genesis-compiler 1.2.12 → 1.2.13

package/src/index/stack-verification.js

@@ -0,0 +1,54 @@
+import { GenesisError } from './errors.js';
+import { isSafeProcessExecutable, parseBacktickedArguments } from './stack-process.js';
+
+function verificationDiagnostic(stackPath, message, line, details = {}) {
+  throw new GenesisError('STACK_VERIFICATION_INVALID', message, {
+    path: stackPath,
+    ...(line === undefined ? {} : { line }),
+    ...details,
+  });
+}
+
+export function parseStackVerificationLines(lines, { path: stackPath } = {}) {
+  const commands = [];
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const source = lines[index];
+    const line = index + 1;
+    if (!source.trim()) continue;
+    const entry = source.match(/^- Verify `([^`\r\n]+)`:[ \t]+(.+)$/u);
+    if (!entry) {
+      verificationDiagnostic(
+        stackPath,
+        'Every Verification entry must use `- Verify `label`: `command` `argument`...`.',
+        line,
+        { observed: source },
+      );
+    }
+
+    const tokenSource = entry[2].trim();
+    const argv = parseBacktickedArguments(tokenSource);
+    if (!argv) {
+      verificationDiagnostic(
+        stackPath,
+        'Every verification command and argument must be one separate non-empty backticked value.',
+        line,
+        { observed: source },
+      );
+    }
+
+    const command = argv[0];
+    if (argv.some((value) => value.includes('\0')) || !isSafeProcessExecutable(command)) {
+      verificationDiagnostic(
+        stackPath,
+        'A verification executable must be a PATH name or project-relative path without traversal.',
+        line,
+        { command },
+      );
+    }
+
+    commands.push({ label: entry[1], argv, line });
+  }
+
+  return commands;
+}

package/src/index/stack.js

@@ -7,9 +7,7 @@ import {
   normalizeStackPackageName,
   readStackCatalog,
 } from './stack-catalog.js';
-import { parseStackCommandLines } from './stack-command.js';
 import { composeStackCityPresentation } from './stack-city-presentation.js';
-import { composeStackDeployment, parseStackDeploymentLines } from './stack-deployment.js';
 import { resolveStackPieces } from './stack-composition.js';
 import {
   composeStackEnvironmentDefaults,
@@ -19,11 +17,12 @@ import {
   composeStackEnvironmentFiles,
   parseStackEnvironmentFileLines,
 } from './stack-environment-files.js';
-import { composeStackLaunchTargets, parseStackLaunchLines } from './stack-launch.js';
 import {
-  composeStackWorkspaceSetup,
-  parseStackWorkspaceSetupLines,
-} from './stack-workspace-setup.js';
+  composeStackSections,
+  opaqueStackSections,
+  trimStackSectionLines,
+} from './stack-section.js';
+import { parseStackVerificationLines } from './stack-verification.js';
 import {
   applyStackPieceCustomization,
   normalizeStackPieceId,
@@ -42,10 +41,7 @@ const STACK_SECTIONS = new Set([
   'Resources',
   'Environment defaults',
   'Environment files',
-  'Workspace setup',
-  'Commands',
-  'Deployment',
-  'Launch',
+  'Verification',
 ]);
 const STACK_CUSTOMIZATION_ROOT = 'genesis/stack';
 
@@ -59,8 +55,8 @@ function parseSections(source) {
   for (const line of lines) {
     const heading = line.match(/^##\s+(.+?)\s*$/u);
     if (heading) {
-      if (!STACK_SECTIONS.has(heading[1]) || sections.has(heading[1])) {
-        throw new GenesisError('STACK_INVALID', `Unknown or duplicate Stack section: ${heading[1]}.`);
+      if (sections.has(heading[1])) {
+        throw new GenesisError('STACK_INVALID', `Duplicate Stack section: ${heading[1]}.`);
       }
       current = [];
       sections.set(heading[1], current);
@@ -69,6 +65,9 @@ function parseSections(source) {
       throw new GenesisError('STACK_INVALID', `${STACK_PATH} contains content outside a Stack section.`);
     }
   }
+  if (!sections.has('Components')) {
+    throw new GenesisError('STACK_INVALID', `${STACK_PATH} needs one \`## Components\` section.`);
+  }
   return sections;
 }
 
@@ -123,23 +122,14 @@ function knownPieces(resolution) {
   return resolution.pieces;
 }
 
-function withoutOuterBlankLines(lines = []) {
-  const result = [...lines];
-  while (result[0]?.trim() === '') result.shift();
-  while (result.at(-1)?.trim() === '') result.pop();
-  return result;
-}
-
 function renderStack({
-  commandLines = [],
   componentIds: componentIdsValue,
-  deploymentLines = null,
   environmentDefaultLines = null,
   environmentFileLines = null,
-  launchLines = null,
   resourceLines = null,
+  extensionSections = [],
   stackPackages = [],
-  workspaceSetupLines = null,
+  verificationLines = [],
 }) {
   return [
     '# Stack',
@@ -151,21 +141,17 @@ function renderStack({
     ...componentIdsValue.map((id) => `- \`${id}\``),
     ...(resourceLines === null
       ? []
-      : ['', '## Resources', '', ...withoutOuterBlankLines(resourceLines)]),
+      : ['', '## Resources', '', ...trimStackSectionLines(resourceLines)]),
     ...(environmentDefaultLines === null
       ? []
-      : ['', '## Environment defaults', '', ...withoutOuterBlankLines(environmentDefaultLines)]),
+      : ['', '## Environment defaults', '', ...trimStackSectionLines(environmentDefaultLines)]),
     ...(environmentFileLines === null
       ? []
-      : ['', '## Environment files', '', ...withoutOuterBlankLines(environmentFileLines)]),
-    ...(workspaceSetupLines === null
-      ? []
-      : ['', '## Workspace setup', '', ...withoutOuterBlankLines(workspaceSetupLines)]),
-    ...(commandLines.length > 0 ? ['', '## Commands', ...commandLines] : []),
-    ...(launchLines === null ? [] : ['', '## Launch', '', ...withoutOuterBlankLines(launchLines)]),
-    ...(deploymentLines === null
-      ? []
-      : ['', '## Deployment', '', ...withoutOuterBlankLines(deploymentLines)]),
+      : ['', '## Environment files', '', ...trimStackSectionLines(environmentFileLines)]),
+    ...(verificationLines.length > 0 ? ['', '## Verification', ...verificationLines] : []),
+    ...extensionSections.flatMap(({ name, lines }) => (
+      ['', `## ${name}`, '', ...trimStackSectionLines(lines)]
+    )),
     '',
   ].join('\n');
 }
@@ -203,7 +189,10 @@ export async function addStackPieces({ pieces, projectRoot, stackPackages = [] }
     ...declaredPackages,
     ...selectedPieces.map(({ stackPackage }) => stackPackage).filter(Boolean),
   ])].sort();
-  const commandLines = parseStackCommandLines(sections.get('Commands') || [], { path: STACK_PATH })
+  const verificationLines = parseStackVerificationLines(
+    sections.get('Verification') || [],
+    { path: STACK_PATH },
+  )
     .map(({ label, argv }) => `- Verify \`${label}\`: ${argv.map((value) => `\`${value}\``).join(' ')}`);
   const resourceLines = sections.has('Resources') ? sections.get('Resources') : null;
   parseStackResourceLines(resourceLines === null ? undefined : resourceLines, { path: STACK_PATH });
@@ -221,30 +210,15 @@ export async function addStackPieces({ pieces, projectRoot, stackPackages = [] }
     environmentFileLines === null ? undefined : environmentFileLines,
     { path: STACK_PATH },
   );
-  const launchLines = sections.has('Launch') ? sections.get('Launch') : null;
-  parseStackLaunchLines(launchLines === null ? undefined : launchLines, { path: STACK_PATH });
-  const deploymentLines = sections.has('Deployment') ? sections.get('Deployment') : null;
-  parseStackDeploymentLines(
-    deploymentLines === null ? undefined : deploymentLines,
-    { path: STACK_PATH },
-  );
-  const workspaceSetupLines = sections.has('Workspace setup')
-    ? sections.get('Workspace setup')
-    : null;
-  parseStackWorkspaceSetupLines(
-    workspaceSetupLines === null ? undefined : workspaceSetupLines,
-    { path: STACK_PATH },
-  );
+  const extensionSections = opaqueStackSections(sections, STACK_SECTIONS);
   const rendered = renderStack({
-    commandLines,
     componentIds: selected,
-    deploymentLines,
     environmentDefaultLines,
     environmentFileLines,
-    launchLines,
     resourceLines,
+    extensionSections,
     stackPackages: selectedPackages,
-    workspaceSetupLines,
+    verificationLines,
   });
   const stackChanged = rendered !== source;
   if (stackChanged) await writeFileAtomic(location, rendered);
@@ -267,7 +241,7 @@ export async function addStackPieces({ pieces, projectRoot, stackPackages = [] }
   };
 }
 
-function distinctCommands(commands) {
+function distinctVerificationCommands(commands) {
   const seen = new Set();
   return commands.filter((command) => {
     const key = JSON.stringify([command.label, command.argv]);
@@ -331,12 +305,16 @@ export async function readStack(projectRoot, { stackPackages = [] } = {}) {
     catalog,
     requested: componentIds(sections),
   })).map((piece) => customizePiece(projectRoot, piece)));
-  const projectCommands = parseStackCommandLines(
-    sections.get('Commands') || [],
+  const projectVerificationCommands = parseStackVerificationLines(
+    sections.get('Verification') || [],
     { path: STACK_PATH },
   ).map(({ line: _line, ...command }) => command);
-  const componentCommands = components.flatMap((piece) => piece.commands);
-  const commands = distinctCommands(projectCommands.length > 0 ? projectCommands : componentCommands);
+  const componentVerificationCommands = components.flatMap((piece) => piece.verificationCommands);
+  const verificationCommands = distinctVerificationCommands(
+    projectVerificationCommands.length > 0
+      ? projectVerificationCommands
+      : componentVerificationCommands,
+  );
   const cityPresentation = composeStackCityPresentation(components);
   const projectResources = sections.has('Resources')
     ? parseStackResourceLines(sections.get('Resources'), { path: STACK_PATH })
@@ -356,21 +334,10 @@ export async function readStack(projectRoot, { stackPackages = [] } = {}) {
     { path: STACK_PATH },
   );
   const environmentFiles = composeStackEnvironmentFiles(components, projectEnvironmentFiles);
-  const projectLaunch = parseStackLaunchLines(
-    sections.has('Launch') ? sections.get('Launch') : undefined,
-    { path: STACK_PATH },
-  );
-  const launchTargets = composeStackLaunchTargets(components, projectLaunch);
-  const projectDeployment = parseStackDeploymentLines(
-    sections.has('Deployment') ? sections.get('Deployment') : undefined,
-    { path: STACK_PATH },
-  );
-  const deployment = composeStackDeployment(components, projectDeployment);
-  const projectWorkspaceSetup = parseStackWorkspaceSetupLines(
-    sections.has('Workspace setup') ? sections.get('Workspace setup') : undefined,
-    { path: STACK_PATH },
+  const extensions = composeStackSections(
+    components,
+    opaqueStackSections(sections, STACK_SECTIONS),
   );
-  const workspaceSetup = composeStackWorkspaceSetup(components, projectWorkspaceSetup);
   return {
     path: STACK_PATH,
     identityHash: sha256(stableJson({
@@ -378,24 +345,20 @@ export async function readStack(projectRoot, { stackPackages = [] } = {}) {
       components: components.map(({ id }) => id),
       cityExclusions: cityPresentation.exclusions,
       cityRegions: cityPresentation.regions,
-      commands: commands.map(({ label, argv }) => ({ label, argv })),
+      verificationCommands: verificationCommands.map(({ label, argv }) => ({ label, argv })),
       environmentDefaults,
       environmentFiles,
-      launchTargets,
-      deployment,
+      extensions,
       resources,
-      workspaceSetup,
     })),
     components,
     stackPackages: declaredPackages,
     cityExclusions: cityPresentation.exclusions,
     cityRegions: cityPresentation.regions,
-    commands,
+    verificationCommands,
     environmentDefaults,
     environmentFiles,
-    launchTargets,
-    deployment,
-    workspaceSetup,
+    extensions,
     resources,
     guidance: composedProse(components, 'guidance'),
     adoption: composedProse(components, 'adoption'),
@@ -415,12 +378,15 @@ export function stackPromptContext(stack) {
     })),
     cityExclusions: stack.cityExclusions,
     cityRegions: stack.cityRegions,
-    verifyCommands: stack.commands.map(({ label, argv }) => ({ label, argv })),
+    verificationCommands: stack.verificationCommands.map(({ label, argv }) => ({ label, argv })),
     environmentDefaults: stack.environmentDefaults,
     resources: stack.resources,
     environmentFiles: stack.environmentFiles,
-    launchTargets: stack.launchTargets,
-    deployment: stack.deployment,
-    workspaceSetup: stack.workspaceSetup,
+    extensions: stack.extensions.map(({ name, source, lines, diagnostics }) => ({
+      name,
+      source,
+      content: lines.join('\n'),
+      diagnostics,
+    })),
   };
 }

package/src/index/verification.js

@@ -5,7 +5,6 @@ import { clearVerification, writeVerification } from './project-state.js';
 import { withStackEnvironmentDefaults } from './stack-environment-defaults.js';
 import { missingStackResources } from './stack-preflight.js';
 import { readStack } from './stack.js';
-import { inspectWorkspaceSetupForStack } from './workspace-setup.js';
 import { GENESIS_CONTRACTS } from './contracts.js';
 
 const DEFAULT_FINITE_COMMAND_TIMEOUT_MS = 30 * 60 * 1_000;
@@ -25,28 +24,6 @@ export async function verifyProject({
 } = {}) {
   const root = (await gitContext(projectRoot)).repositoryRoot;
   const stack = await readStack(root, { stackPackages });
-  const workspaceSetup = await inspectWorkspaceSetupForStack({ projectRoot: root, stack });
-  if (workspaceSetup.status === 'blocked') {
-    return {
-      contract: GENESIS_CONTRACTS.verification,
-      status: 'blocked',
-      summary: workspaceSetup.diagnostics.map(({ message }) => message).join(' '),
-      commands: [],
-      diagnostics: workspaceSetup.diagnostics,
-    };
-  }
-  const waiting = workspaceSetup.diagnostics.filter(
-    ({ code }) => code === 'STACK_WORKSPACE_SETUP_WAITING',
-  );
-  if (waiting.length > 0) {
-    return {
-      contract: GENESIS_CONTRACTS.verification,
-      status: 'unconfigured',
-      summary: waiting.map(({ message }) => message).join(' '),
-      commands: [],
-      diagnostics: waiting,
-    };
-  }
   const resolvedEnvironment = withStackEnvironmentDefaults(
     environment,
     stack.environmentDefaults,
@@ -64,7 +41,7 @@ export async function verifyProject({
       diagnostics: missing,
     };
   }
-  if (stack.commands.length === 0) {
+  if (stack.verificationCommands.length === 0) {
     return {
       contract: GENESIS_CONTRACTS.verification,
       status: 'unconfigured',
@@ -77,7 +54,7 @@ export async function verifyProject({
   await clearVerification(root);
   try {
     const commands = [];
-    for (const command of stack.commands) {
+    for (const command of stack.verificationCommands) {
       await emit(onEvent, {
         type: 'genesis.verification',
         code: 'VERIFICATION_STARTED',

package/src/index.js

@@ -8,15 +8,10 @@ import { generateProjectPrompt } from './index/prompt.js';
 import { initializeProject } from './index/init.js';
 import { installCodexPlugin } from './index/codex-plugin.js';
 import { inspectProjectEnvironment } from './index/environment-files.js';
-import { inspectProjectDeployment } from './index/deployment.js';
-import { inspectProjectLaunch } from './index/launch.js';
+import { inspectProjectStackSection } from './index/stack-section-inspection.js';
 import { listStackCatalogPieces } from './index/stack-catalog.js';
 import { addStackPieces, readStack } from './index/stack.js';
 import { verifyProject } from './index/verification.js';
-import {
-  inspectProjectWorkspaceSetup,
-  prepareProjectWorkspace,
-} from './index/workspace-setup.js';
 
 export { GENESIS_CONTRACTS };
 
@@ -95,24 +90,12 @@ export async function listStackPieces({
   });
 }
 
-export function inspectLaunch(options) {
-  return inspectProjectLaunch(options);
-}
-
 export function inspectEnvironment(options) {
   return inspectProjectEnvironment(options);
 }
 
-export function inspectDeployment(options) {
-  return inspectProjectDeployment(options);
-}
-
-export function inspectWorkspaceSetup(options) {
-  return inspectProjectWorkspaceSetup(options);
-}
-
-export function prepareWorkspace(options) {
-  return prepareProjectWorkspace(options);
+export function inspectStackSection(options) {
+  return inspectProjectStackSection(options);
 }
 
 export function generatePrompt(options) {

package/docs/preview-identity-command.md

@@ -1,113 +0,0 @@
-# Preview identity command protocol
-
-`genesis.preview-identity.command.v1` lets an application expose its ordinary
-development sign-in and sign-out behavior to any preview host. It is language-
-and framework-neutral: `tools/preview-identity` may be a native C/C++ binary, a
-script, or another committed executable supported by the target's declared
-runtimes.
-
-Genesis only validates and reports the declaration. The preview host resolves
-the command beneath the project root, rejects traversal and symlinks, supplies
-the declared runtime and environment policy, enforces the declared timeout,
-and controls the browser. The application owns user lookup and its normal
-session cookies.
-
-## Invocation
-
-The host runs the exact declared argv with the project root as the working
-directory. Standard input contains exactly one UTF-8 JSON object followed by a
-newline and EOF. Standard output contains exactly one JSON object; diagnostic
-logs belong on standard error. There is no streaming or multi-message framing.
-
-The host supplies a fresh opaque `requestId`. A sign-in request is:
-
-```json
-{
-  "protocol": "genesis.preview-identity.command.v1",
-  "requestId": "opaque-request-id",
-  "operation": "login-as",
-  "subject": {
-    "kind": "selector",
-    "selector": {
-      "type": "email",
-      "value": "person@example.com"
-    }
-  },
-  "target": {
-    "href": "http://127.0.0.1:4100/home",
-    "origin": "http://127.0.0.1:4100"
-  }
-}
-```
-
-`subject.selector.type` must be one of the identity types advertised by the
-Launch declaration: `email`, `login`, or `user-id`. The application treats the
-selector as an existing application identity; a preview host does not create
-users, memberships, roles, or seed data.
-
-Sign-out uses the same envelope with `operation` set to `logout` and omits
-`subject`.
-
-## Responses
-
-Every protocol response repeats the exact `protocol` and `requestId` and exits
-with status zero. A successful sign-in response is:
-
-```json
-{
-  "protocol": "genesis.preview-identity.command.v1",
-  "requestId": "opaque-request-id",
-  "ok": true,
-  "signedOut": false,
-  "identity": {
-    "displayName": "Person",
-    "email": "person@example.com",
-    "userId": "42"
-  },
-  "setCookie": [
-    "app_session=opaque; Path=/; HttpOnly; SameSite=Lax"
-  ]
-}
-```
-
-`identity` contains at least one non-empty application identifier. Supported
-descriptive fields are `displayName`, `email`, `login`, `userId`, and
-`username`. `setCookie` contains the application's ordinary Set-Cookie header
-values. Cookies must contain no CR/LF or `Domain` attribute; the host may reject
-additional cookie names reserved by its own preview transport.
-
-A successful logout sets `signedOut` to true, omits `identity`, and returns the
-cookie expirations needed to clear the application's session. A structured
-application rejection still exits zero and uses:
-
-```json
-{
-  "protocol": "genesis.preview-identity.command.v1",
-  "requestId": "opaque-request-id",
-  "ok": false,
-  "code": "user_not_found",
-  "error": "User not found.",
-  "statusCode": 404,
-  "signedOut": true,
-  "setCookie": []
-}
-```
-
-`statusCode` is an integer from 400 through 599. A malformed request, command
-crash, timeout, nonzero exit, invalid JSON, mismatched request ID, oversized
-output, or invalid cookie is a command/transport failure rather than an
-application rejection. Hosts should bound output to 512 KiB, at most 64
-cookies, and at most 16 KiB per cookie.
-
-## Environment and safety
-
-The optional Enabled and Secret environment entries in the Launch declaration
-are application-owned variable names, never values. A host that offers identity
-switching supplies `true` through the enabled name and a fresh launch-scoped
-secret through the secret name. The helper and any private application endpoint
-it calls must remain disabled unless those values are present and valid.
-
-The command is a development-preview control, not a production sign-in API.
-Genesis does not store selectors, generate credentials, materialize environment
-files, execute the helper, or decide which identities a host is allowed to
-offer.

package/src/index/deployment.js

@@ -1,34 +0,0 @@
-import { gitContext } from './git.js';
-import { readStack } from './stack.js';
-import { sha256, stableJson, uniqueSorted } from './utils.js';
-import { GENESIS_CONTRACTS } from './contracts.js';
-
-/** Read the Stack's production recipe without provisioning or publishing anything. */
-export async function inspectProjectDeployment({ projectRoot, stackPackages = [] } = {}) {
-  const root = (await gitContext(projectRoot)).repositoryRoot;
-  const stack = await readStack(root, { stackPackages });
-  const diagnostics = [...stack.deployment.diagnostics];
-  let status = 'unconfigured';
-  if (diagnostics.length > 0) status = 'blocked';
-  else if (stack.deployment.steps.length > 0) status = 'ready';
-  const recipe = {
-    version: stack.deployment.version,
-    artifact: stack.deployment.artifact,
-    workdir: stack.deployment.workdir,
-    runtimeRequirements: stack.deployment.runtimeRequirements,
-    readiness: stack.deployment.readiness,
-    steps: stack.deployment.steps,
-  };
-  return {
-    contract: GENESIS_CONTRACTS.deployment,
-    status,
-    stackHash: stack.identityHash,
-    recipeHash: status === 'ready' ? sha256(stableJson(recipe)) : '',
-    components: stack.components.map(({ id }) => id),
-    source: stack.deployment.source,
-    runtimeRequirements: uniqueSorted(stack.deployment.runtimeRequirements),
-    resources: stack.resources,
-    ...recipe,
-    diagnostics,
-  };
-}

package/src/index/launch.js

@@ -1,42 +0,0 @@
-import { gitContext } from './git.js';
-import { missingStackResources } from './stack-preflight.js';
-import { withStackEnvironmentDefaults } from './stack-environment-defaults.js';
-import { readStack } from './stack.js';
-import { uniqueSorted } from './utils.js';
-import { GENESIS_CONTRACTS } from './contracts.js';
-
-/** Read the Stack's launch declaration without choosing or starting a runtime. */
-export async function inspectProjectLaunch({
-  environment = process.env,
-  projectRoot,
-  stackPackages = [],
-} = {}) {
-  const root = (await gitContext(projectRoot)).repositoryRoot;
-  const stack = await readStack(root, { stackPackages });
-  const diagnostics = missingStackResources({
-    environment: withStackEnvironmentDefaults(environment, stack.environmentDefaults),
-    resources: stack.resources,
-  });
-  const disabledReason = diagnostics.length === 0
-    ? null
-    : diagnostics.map(({ message }) => message).join(' ');
-  const targets = stack.launchTargets.map((target) => ({
-    ...target,
-    available: diagnostics.length === 0,
-    disabledReason,
-  }));
-  let status = 'ready';
-  if (targets.length === 0) status = 'unconfigured';
-  else if (diagnostics.length > 0) status = 'blocked';
-  return {
-    contract: GENESIS_CONTRACTS.launch,
-    status,
-    stackHash: stack.identityHash,
-    components: stack.components.map(({ id }) => id),
-    environmentDefaults: stack.environmentDefaults,
-    runtimeRequirements: uniqueSorted(targets.flatMap((target) => target.runtimeRequirements)),
-    resources: stack.resources,
-    targets,
-    diagnostics,
-  };
-}

package/src/index/stack-command.js

@@ -1,65 +0,0 @@
-import { GenesisError } from './errors.js';
-import { isSafeProcessExecutable, parseBacktickedArguments } from './stack-process.js';
-
-function commandDiagnostic(stackPath, message, line, details = {}) {
-  throw new GenesisError(
-    'STACK_COMMANDS_INVALID',
-    message,
-    {
-      path: stackPath,
-      ...(line === undefined ? {} : { line }),
-      ...details,
-    },
-  );
-}
-
-export function parseStackCommandLines(lines, { path: stackPath } = {}) {
-  const commands = [];
-
-  for (let index = 0; index < lines.length; index += 1) {
-    const source = lines[index];
-    const line = index + 1;
-    if (!source.trim()) continue;
-    const entry = source.match(/^- Verify `([^`\r\n]+)`:[ \t]+(.+)$/u);
-    if (!entry) {
-      commandDiagnostic(
-        stackPath,
-        'Every Commands entry must use `- Verify `label`: `command` `argument`...`.',
-        line,
-        { observed: source },
-      );
-    }
-
-    const tokenSource = entry[2].trim();
-    const argv = parseBacktickedArguments(tokenSource);
-    if (!argv) {
-      commandDiagnostic(
-        stackPath,
-        'Every command and argument must be one separate non-empty backticked value.',
-        line,
-        { observed: source },
-      );
-    }
-
-    const command = argv[0];
-    if (
-      argv.some((value) => value.includes('\0'))
-      || !isSafeProcessExecutable(command)
-    ) {
-      commandDiagnostic(
-        stackPath,
-        'A stack command executable must be a PATH name or project-relative path without traversal.',
-        line,
-        { command },
-      );
-    }
-
-    commands.push({
-      label: entry[1],
-      argv,
-      line,
-    });
-  }
-
-  return commands;
-}