((name) => components[name].role === 'service')) continue;
+    if (!declared.length) findings.push(found(SERVICE_STACK_DECLARATION, file, `${file} declares no component for the ${app.kind} app be/apps/${app.name}: none named \`${app.name}\` and none mapped to it by \`environments.<env>.deploy.images.<component>.app: ${app.name}\`; every service of a multi-service product is a \`role: service\` component (own image at an exact version, built from be/apps/${app.name}/Dockerfile).`, { app: app.name }));
+    else findings.push(found(SERVICE_STACK_DECLARATION, file, `${file} ${declared.map((name) => 'components.' + name).join(', ')} is the stack's face of be/apps/${app.name} and must be \`role: service\`, not \`${String(components[declared[0]].role)}\`.`, { app: app.name, components: declared }));
   }
   return findings;
 }

package/runtime/scripts/hfs/rules/stack-tooling.mjs

@@ -13,7 +13,10 @@ const SCRIPTS_DIR = /(?:^|\/)scripts\//;
 const PACKAGE_JSON = /(?:^|\/)package\.json$/;
 const SOURCE_FILE = /(?:^|\/)[^/.]+$|\.(?:sh|bash|zsh|mjs|cjs|js|ts|mts|py|ya?ml)$/;
 const TEST_FILE = /\.(?:spec|test)\.[cm]?[jt]s$/;
-const CREDENTIAL_FILE = /(?:(?:^|\/)(?:secrets?\.env(?:\.[^/]*)?|\.env(?:\.[^/]*)?|secrets\/))|(?:\.enc$)/i;
+const CREDENTIAL_ENV_FILE = /(?:^|\/)(?:secrets?\.env|\.env)(?:\.[^/]*)?/i;
+const CREDENTIAL_SECRETS_DIR = /(?:^|\/)secrets\//i;
+const CREDENTIAL_ENC_FILE = /\.enc$/i;
+const isCredentialFile = (file) => CREDENTIAL_ENV_FILE.test(file) || CREDENTIAL_SECRETS_DIR.test(file) || CREDENTIAL_ENC_FILE.test(file);
 const VERB_FILE = /^(render|provision|converge|verify|prune|rollback|release|backup|prepare|doctor|jobs|public)\.(?:mjs|js|cjs|sh)$/;
 const COMMENT_LINE = /^[ \t]*(?:#|\/\/).*$/gm;
 const LINE_CONTINUATION = /\\\r?\n\s*/g;
@@ -57,7 +60,7 @@ function sourceText(file, raw) {
 }
 
 function deploySource(file) {
-  if (MANAGED_WORKFLOW.test(file) || CREDENTIAL_FILE.test(file) || TEST_FILE.test(file)) return false;
+  if (MANAGED_WORKFLOW.test(file) || isCredentialFile(file) || TEST_FILE.test(file)) return false;
   if (PACKAGE_JSON.test(file) || WORKFLOW.test(file)) return true;
   return (DEPLOY_DIR.test(file) || SCRIPTS_DIR.test(file)) && SOURCE_FILE.test(file);
 }

package/runtime/scripts/hfs/rules/stacks-swarm.mjs

@@ -14,8 +14,8 @@ import { stacksDeploymentFindings } from './stacks-runtime.mjs';
 
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());
-const VERSION = /^[1-9][0-9]*$/;
-const VERSIONED_SECRET = /-v[1-9][0-9]*$/;
+const VERSION = /^[1-9]\d*$/;
+const VERSIONED_SECRET = /-v[1-9]\d*$/;
 const SENSITIVE_KEY = /password|passwd|secret|token|credential|private[_-]?key|api[_-]?key|service[_-]?role|(?:(?:^|_)key$)/i;
 const SOURCE = /^be\/(?:apps|src)\/.*\.[cm]?[jt]sx?$/;
 const TEST_SOURCE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$|\/tests\//;
@@ -124,7 +124,7 @@ function traefikHosts(rule) {
 function positiveHostCall(prefix) {
   const scopes = [false];
   let pending = false;
-  for (const token of prefix.match(/"[^"]*"|'[^']*'|`[^`]*`|[()!]|[A-Za-z_][A-Za-z_0-9]*|\S/g) ?? []) {
+  for (const token of prefix.match(/"[^"]*"|'[^']*'|`[^`]*`|[()!]|[A-Za-z_]\w*|\S/g) ?? []) {
     if (token === '!') { pending = !pending; continue; }
     if (token === '(') scopes.push(scopes.at(-1) !== pending);
     if (token === ')' && scopes.length > 1) scopes.pop();
@@ -139,7 +139,7 @@ function labelHosts(service, family) {
   if (family === 'traefik' && labels.some(([key, value]) => key === 'traefik.enable' && String(value) === 'false')) return hosts;
   for (const [key, value] of labels) {
     if (family === 'traefik' && key.startsWith('traefik.http.routers.') && key.endsWith('.rule')) hosts.push(...traefikHosts(value));
-    if (family === 'caddy-docker-proxy' && /^caddy(?:_[0-9]+)?$/.test(key)) hosts.push(...String(value).split(/[\s,]+/).map(hostOf).filter(Boolean));
+    if (family === 'caddy-docker-proxy' && /^caddy(?:_\d+)?$/.test(key)) hosts.push(...String(value).split(/[\s,]+/).map(hostOf).filter(Boolean));
   }
   return hosts;
 }
@@ -282,7 +282,7 @@ function positiveMonitor(value) {
   const units = value.match(/[a-z]+/g) ?? [], quantities = value.split(/[a-z]+/);
   if (quantities.pop() !== '' || !units.length) return false;
   return units.every(unit => ['ns', 'us', 'ms', 's', 'm', 'h'].includes(unit))
-    && quantities.every(quantity => /^[0-9]+(?:\.[0-9]+)?$/.test(quantity)) && /[1-9]/.test(value);
+    && quantities.every(quantity => /^\d+(?:\.\d+)?$/.test(quantity)) && /[1-9]/.test(value);
 }
 
 function updatePolicyIssues(id, service, add) {

package/runtime/scripts/hfs/rules/staged-specs.mjs

@@ -0,0 +1,26 @@
+// staged-specs.mjs - BE_UNIT_SPEC_NOT_STAGED (R47): the commit that adds a back-end logic file adds its unit spec beside it. A new
+// file `be/<path>/<name>.<role>.ts` that the coverage scope measures (scripts/hfs/coverage-scope.mjs isMeasured: a role of
+// ruleParams.be.logicRoles below a measured root, outside its none folders) needs `<name>.<role>.spec.ts` in the same index.
+// `starci app hygiene` judges the files the index adds (packages/hfs/sync/hygiene.mjs, run by the managed pre-commit hook), so a
+// coding agent cannot commit the code first and its spec afterwards. A file that already exists is the coverage gate's.
+import { isMeasured } from '../coverage-scope.mjs';
+
+const SPEC_NOT_STAGED = 'BE_UNIT_SPEC_NOT_STAGED';
+const BE = 'be/';
+
+/** The unit spec beside an app-relative `<name>.<role>.ts`: `<name>.<role>.spec.ts`. */
+const siblingSpec = (file) => file.replace(/\.ts$/u, '.spec.ts');
+
+/**
+ * The findings `{ file, code, message }` of the app-relative files the index adds (`added`) whose sibling spec is not among the
+ * paths the index holds (`indexed`, a Set). `manifest` is the slot manifest the coverage scope reads.
+ */
+export function stagedSpecFindings(manifest, added, indexed) {
+  return added
+    .filter((file) => file.startsWith(BE) && !file.endsWith('.spec.ts') && isMeasured(manifest, file.slice(BE.length)) && !indexed.has(siblingSpec(file)))
+    .map((file) => ({
+      file,
+      code: SPEC_NOT_STAGED,
+      message: `is a new back-end logic file the unit coverage measures at 100 per file, staged without ${siblingSpec(file).slice(file.lastIndexOf('/') + 1)} beside it; write the spec in the same change (starci gate read, code and spec, starci gate run --tests) and stage both`,
+    }));
+}

package/runtime/scripts/hfs/rules/supply-chain.mjs

@@ -141,12 +141,12 @@ const provenanceEnabled = (value) => asserted(value) || typeof value === 'string
 
 function imageActionEvidence(step) {
   const action = step.uses ?? '';
-  if (/^docker\/build-push-action@/.test(action)) {
+  if (action.startsWith('docker/build-push-action@')) {
     return { sbom: asserted(step.with?.sbom), provenance: provenanceEnabled(step.with?.provenance) };
   }
   return {
-    sbom: /^actions\/attest-sbom@/.test(action) && Boolean(step.with?.['sbom-path']),
-    provenance: /^actions\/attest-build-provenance@/.test(action) && Boolean(step.with?.['subject-path'] || step.with?.['subject-digest']),
+    sbom: action.startsWith('actions/attest-sbom@') && Boolean(step.with?.['sbom-path']),
+    provenance: action.startsWith('actions/attest-build-provenance@') && Boolean(step.with?.['subject-path'] || step.with?.['subject-digest']),
   };
 }
 

package/runtime/scripts/hfs/rules/unused-symbol-properties.mjs

@@ -14,7 +14,7 @@ function mergeProperty(before, after) {
 /** Every possible spread owner must be known before its property provenance is admitted. */
 function spreadProperty(state, expression, name, seen, resolve) {
   const choices = resolve(state, expression, seen).map(owner => ownerProperty(state, owner, name, seen, resolve));
-  if (!choices.length || choices.some(choice => choice === null)) return null;
+  if (!choices.length || choices.includes(null)) return null;
   return { values: choices.flatMap(choice => choice.values), missing: choices.some(choice => choice.missing) };
 }
 

package/runtime/scripts/hfs/rules/unused-symbol.mjs

@@ -12,7 +12,10 @@ import { returnedExpressions, valuesOf } from './unused-symbol-flow.mjs';
 
 export const HFS_UNUSED_SYMBOL = 'HFS_UNUSED_SYMBOL';
 const SOURCE = /\.[cm]?[jt]sx?$/u;
-const EXCLUDED = /(?:^|\/)(?:node_modules|__generated__|_generated|dist|tests?|__tests__|test-support)\/|(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/u;
+const EXCLUDED_DIR = /(?:^|\/)(?:node_modules|__generated__|_generated|dist|tests?|__tests__|test-support)\//u;
+const EXCLUDED_TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]sx?$/u;
+const EXCLUDED_DECLARATION_FILE = /\.d\.[cm]?ts$/u;
+const isExcluded = (file) => EXCLUDED_DIR.test(file) || EXCLUDED_TEST_FILE.test(file) || EXCLUDED_DECLARATION_FILE.test(file);
 const CATALOG = /(?:\.messages|\.catalog)\.[cm]?[jt]s$/u;
 const JSON_CATALOG = /(?:^|\/)(?:messages|locales)\/[^/]+\.json$|\.catalog\.json$/u;
 const QUEUE_NAME = /(?:^QUEUE(?:_NAME)?$|_QUEUE(?:_NAME)?$)/u;
@@ -29,7 +32,7 @@ function compilerAt(repoRoot, supplied) {
 function sourceFiles(ts, repoRoot, files) {
   const sources = new Map();
   for (const file of files) {
-    if (!SOURCE.test(file) || EXCLUDED.test(file) || !/(?:^|\/)src\//u.test(file)) continue;
+    if (!SOURCE.test(file) || isExcluded(file) || !/(?:^|\/)src\//u.test(file)) continue;
     const text = readText(repoRoot, file);
     if (text !== null) sources.set(slash(path.resolve(repoRoot, file)), ts.createSourceFile(path.resolve(repoRoot, file), text, ts.ScriptTarget.Latest, true));
   }
@@ -259,7 +262,7 @@ function sourceReads(state, sources) {
 }
 
 function jsonCandidates(state, files) {
-  for (const file of files.filter(file => JSON_CATALOG.test(file) && !EXCLUDED.test(file))) {
+  for (const file of files.filter(file => JSON_CATALOG.test(file) && !isExcluded(file))) {
     let json;
     try { json = JSON.parse(readText(state.repoRoot, file)); } catch { continue; }
     const leaves = (value, prefix = '') => {
@@ -316,7 +319,8 @@ export function unusedSymbolFindings({ repoRoot, files, repo = {}, isRoot = fals
   const findings = new Map();
   for (const candidate of state.candidates) {
     if (candidate.used || candidate.kind === 'catalog key' && catalogRead(state, candidate, liveCodes) || !inScope(candidate.path)) continue;
-    const { used: _used, ...extra } = candidate;
+    const extra = { ...candidate };
+    delete extra.used;
     findings.set(`${candidate.path}:${candidate.name}`, found(HFS_UNUSED_SYMBOL, candidate.path, `${candidate.path} declares unused ${candidate.kind} ${candidate.name}; remove it or read it in production source (declarations, metadata maps and tests do not count).`, extra));
   }
   return [...findings.values(), ...ledgerFindings.filter(finding => inScope(finding.path))].sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.name.localeCompare(b.name));

package/runtime/scripts/hfs/sealed-members.mjs

@@ -75,7 +75,7 @@ export function declaredSealedMembers(repoRoot) {
 
 function placeholderValue(key) {
   const generated = randomUUID();
-  if (/DB_URL$/u.test(key)) return `postgresql://app_be:${generated}@db.invalid:5432/app`;
+  if (key.endsWith('_URL') && key.slice(0, -4).endsWith('DB')) return `postgresql://app_be:${generated}@db.invalid:5432/app`;
   if (key.endsWith('_URL')) return `https://example.invalid/${generated}`;
   return generated;
 }

package/runtime/scripts/hfs/secret-bootstrap-crypto.mjs

@@ -163,7 +163,7 @@ function bootstrapEntries(values) {
   const entries = Object.entries(values);
   if (!entries.length) throw new Error('Bootstrap requires at least one value');
   for (const [name, value] of entries) {
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || name.startsWith('sops_') || name.endsWith('_unencrypted')) {
+    if (!/^[A-Za-z_]\w*$/.test(name) || name.startsWith('sops_') || name.endsWith('_unencrypted')) {
       throw new Error('Bootstrap contains an invalid or reserved dotenv key');
     }
     if (typeof value !== 'string' || !value.length) throw new Error('Bootstrap values must be nonempty strings');

package/runtime/scripts/hfs/secret-files.mjs

@@ -61,7 +61,7 @@ export function privateDirectory(repoRoot, directory) {
   const missing = [];
   for (let at = directory; !fs.existsSync(at); at = path.dirname(at))
     missing.push(at);
-  for (const at of missing.reverse()) fs.mkdirSync(at, { mode: 0o700 });
+  for (const at of missing.toReversed()) fs.mkdirSync(at, { mode: 0o700 });
   for (let at = directory; ; at = path.dirname(at)) {
     const stat = fs.lstatSync(at);
     if (!stat.isDirectory() || stat.isSymbolicLink())

package/runtime/scripts/hfs/secret-sops.mjs

@@ -19,7 +19,7 @@ export function defaultSops(
   env = process.env,
   repoRoot = invocationDir(),
   platform = process.platform,
-  tools,
+  tools = undefined,
 ) {
   const { sops: binary } = publicStorage(() => secretTools(env, tools));
   const selectedEnv = ageIdentityEnv(repoRoot, env, tools);