@starci/hfs 5.0.4 → 5.0.6

package/ci/cli.mjs

@@ -1,19 +1,22 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { parseYaml } from '../runtime/engine/yaml.mjs';
-import { isValidCiDeclaration, readCiDeclaration, sealedKeyNames } from '../runtime/scripts/hfs/ci-declaration.mjs';
+import { isValidCiDeclaration, readCiDeclaration, sealedKeyNames, serviceBindings, serviceCredentialNames, runtimeGranted } from '../runtime/scripts/hfs/ci-declaration.mjs';
+import { repositoryName, identityQueryEnvironment } from '../runtime/scripts/hfs/repo-identity.mjs';
+import { serviceCredentialFile, serviceCredentialValue } from '../runtime/scripts/hfs/secret-store.mjs';
+import { defaultSops } from '../runtime/scripts/hfs/secret-sops.mjs';
 import { github, refuse } from './github.mjs';
 import { setSecret } from './secret.mjs';
 import { setVariable, syncVariables } from './vars.mjs';
 import { badgeVisibilityNotices, verifyCi } from './verify.mjs';
 /** The commands of `starci app ci` (besides `local`) with the options each takes; the parser refuses every other. */
 export const COMMANDS = {
-    'secret set': ['env', 'dependabot', 'repo', 'execute'],
+    'secret set': ['env', 'dependabot', 'repo', 'execute', 'from-custody'],
     'var set': ['env', 'value', 'repo', 'execute'],
     'var sync': ['execute', 'repo'],
     verify: ['json', 'repo'],
 };
-export const BOOLEAN = new Set(['dependabot', 'execute', 'json']);
+export const BOOLEAN = new Set(['dependabot', 'execute', 'json', 'from-custody']);
 /** Invalid options never echo argv, because an extra argument may itself contain a secret. */
 function parse(argv) {
     const command = argv[0] === 'verify' ? 'verify' : argv.slice(0, 2).join(' ');
@@ -52,7 +55,7 @@ function parse(argv) {
     return { command, options: options, name: positional[0] };
 }
 /** Manifest and sealed key reads remain offline; only github.mjs may invoke the GitHub CLI. */
-export async function ciMain(argv, { cwd = process.cwd(), stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), stdin, env = process.env, tools = {} } = {}) {
+export async function ciMain(argv, { cwd = process.cwd(), stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), stdin, env = process.env, tools = {}, hostIdentity, sops, platform = process.platform, inputRedirected } = {}) {
     // `ci local` runs the rendered CI on this machine (local.mjs): no manifest custody and no GitHub.
     if (argv[0] === 'local')
         return (await import('./local.mjs')).ciLocalMain(argv.slice(1), { cwd, stdout, stderr, env });
@@ -69,8 +72,36 @@ export async function ciMain(argv, { cwd = process.cwd(), stdout = (s) => proces
         }
         if (!isValidCiDeclaration(declaration))
             throw refuse('CI_DECLARATION_INVALID', 'correct the CI declaration before using GitHub');
-        const gh = github({ cwd, env, spawn: tools.spawn });
-        const context = { ...parsed, declaration, sealed, gh, stdin, stdout };
+        const childEnv = identityQueryEnvironment(env, serviceCredentialNames(doc));
+        const repository = repositoryName(cwd, { env: childEnv }), selected = serviceBindings(doc, repository);
+        if (selected.problems.length)
+            throw refuse('CI_CUSTODY_INVALID', 'correct the explicit project service credential bindings before using CI');
+        const runtime = sealed.filter((entry) => runtimeGranted(doc, entry.env, entry.member, entry.key));
+        if (parsed.command.endsWith(' set') && runtime.some((entry) => entry.key === parsed.name))
+            throw refuse('APP_SECRET_IN_CI', 'the selected key belongs to app runtime authority');
+        if (parsed.options['from-custody']) {
+            const binding = selected.bindings.find((item) => item.name === parsed.name);
+            if (!binding || parsed.options.dependabot)
+                throw refuse('CI_CUSTODY_INVALID', 'one project service binding is required');
+            try {
+                serviceCredentialFile(cwd, binding);
+            }
+            catch {
+                throw refuse('CI_CUSTODY_INVALID', 'the selected project member is missing, ambiguous or outside this product');
+            }
+            if (parsed.options.repo && (parsed.options.repo.split('/')[1] !== repository || (doc.ci?.github?.repository && parsed.options.repo !== doc.ci.github.repository)))
+                throw refuse('CI_CUSTODY_INVALID', 'the destination repository differs from this project');
+        }
+        const gh = github({ cwd, env: childEnv, spawn: tools.spawn });
+        const custody = (binding) => {
+            try {
+                return serviceCredentialValue(cwd, binding, sops ?? defaultSops(env, cwd, platform, undefined, hostIdentity));
+            }
+            catch {
+                throw refuse('CI_CUSTODY_UNAVAILABLE', 'the selected service member could not be opened with the owner identity');
+            }
+        };
+        const context = { ...parsed, declaration, sealed, runtime, gh, stdin, stdout, bindings: selected.bindings, custody, inputRedirected };
         if (parsed.command === 'secret set')
             return await setSecret(context);
         if (parsed.command === 'var set')

package/ci/github.d.mts

@@ -11,6 +11,7 @@ export interface CiOptions extends CiScope {
     value?: string | undefined;
     execute?: boolean | undefined;
     json?: boolean | undefined;
+    'from-custody'?: boolean | undefined;
 }
 /** One declared CI secret or variable of a declaration without problems (runtime/scripts/hfs/ci-declaration.mjs readCiDeclaration). */
 export type CiEntry = ValidCiEntry;

package/ci/secret.d.mts

@@ -1,10 +1,16 @@
 import type { CiDeclaration, CiEntry, CiOptions, Gh, StdinSource } from './github.mjs';
+import { type ServiceBinding } from '../runtime/scripts/hfs/ci-declaration.mjs';
+/** An input pipe or file is an input source even before its bytes arrive; fstat never consumes its value. */
+export declare function redirectedSecretInput(): boolean;
 /** A declared name must belong to the requested store before a secret body is read. */
 export declare function declaredEntry(entries: readonly CiEntry[], name: string, options: CiOptions): CiEntry;
 /** Secret input is read once, stripped of one trailing newline, and passed only to the child stdin; without options.execute nothing is read or written. */
-export declare function setSecret({ declaration, sealed, gh, options, name, stdin, stdout }: {
+export declare function setSecret({ declaration, sealed, gh, options, name, stdin, stdout, bindings, custody, inputRedirected }: {
     declaration: CiDeclaration;
     sealed: readonly {
+        env?: string;
+        member?: string;
+        file?: string;
         key: string;
     }[];
     gh: Gh;
@@ -12,4 +18,7 @@ export declare function setSecret({ declaration, sealed, gh, options, name, stdi
     name: string;
     stdin: StdinSource;
     stdout: (text: string) => unknown;
+    bindings?: ServiceBinding[];
+    custody?: ((binding: ServiceBinding) => string) | undefined;
+    inputRedirected?: (() => boolean) | undefined;
 }): Promise<number>;

package/ci/secret.mjs

@@ -1,5 +1,16 @@
 import fs from 'node:fs';
 import { refuse, scopeArgs, scopeName } from './github.mjs';
+import { boundSealedKey } from '../runtime/scripts/hfs/ci-declaration.mjs';
+/** An input pipe or file is an input source even before its bytes arrive; fstat never consumes its value. */
+export function redirectedSecretInput() {
+    try {
+        const input = fs.fstatSync(0);
+        return !input.isCharacterDevice();
+    }
+    catch {
+        return false;
+    }
+}
 /** A declared name must belong to the requested store before a secret body is read. */
 export function declaredEntry(entries, name, options) {
     const entry = entries.find((item) => item.name === name);
@@ -11,24 +22,33 @@ export function declaredEntry(entries, name, options) {
     return entry;
 }
 /** Secret input is read once, stripped of one trailing newline, and passed only to the child stdin; without options.execute nothing is read or written. */
-export async function setSecret({ declaration, sealed, gh, options, name, stdin, stdout }) {
-    if (sealed.some((item) => item.key === name))
-        throw refuse('CI_SECRET_SEALED', 'the name belongs to a sealed app secret');
+export async function setSecret({ declaration, sealed, gh, options, name, stdin, stdout, bindings = [], custody, inputRedirected = redirectedSecretInput }) {
     declaredEntry(options.dependabot ? declaration.dependabotSecrets : declaration.secrets, name, options);
+    const binding = options.dependabot ? undefined : bindings.find((item) => item.name === name);
+    if (sealed.some((item) => (item.key === name || (binding && item.key === binding.key)) && !(binding && boundSealedKey(binding, item))))
+        throw refuse('CI_SECRET_SEALED', 'the name or selected key belongs to unrelated sealed app custody');
+    if (binding && options['from-custody'] !== true)
+        throw refuse('CI_CUSTODY_REQUIRED', 'this service secret is an execution copy; use --from-custody');
+    if (options['from-custody'] && (!binding || !custody))
+        throw refuse('CI_CUSTODY_INVALID', 'one explicit project service credential binding is required');
+    if (options['from-custody'] && (stdin !== undefined || inputRedirected()))
+        throw refuse('CI_VALUE_AMBIGUOUS', 'choose custody or stdin, never both');
     // Dry until --execute: the name is judged, but no value is read and GitHub is not reached; the line never carries a value.
     if (options.execute !== true) {
-        stdout(`dry run: would set secret ${name} (${scopeName(options)}) from the value on stdin; add --execute\n`);
+        stdout(`dry run: would set secret ${name} (${scopeName(options)}) from ${binding ? 'its declared service custody' : 'the value on stdin'}; add --execute\n`);
         return 0;
     }
     let value;
-    if (stdin === undefined) {
+    if (binding && custody)
+        value = custody(binding);
+    else if (stdin === undefined) {
         if (process.stdin.isTTY)
             throw refuse('CI_VALUE_EMPTY', 'a secret value is required on stdin');
         value = fs.readFileSync(0, 'utf8');
     }
     else
         value = typeof stdin === 'function' ? await stdin() : stdin;
-    value = String(value ?? '').replace(/\r?\n$/, '');
+    value = binding ? value : String(value ?? '').replace(/\r?\n$/, '');
     if (!value.length)
         throw refuse('CI_VALUE_EMPTY', 'a secret value is required on stdin');
     const repo = gh.repository(options.repo);

package/ci/verify.d.mts

@@ -1,14 +1,22 @@
 import type { CiDeclaration, CiOptions, Gh } from './github.mjs';
+import { type ServiceBinding } from '../runtime/scripts/hfs/ci-declaration.mjs';
 /** Verification reports names and scopes only; values are compared in memory and excluded from findings. */
-export declare function verifyCi({ declaration, sealed, gh, options, stdout, notices }: {
+export declare function verifyCi({ declaration, sealed, gh, options, stdout, notices, bindings, runtime }: {
     declaration: CiDeclaration;
     sealed: readonly {
+        env?: string;
+        member?: string;
+        file?: string;
         key: string;
     }[];
     gh: Gh;
     options: CiOptions;
     stdout: (text: string) => unknown;
     notices?: string[];
+    bindings?: ServiceBinding[];
+    runtime?: readonly {
+        key: string;
+    }[];
 }): number;
 /** Manifest visibility wins; optional GitHub visibility discovery never changes verification findings or errors. */
 export declare function badgeVisibilityNotices({ doc, gh, repo }: {

package/ci/verify.mjs

@@ -1,7 +1,8 @@
 import { badgeTokenNotices } from '../sync/readme-badges.mjs';
 import { refuse, scopeArgs, scopeName } from './github.mjs';
+import { boundSealedKey } from '../runtime/scripts/hfs/ci-declaration.mjs';
 /** Verification reports names and scopes only; values are compared in memory and excluded from findings. */
-export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [] }) {
+export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [], bindings = [], runtime = [] }) {
     const repo = gh.repository(options.repo), stores = [];
     const environments = [...new Set([...declaration.secrets, ...declaration.vars].filter((item) => item.scope === 'environment').map((item) => item.environment))].sort();
     for (const scope of [{}, ...environments.map((env) => ({ env })), { dependabot: true }]) {
@@ -12,7 +13,7 @@ export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [
             stores.push({ scope, kind, rows });
         }
     }
-    const findings = [], sealedNames = new Set(sealed.map((item) => item.key));
+    const findings = [];
     const declarations = (store) => store.scope.dependabot ? declaration.dependabotSecrets : store.kind === 'secret' ? declaration.secrets : declaration.vars;
     const matches = (entry, scope) => (entry.scope === 'environment' ? entry.environment : undefined) === scope.env;
     const add = (code, name, scope) => { findings.push({ code, name, scope: scopeName(scope) }); };
@@ -26,7 +27,8 @@ export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [
                 add('CI_VAR_DRIFT', entry.name, store.scope);
         }
         for (const row of store.rows) {
-            if (store.kind === 'secret' && sealedNames.has(row.name))
+            const binding = store.scope.dependabot ? undefined : bindings.find((item) => item.name === row.name);
+            if (runtime.some((item) => item.key === row.name) || (store.kind === 'secret' && sealed.some((item) => (item.key === row.name || (binding && item.key === binding.key)) && !(binding && boundSealedKey(binding, item)))))
                 add('APP_SECRET_IN_CI', row.name, store.scope);
             if (entries.some((entry) => entry.name === row.name && matches(entry, store.scope)))
                 continue;

package/emit/contracts.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 /** The parts of the parsed hfs.json this module reads. */
 export interface HfsDeclaration {
     readonly apps?: ReadonlyArray<{
@@ -18,18 +19,20 @@ export declare function aliasesOf(paths: Readonly<Record<string, readonly string
 export declare function aliasTarget(aliases: readonly PathAlias[], specifier: string): string | null;
 /** The text written to a snapshot file: the printed schema and one final newline. Pure. */
 export declare const snapshotText: (printed: string) => string;
-/**
- * Writes the snapshots of every api app: `contracts/<app>/schema.graphql` when it serves GraphQL and `contracts/<app>/openapi.json`
- * when it has an operation table. Answers `{ written: [paths], skipped: [apps], standIns: { app: [lines] } }`, `skipped`
- * being the apps with neither. `declaration` is the parsed hfs.json. `outDir` (absolute) redirects the snapshots to another
- * root, keeping their relative paths.
- */
-export declare function emitContracts({ repoRoot, declaration, outDir }: {
+interface EmitInput {
     repoRoot: string;
     declaration: HfsDeclaration;
     outDir?: string;
-}): {
+}
+interface EmitResult {
     written: string[];
     skipped: string[];
     standIns: Record<string, string[]>;
-};
+}
+/** Existing synchronous emitter for source finders and their worker proofs. */
+export declare function emitContracts(input: EmitInput): EmitResult;
+/** App-check/emit execution: each actual compiler worker is admitted separately, with the original isolated environment. */
+export declare function emitContractsAsync(input: EmitInput & {
+    execute?: HeavyNodeRun | undefined;
+}): Promise<EmitResult>;
+export {};

package/emit/contracts.mjs

@@ -21,6 +21,7 @@
  * * artifact, so a redirected `outDir` (the R23 check mode, which emits into a scratch root) does not get them.
  */
 import { spawnSync } from 'node:child_process';
+import { completedNode, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -50,9 +51,8 @@ export function aliasTarget(aliases, specifier) {
 const apiApps = (declaration) => (declaration.apps ?? []).filter((app) => app.kind === 'api').map((app) => app.name);
 /** The text written to a snapshot file: the printed schema and one final newline. Pure. */
 export const snapshotText = (printed) => `${printed.replace(/\n+$/, '')}\n`;
-/** Runs one worker of one app; answers its stdout, or null when the app has nothing of that kind (exit 3). */
-function runWorker(worker, repoRoot, app) {
-    const result = spawnSync(process.execPath, [worker, repoRoot, app], { encoding: 'utf8', cwd: repoRoot, env: { PATH: readEnv('PATH') ?? '' }, maxBuffer: 256 * 1024 * 1024 });
+/** Both transports judge the same native worker status and exact text. Exit 3 means the app serves no such contract. */
+function workerOutput(result, app) {
     if (result.status === 3)
         return { text: null, lines: [] };
     const lines = (result.stderr ?? '').split(/\r?\n/).filter(Boolean);
@@ -60,24 +60,20 @@ function runWorker(worker, repoRoot, app) {
         throw new Error(`starci app emit: ${app} failed (exit ${result.status}): ${(lines.join('\n') || result.stdout).trim()}`);
     return { text: result.stdout, lines: lines.filter((line) => line.startsWith(STAND_IN)) };
 }
-/** Emits the GraphQL schema and the operations of one app: `{ graphql, openapi, standIns }`, each text or null. */
-function emitApp(repoRoot, app) {
-    const graphql = runWorker(WORKER, repoRoot, app);
-    const operations = runWorker(OPERATIONS_WORKER, repoRoot, app);
-    return { graphql: graphql.text, openapi: operations.text, standIns: [...graphql.lines, ...operations.lines] };
-}
 /**
  * Writes the snapshots of every api app: `contracts/<app>/schema.graphql` when it serves GraphQL and `contracts/<app>/openapi.json`
  * when it has an operation table. Answers `{ written: [paths], skipped: [apps], standIns: { app: [lines] } }`, `skipped`
  * being the apps with neither. `declaration` is the parsed hfs.json. `outDir` (absolute) redirects the snapshots to another
  * root, keeping their relative paths.
  */
-export function emitContracts({ repoRoot, declaration, outDir = repoRoot }) {
+function* emissionProgram({ repoRoot, declaration, outDir = repoRoot }) {
     const written = [];
     const skipped = [];
     const standIns = {};
     for (const app of apiApps(declaration)) {
-        const emitted = emitApp(repoRoot, app);
+        const graphql = yield { worker: WORKER, repoRoot, app };
+        const operations = yield { worker: OPERATIONS_WORKER, repoRoot, app };
+        const emitted = { graphql: graphql.text, openapi: operations.text, standIns: [...graphql.lines, ...operations.lines] };
         if (emitted.graphql === null && emitted.openapi === null) {
             skipped.push(app);
             continue;
@@ -106,3 +102,25 @@ export function emitContracts({ repoRoot, declaration, outDir = repoRoot }) {
     }
     return { written, skipped, standIns };
 }
+/** Existing synchronous emitter for source finders and their worker proofs. */
+export function emitContracts(input) {
+    const program = emissionProgram(input);
+    let step = program.next();
+    while (!step.done) {
+        const { worker, repoRoot, app } = step.value;
+        const result = spawnSync(process.execPath, [worker, repoRoot, app], { encoding: 'utf8', cwd: repoRoot, env: { PATH: readEnv('PATH') ?? '' }, maxBuffer: 256 * 1024 * 1024 });
+        step = program.next(workerOutput(result, app));
+    }
+    return step.value;
+}
+/** App-check/emit execution: each actual compiler worker is admitted separately, with the original isolated environment. */
+export async function emitContractsAsync(input) {
+    const program = emissionProgram(input);
+    let step = program.next();
+    while (!step.done) {
+        const { worker, repoRoot, app } = step.value;
+        const result = completedNode(await runHeavyNode(input.execute, { kind: 'tsc', label: `app emit ${app} ${path.basename(worker)}`, args: [worker, repoRoot, app], cwd: repoRoot, env: { PATH: readEnv('PATH') ?? '' }, maxBuffer: 256 * 1024 * 1024 }), 'contract compiler');
+        step = program.next(workerOutput(result, app));
+    }
+    return step.value;
+}

package/lint/chunk.mjs

@@ -1,4 +1,5 @@
 // chunk.mjs - split a long argument list under the command-line limit (Windows allows 32,767 characters) and run the parts with bounded concurrency.
+import { isHostHeld, isNodeExecutionRefusal } from '../runtime/scripts/api/node/run-node.mjs';
 /** The command-line characters one argument costs: its length, a separating space and a pair of quotes. */
 const cost = (arg) => String(arg).length + 3;
 /**
@@ -26,18 +27,26 @@ export function chunkByChars(items, budget = 24_000) {
 export async function mapBounded(chunks, task, limit = 3) {
     const out = new Array(chunks.length);
     let next = 0;
+    let held;
     const worker = async () => {
-        while (next < chunks.length) {
+        while (next < chunks.length && held === undefined) {
             const at = next++;
             try {
                 out[at] = await task(chunks[at], at);
             }
             catch (error) {
-                out[at] = { error: `could not start a lint child: ${String(error?.message ?? error)}` };
+                if (isNodeExecutionRefusal(error)) {
+                    if (held === undefined || isHostHeld(error))
+                        held = error;
+                }
+                else
+                    out[at] = { error: `could not start a lint child: ${String(error?.message ?? error)}` };
             }
         }
     };
     await Promise.all(Array.from({ length: Math.min(limit, chunks.length) }, worker));
+    if (held !== undefined)
+        throw held;
     return out;
 }
 /** Merge the `{ results, error }` records of the chunks, in chunk order: every result kept, every distinct error reported. */

package/lint/run.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type CanonDeclarations, type LintSideStats } from '../cache/lint-family.mjs';
 import type { CheckSession } from '../cache/types.mjs';
 type Dynamic = any;
@@ -62,7 +63,7 @@ export declare function runLinter({ cwd, pkg, bin, args, bound }: {
     bin: string;
     args: string[];
     bound?: string | null;
-}): Promise<LinterRun>;
+}, execute?: HeavyNodeRun): Promise<LinterRun>;
 /**
  * The lint scope a flat config declares: `ignored(file)` for its global ignores (a block holding only `ignores` and `name`), which prune
  * the walk, and `source(file)` for a file some block's `files` select while that block's own `ignores` do not (standard flat-config

package/lint/run.mjs

@@ -30,7 +30,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawn } from 'node:child_process';
+import { completedNode, isHostHeld, isNodeExecutionRefusal, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { linterReport, mergeReports, sonarReport, sourceRootsOf } from '../report/sonar.mjs';
 import { SIDES, appRelativeMessages, loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
@@ -119,28 +119,8 @@ export function eslintHeapArgs(env = process.env) {
     const mb = Number(env[ESLINT_HEAP_ENV]);
     return Number.isInteger(mb) && mb > 0 ? [`--max-old-space-size=${mb}`] : [];
 }
-/** The child `node` ran with `args` from `cwd`: its exit status, signal, spawn error and the text of both streams, once it closes. */
-function runNode(args, options) {
-    return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawn(process.execPath, args, { ...options, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
-        }
-        catch (error) {
-            resolve({ status: 2, signal: null, error: error, stdout: '', stderr: String(error?.message ?? error) });
-            return;
-        }
-        const out = [];
-        const err = [];
-        let failure;
-        child.stdout.on('data', (chunk) => out.push(chunk));
-        child.stderr.on('data', (chunk) => err.push(chunk));
-        child.on('error', (error) => { failure = error; });
-        child.on('close', (status, signal) => resolve({ status, signal, error: failure, stdout: Buffer.concat(out).toString('utf8'), stderr: Buffer.concat(err).toString('utf8') }));
-    });
-}
 /** A linter's json results through the app's own install, run from `cwd` (a side folder): `{ results }` or `{ error }`. The child runs while the caller goes on. */
-export async function runLinter({ cwd, pkg, bin, args, bound = null }) {
+export async function runLinter({ cwd, pkg, bin, args, bound = null }, execute) {
     let entry;
     try {
         const manifest = createRequire(path.join(cwd, 'package.json')).resolve(`${pkg}/package.json`);
@@ -151,7 +131,7 @@ export async function runLinter({ cwd, pkg, bin, args, bound = null }) {
         return { error: `${pkg} is not installed for ${cwd}` };
     }
     const heap = pkg === 'eslint' ? eslintHeapArgs() : [];
-    const run = await runNode([...heap, ...(bound ? linterBoundArgs() : []), entry, ...args], { cwd, ...(bound ? { env: { ...process.env, [BOUND_ENV]: bound } } : {}) });
+    const run = completedNode(await runHeavyNode(execute, { kind: 'eslint', label: `app lint ${pkg} ${path.basename(cwd)}`, args: [...heap, ...(bound ? linterBoundArgs() : []), entry, ...args], cwd, maxBuffer: 64 * 1024 * 1024, ...(bound ? { env: { ...process.env, [BOUND_ENV]: bound } } : {}) }), pkg);
     // ESLint prints its report on stdout; stylelint uses stderr. JSON does not prove a completed child: only exits 0/1
     // without a spawn error or signal are measurable, and exit 1 must carry findings.
     let results;
@@ -348,7 +328,11 @@ function checkedEslintResults({ results, expected, cwd, scope, changed }) {
 const ESLINT_ARGV_BUDGET = 24_000;
 const ESLINT_CONCURRENCY = 3;
 /** A launch that threw instead of returning a record is a tool error of the run (exit 2), not a crash of the CLI. */
-const spawnFailure = (error) => ({ error: `could not start eslint: ${String(error?.message ?? error)}` });
+const spawnFailure = (error) => {
+    if (isNodeExecutionRefusal(error))
+        throw error;
+    return { error: `could not start eslint: ${String(error?.message ?? error)}` };
+};
 /** Starts the ESLint child of every side that has work and returns one record per side: skipped, a scope error, or the running child. */
 async function launchEslint({ app, repoRoot, opts, changed, existing, workspace, onFe, run = runLinter }) {
     const launches = [];
@@ -386,7 +370,12 @@ export async function eslintRepository({ repoRoot, app = readRepoDeclaration(loa
     if (!app.sides)
         throw new Error('ESLint runs at the app root, the folder of hfs.json');
     const launches = await launchEslint({ app, repoRoot, opts, changed, existing, workspace, onFe, run });
-    const runs = await Promise.all(launches.map(launch => launch.run ?? null));
+    const settled = await Promise.allSettled(launches.map(launch => launch.run ?? null));
+    const rejected = settled.filter((run) => run.status === 'rejected');
+    const failed = rejected.find(run => isHostHeld(run.reason)) ?? rejected[0];
+    if (failed !== undefined)
+        throw failed.reason;
+    const runs = settled.map(run => run.status === 'fulfilled' ? run.value : null);
     launches.forEach((launch, at) => {
         const { side } = launch;
         if (launch.skipped) {
@@ -528,7 +517,7 @@ export async function cachedLinters({ repoRoot, app, opts, workspace, onFe, run,
                 return { results: sub.raw, errors: sub.errors };
             },
             stylelint: styled ? async (files) => {
-                const linted = await runLinter({ cwd, pkg: 'stylelint', bin: 'stylelint', args: [...(files ?? [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json'] });
+                const linted = await (run ?? runLinter)({ cwd, pkg: 'stylelint', bin: 'stylelint', args: [...(files ?? [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json'] });
                 const appRelative = appRelativeMessages(STYLE_SIDE, cwd);
                 for (const result of linted.results ?? [])
                     for (const warning of result.warnings ?? [])
@@ -551,13 +540,13 @@ export async function cachedLinters({ repoRoot, app, opts, workspace, onFe, run,
     return { eslint, stylelint: style, sides };
 }
 /** Starts stylelint over the fe stylesheets (the running child), or returns null when no stylesheet is in scope. */
-function launchStylelint({ repoRoot, opts, changed, existing, onFe }) {
+function launchStylelint({ repoRoot, opts, changed, existing, onFe, run }) {
     if (opts.side === 'be')
         return null;
     const styles = onSide(existing, STYLE_SIDE).filter((file) => file.endsWith('.css'));
     if (changed !== null && !styles.length)
         return null;
-    return runLinter({ cwd: path.join(repoRoot, STYLE_SIDE), pkg: 'stylelint', bin: 'stylelint', args: [...(changed ? styles : [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json', ...(opts.fix ? ['--fix'] : [])] });
+    return (run ?? runLinter)({ cwd: path.join(repoRoot, STYLE_SIDE), pkg: 'stylelint', bin: 'stylelint', args: [...(changed ? styles : [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json', ...(opts.fix ? ['--fix'] : [])] });
 }
 /**
  * Run the whole lint of the app at `repoRoot`. `hfsCheck(repoRoot)` returns the `starci app check` result (`{ findings, tracked }`); the CLI
@@ -613,8 +602,14 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
     const cached = cache !== undefined && changed === null && !opts.fix ? cache : null;
     const cachedRun = app && cached ? cachedLinters({ app, repoRoot, opts, workspace, onFe, run: linter, cache: cached }) : null;
     const eslintRun = app ? (cachedRun ? cachedRun.then((answer) => answer.eslint) : eslintRepository({ app, repoRoot, opts, changed: changed ? [...changed] : null, existing, workspace, onFe, run: linter })) : null;
-    const styleLaunch = app && !cachedRun ? launchStylelint({ repoRoot, opts, changed, existing, onFe }) : null;
+    const styleLaunch = app && !cachedRun ? launchStylelint({ repoRoot, opts, changed, existing, onFe, run: linter }) : null;
     const checkRun = app ? Promise.resolve().then(() => hfsCheck(repoRoot)).then((value) => ({ value, error: undefined }), (error) => ({ value: undefined, error })) : null;
+    // A transport refusal does not abandon a sibling child or let its rejection escape unobserved.
+    const completed = await Promise.allSettled([eslintRun, styleLaunch, checkRun]);
+    const refused = completed.filter((run) => run.status === 'rejected');
+    const failure = refused.find(run => isHostHeld(run.reason)) ?? refused[0];
+    if (failure !== undefined)
+        throw failure.reason;
     // 1. ESLint, once per side, from the side folder with that side's config.
     const eslint = eslintRun ? await eslintRun : { engine: { sides: {} }, errors: [], raw: [], findings: [] };
     engines.eslint = eslint.engine;
@@ -649,6 +644,8 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
     let checked = { findings: [] };
     if (checkRun) {
         const settled = await checkRun;
+        if (isNodeExecutionRefusal(settled.error))
+            throw settled.error;
         if (settled.error)
             errors.push(`starci app check could not run: ${String(settled.error?.message ?? settled.error)}`);
         else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "5.0.4",
+  "version": "5.0.6",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/candidate-ci.mjs

@@ -8,7 +8,7 @@ const PASSING = new Set(['success', 'neutral']);
 export const candidateRef = (tag, prefix = 'v') => `${CANDIDATE_PREFIX}${String(tag).startsWith(prefix) ? String(tag).slice(prefix.length) : String(tag)}`;
 function run(ctx, command, args) {
     try {
-        return ctx.spawn(command, args, { cwd: ctx.cwd });
+        return ctx.spawn(command, args, { cwd: ctx.cwd, env: ctx.env });
     }
     catch {
         return { status: null };

package/release/gate.d.mts

@@ -72,6 +72,7 @@ export declare const refName: (value: unknown) => value is string;
 export declare function normalizeRelease(block: unknown, scripts?: Record<string, unknown> | undefined, services?: Services, options?: {
     example?: boolean;
     entities?: boolean;
+    repository?: string;
 }): {
     config: ReleaseConfig;
     problems?: undefined;