@starci/hfs 4.7.19 → 4.7.21

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 4.7.21 - 2026-10-22
+- Fixed: the release gate's Sonar read retries a network error or HTTP 5xx up to 5 times with backoff inside its 600 s wait; a 4xx and every gate status keep their verdict. Spec: `src/sonar-quality-gate.spec.mjs`.
+- Fixed: `starci app db dump` archives its parts with tar run inside the scratch directory and relative names only (no `-C`, no absolute path): GNU tar, first on PATH under Git Bash on Windows, read the absolute drive-letter archive path as a remote host and every backup failed with `DB_BACKUP_TOOL_FAILED`. Spec: `src/db-dump-archive.spec.mjs`.
+- Fixed: the bundled stacks gate validates a declaration's `operations` block with the composed provision-operation schema instead of crashing on its cross-file `$ref`; the bundled schema lets a SonarCloud admin credential name a runtime secret.env variable (`hostConnection: sonar-runtime-secret-env`).
+
+## 4.7.20 - 2026-10-22
+- Changed: the bundled failure-code catalog carries the Sonar quality-gate ensure results (`sonar-gate-*`); canon pins follow the matching package cohort.
+
 ## 4.7.19 - 2026-10-21
 - Changed: supersedes 4.7.18 (app lint broken: the canons' Sonar way block carries its own ignores, which `starci app lint` refused as an unsupported source scope, so it exited 2 without running ESLint and reported 0 findings); 4.7.18 is not used.
 - Fixed: `starci app lint` reads the canons' flat config as flat config defines it: global ignores prune the source walk and a block's own ignores narrow only that block, so the Sonar way block no longer makes the source scope unavailable (exit 2 without ESLint); a file is a source when some block's files match it and that block's ignores do not.

package/db/dump.mjs

@@ -17,6 +17,19 @@ export function rowcounts(session) {
   });
 }
 
+/** The archive name inside the plaintext scratch directory. */
+export const ARCHIVE_NAME = 'backup.tar';
+
+/**
+ * Archive `parts` of `scratch` into scratch/backup.tar. tar runs inside scratch with relative names only: no -C and no
+ * absolute path, because GNU tar (Git Bash puts it first on Windows) reads a drive-letter path (the `C:` of an absolute Windows path) as a remote `host:path`, while bsdtar
+ * does not; relative arguments mean the same to both. Returns the archive's absolute path.
+ */
+export function archiveParts(ctx, scratch, parts) {
+  backupTool(ctx, 'tar', ['-cf', ARCHIVE_NAME, ...parts], { cwd: scratch });
+  return path.join(scratch, ARCHIVE_NAME);
+}
+
 /** Writes only ciphertext and its receipt permanently; a receipt is published only after header, size and hash checks. */
 function dumpDatabase(ctx, options = {}) {
   if (!options.out) throw refusal('DB_USAGE', '--out is required');
@@ -41,8 +54,7 @@ function dumpDatabase(ctx, options = {}) {
     const counts = rowcounts(session);
     fs.writeFileSync(path.join(scratch, 'rowcounts.json'), `${JSON.stringify(counts, null, 2)}\n`, { mode: 0o600 });
     const parts = [...jobs.map(([file]) => file), 'rowcounts.json'];
-    const tar = path.join(scratch, 'backup.tar');
-    backupTool(ctx, 'tar', ['-cf', tar, '-C', scratch, ...parts]);
+    const tar = archiveParts(ctx, scratch, parts);
     const bytes = encryptFile(ctx, tar, archive, recipients);
     const receipt = { schema: RECEIPT_SCHEMA, project: session.project, target: session.target.kind, ref: session.target.ref ?? null,
       at, file: path.basename(archive), bytes, sha256: sha256(archive), parts,

package/emit/static-graph.mjs

@@ -28,6 +28,20 @@ const undef = { t: 'undef' };
 const nul = { t: 'nul' };
 const free = (why) => ({ t: 'free', why });
 
+/**
+ * JavaScript's abstract equality (`==`) for the literal kinds this graph forces - string, number, boolean - without
+ * the `==` operator: one type compares strictly, a boolean compares as its number, and a number meets a string as
+ * Number(string), exactly as the language coerces them (so '' == 0, '1' == true, NaN never equals).
+ */
+export function looseLiteralEqual(x, y) {
+  if (typeof x === typeof y) return x === y;
+  if (typeof x === 'boolean') return looseLiteralEqual(Number(x), y);
+  if (typeof y === 'boolean') return looseLiteralEqual(x, Number(y));
+  if (typeof x === 'number' && typeof y === 'string') return x === Number(y);
+  if (typeof x === 'string' && typeof y === 'number') return Number(x) === y;
+  return false;
+}
+
 export function createGraphReader({ ts, host }) {
   const files = new Map();
   const classes = new Map();
@@ -194,7 +208,7 @@ export function createGraphReader({ ts, host }) {
     const nullish = (v) => v.t === 'undef' || v.t === 'nul';
     if (nullish(a) && nullish(b)) return loose ? true : a.t === b.t;
     if (nullish(a) || nullish(b)) return ['lit', 'class', 'obj', 'arr'].includes(nullish(a) ? b.t : a.t) ? false : null;
-    if (a.t === 'lit' && b.t === 'lit') return loose ? a.v == b.v : a.v === b.v; // eslint-disable-line eqeqeq
+    if (a.t === 'lit' && b.t === 'lit') return loose ? looseLiteralEqual(a.v, b.v) : a.v === b.v;
     if (a.t === 'class' && b.t === 'class') return a === b;
     return null;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.19",
+  "version": "4.7.21",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/sonar-quality-gate.mjs

@@ -2,7 +2,8 @@
 // that the report was uploaded; the server computes the analysis afterwards. This reads the task the scanner wrote
 // (`.scannerwork/report-task.txt`), polls `api/ce/task` until the compute-engine task ends, then reads the quality gate of that
 // analysis from `api/qualitygates/project_status` with the same token. OK passes; ERROR is red and names every failed condition;
-// a task that ends FAILED or CANCELED, an unreadable answer and a deadline passed are typed refusals in the row's detail.
+// a task that ends FAILED or CANCELED, an unreadable answer and a deadline passed are typed refusals in the row's detail. A transient
+// read failure (a network error or an HTTP 5xx) is retried with a bounded backoff inside the same wait before it is unreadable.
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -21,13 +22,36 @@ function reportTask(cwd) {
   return Object.fromEntries(text.split(/\r?\n/u).map((line) => line.split('=')).filter(([key, ...rest]) => key && rest.length).map(([key, ...rest]) => [key.trim(), rest.join('=').trim()]));
 }
 
-/** One authenticated JSON GET; a failed request or a non-JSON body throws. */
-async function getJson(ctx, url, token) {
-  const response = await ctx.fetch(url, { headers: { Authorization: `Basic ${Buffer.from(`${token}:`).toString('base64')}` }, signal: AbortSignal.timeout(30_000) });
-  if (!response.ok) throw new Error(`HTTP ${response.status} from ${url.split('?')[0]}`);
+/** The bound of a transient read failure: attempts per request and the first pause, doubled after each retry (milliseconds). */
+const TRANSIENT_RETRY = Object.freeze({ attempts: 5, firstPause: 2_000 });
+
+/** One authenticated JSON GET; a failed request or a non-JSON body throws. A network error or an HTTP 5xx is marked transient. */
+async function getJsonOnce(ctx, url, token) {
+  let response;
+  try {
+    response = await ctx.fetch(url, { headers: { Authorization: `Basic ${Buffer.from(`${token}:`).toString('base64')}` }, signal: AbortSignal.timeout(30_000) });
+  } catch (error) {
+    throw Object.assign(new Error(`${String(error?.message ?? error)} (${url.split('?')[0]})`), { transient: true });
+  }
+  if (!response.ok) throw Object.assign(new Error(`HTTP ${response.status} from ${url.split('?')[0]}`), { transient: response.status >= 500 });
   return response.json();
 }
 
+/**
+ * getJsonOnce, retried only when the failure is transient (a network error or an HTTP 5xx): at most TRANSIENT_RETRY.attempts
+ * tries, pausing 2 s, 4 s, 8 s, ... between them, and never past `deadline`. A 4xx (401 and 403 included) and an unreadable body
+ * throw at once; the last transient failure throws as itself, so a retry never turns an unreadable answer into a verdict.
+ */
+async function getJson(ctx, url, token, { sleep, deadline }) {
+  for (let attempt = 1, pause = TRANSIENT_RETRY.firstPause; ; attempt += 1, pause *= 2) {
+    try { return await getJsonOnce(ctx, url, token); }
+    catch (error) {
+      if (!error.transient || attempt >= TRANSIENT_RETRY.attempts || ctx.now() + pause > deadline) throw error;
+      await sleep(pause);
+    }
+  }
+}
+
 /** The failed conditions of a quality gate answer, as `metric comparator threshold (actual value)` lines. */
 const failedConditions = (status) => (status?.conditions ?? []).filter((condition) => condition.status === 'ERROR')
   .map((condition) => `${condition.metricKey} ${condition.comparator ?? ''} ${condition.errorThreshold ?? ''} (actual ${condition.actualValue ?? '?'})`.replace(/\s+/gu, ' '));
@@ -42,10 +66,11 @@ export async function sonarQualityGate(ctx, { cwd, host, token, wait = QUALITY_G
   const server = String(task.serverUrl || host).replace(/\/$/u, '');
   const sleep = ctx.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const deadline = ctx.now() + wait.deadline;
+  const retry = { sleep, deadline };
   let analysisId = null;
   try {
     for (;;) {
-      const state = (await getJson(ctx, `${server}/api/ce/task?id=${encodeURIComponent(task.ceTaskId)}`, token))?.task;
+      const state = (await getJson(ctx, `${server}/api/ce/task?id=${encodeURIComponent(task.ceTaskId)}`, token, retry))?.task;
       if (DONE.has(state?.status)) {
         if (state.status !== 'SUCCESS') return { pass: false, detail: `${SONAR_GATE_FAILED}: compute-engine task ${task.ceTaskId} ended ${state.status}${state.errorMessage ? `: ${state.errorMessage}` : ''}` };
         analysisId = state.analysisId;
@@ -55,7 +80,7 @@ export async function sonarQualityGate(ctx, { cwd, host, token, wait = QUALITY_G
       await sleep(wait.interval);
     }
     const query = analysisId ? `analysisId=${encodeURIComponent(analysisId)}` : `projectKey=${encodeURIComponent(task.projectKey ?? '')}`;
-    const status = (await getJson(ctx, `${server}/api/qualitygates/project_status?${query}`, token))?.projectStatus;
+    const status = (await getJson(ctx, `${server}/api/qualitygates/project_status?${query}`, token, retry))?.projectStatus;
     if (status?.status === 'OK') return { pass: true, detail: 'exit 0, quality gate OK' };
     if (status?.status === 'ERROR') {
       const conditions = failedConditions(status);

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.27
+    version: 3.4.29
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.26
+    version: 8.4.28
     group: starci
     install: registry
     side: fe
@@ -50,7 +50,7 @@ pins:
     source: packages/stylelint/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.4
+    version: 2.0.5
     group: starci
     install: registry
     side: both
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.19
+    version: 1.7.21
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.19
+    version: 4.7.21
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -3754,7 +3754,7 @@ rules:
       - {path: packages/eslint/be/sonar-parity-editions.spec.mjs, edition: full}
       - {path: packages/eslint/fe/sonar-parity-editions.spec.mjs, edition: lite}
       - {path: packages/eslint/fe/sonar-parity-editions.spec.mjs, edition: full}
-    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), no `<video>` or `<audio>` without a captions track unless muted (S4084, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). Every other rule of the Sonar way TypeScript profile with an ESLint equivalent (scripts/lib/sonar-way.mjs: eslint-plugin-sonarjs' Sonar way set, the core, typescript-eslint and unicorn rules it builds on) is on at error in both canons. The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
+    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), no `<video>` or `<audio>` without a captions track unless muted (S4084, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). No function takes more than seven parameters (S107), except the constructor of an injectable class, whose parameters are its injected dependencies. Every other rule of the Sonar way TypeScript profile with an ESLint equivalent that reports what the server reports on the same source (scripts/lib/sonar-way.mjs: eslint-plugin-sonarjs' Sonar way set and the core and unicorn rules it builds on) is on at error in both canons; a port that does not match the server is left to the server. The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
     kinds: [lint, codemod]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["SCAN_SMELL"]
@@ -3775,6 +3775,8 @@ rules:
       - {kind: eslint-fe, id: prefer-export-from}
       - {kind: eslint-fe, id: no-unused-prop-types}
       - {kind: eslint-fe, id: media-has-caption}
+      - {kind: eslint-be, id: max-params}
+      - {kind: eslint-fe, id: max-params}
   - id: R236
     code: "RT_GATE_LOOSENING"
     editions: [lite, full]

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "fb2a551d3cb254cc42fa5c95dc1a32af973df14313385f03703bc209b2badb8a",
+  "hash": "4018e220cb9abde27d6d8cd79cd502c4d0c64a5312d7549c8e631553a22cb878",
   "global": [
     {
       "name": "json",
@@ -1240,7 +1240,8 @@ export const CATALOG = {
             "disabled or unavailable Sonar or an unset token refuses RELEASE_SONAR_UNAVAILABLE",
             "a scanner exit 0 is not a pass: the row polls api/ce/task until the analysis ends, then reads api/qualitygates/project_status with the same token",
             "OK passes; ERROR is red as RELEASE_SONAR_GATE_FAILED naming each failed condition, as is a FAILED or CANCELED task",
-            "a task still running after 600 s is RELEASE_SONAR_GATE_TIMEOUT; no report-task, an HTTP error or no gate is RELEASE_SONAR_GATE_UNREADABLE",
+            "a task still running after 600 s is RELEASE_SONAR_GATE_TIMEOUT; no report-task, an HTTP 4xx or no gate is RELEASE_SONAR_GATE_UNREADABLE",
+            "a network error or HTTP 5xx is retried up to 5 times with backoff inside the 600 s; still failing, it is RELEASE_SONAR_GATE_UNREADABLE",
             "OWNER RULING candidate-ci (2026-10-18): the gate no longer reads the default-branch CI; the verdict is the candidate run of the sha",
             "release.requireCi (default false, owner ruling release-require-ci-per-project) decides whether push waits for CI; the local gate is never skipped",
             "requireCi false: push needs the tag and the green L4 record, runs the dry run, pushes atomically and states CI was not required",
@@ -10182,13 +10183,14 @@ export const CATALOG = {
           "runtimeSide": "host"
         },
         "project": {
-          "summary": "ensure a declared Sonar project through its provider adapter",
+          "summary": "ensure a declared Sonar project, or move it to its declared key, through its provider adapter",
           "owner": "runtime",
           "positional": [
             {
               "name": "action",
               "enum": [
-                "ensure"
+                "ensure",
+                "rekey"
               ],
               "required": true,
               "variadic": false
@@ -10234,7 +10236,8 @@ export const CATALOG = {
           },
           "json": "always",
           "examples": [
-            "starci sonar project ensure --target quality --operation project-bootstrap"
+            "starci sonar project ensure --target quality --operation project-bootstrap",
+            "starci sonar project rekey --target quality --operation project-rename"
           ],
           "editions": [
             "full",
@@ -10252,7 +10255,9 @@ export const CATALOG = {
             "owner"
           ],
           "conventions": [
-            "a target and existing accepted operation scope bind provider effects; execute grants no authority"
+            "a target and existing accepted operation scope bind provider effects; execute grants no authority",
+            "rekey moves the project at previousKey to projectKey (api/projects/update_key); its analyses, issues and quality gate stay with it",
+            "rekey is verified when the new key reads back and the old key no longer does"
           ],
           "operationPolicy": {
             "ensure": {
@@ -10265,6 +10270,17 @@ export const CATALOG = {
               "checkpoints": [
                 "account-authority"
               ]
+            },
+            "rekey": {
+              "action": "sonar.project.rekey",
+              "effect": "remote",
+              "credentials": [
+                "admin"
+              ],
+              "destination": "none",
+              "checkpoints": [
+                "account-authority"
+              ]
             }
           },
           "runtimeSide": "host"

package/runtime/scripts/hfs/stacks-gate.mjs

@@ -3,6 +3,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { lsFiles } from '../api/git/ls-files.mjs';
 import {parseYaml} from '../../engine/yaml.mjs';
+import { validateAgainstSchema } from '../lib/json-schema.mjs';
+import { PROVISION_OPERATION_SCHEMA_REF, provisionOperationSchema } from '../lib/provision-operation-schema.mjs';
 import {slash} from '../lib/path-key.mjs';
 import { isInside, walkFiles } from '../lib/walk.mjs';
 import { composeIncludePaths, swarmInventoryIssues, swarmModelIssues } from '../lib/swarm-stack.mjs';
@@ -92,7 +94,13 @@ function validateSchema(value){
     if(shape.minItems&&node.length<shape.minItems)errors.push({path:at,message:'array too short'});
     node.forEach((item,index)=>shape.items&&check(item,shape.items,`${at}/${index}`));
   };
+  // The operations block refers to its own schema file: its owner's composed schema validates it, as the provision target owner does.
+  const checkOperations=(node,at)=>{
+    for(const error of validateAgainstSchema(node,provisionOperationSchema()))errors.push({path:at,message:error});
+  };
   const check=(node,shape,at)=>{
+    if(shape?.$ref===PROVISION_OPERATION_SCHEMA_REF)return checkOperations(node,at);
+    if(shape?.$ref&&!shape.$ref.startsWith('#/')){errors.push({path:at,message:`unresolved schema reference ${shape.$ref}`});return;}
     if(shape?.$ref)return check(node,resolve(shape.$ref),at);
     if(Array.isArray(shape?.anyOf)){
       checkAlternatives(node,shape,at,check);

package/runtime/scripts/lib/json-schema.mjs

@@ -0,0 +1,96 @@
+// json-schema.mjs - a minimal draft-2020-12 JSON schema walker over the keywords the runtime's yaml schemas use.
+import {isPlainObject} from '../../engine/plain-object.mjs';
+
+// A minimal draft-2020-12 walker over the keywords op.schema.yaml uses. ajv is
+// a devDependency; the runtime has no npm dependencies, so the walker is here.
+/** Validate the supported schema keywords, including exact-one and at-least-one alternatives, without mutating input. */
+export function validateAgainstSchema(value, schema) {
+  const errors = [];
+  const resolve = (ref) => String(ref).replace(/^#\//, '').split('/')
+    .reduce((node, key) => node?.[key.replaceAll('~1', '/').replaceAll('~0', '~')], schema);
+  const typeOk = (node, type) => {
+    if (Array.isArray(type)) return type.some((t) => typeOk(node, t));
+    if (type === 'object') return isPlainObject(node);
+    if (type === 'array') return Array.isArray(node);
+    if (type === 'integer') return Number.isInteger(node);
+    if (type === 'null') return node === null;
+    return typeof node === type;
+  };
+  const validateType = (node, shape, at) => {
+    if (shape.type !== undefined && !typeOk(node, shape.type)) {
+      errors.push(`${at}: expected ${Array.isArray(shape.type) ? shape.type.join('|') : shape.type}`);
+      return false;
+    }
+    return true;
+  };
+  const validateString = (node, shape, at) => {
+    if (shape.minLength !== undefined && node.length < shape.minLength) errors.push(`${at}: empty or too short`);
+    if (shape.pattern && !new RegExp(shape.pattern, 'u').test(node)) errors.push(`${at}: ${JSON.stringify(node)} does not match ${shape.pattern}`);
+  };
+  const validateNumber = (node, shape, at) => {
+    if (shape.minimum !== undefined && node < shape.minimum) errors.push(`${at}: below minimum ${shape.minimum}`);
+    if (shape.maximum !== undefined && node > shape.maximum) errors.push(`${at}: above maximum ${shape.maximum}`);
+  };
+  const validateScalar = (node, shape, at) => {
+    if (Object.hasOwn(shape, 'const') && node !== shape.const) errors.push(`${at}: must be ${JSON.stringify(shape.const)}`);
+    if (Array.isArray(shape.enum) && !shape.enum.includes(node)) errors.push(`${at}: ${JSON.stringify(node)} is outside [${shape.enum.join(', ')}]`);
+    if (typeof node === 'string') validateString(node, shape, at);
+    if (typeof node === 'number') validateNumber(node, shape, at);
+  };
+  const validateArray = (node, shape, at, walk) => {
+    if (shape.minItems !== undefined && node.length < shape.minItems) errors.push(`${at}: needs at least ${shape.minItems} item(s)`);
+    if (shape.items) node.forEach((item, i) => walk(item, shape.items, `${at}[${i}]`));
+  };
+  const validateObject = (node, shape, at, walk) => {
+    if (shape.minProperties !== undefined && Object.keys(node).length < shape.minProperties) errors.push(`${at}: needs at least ${shape.minProperties} entr(y|ies)`);
+    for (const key of shape.required ?? []) if (!Object.hasOwn(node, key)) errors.push(`${at}: missing ${key}`);
+    for (const [key, child] of Object.entries(node)) {
+      const where = at === '$' ? `$.${key}` : `${at}.${key}`;
+      if (Object.hasOwn(shape.properties ?? {}, key)) walk(child, shape.properties[key], where);
+      else if (shape.additionalProperties === false) errors.push(`${where}: unknown key`);
+      else if (isPlainObject(shape.additionalProperties)) walk(child, shape.additionalProperties, where);
+    }
+  };
+  const validateAlternatives = (node, shape, at, walk) => {
+    for (const keyword of ['anyOf', 'oneOf']) {
+      if (!Object.hasOwn(shape, keyword)) continue;
+      const branches = shape[keyword];
+      if (!Array.isArray(branches) || branches.length === 0) { errors.push(`${at}: ${keyword} needs a nonempty schema list`); continue; }
+      const outcomes = branches.map((branch) => {
+        const start = errors.length;
+        walk(node, branch, at);
+        return errors.splice(start);
+      });
+      const matched = outcomes.filter((findings) => findings.length === 0).length;
+      if (keyword === 'oneOf' && matched > 1) errors.push(`${at}: oneOf matches more than one alternative`);
+      else if (matched === 0) {
+        errors.push(`${at}: ${keyword} matches no alternative`);
+        // The nearest branch explains a refusal without mixing findings from mutually exclusive shapes.
+        const nearest = outcomes.reduce((best, findings) => findings.length < best.length ? findings : best, outcomes[0]);
+        errors.push(...nearest);
+      }
+    }
+  };
+  const walk = (node, shape, at) => {
+    if (shape === true) return;
+    if (shape === false) { errors.push(`${at}: schema refuses this value`); return; }
+    if (!isPlainObject(shape)) { errors.push(`${at}: schema is invalid`); return; }
+    if (shape.$ref) {
+      const referenced = String(shape.$ref).startsWith('#/') ? resolve(shape.$ref) : undefined;
+      if (referenced === undefined) { errors.push(`${at}: schema reference is unresolved`); return; }
+      walk(node, referenced, at);
+      return;
+    }
+    validateAlternatives(node, shape, at, walk);
+    if (!validateType(node, shape, at)) return;
+    validateScalar(node, shape, at);
+    if (Array.isArray(node)) {
+      validateArray(node, shape, at, walk);
+      return;
+    }
+    if (!isPlainObject(node)) return;
+    validateObject(node, shape, at, walk);
+  };
+  walk(value, schema, '$');
+  return errors;
+}

package/runtime/scripts/lib/path-key.mjs

@@ -40,7 +40,7 @@ export const pathsOverlap = (a, b) => sameOrUnder(a, b) || sameOrUnder(b, a);
  * `trim` blanks at the ends, `collapse` folds '//' runs to '/', `dot` drops a leading './',
  * `glob` strips a trailing glob ('star': '*'/'**' with their slash, 'double': a '/**' only),
  * `fold` lowercases. A trailing '/' always goes. Null reads as ''.
- * @param {unknown} p
+ * @param {string|number|null|undefined} p
  * @param {{trim?: boolean, collapse?: boolean, dot?: boolean, glob?: string|null, fold?: boolean}} [options]
  */
 export const normPath = (p, { trim = false, collapse = false, dot = false, glob = null, fold = false } = {}) => {

package/runtime/scripts/lib/provision-operation-schema.mjs

@@ -0,0 +1,17 @@
+// The schema of a stack declaration's `operations` block, composed once for its two readers: the provision target owner and the
+// stacks gate. provision-operation.schema.yaml refers to the service credential of application-stacks.schema.yaml; the composition
+// inlines that definition so the self-contained walker of json-schema.mjs resolves every reference.
+import fs from 'node:fs';
+import path from 'node:path';
+import { parseYaml } from '../../engine/yaml.mjs';
+import { skillRoot } from '../../engine/runtime-root.mjs';
+
+/** The `$ref` application-stacks.schema.yaml uses for its `operations` block. */
+export const PROVISION_OPERATION_SCHEMA_REF = 'provision-operation.schema.yaml';
+
+/** The composed `operations` schema, read from this runtime's modules/schemas. */
+export function provisionOperationSchema() {
+  const schema = parseYaml(fs.readFileSync(path.join(skillRoot, 'modules/schemas', PROVISION_OPERATION_SCHEMA_REF), 'utf8'));
+  const stacks = parseYaml(fs.readFileSync(path.join(skillRoot, 'modules/schemas/application-stacks.schema.yaml'), 'utf8'));
+  return { ...schema, $defs: { ...schema.$defs, serviceCredential: stacks.$defs.serviceCredential } };
+}

package/sync/index.mjs

@@ -340,7 +340,7 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     nodeMajor: String(NODE_MAJOR),
     sonarKey: sonarKey ?? app.project,
     sonarHostLine: sonarHostLine(quality.sonar),
-    sonarExclusions: [presets?.sonarExclusions, '**/.next/**', '**/node_modules/**', '**/src/messages/**', ...(lite ? ['supabase/types/**'] : [])].filter(Boolean).join(','),
+    sonarExclusions: [presets?.sonarExclusions, '**/.next/**', '**/node_modules/**', ...(lite ? ['supabase/types/**'] : [])].filter(Boolean).join(','),
     sonarSources: ['be/apps', 'be/src', 'fe/apps', ...(packages ? ['fe/packages'] : [])].join(','),
     lcovReport: LCOV_REPORT,
     ...ciWorkflowCommands(source, LCOV_REPORT, source.qualityDeclared === false ? undefined : source.quality, { app }),

package/templates/app/hooks/husky/pre-commit

@@ -7,7 +7,7 @@ git diff --cached --name-only --diff-filter=ACMR -z --relative=be -- '*.ts' '*.m
   xargs -0 -n 50 sh -c 'if [ "$#" -gt 0 ]; then cd be && npx eslint -- "$@"; fi' sh || exit $?
 git diff --cached --name-only --diff-filter=ACMR -z --relative=fe -- '*.ts' '*.tsx' '*.mts' '*.cts' '*.js' '*.jsx' '*.mjs' '*.cjs' |
   xargs -0 -n 50 sh -c 'if [ "$#" -gt 0 ]; then cd fe && npx eslint --max-warnings=0 --no-warn-ignored -- "$@"; fi' sh || exit $?
-styles=$(git diff --cached --name-only --diff-filter=ACMR --relative=fe -- '*.css' || true)
+styles=$(git diff --cached --name-only --diff-filter=ACMR --relative=fe -- '*.css') || exit $?
 if [ -n "$styles" ]; then
   (cd fe && npx stylelint $styles)
 fi

package/templates/app/tool-config/prettierignore

@@ -10,4 +10,4 @@ contracts/
 .starcistacks/
 .starciwork/
 **/__generated__/
-**/messages/**
+**/i18n/messages/**

package/templates/be/skeleton/src/modules/domain/identity/messages/identity.messages.ts

@@ -3,7 +3,8 @@ import type { MessageBundle } from "@modules/platform/i18n"
 /** Display text of the identity codes, Vietnamese and English. */
 export const IDENTITY_MESSAGES: MessageBundle = {
     vi: {
-        "errors.IDENTITY_UNAUTHENTICATED": "B\u1ea1n c\u1ea7n \u0111\u0103ng nh\u1eadp \u0111\u1ec3 th\u1ef1c hi\u1ec7n thao t\u00e1c n\u00e0y.",
+        "errors.IDENTITY_UNAUTHENTICATED":
+            "B\u1ea1n c\u1ea7n \u0111\u0103ng nh\u1eadp \u0111\u1ec3 th\u1ef1c hi\u1ec7n thao t\u00e1c n\u00e0y.",
     },
     en: {
         "errors.IDENTITY_UNAUTHENTICATED": "You need to sign in to do this.",

package/templates/be/skeleton/src/modules/platform/http-security/messages/http-security.messages.ts

@@ -3,7 +3,8 @@ import type { MessageBundle } from "@modules/platform/i18n"
 /** Display text of the http-security codes, Vietnamese and English. */
 export const HTTP_SECURITY_MESSAGES: MessageBundle = {
     vi: {
-        "errors.HTTP_SECURITY_REQUIRED_DEPENDENCY_UNAVAILABLE": "C\u01a1 s\u1edf d\u1eef li\u1ec7u b\u1eaft bu\u1ed9c hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng.",
+        "errors.HTTP_SECURITY_REQUIRED_DEPENDENCY_UNAVAILABLE":
+            "C\u01a1 s\u1edf d\u1eef li\u1ec7u b\u1eaft bu\u1ed9c hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng.",
         "errors.HTTP_SECURITY_ORIGIN_REJECTED":
             "Ngu\u1ed3n g\u1eedi y\u00eau c\u1ea7u kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e9p.",
         "errors.HTTP_SECURITY_RATE_LIMITED":