@starci/hfs 4.7.20 → 4.7.22

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 4.7.22 - 2026-10-22
+- Fixed: the bundled runtime carries `modules/schemas/provision-operation.schema.yaml`; 4.7.21 left it out, so `starci app check` and `starci app lint` failed with ENOENT in every app whose stack declaration has an `operations` block. The composition reads both schemas through `new URL(..., import.meta.url)`, the form the runtime copy follows. Spec: `src/provision-operation-schema-bundle.spec.mjs`.
+
+## 4.7.21 - 2026-10-22
+- Fixed: the release gate's Sonar read retries a network error or HTTP 5xx up to 5 times with backoff inside its 600 s wait; a 4xx and every gate status keep their verdict. Spec: `src/sonar-quality-gate.spec.mjs`.
+- Fixed: `starci app db dump` archives its parts with tar run inside the scratch directory and relative names only (no `-C`, no absolute path): GNU tar, first on PATH under Git Bash on Windows, read the absolute drive-letter archive path as a remote host and every backup failed with `DB_BACKUP_TOOL_FAILED`. Spec: `src/db-dump-archive.spec.mjs`.
+- Fixed: the bundled stacks gate validates a declaration's `operations` block with the composed provision-operation schema instead of crashing on its cross-file `$ref`; the bundled schema lets a SonarCloud admin credential name a runtime secret.env variable (`hostConnection: sonar-runtime-secret-env`).
+
 ## 4.7.20 - 2026-10-22
 - Changed: the bundled failure-code catalog carries the Sonar quality-gate ensure results (`sonar-gate-*`); canon pins follow the matching package cohort.
 

package/db/dump.mjs

@@ -17,6 +17,19 @@ export function rowcounts(session) {
   });
 }
 
+/** The archive name inside the plaintext scratch directory. */
+export const ARCHIVE_NAME = 'backup.tar';
+
+/**
+ * Archive `parts` of `scratch` into scratch/backup.tar. tar runs inside scratch with relative names only: no -C and no
+ * absolute path, because GNU tar (Git Bash puts it first on Windows) reads a drive-letter path (the `C:` of an absolute Windows path) as a remote `host:path`, while bsdtar
+ * does not; relative arguments mean the same to both. Returns the archive's absolute path.
+ */
+export function archiveParts(ctx, scratch, parts) {
+  backupTool(ctx, 'tar', ['-cf', ARCHIVE_NAME, ...parts], { cwd: scratch });
+  return path.join(scratch, ARCHIVE_NAME);
+}
+
 /** Writes only ciphertext and its receipt permanently; a receipt is published only after header, size and hash checks. */
 function dumpDatabase(ctx, options = {}) {
   if (!options.out) throw refusal('DB_USAGE', '--out is required');
@@ -41,8 +54,7 @@ function dumpDatabase(ctx, options = {}) {
     const counts = rowcounts(session);
     fs.writeFileSync(path.join(scratch, 'rowcounts.json'), `${JSON.stringify(counts, null, 2)}\n`, { mode: 0o600 });
     const parts = [...jobs.map(([file]) => file), 'rowcounts.json'];
-    const tar = path.join(scratch, 'backup.tar');
-    backupTool(ctx, 'tar', ['-cf', tar, '-C', scratch, ...parts]);
+    const tar = archiveParts(ctx, scratch, parts);
     const bytes = encryptFile(ctx, tar, archive, recipients);
     const receipt = { schema: RECEIPT_SCHEMA, project: session.project, target: session.target.kind, ref: session.target.ref ?? null,
       at, file: path.basename(archive), bytes, sha256: sha256(archive), parts,

package/emit/static-graph.mjs

@@ -28,6 +28,20 @@ const undef = { t: 'undef' };
 const nul = { t: 'nul' };
 const free = (why) => ({ t: 'free', why });
 
+/**
+ * JavaScript's abstract equality (`==`) for the literal kinds this graph forces - string, number, boolean - without
+ * the `==` operator: one type compares strictly, a boolean compares as its number, and a number meets a string as
+ * Number(string), exactly as the language coerces them (so '' == 0, '1' == true, NaN never equals).
+ */
+export function looseLiteralEqual(x, y) {
+  if (typeof x === typeof y) return x === y;
+  if (typeof x === 'boolean') return looseLiteralEqual(Number(x), y);
+  if (typeof y === 'boolean') return looseLiteralEqual(x, Number(y));
+  if (typeof x === 'number' && typeof y === 'string') return x === Number(y);
+  if (typeof x === 'string' && typeof y === 'number') return Number(x) === y;
+  return false;
+}
+
 export function createGraphReader({ ts, host }) {
   const files = new Map();
   const classes = new Map();
@@ -194,7 +208,7 @@ export function createGraphReader({ ts, host }) {
     const nullish = (v) => v.t === 'undef' || v.t === 'nul';
     if (nullish(a) && nullish(b)) return loose ? true : a.t === b.t;
     if (nullish(a) || nullish(b)) return ['lit', 'class', 'obj', 'arr'].includes(nullish(a) ? b.t : a.t) ? false : null;
-    if (a.t === 'lit' && b.t === 'lit') return loose ? a.v == b.v : a.v === b.v; // eslint-disable-line eqeqeq
+    if (a.t === 'lit' && b.t === 'lit') return loose ? looseLiteralEqual(a.v, b.v) : a.v === b.v;
     if (a.t === 'class' && b.t === 'class') return a === b;
     return null;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.20",
+  "version": "4.7.22",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/sonar-quality-gate.mjs

@@ -2,7 +2,8 @@
 // that the report was uploaded; the server computes the analysis afterwards. This reads the task the scanner wrote
 // (`.scannerwork/report-task.txt`), polls `api/ce/task` until the compute-engine task ends, then reads the quality gate of that
 // analysis from `api/qualitygates/project_status` with the same token. OK passes; ERROR is red and names every failed condition;
-// a task that ends FAILED or CANCELED, an unreadable answer and a deadline passed are typed refusals in the row's detail.
+// a task that ends FAILED or CANCELED, an unreadable answer and a deadline passed are typed refusals in the row's detail. A transient
+// read failure (a network error or an HTTP 5xx) is retried with a bounded backoff inside the same wait before it is unreadable.
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -21,13 +22,36 @@ function reportTask(cwd) {
   return Object.fromEntries(text.split(/\r?\n/u).map((line) => line.split('=')).filter(([key, ...rest]) => key && rest.length).map(([key, ...rest]) => [key.trim(), rest.join('=').trim()]));
 }
 
-/** One authenticated JSON GET; a failed request or a non-JSON body throws. */
-async function getJson(ctx, url, token) {
-  const response = await ctx.fetch(url, { headers: { Authorization: `Basic ${Buffer.from(`${token}:`).toString('base64')}` }, signal: AbortSignal.timeout(30_000) });
-  if (!response.ok) throw new Error(`HTTP ${response.status} from ${url.split('?')[0]}`);
+/** The bound of a transient read failure: attempts per request and the first pause, doubled after each retry (milliseconds). */
+const TRANSIENT_RETRY = Object.freeze({ attempts: 5, firstPause: 2_000 });
+
+/** One authenticated JSON GET; a failed request or a non-JSON body throws. A network error or an HTTP 5xx is marked transient. */
+async function getJsonOnce(ctx, url, token) {
+  let response;
+  try {
+    response = await ctx.fetch(url, { headers: { Authorization: `Basic ${Buffer.from(`${token}:`).toString('base64')}` }, signal: AbortSignal.timeout(30_000) });
+  } catch (error) {
+    throw Object.assign(new Error(`${String(error?.message ?? error)} (${url.split('?')[0]})`), { transient: true });
+  }
+  if (!response.ok) throw Object.assign(new Error(`HTTP ${response.status} from ${url.split('?')[0]}`), { transient: response.status >= 500 });
   return response.json();
 }
 
+/**
+ * getJsonOnce, retried only when the failure is transient (a network error or an HTTP 5xx): at most TRANSIENT_RETRY.attempts
+ * tries, pausing 2 s, 4 s, 8 s, ... between them, and never past `deadline`. A 4xx (401 and 403 included) and an unreadable body
+ * throw at once; the last transient failure throws as itself, so a retry never turns an unreadable answer into a verdict.
+ */
+async function getJson(ctx, url, token, { sleep, deadline }) {
+  for (let attempt = 1, pause = TRANSIENT_RETRY.firstPause; ; attempt += 1, pause *= 2) {
+    try { return await getJsonOnce(ctx, url, token); }
+    catch (error) {
+      if (!error.transient || attempt >= TRANSIENT_RETRY.attempts || ctx.now() + pause > deadline) throw error;
+      await sleep(pause);
+    }
+  }
+}
+
 /** The failed conditions of a quality gate answer, as `metric comparator threshold (actual value)` lines. */
 const failedConditions = (status) => (status?.conditions ?? []).filter((condition) => condition.status === 'ERROR')
   .map((condition) => `${condition.metricKey} ${condition.comparator ?? ''} ${condition.errorThreshold ?? ''} (actual ${condition.actualValue ?? '?'})`.replace(/\s+/gu, ' '));
@@ -42,10 +66,11 @@ export async function sonarQualityGate(ctx, { cwd, host, token, wait = QUALITY_G
   const server = String(task.serverUrl || host).replace(/\/$/u, '');
   const sleep = ctx.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const deadline = ctx.now() + wait.deadline;
+  const retry = { sleep, deadline };
   let analysisId = null;
   try {
     for (;;) {
-      const state = (await getJson(ctx, `${server}/api/ce/task?id=${encodeURIComponent(task.ceTaskId)}`, token))?.task;
+      const state = (await getJson(ctx, `${server}/api/ce/task?id=${encodeURIComponent(task.ceTaskId)}`, token, retry))?.task;
       if (DONE.has(state?.status)) {
         if (state.status !== 'SUCCESS') return { pass: false, detail: `${SONAR_GATE_FAILED}: compute-engine task ${task.ceTaskId} ended ${state.status}${state.errorMessage ? `: ${state.errorMessage}` : ''}` };
         analysisId = state.analysisId;
@@ -55,7 +80,7 @@ export async function sonarQualityGate(ctx, { cwd, host, token, wait = QUALITY_G
       await sleep(wait.interval);
     }
     const query = analysisId ? `analysisId=${encodeURIComponent(analysisId)}` : `projectKey=${encodeURIComponent(task.projectKey ?? '')}`;
-    const status = (await getJson(ctx, `${server}/api/qualitygates/project_status?${query}`, token))?.projectStatus;
+    const status = (await getJson(ctx, `${server}/api/qualitygates/project_status?${query}`, token, retry))?.projectStatus;
     if (status?.status === 'OK') return { pass: true, detail: 'exit 0, quality gate OK' };
     if (status?.status === 'ERROR') {
       const conditions = failedConditions(status);

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.28
+    version: 3.4.29
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.27
+    version: 8.4.28
     group: starci
     install: registry
     side: fe
@@ -50,7 +50,7 @@ pins:
     source: packages/stylelint/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.4
+    version: 2.0.5
     group: starci
     install: registry
     side: both
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.20
+    version: 1.7.22
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.20
+    version: 4.7.22
     group: starci
     install: registry
     side: both

package/runtime/modules/schemas/provision-operation.schema.yaml

@@ -0,0 +1,165 @@
+$schema: https://json-schema.org/draft/2020-12/schema
+$id: urn:starci:provision-operation:1
+title: Target-bound provider operations
+description: Public target and custody references for executable provider adapters; values never enter this declaration.
+type: object
+additionalProperties: false
+required: [targets]
+properties:
+  targets:
+    type: object
+    minProperties: 1
+    additionalProperties: {$ref: '#/$defs/target'}
+$defs:
+  goalGrants:
+    type: object
+    additionalProperties: false
+    required: [schema, grants]
+    properties:
+      schema: {const: 'starci/provision-grants@1'}
+      grants:
+        type: array
+        items:
+          type: object
+          additionalProperties: false
+          required: [op, operation, digest]
+          properties:
+            op: {type: string, pattern: '^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)+$'}
+            operation: {type: string, pattern: '^[a-zA-Z0-9][a-zA-Z0-9-]{0,127}$'}
+            digest: {type: string, pattern: '^[a-f0-9]{64}$'}
+  credential:
+    oneOf:
+      - {$ref: '#/$defs/serviceCredential'}
+      - {$ref: '#/$defs/hostCredential'}
+  serviceCredential:
+    $ref: application-stacks.schema.yaml#/$defs/serviceCredential
+  hostCredential:
+    description: >-
+      A fixed host bridge for the admin role, never a value. sonar-selfhost-admin is the native self-hosted Sonar administrator;
+      sonar-runtime-secret-env is the variable `env` of the runtime's untracked secret.env (the reader `starci gate sonar up` uses),
+      for a SonarCloud target only.
+    oneOf:
+      - type: object
+        additionalProperties: false
+        required: [id, hostConnection]
+        properties:
+          id: {const: admin}
+          hostConnection: {const: sonar-selfhost-admin}
+      - type: object
+        additionalProperties: false
+        required: [id, hostConnection, env]
+        properties:
+          id: {const: admin}
+          hostConnection: {const: sonar-runtime-secret-env}
+          env: {type: string, pattern: '^[A-Z][A-Z0-9_]{0,63}$'}
+          purpose: {type: string, minLength: 1}
+  target:
+    type: object
+    additionalProperties: false
+    required: [provider, context, resource, credentials]
+    oneOf:
+      - required: [origin]
+        properties:
+          provider: {enum: [supabase-cloud, supabase-auth, sonar-server, sonar-community, sonar-cloud, app, github, ghcr]}
+          endpoint: false
+      - required: [endpoint]
+        properties:
+          provider: {const: app-stack}
+          origin: false
+          endpoint: {$ref: '#/$defs/swarmEndpoint'}
+      - required: [endpoint]
+        properties:
+          provider: {const: app-db}
+          origin: false
+          endpoint: {$ref: '#/$defs/databaseEndpoint'}
+        oneOf:
+          - properties:
+              context: {const: local}
+              endpoint:
+                properties:
+                  mode: {const: local}
+          - properties:
+              endpoint:
+                properties:
+                  mode: {enum: [linked, url-env]}
+    properties:
+      provider:
+        enum: [supabase-cloud, supabase-auth, sonar-server, sonar-community, sonar-cloud, app, github, ghcr, app-stack, app-db]
+      context:
+        enum: [local, development, staging, production]
+      origin:
+        type: string
+        pattern: '^https?://[^\s]+$'
+        description: Auth-free origin; the resolver permits HTTP only for an explicitly local loopback target.
+      endpoint:
+        type: object
+        description: Closed native endpoint selected by app-stack or app-db; public declaration checks precede custody and the effective private endpoint is compared before network access.
+      resource:
+        type: object
+        description: Adapter-owned public configuration; each adapter refuses fields outside its action contract.
+      credentials:
+        type: array
+        items: {$ref: '#/$defs/credential'}
+        description: Named roles using the existing service credential contract; ids become the execution role map.
+      optionalCredentials:
+        type: array
+        uniqueItems: true
+        items: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+        description: Declared roles whose absence may be inspected without substituting another credential.
+      destination:
+        $ref: '#/$defs/credential'
+      actions:
+        type: array
+        minItems: 1
+        uniqueItems: true
+        items: {type: string, pattern: '^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)+$'}
+        description: Exact action ids allowed for this target; the catalog and execution owner enforce the selected action.
+  swarmEndpoint:
+    type: object
+    additionalProperties: false
+    required: [kind, environment, stack, host, user, port]
+    properties:
+      kind: {const: docker-swarm}
+      environment: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+      stack: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+      host: {type: string, pattern: '^[a-zA-Z0-9][a-zA-Z0-9.-]*$'}
+      user: {type: string, pattern: '^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$'}
+      port: {const: 22}
+  databaseEndpoint:
+    type: object
+    additionalProperties: false
+    required: [kind, mode, environment]
+    oneOf:
+      - required: [localProject, port]
+        properties:
+          mode: {const: local}
+          projectRef: false
+          urlEnv: false
+          host: false
+          database: false
+          user: false
+      - required: [projectRef]
+        properties:
+          mode: {const: linked}
+          localProject: false
+          port: false
+          urlEnv: false
+          host: false
+          database: false
+          user: false
+      - required: [urlEnv, host, port, database, user]
+        properties:
+          mode: {const: url-env}
+          localProject: false
+          projectRef: false
+    properties:
+      kind: {const: supabase-db}
+      mode: {enum: [local, linked, url-env]}
+      environment: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+      localProject: {type: string, pattern: '^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$'}
+      projectRef: {type: string, pattern: '^[a-z0-9]{20}$'}
+      urlEnv: {type: string, pattern: '^[A-Z][A-Z0-9_]*$'}
+      host: {type: string, pattern: '^[a-zA-Z0-9][a-zA-Z0-9.-]*$'}
+      port: {type: integer, minimum: 1, maximum: 65535}
+      database: {type: string, pattern: '^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$'}
+      user: {type: string, pattern: '^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$'}

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "fb2a551d3cb254cc42fa5c95dc1a32af973df14313385f03703bc209b2badb8a",
+  "hash": "4018e220cb9abde27d6d8cd79cd502c4d0c64a5312d7549c8e631553a22cb878",
   "global": [
     {
       "name": "json",
@@ -1240,7 +1240,8 @@ export const CATALOG = {
             "disabled or unavailable Sonar or an unset token refuses RELEASE_SONAR_UNAVAILABLE",
             "a scanner exit 0 is not a pass: the row polls api/ce/task until the analysis ends, then reads api/qualitygates/project_status with the same token",
             "OK passes; ERROR is red as RELEASE_SONAR_GATE_FAILED naming each failed condition, as is a FAILED or CANCELED task",
-            "a task still running after 600 s is RELEASE_SONAR_GATE_TIMEOUT; no report-task, an HTTP error or no gate is RELEASE_SONAR_GATE_UNREADABLE",
+            "a task still running after 600 s is RELEASE_SONAR_GATE_TIMEOUT; no report-task, an HTTP 4xx or no gate is RELEASE_SONAR_GATE_UNREADABLE",
+            "a network error or HTTP 5xx is retried up to 5 times with backoff inside the 600 s; still failing, it is RELEASE_SONAR_GATE_UNREADABLE",
             "OWNER RULING candidate-ci (2026-10-18): the gate no longer reads the default-branch CI; the verdict is the candidate run of the sha",
             "release.requireCi (default false, owner ruling release-require-ci-per-project) decides whether push waits for CI; the local gate is never skipped",
             "requireCi false: push needs the tag and the green L4 record, runs the dry run, pushes atomically and states CI was not required",
@@ -10182,13 +10183,14 @@ export const CATALOG = {
           "runtimeSide": "host"
         },
         "project": {
-          "summary": "ensure a declared Sonar project through its provider adapter",
+          "summary": "ensure a declared Sonar project, or move it to its declared key, through its provider adapter",
           "owner": "runtime",
           "positional": [
             {
               "name": "action",
               "enum": [
-                "ensure"
+                "ensure",
+                "rekey"
               ],
               "required": true,
               "variadic": false
@@ -10234,7 +10236,8 @@ export const CATALOG = {
           },
           "json": "always",
           "examples": [
-            "starci sonar project ensure --target quality --operation project-bootstrap"
+            "starci sonar project ensure --target quality --operation project-bootstrap",
+            "starci sonar project rekey --target quality --operation project-rename"
           ],
           "editions": [
             "full",
@@ -10252,7 +10255,9 @@ export const CATALOG = {
             "owner"
           ],
           "conventions": [
-            "a target and existing accepted operation scope bind provider effects; execute grants no authority"
+            "a target and existing accepted operation scope bind provider effects; execute grants no authority",
+            "rekey moves the project at previousKey to projectKey (api/projects/update_key); its analyses, issues and quality gate stay with it",
+            "rekey is verified when the new key reads back and the old key no longer does"
           ],
           "operationPolicy": {
             "ensure": {
@@ -10265,6 +10270,17 @@ export const CATALOG = {
               "checkpoints": [
                 "account-authority"
               ]
+            },
+            "rekey": {
+              "action": "sonar.project.rekey",
+              "effect": "remote",
+              "credentials": [
+                "admin"
+              ],
+              "destination": "none",
+              "checkpoints": [
+                "account-authority"
+              ]
             }
           },
           "runtimeSide": "host"

package/runtime/scripts/hfs/stacks-gate.mjs

@@ -3,6 +3,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { lsFiles } from '../api/git/ls-files.mjs';
 import {parseYaml} from '../../engine/yaml.mjs';
+import { validateAgainstSchema } from '../lib/json-schema.mjs';
+import { PROVISION_OPERATION_SCHEMA_REF, provisionOperationSchema } from '../lib/provision-operation-schema.mjs';
 import {slash} from '../lib/path-key.mjs';
 import { isInside, walkFiles } from '../lib/walk.mjs';
 import { composeIncludePaths, swarmInventoryIssues, swarmModelIssues } from '../lib/swarm-stack.mjs';
@@ -92,7 +94,13 @@ function validateSchema(value){
     if(shape.minItems&&node.length<shape.minItems)errors.push({path:at,message:'array too short'});
     node.forEach((item,index)=>shape.items&&check(item,shape.items,`${at}/${index}`));
   };
+  // The operations block refers to its own schema file: its owner's composed schema validates it, as the provision target owner does.
+  const checkOperations=(node,at)=>{
+    for(const error of validateAgainstSchema(node,provisionOperationSchema()))errors.push({path:at,message:error});
+  };
   const check=(node,shape,at)=>{
+    if(shape?.$ref===PROVISION_OPERATION_SCHEMA_REF)return checkOperations(node,at);
+    if(shape?.$ref&&!shape.$ref.startsWith('#/')){errors.push({path:at,message:`unresolved schema reference ${shape.$ref}`});return;}
     if(shape?.$ref)return check(node,resolve(shape.$ref),at);
     if(Array.isArray(shape?.anyOf)){
       checkAlternatives(node,shape,at,check);

package/runtime/scripts/lib/json-schema.mjs

@@ -0,0 +1,96 @@
+// json-schema.mjs - a minimal draft-2020-12 JSON schema walker over the keywords the runtime's yaml schemas use.
+import {isPlainObject} from '../../engine/plain-object.mjs';
+
+// A minimal draft-2020-12 walker over the keywords op.schema.yaml uses. ajv is
+// a devDependency; the runtime has no npm dependencies, so the walker is here.
+/** Validate the supported schema keywords, including exact-one and at-least-one alternatives, without mutating input. */
+export function validateAgainstSchema(value, schema) {
+  const errors = [];
+  const resolve = (ref) => String(ref).replace(/^#\//, '').split('/')
+    .reduce((node, key) => node?.[key.replaceAll('~1', '/').replaceAll('~0', '~')], schema);
+  const typeOk = (node, type) => {
+    if (Array.isArray(type)) return type.some((t) => typeOk(node, t));
+    if (type === 'object') return isPlainObject(node);
+    if (type === 'array') return Array.isArray(node);
+    if (type === 'integer') return Number.isInteger(node);
+    if (type === 'null') return node === null;
+    return typeof node === type;
+  };
+  const validateType = (node, shape, at) => {
+    if (shape.type !== undefined && !typeOk(node, shape.type)) {
+      errors.push(`${at}: expected ${Array.isArray(shape.type) ? shape.type.join('|') : shape.type}`);
+      return false;
+    }
+    return true;
+  };
+  const validateString = (node, shape, at) => {
+    if (shape.minLength !== undefined && node.length < shape.minLength) errors.push(`${at}: empty or too short`);
+    if (shape.pattern && !new RegExp(shape.pattern, 'u').test(node)) errors.push(`${at}: ${JSON.stringify(node)} does not match ${shape.pattern}`);
+  };
+  const validateNumber = (node, shape, at) => {
+    if (shape.minimum !== undefined && node < shape.minimum) errors.push(`${at}: below minimum ${shape.minimum}`);
+    if (shape.maximum !== undefined && node > shape.maximum) errors.push(`${at}: above maximum ${shape.maximum}`);
+  };
+  const validateScalar = (node, shape, at) => {
+    if (Object.hasOwn(shape, 'const') && node !== shape.const) errors.push(`${at}: must be ${JSON.stringify(shape.const)}`);
+    if (Array.isArray(shape.enum) && !shape.enum.includes(node)) errors.push(`${at}: ${JSON.stringify(node)} is outside [${shape.enum.join(', ')}]`);
+    if (typeof node === 'string') validateString(node, shape, at);
+    if (typeof node === 'number') validateNumber(node, shape, at);
+  };
+  const validateArray = (node, shape, at, walk) => {
+    if (shape.minItems !== undefined && node.length < shape.minItems) errors.push(`${at}: needs at least ${shape.minItems} item(s)`);
+    if (shape.items) node.forEach((item, i) => walk(item, shape.items, `${at}[${i}]`));
+  };
+  const validateObject = (node, shape, at, walk) => {
+    if (shape.minProperties !== undefined && Object.keys(node).length < shape.minProperties) errors.push(`${at}: needs at least ${shape.minProperties} entr(y|ies)`);
+    for (const key of shape.required ?? []) if (!Object.hasOwn(node, key)) errors.push(`${at}: missing ${key}`);
+    for (const [key, child] of Object.entries(node)) {
+      const where = at === '$' ? `$.${key}` : `${at}.${key}`;
+      if (Object.hasOwn(shape.properties ?? {}, key)) walk(child, shape.properties[key], where);
+      else if (shape.additionalProperties === false) errors.push(`${where}: unknown key`);
+      else if (isPlainObject(shape.additionalProperties)) walk(child, shape.additionalProperties, where);
+    }
+  };
+  const validateAlternatives = (node, shape, at, walk) => {
+    for (const keyword of ['anyOf', 'oneOf']) {
+      if (!Object.hasOwn(shape, keyword)) continue;
+      const branches = shape[keyword];
+      if (!Array.isArray(branches) || branches.length === 0) { errors.push(`${at}: ${keyword} needs a nonempty schema list`); continue; }
+      const outcomes = branches.map((branch) => {
+        const start = errors.length;
+        walk(node, branch, at);
+        return errors.splice(start);
+      });
+      const matched = outcomes.filter((findings) => findings.length === 0).length;
+      if (keyword === 'oneOf' && matched > 1) errors.push(`${at}: oneOf matches more than one alternative`);
+      else if (matched === 0) {
+        errors.push(`${at}: ${keyword} matches no alternative`);
+        // The nearest branch explains a refusal without mixing findings from mutually exclusive shapes.
+        const nearest = outcomes.reduce((best, findings) => findings.length < best.length ? findings : best, outcomes[0]);
+        errors.push(...nearest);
+      }
+    }
+  };
+  const walk = (node, shape, at) => {
+    if (shape === true) return;
+    if (shape === false) { errors.push(`${at}: schema refuses this value`); return; }
+    if (!isPlainObject(shape)) { errors.push(`${at}: schema is invalid`); return; }
+    if (shape.$ref) {
+      const referenced = String(shape.$ref).startsWith('#/') ? resolve(shape.$ref) : undefined;
+      if (referenced === undefined) { errors.push(`${at}: schema reference is unresolved`); return; }
+      walk(node, referenced, at);
+      return;
+    }
+    validateAlternatives(node, shape, at, walk);
+    if (!validateType(node, shape, at)) return;
+    validateScalar(node, shape, at);
+    if (Array.isArray(node)) {
+      validateArray(node, shape, at, walk);
+      return;
+    }
+    if (!isPlainObject(node)) return;
+    validateObject(node, shape, at, walk);
+  };
+  walk(value, schema, '$');
+  return errors;
+}

package/runtime/scripts/lib/provision-operation-schema.mjs

@@ -0,0 +1,17 @@
+// The schema of a stack declaration's `operations` block, composed once for its two readers: the provision target owner and the
+// stacks gate. provision-operation.schema.yaml refers to the service credential of application-stacks.schema.yaml; the composition
+// inlines that definition so the self-contained walker of json-schema.mjs resolves every reference.
+// Both schemas are read through `new URL(<literal>, import.meta.url)`: that is the form sync-runtime follows, so the copy
+// bundled in @starci/hfs carries them beside this module (a skillRoot join left provision-operation.schema.yaml out of it).
+import fs from 'node:fs';
+import { parseYaml } from '../../engine/yaml.mjs';
+
+/** The `$ref` application-stacks.schema.yaml uses for its `operations` block. */
+export const PROVISION_OPERATION_SCHEMA_REF = 'provision-operation.schema.yaml';
+
+/** The composed `operations` schema, read from this runtime's modules/schemas. */
+export function provisionOperationSchema() {
+  const schema = parseYaml(fs.readFileSync(new URL('../../modules/schemas/provision-operation.schema.yaml', import.meta.url), 'utf8'));
+  const stacks = parseYaml(fs.readFileSync(new URL('../../modules/schemas/application-stacks.schema.yaml', import.meta.url), 'utf8'));
+  return { ...schema, $defs: { ...schema.$defs, serviceCredential: stacks.$defs.serviceCredential } };
+}

package/sync/index.mjs

@@ -340,7 +340,7 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     nodeMajor: String(NODE_MAJOR),
     sonarKey: sonarKey ?? app.project,
     sonarHostLine: sonarHostLine(quality.sonar),
-    sonarExclusions: [presets?.sonarExclusions, '**/.next/**', '**/node_modules/**', '**/src/messages/**', ...(lite ? ['supabase/types/**'] : [])].filter(Boolean).join(','),
+    sonarExclusions: [presets?.sonarExclusions, '**/.next/**', '**/node_modules/**', ...(lite ? ['supabase/types/**'] : [])].filter(Boolean).join(','),
     sonarSources: ['be/apps', 'be/src', 'fe/apps', ...(packages ? ['fe/packages'] : [])].join(','),
     lcovReport: LCOV_REPORT,
     ...ciWorkflowCommands(source, LCOV_REPORT, source.qualityDeclared === false ? undefined : source.quality, { app }),

package/templates/app/hooks/husky/pre-commit

@@ -7,7 +7,7 @@ git diff --cached --name-only --diff-filter=ACMR -z --relative=be -- '*.ts' '*.m
   xargs -0 -n 50 sh -c 'if [ "$#" -gt 0 ]; then cd be && npx eslint -- "$@"; fi' sh || exit $?
 git diff --cached --name-only --diff-filter=ACMR -z --relative=fe -- '*.ts' '*.tsx' '*.mts' '*.cts' '*.js' '*.jsx' '*.mjs' '*.cjs' |
   xargs -0 -n 50 sh -c 'if [ "$#" -gt 0 ]; then cd fe && npx eslint --max-warnings=0 --no-warn-ignored -- "$@"; fi' sh || exit $?
-styles=$(git diff --cached --name-only --diff-filter=ACMR --relative=fe -- '*.css' || true)
+styles=$(git diff --cached --name-only --diff-filter=ACMR --relative=fe -- '*.css') || exit $?
 if [ -n "$styles" ]; then
   (cd fe && npx stylelint $styles)
 fi

package/templates/app/tool-config/prettierignore

@@ -10,4 +10,4 @@ contracts/
 .starcistacks/
 .starciwork/
 **/__generated__/
-**/messages/**
+**/i18n/messages/**

package/templates/be/skeleton/src/modules/domain/identity/messages/identity.messages.ts

@@ -3,7 +3,8 @@ import type { MessageBundle } from "@modules/platform/i18n"
 /** Display text of the identity codes, Vietnamese and English. */
 export const IDENTITY_MESSAGES: MessageBundle = {
     vi: {
-        "errors.IDENTITY_UNAUTHENTICATED": "B\u1ea1n c\u1ea7n \u0111\u0103ng nh\u1eadp \u0111\u1ec3 th\u1ef1c hi\u1ec7n thao t\u00e1c n\u00e0y.",
+        "errors.IDENTITY_UNAUTHENTICATED":
+            "B\u1ea1n c\u1ea7n \u0111\u0103ng nh\u1eadp \u0111\u1ec3 th\u1ef1c hi\u1ec7n thao t\u00e1c n\u00e0y.",
     },
     en: {
         "errors.IDENTITY_UNAUTHENTICATED": "You need to sign in to do this.",

package/templates/be/skeleton/src/modules/platform/http-security/messages/http-security.messages.ts

@@ -3,7 +3,8 @@ import type { MessageBundle } from "@modules/platform/i18n"
 /** Display text of the http-security codes, Vietnamese and English. */
 export const HTTP_SECURITY_MESSAGES: MessageBundle = {
     vi: {
-        "errors.HTTP_SECURITY_REQUIRED_DEPENDENCY_UNAVAILABLE": "C\u01a1 s\u1edf d\u1eef li\u1ec7u b\u1eaft bu\u1ed9c hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng.",
+        "errors.HTTP_SECURITY_REQUIRED_DEPENDENCY_UNAVAILABLE":
+            "C\u01a1 s\u1edf d\u1eef li\u1ec7u b\u1eaft bu\u1ed9c hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng.",
         "errors.HTTP_SECURITY_ORIGIN_REJECTED":
             "Ngu\u1ed3n g\u1eedi y\u00eau c\u1ea7u kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e9p.",
         "errors.HTTP_SECURITY_RATE_LIMITED":