chore: ignore feature worktrees

.agents/skills/replace-production-database/SKILL.md

@@ -1,32 +1,53 @@
 ---
 name: replace-production-database
-description: Replace the populated SHD.build production database with a local full bootstrap bundle after verified backups. Use only when the user explicitly authorizes replacement of all production data.
+description:
+  Replace the populated SHD.build production database with a local full
+  bootstrap bundle after verified backups. Use only when the user explicitly
+  authorizes replacement of all production data.
 ---
 
 # Replace Production Database
 
-This procedure overwrites production users, sessions, builds, guides, audits, proposals, settings, and source data. Obtain explicit approval for a full replacement. Use the ISAC import flow when the request only concerns canonical game data.
+This procedure overwrites production users, sessions, builds, guides, audits,
+proposals, settings, and source data. Obtain explicit approval for a full
+replacement. Use the ISAC import flow when the request only concerns canonical
+game data.
 
 ## Export
 
-1. Stop only this repository's local development server. The embedded database must be closed during export.
-2. Run `npm run production:bootstrap:export`. Record the generated bundle beneath `data/backups/`; it includes private account data and uploaded assets.
-3. Transfer the bundle to `f302` over SSH. Keep it outside Git and confirm the remote copy is nonempty.
+1. Stop only this repository's local development server. The embedded database
+   must be closed during export.
+2. Run `npm run production:bootstrap:export`. Record the generated bundle
+   beneath `data/backups/`; it includes private account data and uploaded
+   assets.
+3. Transfer the bundle to `f302` over SSH. Keep it outside Git and confirm the
+   remote copy is nonempty.
 
 ## Replace
 
-1. Confirm the current production deployment is healthy and no Gitea production deployment is running.
-2. On `f302`, stop only the production `app` and `scheduler` services from `/opt/shd-build-production`.
-3. Run `node scripts/db-backup.mjs` through the production Compose service. Record and retain the JSON backup path before any destructive work.
-4. Reset the production database file and its embedded-database support files. Keep the persistent volume and existing upload directories; the import writes the local avatar and managed-image files without deleting retained files.
-5. Run `node scripts/db-migrate.mjs` through the production Compose service to create the current empty schema.
-6. Run `environment-bootstrap-import.mjs` with `ALLOW_PRODUCTION_BOOTSTRAP=true`, the copied bundle mounted read-only, `--target production`, and `--confirm-empty-target-replace`.
-7. Start `app` and `scheduler`, wait for app health, then remove the remote transfer bundle.
+1. Confirm the current production deployment is healthy and no Gitea production
+   deployment is running.
+2. On `f302`, stop only the production `app` and `scheduler` services from
+   `/opt/shd-build-production`.
+3. Run `node scripts/db-backup.mjs` through the production Compose service.
+   Record and retain the JSON backup path before any destructive work.
+4. Reset the production database file and its embedded-database support files.
+   Keep the persistent volume and existing upload directories; the import writes
+   the local avatar and managed-image files without deleting retained files.
+5. Run `node scripts/db-migrate.mjs` through the production Compose service to
+   create the current empty schema.
+6. Run `/opt/shd-build-production/bootstrap-production.sh <bundle-path>`. The
+   script stages the bundle in the private data volume, assigns it to the
+   runtime UID, runs `environment-bootstrap-import.mjs` with the required
+   confirmation, removes the staged copy, and restarts both services.
+7. Wait for app health, then remove the remote transfer bundle.
 
 ## Verify
 
-1. Confirm the importer reports the expected row, avatar, and managed-image counts.
-2. Confirm `https://shd.build/api/health` returns `ready: true` with an `ok` database check.
+1. Confirm the importer reports the expected row, avatar, and managed-image
+   counts.
+2. Confirm `https://shd.build/api/health` returns `ready: true` with an `ok`
+   database check.
 3. Confirm the production app container is healthy and its scheduler is running.
 4. Restart the local development server and verify it accepts an HTTP request.
 
@@ -35,4 +56,5 @@ This procedure overwrites production users, sessions, builds, guides, audits, pr
 - Never replace a populated production database without explicit user approval.
 - Never delete the production Compose volume.
 - Do not replace the database while the app or scheduler can write to it.
-- Keep the verified pre-replacement backup. It is the recovery source if the import or restart fails.
+- Keep the verified pre-replacement backup. It is the recovery source if the
+  import or restart fails.

.codex/hooks.json

@@ -1,29 +0,0 @@
-{
-  "hooks": {
-    "PostToolUse": [
-      {
-        "matcher": "Edit|Write|apply_patch",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "[ ! -f \".agents/skills/impeccable/scripts/hook.mjs\" ] || node \".agents/skills/impeccable/scripts/hook.mjs\"",
-            "timeout": 5,
-            "statusMessage": "Checking UI changes"
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "[ ! -f \".agents/skills/impeccable/scripts/hook.mjs\" ] || node \".agents/skills/impeccable/scripts/hook.mjs\"",
-            "timeout": 30,
-            "statusMessage": "Design deep pass"
-          }
-        ]
-      }
-    ]
-  }
-}

.env.development

@@ -1,32 +0,0 @@
-#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
-#/            public-key encryption for .env files          /
-#/       [how it works](https://dotenvx.com/encryption)     /
-#/----------------------------------------------------------/
-DOTENV_PUBLIC_KEY_DEVELOPMENT="038fa4f9f7abd799fabebc69cb4d6a42a2ea361c3ec799580ddd213bcafac5c167"
-
-# .env.development
-# Server-only OpenAI access for the permission-gated ISAC mechanic authoring
-# assistant. Use a project-scoped, Responses-only restricted key.
-OPENAI_MECHANIC_API_KEY=encrypted:BGRKl6pMDudJdr4yvye51GWuIsyjPfgarjsyxFnDs/HdgcRPdttk7nNz/40TEdfHidyaWHvag6HkM46zG/37VEhFpZ5N3iPPJmKV1a43NaAZNUeOP0dy6ct8UmOd6gEjDK9U6wzrjczRijgAffZ3GDyKyxkeDrn+8PHjng/0sXL78tpPr4p040cTEfSyet/XRsIUqeiV/6euS60afbnyzfOMUJ5liPdXK4VoJh6iLCsVrpmoNZ+rB5FMd65vpdSXOy6MKoG25aGq/1gtC5JOBiknrSE4vYGnuMriczklJviEBma+4rKMTSLTBOnYnHzpsuDC7+Tcft9VcluvNgcy0McGDExm
-OPENAI_MECHANIC_MODEL=encrypted:BCCIuv04UwV44nzKVT3X7PpzbUJofJXPj/X2EYqErcSxedHh7IDAszLKgrBL+uzAT3xLOYS8lhOYfaFl/GaI12oOWAiZV2pijxRjpOE5Zv6X9wFJ7c+su44IRa7GIXF8wwnfWnSwSAg1S6kdS98=
-OPENAI_MECHANIC_REASONING_EFFORT=encrypted:BDOTlCFCvs30g+to1IJD9aFhfPqrVPTccpRJKiUyywAm0ojSihpUL12guVnvjLG9NR2MrzkV1icqviDSR4yqsPC6Zz+Llf3KId4IBMXCa+OIUd+KOCM1AN3adoU9ZcBOIxuKZf6XTg==
-
-TDR_DATABASE_PATH=encrypted:BHzbwoU8Nc6yeHEwxLKFt08YVpz0+IRDBaRRu8mZlKtoi3R7qDOriv1+mIwLxkuZg+n8k7hGf9XhEipvfhbhx/N2sMcvsnVcrZfLIWItcNfrq9O8XmxE5oQpIQiYz/Osm9vclOeu06C6MwykowCtksIQD2xtCLLHInFPa8pJ0M0=
-DISCORD_CLIENT_ID=encrypted:BAUbUqppB9HUQocELaV74nB1Ot6blLFNZ+640X8QLX5VWDzhABsw8JluD34L0ooYZve794HZH8ZFSn/zcvOsgSbGOdte9RQAa0YZpSz3Ih+TAmCvNUWg59A7iE2O1jCB5IEsCrRGbg4UslnP+I9ZHgnjRKo=
-DISCORD_CLIENT_SECRET=encrypted:BA6jiQ2ws/e+y08nRwx2hyH2IlKBOjYVi+kk4gcYH6YyEvGw7HwIMRJ/n5eQx/IQB3KNDnklwL7x9XNGaq2Ht2UOHfrV+HFjPrTy/Kwt6retmMkfrA3PYJ7PdI+SlxE+hzvhYLvBJz6q1IcpRH09gz/x4jYeJPqD/LvPSKU2RlQ9
-DISCORD_REDIRECT_URI=encrypted:BJl92lm9C5zv7guW8O5faHE5t53c5orIMLte3TOOaMFMGcWlybqNuQEf6SmLfgwQ/AoAviJZDxOQRhRaKI5OR4s1r54Fbe2oHQBSlgcCyIKmACukOY9dg9nlpx/EkkvIY77hekCJhh/RfD3P5Os2OfSok7uiZxEGcagkA8H3/2KbpRUZSjWVEqNZjyM=
-
-# Passwordless authentication
-APP_ORIGIN=encrypted:BBjQBgg8fXVjAjSrfzhAmuDuVRpvOlrKZTGqInncSwhJENhUs1EN/mBOlD769tAWEiNQ19mdDhIN1Dsiuu9Ps2VksDNdXjVNGwMYj3TRlX6v9wmzgODoCm6fvlseNJUQqXWSqEGgnrBzg90eg8bRMOzQMBByrA==
-PASSKEY_RP_ID=encrypted:BM8t3iboOCY37Mg3UfYG1b17shBtNvM1QhkPAQPEq6gHIZz5nWeLVIqkZiLdMP81fmyEjmpD4cpnHNffy81xMyqSvzYZfIQ1UhNAM5vJMc6aDB535fRNVRYyf4+zMbiRJtyc+010RN3kCw==
-
-# Shared SMTP account for magic-link and email-verification delivery.
-# Implicit TLS/SSL normally uses port 465. For STARTTLS on port 587, set
-# SMTP_SECURE=false.
-SMTP_HOST=encrypted:BE8dBQOkKsQuDh9SDx3CTyUOzQ8uuoDMlw4bCxQBs7apyg6P5FqZJIvEgnzCRHCo3dC7skgi/KDUDZI1stLX5A9tvlLvasCf2vGiMnn7NgG0e1nAYD1PiAnbQDmqfUcYBMLIWJibqIF96Yv1icnEcfNwkw==
-SMTP_PORT=encrypted:BKt0uerEl2/lqwev72twYoeI0lUZdXgONWB+Xm14ftBG/6vY8E2UiH+/+6Zrf2b8Y1D11PzsZqEGaCYCJ8v1PyDnAQrE0pC4WjiYCl9kCkqsFvtZQcWys3rm0Nu6zrV8s0pYPQ==
-SMTP_SECURE=encrypted:BFj5YB/gxpOwKdCrgUsydheEDV5aYAvtNMtLFSslYgsEkPLWe6nA1deQDXjVEwZxLC6iAgOgzxErRbem8nK5BNFfwpMuwwily+NQWZgPYMu7gD+BPmT9BMNvJkJvCwHEPj6Q6AT1
-SMTP_USER=encrypted:BC7+7c4vy1aS9mkuOaYZbxOdgZunja8UCz3P+ap+ZMK6qqV5KXvp+DPVvtJvVyCZejisS15LFsL+1VCeiD8hYyFKBrE2YJ+kx1hDwNezVMr1Dza548b9dXeMLh7Is6MjN5XBLLUjk2HcqgeXZ8WOmx01Dg==
-SMTP_PASSWORD=encrypted:BOgcw3hrxXlMuQ92RNr+3M+myxlpd8lAtieebwXMsRQKiqLAKSDz3x0VXetvC2foMJ/KIEzTqM5scqkUA7dnm1/tQe0N3dG3ZZFzYIMz90Q0I5/XPWzli6cGtexoujswpkfnAa4EeGlvNEAhOYQrciU=
-SMTP_FROM=encrypted:BGrMEhbploGfX29mvT+8XjgxvXK/QNjzr4CbAywkDyJmZ2xlscDbLC3+UoRSanGMdbVHvbDbYx6wG8M3MQ2QeIknf2AB75LpeeIVquSWa+u6OQBHmiRgEXWRuQJ7leTahd+B+E87gCpVtC3yFcHUtW3STyV1ZyidQJVwsI4HmQ==
-REMOVE_BG_API_KEY=encrypted:BFeraOe9tiw3wCooTZ2ZE0qG9dDwqlpzq3HpEA0J+2LGckZSUxYP4f1Po1LNqWWihX+TzACONzHDhgjSaNq9XTMdjitYw7bEFehQQxsVi5iiJ/C6ZsN9M6vNIRP0FH+SfcYvFI41KJbSNOBFIX4zm5Y8hxG0aFJKkA==

.env.example

@@ -1,3 +1,6 @@
+# Infisical secret inventory. This file contains names and safe defaults only;
+# the application does not load it. Store values under /app unless noted.
+
 # Server-only OpenAI access for the permission-gated ISAC mechanic and
 # calculation authoring assistants. Use a project-scoped, Responses-only restricted key.
 OPENAI_MECHANIC_API_KEY=
@@ -13,7 +16,8 @@ TDR_DATABASE_PATH=./data/shd-build-development.db
 # Persistent directory for normalized user-uploaded avatars.
 TDR_AVATAR_STORAGE_PATH=./data/avatars
 
-# Persistent directory for uploaded talent, brand, protocol, and skill-chip icons.
+# Persistent directory for game-data icons and managed library images, including
+# weapons, gear, mods, talents, brands, protocols, Skill Chips, and Specializations.
 TDR_GAME_ICON_STORAGE_PATH=./data/game-icons
 
 # Optional fixed credentials used only when initializing or explicitly resetting
@@ -25,6 +29,7 @@ DEFAULT_USER_PASSWORD=
 DISCORD_CLIENT_ID=
 DISCORD_CLIENT_SECRET=
 # Proxied development: https://dev.shd.build/auth/discord/callback
+# Staging: https://stage.shd.build/auth/discord/callback
 # Production: https://shd.build/auth/discord/callback
 DISCORD_REDIRECT_URI=https://dev.shd.build/auth/discord/callback
 
@@ -45,9 +50,14 @@ SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM=SHD.build <no-reply@shd.build>
 
-# Long random bearer token used only by the internal container scheduler.
-SCHEDULER_TOKEN=
+# Cloudflare Turnstile challenge keys for anonymous Guide activity.
+TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
+
 REMOVE_BG_API_KEY=
 REMOVE_BG_LOW_CREDIT_THRESHOLD=5
 REMOVE_BG_LOW_FREE_CALL_THRESHOLD=10
 REMOVE_BG_CREDIT_CHECK_HOURS=6
+
+# /shared/scheduler
+SCHEDULER_TOKEN=

.env.production

@@ -1,32 +0,0 @@
-#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
-#/            public-key encryption for .env files          /
-#/       [how it works](https://dotenvx.com/encryption)     /
-#/----------------------------------------------------------/
-DOTENV_PUBLIC_KEY_PRODUCTION="034d799df86cb16852742f1b2a42c69dde86396ddce96448c429c6ba68034a331d"
-
-# .env.production
-# Server-only OpenAI access for the permission-gated ISAC mechanic authoring
-# assistant. Use a project-scoped, Responses-only restricted key.
-OPENAI_MECHANIC_API_KEY=encrypted:BIQtxqHheOrBdpeabt1p2Y1+TCHQDIxp5DHpQMUsS5N8aqukt/IELJSKWo9LXaFXbExHFB/X7Z2WvuWSyLiSA1QyZeUnUwMxnaJiYCpPlM3gTGvvlw/6U9uPxPBO7dLwchTMtqX9Sfx+GSWFzojfPOsVNaUVBRjBy5VTSOLwxMw0LMI+oYGVDEbjR3k/74sHlGXQazN0mThk8NClPJg6BSkKuKKFQLBjc4RyWUm94SE9KZwqiZVkfQaMmn+a9zLvbfd4yZaG4Ae/sneIU1T+cYjqdYAT05kBf8DikJkaezC2dRvcZ8I7jsp08pt+xHj3UC4XgbDLK2IVyLO4C8ELP5g7vQVy
-OPENAI_MECHANIC_MODEL=encrypted:BLZffo6IeKN95zCneOq+FrdTjcjPF+vRkagV7pWAVgdusAK0OWR6B2bFqbqBuRVmos32uEWS4aP2GLrGpOr7gPlGDQTPu2EBAv4eT1OD5ewMC3lJFuqrXnr6j12bJOG8BUM3l+pMxwFBAXrDUew=
-OPENAI_MECHANIC_REASONING_EFFORT=encrypted:BOrPunzMR1atHilHR6MEXaUDEMyPI7gkhyF4bSO1byh2DqGGEyKcGxLf6A2vIOcFM38/k9g9QCxuth54B4Zs5mHE5MUmvj6g8nwDSfO/ae5lAmYLSCqj4MLaDQ2LcJ+vYDrJ8aLpfA==
-
-TDR_DATABASE_PATH=encrypted:BL1wSNLW9BwOyzX89x73UjkxbJIUsOgOGkvLUfBRCqAAL2T4OVccEzh9aTWmLNaEICj6L795Tyd3Up+OZQ34NxqASKKk3o7piwQj8hiRU6W89fLVlSSZxdgLGq2S5YUdm3a/h9Loa1H4iDkg0TxO+MEQ2Qu53GD8zxOYWSQuBQ==
-DISCORD_CLIENT_ID=encrypted:BB7n8VWz0GAV16Fkm7eJIfxI0a/rgHP1YakJ9XeiAvflWdYmndF5dvboOli+yLtuGCe+VqKUnzyLeQ7tk2YPQmMlkDXe75bhRkrLyPPvU0eg1DzhZ9ptU/qmmJZfrCQtT5o+/R61umVmfGkDB8nhpPkzqE8=
-DISCORD_CLIENT_SECRET=encrypted:BJbCD14+3ZJ9T9+y90Uh3ZgRn4zyOqA0ckN/H+A9JfyWGgM2R5PBP2bmOPPGwRZk1Lg2GOWsowox4nrZEmINuUYirLRaszm9sqVejYXWsJPsTiXbukW+4rgtDpW7ifVkajbu/QGb8NqQR0tPUzJMYM0U5at5NM7TrqKWuu+4cLHf
-DISCORD_REDIRECT_URI=encrypted:BKRD6GzZg6Qkt/ydrqkta4pUNlXNQzI4Kdq1ymn6qJH4O7NYVGE4J7MNO5biVsWPQuNU2ZG5qFatxzbbZMWT50x0o+A9wqmQ5XXt1kln8puHZsVOvOqSAI1z7mvWA+nuewv3vRDu0fchSsgSgFRjL1xwpp5tNac8DnvNaw0K/NlWHDdgZFIajQ==
-
-# Passwordless authentication
-APP_ORIGIN=encrypted:BCDOpIDmpg3cipvTGTD/2XFxazXZBJLLf0/Y/sUDdRoKTEaF3m1dh7H3Ep9gyvRSLcbXxVnu3vPBowE5L7/pB6S3KRkjfdwvEImgUmvpfFfkLXM1/AiWO3M1drkfB+0lx5x5ktbtuNpQ22bckMraFzyx
-PASSKEY_RP_ID=encrypted:BFyFsPV8oZCPkKROL0Lo8aDmKK+ay8jy5Z4HeYdkYvfF8e6eaaS29doIyXqEV0eeHEF/iFf5UspARhlf8To/lB1TE8KHXBiHAgfTVhur+tCN/TUzocH1jr1jnw77qykey5FXcoTKqD0+VQ==
-
-# Shared SMTP account for magic-link and email-verification delivery.
-# Implicit TLS/SSL normally uses port 465. For STARTTLS on port 587, set
-# SMTP_SECURE=false.
-SMTP_HOST=encrypted:BFenO3Hh63xJz6dcJrEmCM40VGjPV7Y+F0TVgRRWAGMeBbrYZddhoJi7hhHZXpIX6B3nrSvq7dWIL+0aPKPzyWMgBsj3AnlXx8qi19CejStRQBHTQPyGnlpAZJK4SyBv24RwpwUs19T/TcK8b1DCX3tHYg==
-SMTP_PORT=encrypted:BBxjsH6/dJcBap/sCS97SUPjuhuYSrFR1mqDvzaifCP52n/8jZ0+EYdkK0FcsU8ZhgHAWZ6vRkBjxr3nM39YXLEyATzbNF/tFZg29WGOk3kOxRhgemry0+kK2/UmZ9KUBTn3dQ==
-SMTP_SECURE=encrypted:BAnU6hfdVX2xiPtP183dGjofqmz50/lB4MBeuWoer4KjwOsQXh1b/jOrGACUY7IKD2ngi5IMNdAtcqIkxdQGEfXj9GvPnkOIMNSwFwKNafIsZpS137UGmZCW1XopXU5cID28iSY7
-SMTP_USER=encrypted:BMREkzkhV9Aa4E22SskfpcTt3zbGSPwhvRqTmfXlclta6FZtQD7Oy8rDifhNaMf78V3hJkoaXPk9bcZ8zZn2NnG72NPbRXxukn6LiLePhb78z24g4UiiHON2MP7jIz4pvhPCSET08N/Km5kfiMLvp8otQA==
-SMTP_PASSWORD=encrypted:BG39vFySsPvtm4AsuZZk5UbNaxHOOjxd8yffgsZebGNjxLY8aluuLf3/XMFquOz3bb59ZcyYSPv0Knp/N5c0vSHkl/ByC8WuQFTeLYH6BzpUADiVlGPE9Wg5Oa6dCOmianfRtHBUVrG1DC/BztBVYRg=
-SMTP_FROM=encrypted:BMGyxQY0VdtmVfyiRl7NoO6dz8Q2pqvx8CLXDX/ZS9FsE98SUynl2MeOrOU8Vjz55V+KcLfFUooZoYT5Ke46YfRGMmE0ke2OaDZxFCBnD0rv6Mm9sRqXdyTn0vUxhjXmqLFkef32hN6VvBNN+xlppwwwbgYTg6pwtx6LKBQ1eg==
-REMOVE_BG_API_KEY=encrypted:BLrlul9iafui2MD8NcqLYgwc2crtcC2HbXIX1QNDHy5sX2PMitvRCYOefEKzT6JmNXT2xvD0/uOKB7WTdKG1+qv7jVWl3IBK9wc2ftAtAWgESsUPy2mLKomXe8N04wz682om7EgwJ942294NWMWPLrWGYZCH1vOtog==

.env.staging

@@ -1,35 +0,0 @@
-#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
-#/            public-key encryption for .env files          /
-#/       [how it works](https://dotenvx.com/encryption)     /
-#/----------------------------------------------------------/
-DOTENV_PUBLIC_KEY_STAGING="020bab072314925eb9a9cbaf42282e3a0d5c4a8de3d88a51ed92b4b3c83d598f98"
-
-# .env.staging
-# Server-only OpenAI access for the permission-gated ISAC mechanic authoring
-# assistant. Use a project-scoped, Responses-only restricted key.
-OPENAI_MECHANIC_API_KEY=encrypted:BL4P5f594pMu3zF6onW128E+17uT7Vh7CwnpcAndHTNLAW3Vx3w99MawmLYZ17iiWgu6GF6ZzqavHpGgtTdYa1mU2zSwwfm5f0/gQP9lNM7KETdG8EIQfa167d3XixJu2EeW7Z17dTUEbEOOJ8xiI2HwsIZ/X37KEqYHZ0GJIzU0rXo4i6G17rHRs2OiByZL80ujQNsjU5lPHGnDikmAaSSczqtR0Q4/QmSd9EFDrRLIIGtDwqpCG8C4lV6JxRaU6SrfH+4GtUxSHyvITnsAAAzVVQ9yUmddmPkkfAdmAjz6XlrX5mdNnrjAJI9Z95RGTeCrwXCMI9ffulH84xxpXyXG+qez
-OPENAI_MECHANIC_MODEL=encrypted:BLyNUZ2WPB+jMJOqLoV/xAbd31RsrXbGkV2EChn0vy8rh5yVoqbUX2aoqsTU6mv7oP1NT3CAsC/YkfiJFJ2FEiH9GT8Ddrs43QFMBvU2c3AUlZGZJeQDEIoqjWqmt7I6EYeM5gFiaR4o/i2NEHk=
-OPENAI_MECHANIC_REASONING_EFFORT=encrypted:BHU/0x0Ez9jvwYPhmTCPh4ciVPYyVQTfjfCSb8zV2iNwH6c6LNkEs3omWXvA4wpUhNwub8z79/w4N2QGEnxOy/n8jFnhXqf+mI++niqmRXp8nuFXY0NUGF+THiZlssiKzIAyFXXeCQ==
-
-# Staging is deployed at https://stage.shd.build.
-TDR_DATABASE_PATH=encrypted:BAh41Twl5JvpTKOaxlfw2J8dMBqRy5ontNeIPV8XFqrzQBTdQ7EmLn4gv+OOal4pUGlRQ2onC8TFN8vD0Xr83n1AQRYe48ovlDIRGeWFJoCimNSXqymrT+avXhNwRrMEjIu2E8YW0W8JWDXGWB1c4G8epRLy49Plq6Gzd7P+/RM=
-TDR_AVATAR_STORAGE_PATH=encrypted:BH3DJiNNFUPnK83cby/HVCk0DHoBh2sNrnV1Txoz2Bh5EMPFSVpXdZaAz6C/LkdD5a2mKcDHFZb21Wy/GVJc9N3XNCJQz7GtvWrPNMv4oDFDJjDyeWHFHhPZmee6h3izWVO9mQDQTioamt7r50swMtP2
-TDR_GAME_ICON_STORAGE_PATH=encrypted:BKNWYaPZsXRaUr9gXAFfS5ULOqQPCBaO8fzsfpPMdh9L7dhMPgiIsqNzZlLUr5Ywl7JzKc9EFbdeuVYP2MFpeta0x/lwGnJFy+hjcBHlanXPUyLIYFEs0h2MZdwB4b24un9kZo6igsF478qWRfP2PLPCZ4eq
-
-APP_ORIGIN=encrypted:BAN8bBXyHn0fLmn/HqlK3cXfess/XF0HGYRAKxh89hyV26VHETLKgARQogdzjaAU4IRoTB6Lxr6pXzhuVRtQhsn4SiloTQ+t9Ecg/B7IbJ60F2TlcM5/aMq9QodpDGV2jZKVT7MsDl7yQuOyMca8BDJE6YiYGA==
-PASSKEY_RP_ID=encrypted:BMF+2RmswtWB5Z8eaebDFdK306JvBeu8fqPLK7DmfObq980Tc57a8t0fSOUt13k+f16CnvRc0EeHORq+R2vN0jQW3korDKptBa4LHRJr68u8ITXKqU+gkzIzGWLOdfmkMdXKPN4AGeEryw==
-
-DISCORD_CLIENT_ID="encrypted:BE1JPS3brhFpQ7qvCqmAi9PoQxFKnLZGBe/IrZQ4atx6s0byUQ6RrRW4cRK+XG08FCikCbzW0BaDSjy3z/6I+0dNvCZEMcsfU7v/ZFlmrOpoPF+sxrQNHfbDHaYT0MnOSlvtpnPGAm/FoT4SVuS0XdTyY2M="
-DISCORD_CLIENT_SECRET="encrypted:BDEjA2trC6RqGqDkwq2R8pGdD8xWqnhyFhkS9hxxUt4GJpTtTSUteU1zwHodGc+Xj7UUXAd5o3+MVc31N2yPyVLVHkdN3tkEb87nuUOdxHhtbBW7fPAszq/n5jMJfIfEI9/lvCB4pq/yVKxDkHJt+sWoZhdqUuLgtRFOE0IPZwyW"
-DISCORD_REDIRECT_URI=encrypted:BNM4ROa+P+E06QttCNhxzIwzTKmZb7IJLaK8gIH1n07gadfrNfAzbvFWCOZHnj4mcTvRnWym6761KnkL4FIgGOcLTx8eoGKmFM6WRAgA1u5MAz2k0fhyuNxAU/h0J+VdGLdFa3WpkjEY1TjD1A+6dhDv62A7XF8wCJtZx5mTqzjPjRdalxA/3GwgKRQ=
-
-SMTP_HOST="encrypted:BMjOo3Z/HyXK4c2fiVIqyud3bT83eBuD3uCEs97j2ymE0OAvoEqYaux8fMnSFull6kqvBLnfsxRR7BJaH6B15/Y8bhWmMIzPx1nfmkQTgbHY/esF+LSRZ18WeAIk7NOuvPRWacpY2CtadMZZ9hIe7AIhYg=="
-SMTP_PORT="encrypted:BCaQ3+9VxAash3YSjHRQ/pt1RLy6xjVpzMA4MSDuyFlfnMjE20ywt5ZtnqRrmKzXQa2KELF0mm92v1VehREwUZReD+W8J3p9sSxpG+D4SjDRkXfVEAfXuYml9E+vqwirianL/g=="
-SMTP_SECURE="encrypted:BAyezwpS+qNxZB0JmXJcQyiAS5Lua5XrURUnW1JUobBzTraqafs+2MpNJt3/LzVPayVv9nfuuQlUYfLJFnF6yRLQehqZobkaC6Hh+Q6AiWD3ZgkG+Sn6ON9c/Db+fltzt9D5lqbS"
-SMTP_USER="encrypted:BHnngZLsV6cbONJ10YvT/46wYXA8zZQB4W50VodF/6E3MyRcY9GiUmW+vaCFsrq71KA8HMKQaJ1P+3dB5u/7kaWPzMW8UDUWkBtaBnr0CJLCxN3bff2SA2+iCcHvjgx0bcLJS83JhnKsdo6Fb42IkuEGgw=="
-SMTP_PASSWORD="encrypted:BJs+zmP95i0SCm5h228DpILK5Q8BLX3wpsUx+5qEQgFakGV2b5h1x59q4TJcvX1wkTcbEHG+8ZYI1B2NJCgNgKFxRV4+uBnybIwP9rpHUQGL+kycYaM+hatvLzt9rA0eY+Gbm4AwhbiQ14rWxGqHnD4="
-SMTP_FROM="encrypted:BCrtD05OXCA8xlrFHvRLN/w16m43/S4da2xYWfYsvPIWeDWN56KURl9J6jljUpi5KzPutOfut5azWyKMssNdxAZqlRYQefFBBbrLK+lZjqccGEw2mKwLAibllYqPhiL5hK3bW5fUjojYqAL6Kb1UvN5KtkGzjIe2YW1jsc9eCg=="
-
-ORIGIN="encrypted:BMh6IEGoG+8iLK4a8vDpqduz3bGJ7ZI+X3oBnmmM0sbff3MaU/u3bdPuBtKcxxzMI8+Auc9TVlHOyDwM5pq40ny96CT/ZiMBQH+qFOjN797Vi7GO27eK58Z7iQuN99eQep1Pwxo84JruTUjhEuyYpVyqoQHl/ibN"
-SCHEDULER_TOKEN="encrypted:BAUdHe+C2fE9hU+uzbpQM36hNC7ZY01smAcCuE8uUA8n2QhhVAD6z3Meb6k+IokarpxUrua7W1S7knQx7hdDgZfDPqWsbJW0GYP9Ym6VNe1chJ/F2ceaNxPAPp0jsZ55Vj22rQ1ljni5vD1oSBE2gTkrsqt95KS/qiaRMTRxEkQ0lmXZscmkXhmeNy0="
-REMOVE_BG_API_KEY=encrypted:BFcytS+vbpSp2AhQ7nnRZvGbQCCuDCcp5D6irWwodBVnKB1zosiXapU3Nw6lTwHepl6t+j8hakxF3mKyJmB+6I5hZlzH/v6VUYUQnlYaPE43dYYYbGrseg4ZYK0W9O7SWlOyHHgIv7Ktkx3nqBIwa6PS50Bjoq+8SA==

.gitea/workflows/deploy-production.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: shd-build-production
+  group: shd-build-host-maintenance
   cancel-in-progress: false
 
 jobs:
@@ -21,7 +21,7 @@ jobs:
         run: npm ci
 
       - name: Validate application
-        run: npm run check
+        run: npm run check && npm test
 
       - name: Build Node application
         run: npm run build:app
@@ -33,30 +33,63 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Install environment tooling
-        run: npm ci
-
       - name: Prepare production configuration
         env:
-          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
-          SCHEDULER_TOKEN_PRODUCTION: ${{ secrets.SCHEDULER_TOKEN_PRODUCTION }}
+          INFISICAL_APP_CLIENT_ID:
+            ${{ vars.INFISICAL_PRODUCTION_APP_CLIENT_ID }}
+          INFISICAL_APP_CLIENT_SECRET:
+            ${{ secrets.INFISICAL_PRODUCTION_APP_CLIENT_SECRET }}
+          INFISICAL_SCHEDULER_CLIENT_ID:
+            ${{ vars.INFISICAL_PRODUCTION_SCHEDULER_CLIENT_ID }}
+          INFISICAL_SCHEDULER_CLIENT_SECRET:
+            ${{ secrets.INFISICAL_PRODUCTION_SCHEDULER_CLIENT_SECRET }}
           CONFIGURED_DEPLOY_PATH: ${{ vars.PRODUCTION_DEPLOY_PATH }}
           CONFIGURED_PRODUCTION_PORT: ${{ vars.PRODUCTION_PORT }}
           COMMIT_SHA: ${{ gitea.sha }}
           BUILD_NUMBER: ${{ gitea.run_number }}
         run: |
           set -eu
-          : "${DOTENV_PRIVATE_KEY_PRODUCTION:?DOTENV_PRIVATE_KEY_PRODUCTION is required}"
-          : "${SCHEDULER_TOKEN_PRODUCTION:?SCHEDULER_TOKEN_PRODUCTION is required}"
+          umask 077
+          : "${INFISICAL_APP_CLIENT_ID:?INFISICAL_PRODUCTION_APP_CLIENT_ID is required}"
+          : "${INFISICAL_APP_CLIENT_SECRET:?INFISICAL_PRODUCTION_APP_CLIENT_SECRET is required}"
+          : "${INFISICAL_SCHEDULER_CLIENT_ID:?INFISICAL_PRODUCTION_SCHEDULER_CLIENT_ID is required}"
+          : "${INFISICAL_SCHEDULER_CLIENT_SECRET:?INFISICAL_PRODUCTION_SCHEDULER_CLIENT_SECRET is required}"
           deployment_path="${CONFIGURED_DEPLOY_PATH:-/opt/shd-build-production}"
           production_port="${CONFIGURED_PRODUCTION_PORT:-3102}"
+          case "$deployment_path" in
+            /opt/shd-build-*) ;;
+            *) echo "PRODUCTION_DEPLOY_PATH must be beneath /opt/shd-build-." >&2; exit 1 ;;
+          esac
+          case "$production_port" in
+            ''|*[!0-9]*) echo "PRODUCTION_PORT must be an integer." >&2; exit 1 ;;
+          esac
+          if [ "$production_port" -lt 1 ] || [ "$production_port" -gt 65535 ]; then
+            echo "PRODUCTION_PORT must be from 1 through 65535." >&2
+            exit 1
+          fi
           mkdir -p "$deployment_path"
-          cp deploy/compose.production.yml deploy/deploy-production.sh deploy/bootstrap-production.sh deploy/sync-production-isac-to-staging.sh "$deployment_path/"
-          DOTENV_PRIVATE_KEY_PRODUCTION="$DOTENV_PRIVATE_KEY_PRODUCTION" npx dotenvx decrypt -f .env.production --stdout > "$deployment_path/.env.production.runtime"
-          printf '\nSCHEDULER_TOKEN=%s\n' "$SCHEDULER_TOKEN_PRODUCTION" >> "$deployment_path/.env.production.runtime"
-          printf 'SHD_IMAGE=shd-build-production:%s\nSHD_PRODUCTION_PORT=%s\nSHD_BUILD_NUMBER=%s\n' "$COMMIT_SHA" "$production_port" "$BUILD_NUMBER" > "$deployment_path/.env.deploy"
-          chmod 600 "$deployment_path/.env.production.runtime" "$deployment_path/.env.deploy"
-          chmod 755 "$deployment_path/deploy-production.sh" "$deployment_path/bootstrap-production.sh" "$deployment_path/sync-production-isac-to-staging.sh"
+          release_id="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT:-1}"
+          candidate_path="$deployment_path/candidate-$release_id"
+          rm -rf "$candidate_path"
+          mkdir -p "$candidate_path"
+          cp deploy/compose.production.yml deploy/deploy-production.sh deploy/bootstrap-production.sh deploy/sync-production-isac-to-staging.sh "$candidate_path/"
+          write_credential() {
+            target="$1"
+            value="$2"
+            temporary_file=$(mktemp "${target%/*}/.infisical.XXXXXX")
+            printf '%s' "$value" > "$temporary_file"
+            chmod 600 "$temporary_file"
+            mv "$temporary_file" "$target"
+          }
+          write_credential "$candidate_path/.infisical.app.client-id" "$INFISICAL_APP_CLIENT_ID"
+          write_credential "$candidate_path/.infisical.app.client-secret" "$INFISICAL_APP_CLIENT_SECRET"
+          write_credential "$candidate_path/.infisical.scheduler.client-id" "$INFISICAL_SCHEDULER_CLIENT_ID"
+          write_credential "$candidate_path/.infisical.scheduler.client-secret" "$INFISICAL_SCHEDULER_CLIENT_SECRET"
+          temporary_deploy_environment=$(mktemp "$candidate_path/.env.deploy.XXXXXX")
+          printf 'SHD_IMAGE=shd-build-production:%s-%s\nSHD_PRODUCTION_PORT=%s\nSHD_BUILD_NUMBER=%s\nSHD_COMMIT_SHA=%s\n' "$COMMIT_SHA" "$release_id" "$production_port" "$BUILD_NUMBER" "$COMMIT_SHA" > "$temporary_deploy_environment"
+          chmod 600 "$temporary_deploy_environment"
+          mv "$temporary_deploy_environment" "$candidate_path/.env.deploy"
+          chmod 755 "$candidate_path/deploy-production.sh" "$candidate_path/bootstrap-production.sh" "$candidate_path/sync-production-isac-to-staging.sh"
 
       - name: Deploy production
         env:
@@ -64,8 +97,12 @@ jobs:
           COMMIT_SHA: ${{ gitea.sha }}
         run: |
           deployment_path="${CONFIGURED_DEPLOY_PATH:-/opt/shd-build-production}"
-          "$deployment_path/deploy-production.sh" "$deployment_path" "$GITHUB_WORKSPACE" "shd-build-production:$COMMIT_SHA"
+          release_id="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT:-1}"
+          candidate_path="$deployment_path/candidate-$release_id"
+          "$candidate_path/deploy-production.sh" "$deployment_path" "$GITHUB_WORKSPACE" "shd-build-production:$COMMIT_SHA-$release_id" "$candidate_path"
 
       - name: Remove unused application images
         if: success()
-        run: docker image prune --force --filter "label=org.opencontainers.image.title=shd-build"
+        run:
+          docker image prune --force --filter
+          "label=org.opencontainers.image.title=shd-build"

.gitea/workflows/deploy-staging.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: shd-build-staging
+  group: shd-build-host-maintenance
   cancel-in-progress: false
 
 jobs:
@@ -21,7 +21,7 @@ jobs:
         run: npm ci
 
       - name: Validate application
-        run: npm run check
+        run: npm run check && npm test
 
       - name: Build Node application
         run: npm run build:app
@@ -33,26 +33,62 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Install environment tooling
-        run: npm ci
-
       - name: Prepare deployment configuration
         env:
-          DOTENV_PRIVATE_KEY_STAGING: ${{ secrets.DOTENV_PRIVATE_KEY_STAGING }}
+          INFISICAL_APP_CLIENT_ID: ${{ vars.INFISICAL_STAGING_APP_CLIENT_ID }}
+          INFISICAL_APP_CLIENT_SECRET:
+            ${{ secrets.INFISICAL_STAGING_APP_CLIENT_SECRET }}
+          INFISICAL_SCHEDULER_CLIENT_ID:
+            ${{ vars.INFISICAL_STAGING_SCHEDULER_CLIENT_ID }}
+          INFISICAL_SCHEDULER_CLIENT_SECRET:
+            ${{ secrets.INFISICAL_STAGING_SCHEDULER_CLIENT_SECRET }}
           CONFIGURED_DEPLOY_PATH: ${{ vars.STAGE_DEPLOY_PATH }}
           CONFIGURED_STAGE_PORT: ${{ vars.STAGE_PORT }}
           COMMIT_SHA: ${{ gitea.sha }}
           BUILD_NUMBER: ${{ gitea.run_number }}
         run: |
           set -eu
+          umask 077
+          : "${INFISICAL_APP_CLIENT_ID:?INFISICAL_STAGING_APP_CLIENT_ID is required}"
+          : "${INFISICAL_APP_CLIENT_SECRET:?INFISICAL_STAGING_APP_CLIENT_SECRET is required}"
+          : "${INFISICAL_SCHEDULER_CLIENT_ID:?INFISICAL_STAGING_SCHEDULER_CLIENT_ID is required}"
+          : "${INFISICAL_SCHEDULER_CLIENT_SECRET:?INFISICAL_STAGING_SCHEDULER_CLIENT_SECRET is required}"
           deployment_path="${CONFIGURED_DEPLOY_PATH:-/opt/shd-build-stage}"
           stage_port="${CONFIGURED_STAGE_PORT:-5569}"
+          case "$deployment_path" in
+            /opt/shd-build-*) ;;
+            *) echo "STAGE_DEPLOY_PATH must be beneath /opt/shd-build-." >&2; exit 1 ;;
+          esac
+          case "$stage_port" in
+            ''|*[!0-9]*) echo "STAGE_PORT must be an integer." >&2; exit 1 ;;
+          esac
+          if [ "$stage_port" -lt 1 ] || [ "$stage_port" -gt 65535 ]; then
+            echo "STAGE_PORT must be from 1 through 65535." >&2
+            exit 1
+          fi
           mkdir -p "$deployment_path"
-          cp deploy/compose.staging.yml deploy/deploy-staging.sh deploy/bootstrap-staging.sh "$deployment_path/"
-          DOTENV_PRIVATE_KEY_STAGING="$DOTENV_PRIVATE_KEY_STAGING" npx dotenvx decrypt -f .env.staging --stdout > "$deployment_path/.env.staging.runtime"
-          printf 'SHD_IMAGE=shd-build-stage:%s\nSHD_STAGE_PORT=%s\nSHD_BUILD_NUMBER=%s\n' "$COMMIT_SHA" "$stage_port" "$BUILD_NUMBER" > "$deployment_path/.env.deploy"
-          chmod 600 "$deployment_path/.env.staging.runtime" "$deployment_path/.env.deploy"
-          chmod 755 "$deployment_path/deploy-staging.sh" "$deployment_path/bootstrap-staging.sh"
+          release_id="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT:-1}"
+          candidate_path="$deployment_path/candidate-$release_id"
+          rm -rf "$candidate_path"
+          mkdir -p "$candidate_path"
+          cp deploy/compose.staging.yml deploy/deploy-staging.sh deploy/bootstrap-staging.sh "$candidate_path/"
+          write_credential() {
+            target="$1"
+            value="$2"
+            temporary_file=$(mktemp "${target%/*}/.infisical.XXXXXX")
+            printf '%s' "$value" > "$temporary_file"
+            chmod 600 "$temporary_file"
+            mv "$temporary_file" "$target"
+          }
+          write_credential "$candidate_path/.infisical.app.client-id" "$INFISICAL_APP_CLIENT_ID"
+          write_credential "$candidate_path/.infisical.app.client-secret" "$INFISICAL_APP_CLIENT_SECRET"
+          write_credential "$candidate_path/.infisical.scheduler.client-id" "$INFISICAL_SCHEDULER_CLIENT_ID"
+          write_credential "$candidate_path/.infisical.scheduler.client-secret" "$INFISICAL_SCHEDULER_CLIENT_SECRET"
+          temporary_deploy_environment=$(mktemp "$candidate_path/.env.deploy.XXXXXX")
+          printf 'SHD_IMAGE=shd-build-stage:%s-%s\nSHD_STAGE_PORT=%s\nSHD_BUILD_NUMBER=%s\nSHD_COMMIT_SHA=%s\n' "$COMMIT_SHA" "$release_id" "$stage_port" "$BUILD_NUMBER" "$COMMIT_SHA" > "$temporary_deploy_environment"
+          chmod 600 "$temporary_deploy_environment"
+          mv "$temporary_deploy_environment" "$candidate_path/.env.deploy"
+          chmod 755 "$candidate_path/deploy-staging.sh" "$candidate_path/bootstrap-staging.sh"
 
       - name: Deploy staging
         env:
@@ -60,8 +96,12 @@ jobs:
           COMMIT_SHA: ${{ gitea.sha }}
         run: |
           deployment_path="${CONFIGURED_DEPLOY_PATH:-/opt/shd-build-stage}"
-          "$deployment_path/deploy-staging.sh" "$deployment_path" "$GITHUB_WORKSPACE" "shd-build-stage:$COMMIT_SHA"
+          release_id="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT:-1}"
+          candidate_path="$deployment_path/candidate-$release_id"
+          "$candidate_path/deploy-staging.sh" "$deployment_path" "$GITHUB_WORKSPACE" "shd-build-stage:$COMMIT_SHA-$release_id" "$candidate_path"
 
       - name: Remove unused application images
         if: success()
-        run: docker image prune --force --filter "label=org.opencontainers.image.title=shd-build"
+        run:
+          docker image prune --force --filter
+          "label=org.opencontainers.image.title=shd-build"

.gitea/workflows/export-isac-data.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: shd-build-staging
+  group: shd-build-host-maintenance
   cancel-in-progress: false
 
 jobs:
@@ -25,15 +25,32 @@ jobs:
           compose() {
             docker compose --env-file "$deploy_environment" -f "$compose_file" "$@"
           }
-          restart_services() {
-            compose up -d --no-build app scheduler
-          }
-          trap restart_services EXIT
           snapshot_name="isac-stage-${GITHUB_RUN_ID}.json"
+          volume_snapshot="/app/data/exports/$snapshot_name"
+          remove_volume_snapshot=false
+          cleanup() {
+            exit_status=$?
+            trap - EXIT
+            if [ "$remove_volume_snapshot" = true ]; then
+              compose run --rm --no-deps app rm -f "$volume_snapshot" || true
+            fi
+            if ! compose up -d --no-build app scheduler; then
+              if [ "$exit_status" -eq 0 ]; then exit_status=1; fi
+            fi
+            exit "$exit_status"
+          }
+          trap cleanup EXIT
           compose stop scheduler app
-          compose run --rm --no-deps app node scripts/isac-data-export.mjs "/app/data/exports/$snapshot_name"
-          compose run --rm --no-deps -v "$GITHUB_WORKSPACE:/export" app \
-            cp "/app/data/exports/$snapshot_name" /export/isac-stage.json
+          app_container="$(compose ps --all --quiet app)"
+          if [ -z "$app_container" ]; then
+            echo "The stopped staging app container could not be found." >&2
+            exit 1
+          fi
+          remove_volume_snapshot=true
+          compose run --rm --no-deps app node scripts/isac-data-export.mjs "$volume_snapshot"
+          docker cp "$app_container:$volume_snapshot" "$GITHUB_WORKSPACE/isac-stage.json"
+          compose run --rm --no-deps app rm -f "$volume_snapshot"
+          remove_volume_snapshot=false
 
       - name: Publish ISAC snapshot
         uses: actions/upload-artifact@v3

.gitea/workflows/export-production-isac-data.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: shd-build-production
+  group: shd-build-host-maintenance
   cancel-in-progress: false
 
 jobs:
@@ -25,15 +25,32 @@ jobs:
           compose() {
             docker compose --env-file "$deploy_environment" -f "$compose_file" "$@"
           }
-          restart_services() {
-            compose up -d --no-build app scheduler
-          }
-          trap restart_services EXIT
           snapshot_name="isac-production-${GITHUB_RUN_ID}.json"
+          volume_snapshot="/app/data/exports/$snapshot_name"
+          remove_volume_snapshot=false
+          cleanup() {
+            exit_status=$?
+            trap - EXIT
+            if [ "$remove_volume_snapshot" = true ]; then
+              compose run --rm --no-deps app rm -f "$volume_snapshot" || true
+            fi
+            if ! compose up -d --no-build app scheduler; then
+              if [ "$exit_status" -eq 0 ]; then exit_status=1; fi
+            fi
+            exit "$exit_status"
+          }
+          trap cleanup EXIT
           compose stop scheduler app
-          compose run --rm --no-deps app node scripts/isac-data-export.mjs "/app/data/exports/$snapshot_name"
-          compose run --rm --no-deps -v "$GITHUB_WORKSPACE:/export" app \
-            cp "/app/data/exports/$snapshot_name" /export/isac-production.json
+          app_container="$(compose ps --all --quiet app)"
+          if [ -z "$app_container" ]; then
+            echo "The stopped production app container could not be found." >&2
+            exit 1
+          fi
+          remove_volume_snapshot=true
+          compose run --rm --no-deps app node scripts/isac-data-export.mjs "$volume_snapshot"
+          docker cp "$app_container:$volume_snapshot" "$GITHUB_WORKSPACE/isac-production.json"
+          compose run --rm --no-deps app rm -f "$volume_snapshot"
+          remove_volume_snapshot=false
 
       - name: Publish production ISAC snapshot
         uses: actions/upload-artifact@v3

.gitea/workflows/sync-production-isac-to-staging.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: shd-build-production-to-staging
+  group: shd-build-host-maintenance
   cancel-in-progress: false
 
 jobs:

.gitignore

@@ -17,11 +17,10 @@ Thumbs.db
 .env.*
 !.env.example
 !.env.test
-!.env.development
-!.env.staging
-!.env.production
 .env.keys
 .env.keys.*
+.infisical.*.client-id
+.infisical.*.client-secret
 
 # Embedded Turso database files
 /data/*.db
@@ -38,4 +37,12 @@ vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
 
 _img/
-tmp/
+tmp/
+
+# Python caches
+__pycache__/
+*.py[cod]
+
+.pi
+.mesh
+.worktrees/

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

.impeccable/critique/2026-07-26T15-49-23Z__src-routes.md

@@ -2,29 +2,30 @@
 target: application route system
 total_score: 28
 max_score: 40
-na_heuristics: 
+na_heuristics:
 p0_count: 0
 p1_count: 2
 timestamp: 2026-07-26T15-49-23Z
 slug: src-routes
 ---
+
 # SHD.build route-system critique
 
 ## Design Health Score
 
-| # | Heuristic | Score | Key issue |
-|---|---|---:|---|
-| 1 | Visibility of system status | 4 | ISAC exposes environment, access, mode, active navigation, and filter state clearly. |
-| 2 | Match system / real world | 3 | SHD vocabulary is authentic, but codes such as OSPR and WMOD need plain-language support. |
-| 3 | User control and freedom | 3 | Navigation and cancellation patterns are strong; empty destinations and filter clearing are less explicit. |
-| 4 | Consistency and standards | 3 | Shared patterns are cohesive, but live search plus Search, static-looking KPI links, and Edit-only rows diverge. |
-| 5 | Error prevention | 3 | Guardrails are extensive, but Add/Edit consequence language is not visible before entry. |
-| 6 | Recognition rather than recall | 2 | Seventeen ISAC destinations, code labels, and visually identical category cards create scanning burden. |
-| 7 | Flexibility and efficiency | 3 | Search, filtering, page sizes, and grouped navigation help experts; one-page registries expose unnecessary controls. |
-| 8 | Aesthetic and minimalist design | 2 | The system is disciplined, but cinematic hero scale and equally weighted bordered blocks compete with the task. |
-| 9 | Error recovery | 3 | The application has designed error and preservation patterns, though recovery was not exercised in the inspected states. |
-| 10 | Help and documentation | 2 | Microcopy exists, but ISAC terms, permissions, and proposal consequences lack contextual help. |
-| **Total** |  | **28/40** | **Good foundation; focused hierarchy and disclosure work needed.** |
+| #         | Heuristic                       |     Score | Key issue                                                                                                                |
+| --------- | ------------------------------- | --------: | ------------------------------------------------------------------------------------------------------------------------ |
+| 1         | Visibility of system status     |         4 | ISAC exposes environment, access, mode, active navigation, and filter state clearly.                                     |
+| 2         | Match system / real world       |         3 | SHD vocabulary is authentic, but codes such as OSPR and WMOD need plain-language support.                                |
+| 3         | User control and freedom        |         3 | Navigation and cancellation patterns are strong; empty destinations and filter clearing are less explicit.               |
+| 4         | Consistency and standards       |         3 | Shared patterns are cohesive, but live search plus Search, static-looking KPI links, and Edit-only rows diverge.         |
+| 5         | Error prevention                |         3 | Guardrails are extensive, but Add/Edit consequence language is not visible before entry.                                 |
+| 6         | Recognition rather than recall  |         2 | Seventeen ISAC destinations, code labels, and visually identical category cards create scanning burden.                  |
+| 7         | Flexibility and efficiency      |         3 | Search, filtering, page sizes, and grouped navigation help experts; one-page registries expose unnecessary controls.     |
+| 8         | Aesthetic and minimalist design |         2 | The system is disciplined, but cinematic hero scale and equally weighted bordered blocks compete with the task.          |
+| 9         | Error recovery                  |         3 | The application has designed error and preservation patterns, though recovery was not exercised in the inspected states. |
+| 10        | Help and documentation          |         2 | Microcopy exists, but ISAC terms, permissions, and proposal consequences lack contextual help.                           |
+| **Total** |                                 | **28/40** | **Good foundation; focused hierarchy and disclosure work needed.**                                                       |
 
 ## Design Specificity Verdict
 
@@ -36,11 +37,12 @@ blocks flatten into a generic dark administrative grid.
 
 The deterministic scan found seven source findings across `src/routes`: one
 warning for the two-pixel semantic notification rail in
-`src/routes/account/+page.svelte`, and six advisory colors outside the documented
-palette in the homepage and account route. The rail is largely a detector false
-positive because it conveys semantic message state, but its colors should still
-come from named tokens. The homepage build colors are data-like values rather
-than structural CSS, yet they also bypass the maintained palette.
+`src/routes/account/+page.svelte`, and six advisory colors outside the
+documented palette in the homepage and account route. The rail is largely a
+detector false positive because it conveys semantic message state, but its
+colors should still come from named tokens. The homepage build colors are
+data-like values rather than structural CSS, yet they also bypass the maintained
+palette.
 
 Mutable browser injection was unavailable, so no visual overlay is claimed.
 Fresh Chrome tabs, screenshots, DOM snapshots, and computed styles instead
@@ -72,8 +74,8 @@ its complexity according to the operator's current task and role.
 
 The Attributes screen simultaneously presents 17 sidebar destinations, four
 system-state blocks, four KPI filters, search, pagination, row-size controls,
-six table columns, and repeated Edit actions. Experienced operators can scan
-it, but contributors and new Oversight users must decode the whole information
+six table columns, and repeated Edit actions. Experienced operators can scan it,
+but contributors and new Oversight users must decode the whole information
 architecture before acting.
 
 **Fix:** make sidebar groups collapsible, prioritize modules by role and recent
@@ -109,8 +111,8 @@ to a clear secondary path.
 
 ### P2 — Empty registries promise the same value as populated registries
 
-Four of eight Database cards show zero records and “Awaiting contributions,”
-but look and behave like full destinations. That creates repeated anticipation
+Four of eight Database cards show zero records and “Awaiting contributions,” but
+look and behave like full destinations. That creates repeated anticipation
 followed by a low-value endpoint.
 
 **Fix:** give empty registries an explicit empty-state anatomy with expected
@@ -121,10 +123,10 @@ not imply the same outcome as populated data.
 
 ### P2 — Functional contrast and interaction grammar remain uneven
 
-Muted database descriptions, inactive navigation, unit sublabels, and
-pagination text recede heavily. KPI filters resemble static metrics, table rows
-look selectable while only the small Edit action works, and a Search button
-remains beside an input that searches as the user types.
+Muted database descriptions, inactive navigation, unit sublabels, and pagination
+text recede heavily. KPI filters resemble static metrics, table rows look
+selectable while only the small Edit action works, and a Search button remains
+beside an input that searches as the user types.
 
 **Fix:** reserve the dimmest tone for nonessential metadata, raise informative
 copy and available navigation one contrast step, make KPI filter state
@@ -147,9 +149,9 @@ seven-plus pagination/search controls, and 22 repeated Edit actions.
 The Database hero creates a confident, premium entry peak. Populated cards
 promise useful intelligence, but visually equal empty categories produce a
 disappointment valley. ISAC's “Online / Authorized / Admin” state reassures
-operators, then the uniform density creates fatigue with little calm focus.
-The most important missing reassurance is a plain statement of what Add/Edit
-will do to live data.
+operators, then the uniform density creates fatigue with little calm focus. The
+most important missing reassurance is a plain statement of what Add/Edit will do
+to live data.
 
 ## Persona Red Flags
 

.impeccable/design.json

@@ -8,133 +8,331 @@
         "role": "neutral",
         "displayName": "Operations Black",
         "canonical": "#0a0c0d",
-        "tonalRamp": ["#050606", "#0a0c0d", "#171a1b", "#303536", "#555c5e", "#858b8d", "#c1c4c2", "#f0f0eb"]
+        "tonalRamp": [
+          "#050606",
+          "#0a0c0d",
+          "#171a1b",
+          "#303536",
+          "#555c5e",
+          "#858b8d",
+          "#c1c4c2",
+          "#f0f0eb"
+        ]
       },
       "terminal-black": {
         "role": "neutral",
         "displayName": "Terminal Black",
         "canonical": "#0d0f10",
-        "tonalRamp": ["#050606", "#0d0f10", "#1b1e1f", "#34393a", "#596062", "#888f91", "#c3c7c6", "#f1f2ee"]
+        "tonalRamp": [
+          "#050606",
+          "#0d0f10",
+          "#1b1e1f",
+          "#34393a",
+          "#596062",
+          "#888f91",
+          "#c3c7c6",
+          "#f1f2ee"
+        ]
       },
       "terminal-surface": {
         "role": "neutral",
         "displayName": "Terminal Surface",
         "canonical": "#111415",
-        "tonalRamp": ["#070808", "#111415", "#202425", "#393e3f", "#5f6668", "#8d9496", "#c6cac9", "#f2f3ef"]
+        "tonalRamp": [
+          "#070808",
+          "#111415",
+          "#202425",
+          "#393e3f",
+          "#5f6668",
+          "#8d9496",
+          "#c6cac9",
+          "#f2f3ef"
+        ]
       },
       "terminal-graphite": {
         "role": "neutral",
         "displayName": "Terminal Graphite",
         "canonical": "#141718",
-        "tonalRamp": ["#080a0a", "#111415", "#202425", "#343a3b", "#565e60", "#858d8f", "#c0c5c3", "#f0f1ed"]
+        "tonalRamp": [
+          "#080a0a",
+          "#111415",
+          "#202425",
+          "#343a3b",
+          "#565e60",
+          "#858d8f",
+          "#c0c5c3",
+          "#f0f1ed"
+        ]
       },
       "active-graphite": {
         "role": "neutral",
         "displayName": "Active Graphite",
         "canonical": "#15191a",
-        "tonalRamp": ["#080a0a", "#15191a", "#252a2b", "#3e4445", "#626a6c", "#909799", "#c8cccb", "#f2f3f0"]
+        "tonalRamp": [
+          "#080a0a",
+          "#15191a",
+          "#252a2b",
+          "#3e4445",
+          "#626a6c",
+          "#909799",
+          "#c8cccb",
+          "#f2f3f0"
+        ]
       },
       "modeled-data-surface": {
         "role": "neutral",
         "displayName": "Modeled Data Surface",
         "canonical": "#0d1213",
-        "tonalRamp": ["#050708", "#0d1213", "#1c2527", "#334043", "#526165", "#7d8b8e", "#bac2c2", "#eff1ef"]
+        "tonalRamp": [
+          "#050708",
+          "#0d1213",
+          "#1c2527",
+          "#334043",
+          "#526165",
+          "#7d8b8e",
+          "#bac2c2",
+          "#eff1ef"
+        ]
       },
       "structural-line": {
         "role": "neutral",
         "displayName": "Structural Line",
         "canonical": "#303536",
-        "tonalRamp": ["#0d0f10", "#1b1f20", "#303536", "#4b5152", "#6a7274", "#92999b", "#c3c8c7", "#f0f1ee"]
+        "tonalRamp": [
+          "#0d0f10",
+          "#1b1f20",
+          "#303536",
+          "#4b5152",
+          "#6a7274",
+          "#92999b",
+          "#c3c8c7",
+          "#f0f1ee"
+        ]
       },
       "structural-line-soft": {
         "role": "neutral",
         "displayName": "Structural Line Soft",
         "canonical": "#272c2d",
-        "tonalRamp": ["#0b0d0d", "#181b1c", "#272c2d", "#43494a", "#656d6f", "#8e9597", "#c2c6c5", "#eff0ed"]
+        "tonalRamp": [
+          "#0b0d0d",
+          "#181b1c",
+          "#272c2d",
+          "#43494a",
+          "#656d6f",
+          "#8e9597",
+          "#c2c6c5",
+          "#eff0ed"
+        ]
       },
       "structural-line-strong": {
         "role": "neutral",
         "displayName": "Structural Line Strong",
         "canonical": "#424849",
-        "tonalRamp": ["#111415", "#252a2b", "#424849", "#5d6567", "#7c8587", "#a0a7a8", "#c9cdcc", "#f1f2ef"]
+        "tonalRamp": [
+          "#111415",
+          "#252a2b",
+          "#424849",
+          "#5d6567",
+          "#7c8587",
+          "#a0a7a8",
+          "#c9cdcc",
+          "#f1f2ef"
+        ]
       },
       "modeled-data-line": {
         "role": "neutral",
         "displayName": "Modeled Data Line",
         "canonical": "#3b4648",
-        "tonalRamp": ["#0e1314", "#20292b", "#3b4648", "#566366", "#758184", "#9aa3a5", "#c6cbca", "#f0f2ef"]
+        "tonalRamp": [
+          "#0e1314",
+          "#20292b",
+          "#3b4648",
+          "#566366",
+          "#758184",
+          "#9aa3a5",
+          "#c6cbca",
+          "#f0f2ef"
+        ]
       },
       "field-manual-white": {
         "role": "neutral",
         "displayName": "Field Manual White",
         "canonical": "#ecebe5",
-        "tonalRamp": ["#252522", "#44433f", "#66655f", "#898780", "#aaa8a1", "#cac8c1", "#ecebe5", "#faf9f5"]
+        "tonalRamp": [
+          "#252522",
+          "#44433f",
+          "#66655f",
+          "#898780",
+          "#aaa8a1",
+          "#cac8c1",
+          "#ecebe5",
+          "#faf9f5"
+        ]
       },
       "telemetry-muted": {
         "role": "neutral",
         "displayName": "Telemetry Muted",
         "canonical": "#858b8d",
-        "tonalRamp": ["#151718", "#292d2e", "#414647", "#5e6466", "#858b8d", "#a6abad", "#cbd0cf", "#f1f2ef"]
+        "tonalRamp": [
+          "#151718",
+          "#292d2e",
+          "#414647",
+          "#5e6466",
+          "#858b8d",
+          "#a6abad",
+          "#cbd0cf",
+          "#f1f2ef"
+        ]
       },
       "telemetry-dim": {
         "role": "neutral",
         "displayName": "Telemetry Dim",
         "canonical": "#5d6567",
-        "tonalRamp": ["#111314", "#222627", "#373c3d", "#4b5254", "#5d6567", "#858d8f", "#bcc1c0", "#eef0ed"]
+        "tonalRamp": [
+          "#111314",
+          "#222627",
+          "#373c3d",
+          "#4b5254",
+          "#5d6567",
+          "#858d8f",
+          "#bcc1c0",
+          "#eef0ed"
+        ]
       },
       "signal-orange": {
         "role": "primary",
         "displayName": "Signal Orange",
         "canonical": "#f6a821",
-        "tonalRamp": ["#2b1a05", "#4c2f08", "#754a0d", "#a66c14", "#d7901c", "#f6a821", "#ffd278", "#fff1cf"]
+        "tonalRamp": [
+          "#2b1a05",
+          "#4c2f08",
+          "#754a0d",
+          "#a66c14",
+          "#d7901c",
+          "#f6a821",
+          "#ffd278",
+          "#fff1cf"
+        ]
       },
       "signal-orange-hover": {
         "role": "primary",
         "displayName": "Signal Orange Hover",
         "canonical": "#ffc45d",
-        "tonalRamp": ["#2d1f08", "#51380d", "#785515", "#a97824", "#d99d39", "#ffc45d", "#ffdda0", "#fff3d9"]
+        "tonalRamp": [
+          "#2d1f08",
+          "#51380d",
+          "#785515",
+          "#a97824",
+          "#d99d39",
+          "#ffc45d",
+          "#ffdda0",
+          "#fff3d9"
+        ]
       },
       "system-success": {
         "role": "secondary",
         "displayName": "System Success",
         "canonical": "#75c08c",
-        "tonalRamp": ["#102a19", "#194328", "#275f39", "#3f7d50", "#5c9e6d", "#75c08c", "#a8dcba", "#e2f4e8"]
+        "tonalRamp": [
+          "#102a19",
+          "#194328",
+          "#275f39",
+          "#3f7d50",
+          "#5c9e6d",
+          "#75c08c",
+          "#a8dcba",
+          "#e2f4e8"
+        ]
       },
       "system-danger": {
         "role": "secondary",
         "displayName": "System Danger",
         "canonical": "#df8069",
-        "tonalRamp": ["#32130e", "#542219", "#793428", "#a54a39", "#c9634f", "#df8069", "#edae9f", "#f8dfd9"]
+        "tonalRamp": [
+          "#32130e",
+          "#542219",
+          "#793428",
+          "#a54a39",
+          "#c9634f",
+          "#df8069",
+          "#edae9f",
+          "#f8dfd9"
+        ]
       },
       "system-info": {
         "role": "secondary",
         "displayName": "System Information",
         "canonical": "#70b9d6",
-        "tonalRamp": ["#0d2630", "#163f50", "#245b70", "#387991", "#5599b3", "#70b9d6", "#a6d5e7", "#e1f1f7"]
+        "tonalRamp": [
+          "#0d2630",
+          "#163f50",
+          "#245b70",
+          "#387991",
+          "#5599b3",
+          "#70b9d6",
+          "#a6d5e7",
+          "#e1f1f7"
+        ]
       },
       "quality-standard": {
         "role": "tertiary",
         "displayName": "Standard Quality",
         "canonical": "#69b66f",
-        "tonalRamp": ["#0e2912", "#17431d", "#255e2b", "#397b3e", "#519a56", "#69b66f", "#9dd4a1", "#dff0e0"]
+        "tonalRamp": [
+          "#0e2912",
+          "#17431d",
+          "#255e2b",
+          "#397b3e",
+          "#519a56",
+          "#69b66f",
+          "#9dd4a1",
+          "#dff0e0"
+        ]
       },
       "quality-specialized": {
         "role": "tertiary",
         "displayName": "Specialized Quality",
         "canonical": "#4f9ed8",
-        "tonalRamp": ["#0c2435", "#123c59", "#1d567d", "#2d72a3", "#408dc4", "#4f9ed8", "#8dc5ea", "#d9edf8"]
+        "tonalRamp": [
+          "#0c2435",
+          "#123c59",
+          "#1d567d",
+          "#2d72a3",
+          "#408dc4",
+          "#4f9ed8",
+          "#8dc5ea",
+          "#d9edf8"
+        ]
       },
       "quality-superior": {
         "role": "tertiary",
         "displayName": "Superior Quality",
         "canonical": "#9b68d4",
-        "tonalRamp": ["#21132f", "#38204f", "#522f70", "#704594", "#8959b7", "#9b68d4", "#c3a2e5", "#eee1f7"]
+        "tonalRamp": [
+          "#21132f",
+          "#38204f",
+          "#522f70",
+          "#704594",
+          "#8959b7",
+          "#9b68d4",
+          "#c3a2e5",
+          "#eee1f7"
+        ]
       },
       "quality-high-end": {
         "role": "tertiary",
         "displayName": "High-end Quality",
         "canonical": "#e4bd3f",
-        "tonalRamp": ["#2d2408", "#4c3c0d", "#6f5815", "#95771f", "#bd992d", "#e4bd3f", "#f0d982", "#fbf2ce"]
+        "tonalRamp": [
+          "#2d2408",
+          "#4c3c0d",
+          "#6f5815",
+          "#95771f",
+          "#bd992d",
+          "#e4bd3f",
+          "#f0d982",
+          "#fbf2ce"
+        ]
       }
     },
     "typographyMeta": {

.infisical.json

@@ -0,0 +1,6 @@
+{
+  "workspaceId": "2ee94b27-e599-4194-9797-3372d42e53f6",
+  "defaultEnvironment": "dev",
+  "defaultSecretPath": "/app",
+  "domain": "https://secrets.jb.codes"
+}

.opencode/agents/gdc-architecture.md

@@ -1,35 +0,0 @@
----
-description: Defines and maintains game-data-capture domain contracts, taxonomy, evidence schemas, state transitions, and trust boundaries.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-sol
-variant: high
-steps: 80
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/contracts/**": allow
-    "tools/game-data-capture/src/game_data_capture/domain/**": allow
-    "tools/game-data-capture/tests/contract/**": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-001.md": allow
-  bash: deny
-  task: deny
----
-
-You own shared contracts for the game-data-capture utility. Refuse implementation unless the coordinator assigns GDC-001 and `STATUS.md` marks it `in_progress`. Read `AGENTS.md`, the plan README, GDC-001, and dependency handoffs before editing.
-
-Model source evidence without guesses. Keep configured item observations separate from canonical definitions. Support composite screenshots and explicit abstention. Design JSON Schemas that Python and TypeScript can validate.
-
-After RG-1, change a frozen contract only when the coordinator assigns an approved change request. Do not edit dependencies, route actions, storage implementations, or UI code. Add contract tests and write `handoffs/GDC-001.md`. Do not commit or push.

.opencode/agents/gdc-coordinator.md

@@ -1,68 +0,0 @@
----
-description: Coordinates the game-data-capture implementation, delegates dependency-ready tasks, reviews every handoff, and enforces release gates.
-mode: primary
-model: openai/gpt-5.6-sol
-variant: high
-steps: 120
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  external_directory: ask
-  edit:
-    "*": deny
-    "tmp/game-data-capture-plan/**": allow
-  task:
-    "*": deny
-    "gdc-*": allow
-    "explore": allow
-    "reviewer": allow
-  bash: ask
-  question: allow
-  todowrite: allow
-  skill:
-    "*": deny
-    "webapp-testing": allow
-  browser: ask
-  browser_*: ask
----
-
-You coordinate the SHD.build game-data-capture project. You inspect and delegate; you do not implement source changes.
-
-Before work:
-
-1. Read `AGENTS.md` and every applicable repository instruction.
-2. Read `tmp/game-data-capture-plan/README.md`, `STATUS.md`, the assigned task, and dependency handoffs.
-3. Inspect Git status and preserve unrelated work.
-4. Confirm dependencies and the current review gate. Refuse to delegate a task unless `STATUS.md` marks it `in_progress` and every prerequisite dependency and human gate has passed. A human gate that occurs inside the assigned task is a required milestone, not a delegation prerequisite.
-
-Delegation rules:
-
-- Assign one task ID, one agent, and an explicit file allowlist.
-- Run workers in parallel only when their files do not overlap.
-- Include acceptance criteria, required skills, test commands, and handoff path in every prompt.
-- Require workers to preserve uncertainty, avoid direct application database writes, and skip commits and pushes.
-- Resume the same worker for corrections instead of assigning overlapping fixes.
-
-Review rules:
-
-- Read every changed file and test. Do not accept a worker's summary as evidence.
-- Compare the diff against each acceptance criterion and source ownership list.
-- Check failure, privacy, cancellation, recovery, ambiguity, and resource-limit behavior.
-- Reject tests that pass after removing the intended behavior.
-- Route defects to the owning worker. You may edit only the ignored plan, status, and handoff files.
-- Apply the security criteria in each task during interim review. Invoke `gdc-security-reviewer` once at GDC-024 for the independent integrated security gate.
-- Do not open a downstream wave before its gate passes.
-- Run the task's validation commands after worker review. Ask for shell approval when OpenCode requires it.
-- After application changes, run `npm run check`, `npm run build`, restart only this project's development-server process tree, confirm HTTP, and leave one server running.
-
-Update `STATUS.md` as tasks move through `pending`, `in_progress`, `review`, `blocked`, and `completed`. Record gate verdicts in the relevant handoff.

.opencode/agents/gdc-docs-operations.md

@@ -1,39 +0,0 @@
----
-description: Writes tested installation, privacy, capture, OCR, video, export, ISAC handoff, recovery, and troubleshooting documentation.
-mode: subagent
-hidden: true
-model: openai/gpt-5.4-mini
-variant: low
-steps: 60
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/README.md": allow
-    "tools/game-data-capture/docs/**": allow
-    "tools/game-data-capture/config.example.toml": allow
-    "docs/architecture.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-023.md": allow
-  bash: deny
-  task: deny
-  skill:
-    "*": deny
-    "stop-slop": allow
----
-
-You own GDC-023. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-022 passed review. Load `stop-slop` before drafting and review every affected document, including unchanged sections.
-
-Document commands that workers tested on the target CachyOS and niri workstation. Separate required from optional dependencies. State cloud behavior, retention, and privacy directly. Include no real key, private corpus text, or unsupported behavior.
-
-Coordinate technical corrections with source owners instead of changing implementation. Write `handoffs/GDC-023.md` and do not commit or push.

.opencode/agents/gdc-evidence-export.md

@@ -1,37 +0,0 @@
----
-description: Implements deterministic evidence archives, checksums, verification, and bounded reviewed-draft handoffs for ISAC.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: medium
-steps: 80
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/evidence/**": allow
-    "tools/game-data-capture/src/game_data_capture/export/**": allow
-    "tools/game-data-capture/tests/unit/evidence/**": allow
-    "tools/game-data-capture/tests/unit/export/**": allow
-    "tools/game-data-capture/tests/contract/test_export_golden.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-016.md": allow
-  bash: deny
-  task: deny
----
-
-You own GDC-016. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-013 passed review. Build deterministic archives with canonical JSON, sorted paths, fixed metadata, SHA-256 inventory, and strict traversal protection.
-
-Keep evidence archives separate from bounded ISAC handoffs. Exclude screenshots from handoffs by default. Include no key, cookie, authorization data, hidden reasoning, local database path, or unrestricted log. Preserve export lineage rather than rewriting an old archive.
-
-Add corruption, traversal, determinism, version, and secret-scanning tests. Write `handoffs/GDC-016.md` and do not commit or push.

.opencode/agents/gdc-isac-core.md

@@ -1,45 +0,0 @@
----
-description: Implements the authenticated ISAC capture-intake boundary, handoff validation, dependency planning, permission display, and mutation safeguards.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-sol
-variant: high
-steps: 110
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "src/lib/isac/capture-intake/types.ts": allow
-    "src/lib/isac/capture-intake/schema.ts": allow
-    "src/lib/isac/capture-intake/plan.ts": allow
-    "src/lib/isac/capture-intake/*.test.ts": allow
-    "src/routes/isac/capture/**": allow
-    "src/routes/isac/+layout.svelte": allow
-    "src/app.css": allow
-    "docs/DESIGN_SYSTEM.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-018.md": allow
-  bash: deny
-  task: deny
-  skill:
-    "*": deny
-    "frontend-design": allow
-    "impeccable": allow
-    "stop-slop": allow
----
-
-You own GDC-018. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, GDC-016 and H4 passed, and dependency handoffs were read. Preserve the existing ISAC trust boundary. Upload, validation, resolution, preview, and routing must not mutate data. Require `data.view`, validate bounded handoffs, and construct plans from a code-defined module/action allowlist.
-
-Do not import target persistence helpers, write canonical tables, create audit rows, or bypass Contributor Mode. Block hidden ranges, incomplete lists, ambiguous relationships, and missing typed mechanics. State whether confirmation would publish or propose.
-
-Use project UI skills and load `stop-slop` before any design-system edit. Update the design system only for reusable decisions. Add permission, version, bounds, and no-mutation tests. Write `handoffs/GDC-018.md` and do not commit or push.

.opencode/agents/gdc-isac-progression.md

@@ -1,41 +0,0 @@
----
-description: Adapts reviewed Skill Chip and OS Protocol capture drafts into existing ISAC editors without fabricating relationships or mechanic programs.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 100
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "src/lib/isac/capture-intake/adapters/skillchips.ts": allow
-    "src/lib/isac/capture-intake/adapters/protocols.ts": allow
-    "src/lib/isac/capture-intake/adapters/progression.test.ts": allow
-    "src/routes/isac/skillchips/+page.svelte": allow
-    "src/routes/isac/protocols/+page.svelte": allow
-    "src/routes/isac/skillchips/capture-intake.test.ts": allow
-    "src/routes/isac/protocols/capture-intake.test.ts": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-020.md": allow
-  bash: deny
-  task: deny
-  skill:
-    "*": deny
----
-
-You own GDC-020. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-018 and GDC-010 passed review.
-
-Prefill only reviewed evidence. Resolve abilities and Attributes without fuzzy auto-selection. Keep shared Protocol profiles separate. Do not fabricate `conditionalRule`; require a reviewed contract-valid program. Preserve capacity checks, icon reset, result tokens, Contributor Mode, readiness refresh, and audit behavior.
-
-Tests must assert audit actor, category, action, target, and complete owned relationship evidence. Write `handoffs/GDC-020.md` and do not commit or push.

.opencode/agents/gdc-isac-specializations.md

@@ -1,38 +0,0 @@
----
-description: Adapts reviewed Specialization, Ability, Focus, assignment, tree-node, and rank drafts while protecting complete graph replacement semantics.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-sol
-variant: high
-steps: 110
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "src/lib/isac/capture-intake/adapters/specializations.ts": allow
-    "src/lib/isac/capture-intake/adapters/specializations.test.ts": allow
-    "src/routes/isac/specializations/+page.svelte": allow
-    "src/routes/isac/specializations/capture-intake.test.ts": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-021.md": allow
-  bash: deny
-  task: deny
-  skill:
-    "*": deny
----
-
-You own GDC-021. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-018 and GDC-011 passed review.
-
-Require positive parent resolution. Do not guess tree positions, rank costs, Ability targets, intrinsic attacks, or mechanics. Require a complete current-state comparison and confirmation for node updates. Pause after preparing the first action plan until the owner passes H5. Preserve canonical actions, readiness refresh, editor lifecycle, Contributor Mode, and audit behavior.
-
-Tests must assert audit actor, category, action, target, and complete graph evidence. Write `handoffs/GDC-021.md` and do not commit or push.

.opencode/agents/gdc-isac-weapon-gear.md

@@ -1,43 +0,0 @@
----
-description: Adapts reviewed Weapon and Gear capture drafts into existing ISAC editors while preserving validation, moderation, audit, and editor lifecycle.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "src/lib/isac/capture-intake/adapters/weapons.ts": allow
-    "src/lib/isac/capture-intake/adapters/gear.ts": allow
-    "src/lib/isac/capture-intake/adapters/weapon-gear.test.ts": allow
-    "src/routes/isac/weapons/+page.svelte": allow
-    "src/routes/isac/gear/+page.svelte": allow
-    "src/routes/isac/weapons/capture-intake.test.ts": allow
-    "src/routes/isac/gear/capture-intake.test.ts": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-019.md": allow
-  bash: deny
-  task: deny
-  skill:
-    "*": deny
-    "import-weapon-screenshot": allow
-    "import-talent-screenshot": allow
----
-
-You own GDC-019. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-018 and GDC-009 passed review. Read current editor and action contracts before relying on field names.
-
-Prefill only reviewed evidence. Do not auto-select ambiguous Talents, Brands, or Attributes. Keep hidden ranges, incomplete pools, augments, and mod slots unresolved. Do not auto-submit. Preserve existing actions, result tokens, add/edit lifecycle, Contributor Mode, and audit behavior.
-
-Tests must assert audit actor, category, action, target, and before/after relationship evidence. Write `handoffs/GDC-019.md` and do not commit or push.

.opencode/agents/gdc-openai-fallback.md

@@ -1,38 +0,0 @@
----
-description: Implements automatic OpenAI Responses API vision fallback, structured schemas, retries, duplicate suppression, and secret-safe handling.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/vision/openai_provider.py": allow
-    "tools/game-data-capture/src/game_data_capture/vision/prompts.py": allow
-    "tools/game-data-capture/src/game_data_capture/vision/schemas.py": allow
-    "tools/game-data-capture/src/game_data_capture/vision/privacy.py": allow
-    "tools/game-data-capture/tests/unit/vision/test_openai_provider.py": allow
-    "tools/game-data-capture/tests/contract/test_openai_schema.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-012.md": allow
-  bash: deny
-  task: deny
----
-
-You own GDC-012. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-007 and GDC-008 passed review. Use a fixed configurable OpenAI vision model through the Responses API with `store: false`, no tools, original image detail when supported, and strict Structured Outputs.
-
-Automatic fallback has owner approval and no cost ceiling. Keep retries bounded and suppress duplicate requests. Send useful crops when possible. Treat local OCR as untrusted input and validate every response locally. Never log or persist keys, headers, base64 payloads, unrestricted responses, or hidden reasoning.
-
-Use fake clients in tests. Do not run a live request without coordinator approval. Write `handoffs/GDC-012.md` and do not commit or push.

.opencode/agents/gdc-progression-items.md

@@ -1,37 +0,0 @@
----
-description: Implements evidence extraction for Skill Chips and OS Protocols, including instance values, shared profiles, bonuses, and Talent prose.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/extractors/skill_chip.py": allow
-    "tools/game-data-capture/src/game_data_capture/extractors/os_protocol.py": allow
-    "tools/game-data-capture/tests/unit/extractors/test_skill_chip.py": allow
-    "tools/game-data-capture/tests/unit/extractors/test_os_protocol.py": allow
-    "tools/game-data-capture/tests/evaluation/test_progression_items.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-010.md": allow
-  bash: deny
-  task: deny
----
-
-You own GDC-010. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-008 passed review. Read current Skill Chip, OS Protocol, Attribute, mechanic, and Specialization Ability contracts before editing.
-
-Separate configured instance quality, level, rolls, and upgrades from reusable definitions. Keep the OS Protocol secondary profile separate from an individual Protocol. Capture Talent prose and values without inventing events, reducers, state, expressions, or scopes. Missing pools, endpoints, profiles, abilities, or Attributes remain unresolved.
-
-Add ambiguity and interpolation tests. Write `handoffs/GDC-010.md` and do not commit or push.

.opencode/agents/gdc-python-core.md

@@ -1,47 +0,0 @@
----
-description: Implements the game-data-capture Python package, configuration, diagnostics, dependency lock, and approved web and OCR dependency integration.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 100
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/pyproject.toml": allow
-    "tools/game-data-capture/uv.lock": allow
-    "tools/game-data-capture/.python-version": allow
-    "tools/game-data-capture/config.example.toml": allow
-    "tools/game-data-capture/src/game_data_capture/__init__.py": allow
-    "tools/game-data-capture/src/game_data_capture/__main__.py": allow
-    "tools/game-data-capture/src/game_data_capture/cli.py": allow
-    "tools/game-data-capture/src/game_data_capture/config.py": allow
-    "tools/game-data-capture/src/game_data_capture/paths.py": allow
-    "tools/game-data-capture/src/game_data_capture/logging.py": allow
-    "tools/game-data-capture/src/game_data_capture/doctor.py": allow
-    "tools/game-data-capture/tests/unit/test_config.py": allow
-    "tools/game-data-capture/tests/unit/test_cli.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-002.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-007.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-005.md": allow
-  bash: ask
-  task: deny
----
-
-You own Python packaging and dependency integration. The coordinator assigns GDC-002, the dependency-integration phase of GDC-005, or the dependency-integration phase of GDC-007. Refuse implementation unless `STATUS.md` marks that task `in_progress`. Read the task and dependency handoffs before editing.
-
-Keep imports side-effect free. Use Python 3.12 through `uv`, XDG runtime paths, typed configuration, redacted logs, and explicit dependency pins. Leave runtime and subsystem wiring to `gdc-runtime-integration`.
-
-Do not absorb storage, OCR, web, media, or provider implementations into core modules. Request contract changes through your handoff. Add focused tests, write the task-specific handoff, and do not commit or push.

.opencode/agents/gdc-review-engine.md

@@ -1,37 +0,0 @@
----
-description: Implements capture grouping, duplicate reuse, correction history, merge and split behavior, review states, undo, and ISAC-readiness checks.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/grouping/**": allow
-    "tools/game-data-capture/src/game_data_capture/review/**": allow
-    "tools/game-data-capture/tests/unit/grouping/**": allow
-    "tools/game-data-capture/tests/unit/review/**": allow
-    "tools/game-data-capture/tests/integration/test_review_lifecycle.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-013.md": allow
-  bash: deny
-  task: deny
----
-
-You own GDC-013. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-009 through GDC-012 passed review.
-
-Preserve every source and model result. Exact duplicate reuse may be automatic; semantic merges require evidence or user confirmation. Keep evidence-reviewed separate from ISAC-ready. Append correction and undo history, reject stale mutations, and block readiness for missing ranges, pools, relationships, or mechanics.
-
-Do not edit runtime, storage, provider, extractor, or web code. Write `handoffs/GDC-013.md` and do not commit or push.

.opencode/agents/gdc-review-ui.md

@@ -1,41 +0,0 @@
----
-description: Builds the local capture-labeling and evidence-review interface with accessible states, responsive layouts, and local-only assets.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: medium
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/web/templates/**": allow
-    "tools/game-data-capture/src/game_data_capture/web/static/**": allow
-    "tools/game-data-capture/tests/integration/test_capture_labeling.py": allow
-    "tools/game-data-capture/tests/integration/test_review_ui.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-005.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-014.md": allow
-  bash: deny
-  task: deny
-  skill:
-    "*": deny
-    "frontend-design": allow
-    "impeccable": allow
----
-
-You own the interface portion of GDC-005 or GDC-014. Refuse implementation unless the coordinator assigns one task, `STATUS.md` marks it `in_progress`, the backend handoff exists, and dependencies passed review. Load `frontend-design` and `impeccable` before design work. The coordinator performs browser validation with `webapp-testing`.
-
-Build a restrained local operations interface for dense evidence review. Cover keyboard navigation, focus-visible, pending, disabled, error, success, empty, narrow, and reduced-motion states. Use text with color for state. Load no CDN asset. Never auto-arm capture, approve evidence, export, delete, or submit to ISAC.
-
-Coordinate API needs through the handoff instead of editing backend files. Provide desktop and narrow-layout acceptance cases for coordinator browser validation, update the assigned handoff, and do not commit or push.

.opencode/agents/gdc-runtime-integration.md

@@ -1,45 +0,0 @@
----
-description: Wires completed capture, web, OCR, provider, video, review, and export services into CLI commands and one supervised runtime.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 100
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/cli.py": allow
-    "tools/game-data-capture/src/game_data_capture/runtime.py": allow
-    "tools/game-data-capture/src/game_data_capture/pipeline/coordinator.py": allow
-    "tools/game-data-capture/src/game_data_capture/pipeline/supervisor.py": allow
-    "tools/game-data-capture/src/game_data_capture/pipeline/events.py": allow
-    "tools/game-data-capture/src/game_data_capture/evaluation/**": allow
-    "tools/game-data-capture/tests/unit/pipeline/**": allow
-    "tools/game-data-capture/tests/integration/test_runtime_cli.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-004.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-005.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-014.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-015.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-016.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-017.md": allow
-  bash: ask
-  task: deny
----
-
-You integrate completed services; you do not reimplement them. The coordinator assigns one integration phase of GDC-004, GDC-005, GDC-014, GDC-015, GDC-016, or GDC-017. Refuse implementation unless `STATUS.md` marks that task `in_progress`, the subsystem owner completed its handoff section, and dependencies passed review.
-
-Wire command and lifecycle boundaries through typed ports. Keep SQLite writes in the main process, start one GPU worker, bound provider and media work, reconcile durable jobs, and stop children in order. Aggregate subsystem evaluation interfaces into versioned reports without duplicating OCR, classifier, or extractor policy. Do not edit `pipeline/jobs.py`; `gdc-storage` owns job leases.
-
-Append an integration section to the assigned handoff. Do not absorb subsystem policy, commit, or push.

.opencode/agents/gdc-screen-classifier.md

@@ -1,38 +0,0 @@
----
-description: Implements offline screen-family classification, view and Gear-slot labels, composite record types, region detection, abstention, and evaluation.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  external_directory: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/vision/classifier.py": allow
-    "tools/game-data-capture/src/game_data_capture/vision/regions.py": allow
-    "tools/game-data-capture/tests/unit/vision/test_classifier.py": allow
-    "tools/game-data-capture/tests/unit/vision/test_regions.py": allow
-    "tools/game-data-capture/tests/evaluation/test_classifier.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-008.md": allow
-  bash: ask
-  task: deny
----
-
-You own GDC-008. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, H3 selected the OCR engine, and GDC-007 passed review.
-
-Classify family, view, exact Gear slot, record types, confidence, and abstention. Support composite screens. Use normalized geometry or detected anchors rather than fixed 4K coordinates. Evaluate by capture session and report confusion matrices, class recall, false positives, and abstention. Never call a network service.
-
-Do not edit OCR, provider, extractor, or domain contracts. Write `handoffs/GDC-008.md` and do not commit or push.

.opencode/agents/gdc-security-reviewer.md

@@ -1,32 +0,0 @@
----
-description: Performs independent read-only security, privacy, data-integrity, and ISAC-boundary review for the complete game-data-capture implementation.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-sol
-variant: high
-steps: 100
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tmp/game-data-capture-plan/handoffs/GDC-024.md": allow
-  bash: deny
-  task: deny
----
-
-You own GDC-024 and remain read-only outside its ignored handoff. Refuse review unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-022 and GDC-023 passed. Report findings first, ordered by severity.
-
-Inspect clipboard helper environments, media limits, subprocess commands, storage recovery, paths and symlinks, GPU queues, OpenAI secrets and payloads, localhost security, XSS, CSRF, archives, ISAC permissions, moderation, audit evidence, editor lifecycle, and data semantics. Read tests and identify assertions that cannot catch regressions.
-
-Each finding needs affected files, reproduction, impact, required correction, and verification. High or critical findings block release. Recheck owner fixes and record dispositions. Do not patch implementation, commit, or push.

.opencode/agents/gdc-specializations.md

@@ -1,35 +0,0 @@
----
-description: Implements extraction for Specialization identities, overview screens, abilities, focuses, trees, nodes, ranks, effects, and costs.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-sol
-variant: high
-steps: 110
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/extractors/specialization/**": allow
-    "tools/game-data-capture/tests/unit/extractors/specialization/**": allow
-    "tools/game-data-capture/tests/evaluation/test_specializations.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-011.md": allow
-  bash: deny
-  task: deny
----
-
-You own GDC-011. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-008 passed review. Read the full Specialization route, readiness code, Skill Chip capacity rules, mechanic contracts, and architecture documentation before editing.
-
-Model overview screens as composite evidence. Preserve parent, coordinate, rank, effect, cost, cadence, charge, and intrinsic-damage uncertainty. Do not emit derived readiness or infer executable mechanics from prose. Link fragments only with positive identity evidence.
-
-Test incomplete trees, scrolling, free Ability nodes, multi-rank nodes, modified Ability values, and ambiguous parents. Write `handoffs/GDC-011.md` and do not commit or push.

.opencode/agents/gdc-storage.md

@@ -1,38 +0,0 @@
----
-description: Implements utility-local SQLite migrations, content-addressed blobs, durable jobs, provenance, recovery, safe purge behavior, and approved GDC-005 corpus persistence.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: medium
-steps: 80
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/migrations/**": allow
-    "tools/game-data-capture/src/game_data_capture/storage/**": allow
-    "tools/game-data-capture/src/game_data_capture/pipeline/jobs.py": allow
-    "tools/game-data-capture/tests/unit/storage/**": allow
-    "tools/game-data-capture/tests/integration/storage/**": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-003.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-005.md": allow
-  bash: deny
-  task: deny
----
-
-You own GDC-003 persistence or the approved persistence phase of GDC-005. Refuse implementation unless the coordinator assigns one task, `STATUS.md` marks it `in_progress`, and its dependencies passed review. Read the frozen contracts and dependency handoffs before editing.
-
-Keep the utility database separate from SHD.build. Use checksummed additive migrations, foreign keys, WAL, atomic blob installation, compare-and-swap transitions, and recoverable leases. Model capture occurrences separately from blob identity. Test crashes at transaction and filesystem boundaries.
-
-For GDC-005, implement only the reviewed durable corpus-port operations described in its task and handoff. Do not edit domain contracts, pipeline policy, routes, or application database code. Write the assigned task handoff and do not commit or push.

.opencode/agents/gdc-test-engineer.md

@@ -1,37 +0,0 @@
----
-description: Adds cross-subsystem integration, contract, recovery, synthetic-media, secret-scanning, and ISAC workflow tests without editing production code.
-mode: subagent
-hidden: true
-model: openai/gpt-5.3-codex-spark
-variant: medium
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/tests/integration/test_end_to_end.py": allow
-    "tools/game-data-capture/tests/integration/test_crash_recovery.py": allow
-    "tools/game-data-capture/tests/integration/test_secret_exclusion.py": allow
-    "tools/game-data-capture/tests/fixtures/e2e/**": allow
-    "src/lib/isac/capture-intake/end-to-end.test.ts": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-022.md": allow
-  bash: deny
-  task: deny
----
-
-You own GDC-022. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and every dependency passed review. Add tests only after subsystem contracts and implementations exist. Do not repair production code; report each failure to its owner.
-
-Use synthetic or approved fixtures. Keep proprietary screenshots and private corpus data out of Git. Test end-to-end state, restart recovery, provider failures, media bounds, numeric disagreements, secret exclusion, manager publication, Contributor Mode proposals, and canonical readback. Assert audit actor, category, action, target, and before/after relationship evidence. Ensure tests fail when intended behavior is removed.
-
-Write `handoffs/GDC-022.md` and do not commit or push.

.opencode/agents/gdc-video-import.md

@@ -1,36 +0,0 @@
----
-description: Implements bounded FFmpeg and ffprobe video ingestion, tiled stability analysis, sharp-frame selection, lineage, cancellation, and recovery.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: medium
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/video/**": allow
-    "tools/game-data-capture/tests/unit/video/**": allow
-    "tools/game-data-capture/tests/integration/test_video_import.py": allow
-    "tools/game-data-capture/tests/fixtures/video/**": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-015.md": allow
-  bash: ask
-  task: deny
----
-
-You own GDC-015. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-008 and GDC-013 passed review.
-
-Run FFmpeg and ffprobe with argument arrays, private paths, limits, timeouts, bounded stderr, cancellation, and process-group cleanup. Extract no audio. Use tiled motion so animated backgrounds do not hide stable UI. Preserve parent hashes, timestamps, metrics, commands, and policy versions.
-
-Do not edit web routes, runtime integration, OCR, or storage. Use generated media fixtures. Write `handoffs/GDC-015.md` and do not commit or push.

.opencode/agents/gdc-vision-ocr.md

@@ -1,39 +0,0 @@
----
-description: Benchmarks local GPU OCR and implements preprocessing, the persistent OCR worker, confidence calibration, and OCR evaluation.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 100
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  external_directory: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/ocr/**": allow
-    "tools/game-data-capture/src/game_data_capture/vision/preprocess.py": allow
-    "tools/game-data-capture/tests/unit/ocr/**": allow
-    "tools/game-data-capture/tests/unit/vision/test_preprocess.py": allow
-    "tools/game-data-capture/tests/gpu/**": allow
-    "tools/game-data-capture/tests/evaluation/test_ocr.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-007.md": allow
-  bash: ask
-  task: deny
----
-
-You own the OCR phase of GDC-007. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and H2 passed. Do not select an OCR engine or threshold before the private corpus passes H2.
-
-Measure exact numbers, labels, transcript accuracy, latency, VRAM, CUDA provider, model hashes, and confidence calibration. Keep raw OCR separate from normalized values. Never call a network service from local OCR.
-
-Return dependency pin requests to `gdc-python-core`; do not edit lock files. Write the OCR section of `handoffs/GDC-007.md` and do not commit or push.

.opencode/agents/gdc-wayland-media.md

@@ -1,35 +0,0 @@
----
-description: Implements niri and Wayland clipboard image intake, private spooling, and watcher process supervision.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: medium
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/ingest/**": allow
-    "tools/game-data-capture/tests/unit/ingest/**": allow
-    "tools/game-data-capture/tests/integration/test_clipboard_watch.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-004.md": allow
-  bash: ask
-  task: deny
----
-
-You own GDC-004. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and its dependencies passed review. Use the existing niri focused-window shortcut and `wl-paste`; do not automate game input.
-
-Run child processes without a shell. Bound bytes, dimensions, stderr, queues, retries, and shutdown. Keep the clipboard helper small and remove OpenAI secrets from its environment. Request coordinator approval for live clipboard or compositor commands; never read clipboard text.
-
-Do not edit storage, OCR, provider, video, or web code. Add failure tests, write `handoffs/GDC-004.md`, and do not commit or push.

.opencode/agents/gdc-weapon-gear.md

@@ -1,40 +0,0 @@
----
-description: Implements evidence-preserving extraction for weapons and Gear across Mask, Gloves, Backpack, Body Armor, Holster, and Knee Pads.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: medium
-steps: 90
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/extractors/weapon.py": allow
-    "tools/game-data-capture/src/game_data_capture/extractors/gear.py": allow
-    "tools/game-data-capture/tests/unit/extractors/test_weapon.py": allow
-    "tools/game-data-capture/tests/unit/extractors/test_gear.py": allow
-    "tools/game-data-capture/tests/evaluation/test_weapon_gear.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-009.md": allow
-  bash: deny
-  task: deny
-  skill:
-    "*": deny
-    "import-weapon-screenshot": allow
----
-
-You own GDC-009. Refuse implementation unless the coordinator assigns it, `STATUS.md` marks it `in_progress`, and GDC-008 passed review. Read the current Weapon and Gear actions, scaling documentation, and weapon screenshot import skill before editing.
-
-Preserve displayed values as observations until evidence establishes canonical endpoints. Treat weapon Talent grids as complete unordered sets and mark cropped lists incomplete. Use exact Gear slot rules. Do not guess Talent, Brand, or Attribute IDs, hidden ranges, native tiers, mod slots, or compatibility pools.
-
-Add per-slot and per-view regression tests. Write `handoffs/GDC-009.md` and do not commit or push.

.opencode/agents/gdc-web-service.md

@@ -1,39 +0,0 @@
----
-description: Implements the loopback FastAPI service, authenticated local sessions, capture and review APIs, request bounds, and browser security.
-mode: subagent
-hidden: true
-model: openai/gpt-5.6-terra
-variant: high
-steps: 100
-permission:
-  "*": deny
-  read:
-    "*": allow
-    "*.env": deny
-    "*.env.*": deny
-    "*.env.example": allow
-    "data/**": deny
-    "**/data/**": deny
-    "**/*.db": deny
-    "**/*.db-*": deny
-  glob: allow
-  grep: ask
-  edit:
-    "*": deny
-    "tools/game-data-capture/src/game_data_capture/web/*.py": allow
-    "tools/game-data-capture/src/game_data_capture/web/routes/**": allow
-    "tools/game-data-capture/tests/unit/web/**": allow
-    "tools/game-data-capture/tests/integration/test_capture_labeling.py": allow
-    "tools/game-data-capture/tests/integration/test_web_security.py": allow
-    "tools/game-data-capture/tests/integration/test_review_ui.py": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-005.md": allow
-    "tmp/game-data-capture-plan/handoffs/GDC-014.md": allow
-  bash: deny
-  task: deny
----
-
-You own the backend portion of GDC-005 or GDC-014. Refuse implementation unless the coordinator assigns one task, `STATUS.md` marks it `in_progress`, and its dependencies passed review. Bind only to loopback and defend against DNS rebinding, cross-origin mutation, CSRF, XSS, path traversal, oversized uploads, and unauthorized artifacts.
-
-Use opaque IDs and escaped text. Keep paths, keys, cookies, database internals, and unrestricted OCR/provider content out of responses. Do not embed SQL in routes or duplicate domain policy.
-
-Coordinate route contracts with `gdc-review-ui`, but do not edit templates or static assets. Add failure-path tests, update the assigned handoff, and do not commit or push.

.prettierignore

@@ -0,0 +1,5 @@
+# Ignore artifacts:
+build
+coverage
+tmp
+_img

.prettierrc

@@ -0,0 +1,17 @@
+{
+  "arrowParens": "always",
+  "bracketSpacing": true,
+  "htmlWhitespaceSensitivity": "css",
+  "insertPragma": false,
+  "jsxBracketSameLine": false,
+  "jsxSingleQuote": true,
+  "printWidth": 80,
+  "proseWrap": "always",
+  "quoteProps": "as-needed",
+  "requirePragma": false,
+  "semi": true,
+  "singleQuote": true,
+  "tabWidth": 2,
+  "trailingComma": "all",
+  "useTabs": false
+}

.vscode/extensions.json

@@ -1,3 +1,3 @@
 {
-	"recommendations": ["svelte.svelte-vscode"]
+  "recommendations": ["svelte.svelte-vscode"]
 }

AGENTS.md

@@ -2,145 +2,290 @@
 
 ## Parallel task execution
 
-For substantial changes, use subagents as a standard practice when the work can be divided into concrete, independent tasks that provide real parallel progress.
+For substantial changes, use subagents as a standard practice when the work can
+be divided into concrete, independent tasks that provide real parallel progress.
 
-1. Delegate bounded mechanical work to faster, lower-reasoning agents (focused code discovery, repetitive call-site updates, documentation, isolated test coverage).
-2. Keep architecture, security-sensitive behavior, database migrations, shared data-model decisions, and complex debugging with a suitably capable agent.
-3. Assign explicit file or subsystem ownership before parallel edits. Avoid having multiple agents edit the same files unless their work is deliberately sequenced.
-4. Do not delegate tightly coupled work merely to increase agent count. Keep it with the primary agent when coordination would cost more than it saves.
-5. The primary agent remains responsible for integrating results, reviewing diffs, resolving cross-cutting concerns, and running the final required validation.
-6. Subagents must follow every repository rule that applies to their assigned work, including design-system maintenance, audit logging, and database preservation.
+1. Delegate bounded mechanical work to faster, lower-reasoning agents (focused
+   code discovery, repetitive call-site updates, documentation, isolated test
+   coverage).
+2. Keep architecture, security-sensitive behavior, database migrations, shared
+   data-model decisions, and complex debugging with a suitably capable agent.
+3. Assign explicit file or subsystem ownership before parallel edits. Avoid
+   having multiple agents edit the same files unless their work is deliberately
+   sequenced.
+4. Do not delegate tightly coupled work merely to increase agent count. Keep it
+   with the primary agent when coordination would cost more than it saves.
+5. The primary agent remains responsible for integrating results, reviewing
+   diffs, resolving cross-cutting concerns, and running the final required
+   validation.
+6. Subagents must follow every repository rule that applies to their assigned
+   work, including design-system maintenance, audit logging, and database
+   preservation.
 
 ## Documentation prose
 
-Use the `stop-slop` skill whenever an agent creates or changes project documentation. Apply its review to the complete affected document, including sections that the change did not introduce. Preserve technical meaning, commands, paths, formulas, links, policy strength, and product terminology. Remove filler, vague claims, formulaic contrasts, manufactured emphasis, false agency, and repetition. Prefer active voice and specific subjects. Do not weaken terms such as `must`, `never`, or `always` when they express a real requirement.
+Use the `stop-slop` skill whenever an agent creates or changes project
+documentation. Apply its review to the complete affected document, including
+sections that the change did not introduce. Preserve technical meaning,
+commands, paths, formulas, links, policy strength, and product terminology.
+Remove filler, vague claims, formulaic contrasts, manufactured emphasis, false
+agency, and repetition. Prefer active voice and specific subjects. Do not weaken
+terms such as `must`, `never`, or `always` when they express a real requirement.
 
 ## Dependency source research
 
-Use `npx opensrc` before inspecting an npm dependency's implementation. It resolves the package version from this workspace's lockfile, shallow-clones the matching source revision, and caches it outside the repository at `~/.opensrc/`.
+Use `npx opensrc` before inspecting an npm dependency's implementation. It
+resolves the package version from this workspace's lockfile, shallow-clones the
+matching source revision, and caches it outside the repository at `~/.opensrc/`.
 
-- Do not guess at dependency behavior or implementation details. Identify the needed function, type, option, or control flow in the cached source and use that evidence when designing a change.
-- Search the smallest relevant source area first. Use the package entry point, exports, types, and targeted code search to locate the behavior instead of reading unrelated files.
-- Fetch source before a dependency investigation: `npx opensrc fetch --cwd . <package>`.
-- Print the cached source path for use with repository search and file tools: `npx opensrc path --cwd . <package>`.
-- Fetch several declared packages in one command: `npx opensrc fetch --cwd . <package-a> <package-b>`.
-- After adding or upgrading a direct dependency, fetch its source at the locked version. Do not commit `~/.opensrc/` or copy dependency source into this repository.
-- Use `npx opensrc list` to inspect the cache. Use `npx opensrc remove <package>` or `npx opensrc clean` only when cache removal is intended.
+- Do not guess at dependency behavior or implementation details. Identify the
+  needed function, type, option, or control flow in the cached source and use
+  that evidence when designing a change.
+- Search the smallest relevant source area first. Use the package entry point,
+  exports, types, and targeted code search to locate the behavior instead of
+  reading unrelated files.
+- Fetch source before a dependency investigation:
+  `npx opensrc fetch --cwd . <package>`.
+- Print the cached source path for use with repository search and file tools:
+  `npx opensrc path --cwd . <package>`.
+- Fetch several declared packages in one command:
+  `npx opensrc fetch --cwd . <package-a> <package-b>`.
+- After adding or upgrading a direct dependency, fetch its source at the locked
+  version. Do not commit `~/.opensrc/` or copy dependency source into this
+  repository.
+- Use `npx opensrc list` to inspect the cache. Use
+  `npx opensrc remove <package>` or `npx opensrc clean` only when cache removal
+  is intended.
 
 ## Available skills
 
 The `.agents/skills/` directory contains repo-specific skill files. Key skills:
 
-- `stop-slop` — apply to documentation prose changes
-- `frontend-design` / `impeccable` — UI design, refinement, and polish
-- `import-talent-screenshot` / `import-weapon-screenshot` — extract Division Resurgence game data from screenshots and enter through ISAC
-- `webapp-testing` — Playwright-based local web app testing
+- `stop-slop`: apply to documentation prose changes
+- `frontend-design` / `impeccable`: UI design, refinement, and polish
+- `import-talent-screenshot` / `import-weapon-screenshot`: extract Division
+  Resurgence game data from screenshots and enter through ISAC
+- `webapp-testing`: Playwright-based local web app testing
 
 Use `skill` tool to load one when the task matches.
 
+## Agent skills
+
+### Issue tracker
+
+Track issues in this repository's Gitea Issues using `tea`. See
+`docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Use the five canonical triage labels without overrides. See
+`docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Use the single-context domain documentation layout. See `docs/agents/domain.md`.
+
 ## Verify commands
 
 Run in order after source changes:
 
-```
+```bash
 npm run check        # svelte-kit sync + svelte-check (typecheck)
-npm run build        # dotenvx production env + vite build
+npm run build        # secretless Vite production build
 ```
 
-`npm run check` runs `svelte-kit sync` (generates `.svelte-kit/tsconfig.json`) then `svelte-check --tsconfig ./tsconfig.json`. `npm test` runs all vitest tests; there is no separate vitest config (vitest inherits from `vite.config.ts`).
+`npm run check` runs `svelte-kit sync` (generates `.svelte-kit/tsconfig.json`)
+then `svelte-check --tsconfig ./tsconfig.json`. `npm test` runs all vitest
+tests; there is no separate vitest config (vitest inherits from
+`vite.config.ts`).
 
-Test files (`*.test.ts`) live adjacent to the code they test, mostly in `src/lib/`. Most server-unit tests mock `$lib/server/database` via `vi.mock(...)` — unnecessary for unit tests against pure logic. Integration tests that need database state use the embedded Turso engine.
+Test files (`*.test.ts`) live adjacent to the code they test, mostly in
+`src/lib/`. Most server-unit tests mock `$lib/server/database` via
+`vi.mock(...)`; pure logic tests do not need that mock. Integration tests that
+need database state use the embedded Turso engine.
 
 ## Framework and toolchain quirks
 
-- **SvelteKit 2 / Svelte 5** with forced runes mode (configured in `vite.config.ts` via plugin `compilerOptions.runes`). There is no `svelte.config.js` — SvelteKit config lives in `vite.config.ts`.
-- **Node adapter** (`@sveltejs/adapter-node`). Production entry point is `node build`. The container runs migrations on startup, then serves.
-- **Embedded Turso** (`@tursodatabase/database`) — local SQLite, no Turso Cloud, no libSQL HTTP, no replicas. The dev database path is `./data/shd-build-development.db` (set in `.env.development`).
-- **Passkey auth** (`@simplewebauthn`) is preferred. `APP_ORIGIN` and `PASSKEY_RP_ID` must match the public origin.
-- **Environment files** are encrypted with `dotenvx`. Committed `.env.development`, `.env.staging`, `.env.production` are encrypted; `.env.keys` is git-ignored. The pre-commit hook runs `npm run env:stage` (encrypts and git-adds). To edit: `npm run env:decrypt`, make changes, `npm run env:stage`.
+- **SvelteKit 2 / Svelte 5** with forced runes mode (configured in
+  `vite.config.ts` via plugin `compilerOptions.runes`). There is no
+  `svelte.config.js`; SvelteKit config lives in `vite.config.ts`.
+- **Node adapter** (`@sveltejs/adapter-node`). Production entry point is
+  `node build`. The container runs migrations on startup, then serves.
+- **Embedded Turso** (`@tursodatabase/database`): local SQLite, no Turso Cloud,
+  no libSQL HTTP, no replicas. The Infisical `dev` environment sets the database
+  path to `./data/shd-build-development.db`.
+- **Passkey auth** (`@simplewebauthn`) is preferred. `APP_ORIGIN` must match the
+  public origin. `PASSKEY_RP_ID` must be that hostname or a registrable parent
+  domain; hosted environments use `shd.build`.
+- **Infisical secrets** live in project `2ee94b27-e599-4194-9797-3372d42e53f6`
+  at `https://secrets.jb.codes`. Application values use `/app`;
+  `SCHEDULER_TOKEN` uses `/shared/scheduler`. Local commands use the
+  authenticated Infisical CLI and the `dev` environment. Deployed app and
+  scheduler containers use separate Universal Auth bootstrap credentials mounted
+  through Compose secrets. The root entrypoint exchanges those credentials for
+  one-shot JSON exports, deletes the export files, and starts the workload as
+  the dedicated `shd-runtime` UID 10001 without Infisical credentials or tokens.
+  The self-hosted Free plan cannot scope Viewer identities by environment or
+  path.
 - **Argon2id** password hashing with server-side sessions and CSRF protection.
-- **ISAC namespace**: `/isac` is the admin console; `/admin` redirects there via 308.
+- **ISAC namespace**: `/isac` is the admin console; `/admin` redirects there
+  via 308.
+
+## Long-running development processes
+
+Use the installed `pi-background-tasks` extension's `bg_run` tool for
+development servers, watchers, and other persistent commands. Do not use
+foreground shell sessions, `nohup`, `&`, or process-tree/PID discovery when a
+tracked task exists.
+
+- Use `isAgent: false` and a concise, descriptive task name.
+- Retain the returned task ID and output path. Inspect a task with `bg_status`
+  and read its output with `bg_logs`.
+- Stop a task with `bg_kill <task-id>`. To restart it, start a new `bg_run` task
+  and retain its new task ID and output path; do not search for and kill
+  processes.
+- Do not leave duplicate tracked tasks for the same development service.
 
 ## Development server lifecycle
 
-After changing source code, styles, configuration, dependencies, or routes, restart the development server before handing work back.
+After changing source code, styles, configuration, dependencies, or routes,
+restart the development server before handing work back.
 
-1. Inspect running processes and stop only this project's development-server process tree.
-2. Start one hidden `npm run dev` process from the repository root. Do not leave duplicate project development servers running.
-3. Confirm the server accepts an HTTP request before completing the task.
-4. Leave the verified development server running so the project owner can review the changes.
+1. Start `npm run dev` from the repository root with `bg_run`, using
+   `isAgent: false` and a descriptive task name. Retain its task ID and output
+   path.
+2. Before starting a replacement, stop the existing tracked development-server
+   task with `bg_kill <task-id>` so only one server runs.
+3. Confirm the task logs show the server started, then confirm it accepts an
+   HTTP request before completing the task.
+4. Leave the verified tracked task running so the project owner can review the
+   changes.
 
-Database maintenance may require the server to remain stopped while the embedded database is locked. Restart and verify the server after maintenance completes.
+Database maintenance may require the server to remain stopped while the embedded
+database is locked. Stop its tracked task first, then restart and verify it
+after maintenance completes.
 
 ## SHD design-system maintenance
 
-Treat `docs/DESIGN_SYSTEM.md` and the shared tokens in `src/app.css` as maintained parts of the product. When a change makes a significant visual or interaction-design decision, update the design system in the same change.
+Treat `docs/DESIGN_SYSTEM.md` and the shared tokens in `src/app.css` as
+maintained parts of the product. When a change makes a significant visual or
+interaction-design decision, update the design system in the same change.
 
-For significant design changes: reuse or extend CSS custom properties from `src/app.css`; update `docs/DESIGN_SYSTEM.md`; refactor repeated UI into a reusable component; verify hover, pressed, focus-visible, pending, disabled, error, success, and reduced-motion behavior. Run `npm run check && npm run build` before completing.
+For significant design changes: reuse or extend CSS custom properties from
+`src/app.css`; update `docs/DESIGN_SYSTEM.md`; refactor repeated UI into a
+reusable component; verify hover, pressed, focus-visible, pending, disabled,
+error, success, and reduced-motion behavior. Run
+`npm run check && npm run build` before completing.
 
-Design principles: tactical but restrained, data-first, square and engineered, orange reserved for action/emphasis, explicit textual state indicators.
+Design principles: tactical but restrained, data-first, square and engineered,
+orange reserved for action/emphasis, explicit textual state indicators.
 
-Minor alignment fixes, isolated bug fixes, and corrections that do not introduce a reusable design decision do not require a documentation update.
+Minor alignment fixes, isolated bug fixes, and corrections that do not introduce
+a reusable design decision do not require a documentation update.
 
 ## Reusable interface patterns
 
-Favor shared components from `src/lib/components`. Before adding page-local markup, check if a shared component covers the need. When introducing a reusable pattern, migrate the clearest existing duplicate in the same change.
+Favor shared components from `src/lib/components`. Before adding page-local
+markup, check if a shared component covers the need. When introducing a reusable
+pattern, migrate the clearest existing duplicate in the same change.
 
-For small, finite option sets, prefer the shared segmented-choice pattern over a dropdown. Use radio semantics for exactly one choice and checkbox semantics for additive independent choices. Reserve dropdowns for long, dynamic, or search-oriented option sets.
+For small, finite option sets, prefer the shared segmented-choice pattern over a
+dropdown. Use radio semantics for exactly one choice and checkbox semantics for
+additive independent choices. Reserve dropdowns for long, dynamic, or
+search-oriented option sets.
 
 ## ISAC editor lifecycle
 
 All ISAC data-management editors must follow the same successful-save behavior:
 
-1. Saving an edit to an existing record closes the editor and returns the user to the registry.
+1. Saving an edit to an existing record closes the editor and returns the user
+   to the registry.
 2. Saving a newly added record keeps the editor open with a fresh blank record.
 3. Validation errors keep the editor open and preserve the entered values.
-4. Server actions must return the add/edit mode and a unique result token; client-side reactive handling must consume each token only once to avoid repeated state updates.
-5. When a successful add keeps an icon-enabled editor open, increment the shared upload reset token so the file input, preview, filename, drag/paste state, validation message, and removal state are fresh for the next record.
+4. Server actions must return the add/edit mode and a unique result token;
+   client-side reactive handling must consume each token only once to avoid
+   repeated state updates.
+5. When a successful add keeps an icon-enabled editor open, increment the shared
+   upload reset token so the file input, preview, filename, drag/paste state,
+   validation message, and removal state are fresh for the next record.
 
 Apply this convention whenever an ISAC editor is added or materially changed.
 
 ## ISAC audit logging
 
-Every successful server-side ISAC mutation must create an append-only audit event. Follow these rules:
+Every successful server-side ISAC mutation must create an append-only audit
+event. Follow these rules:
 
-1. Use the shared audit utilities in `src/lib/server/audit.ts`; do not write directly to `audit_log`.
-2. Record the authenticated operator ID, stable category, specific action (namespaced past tense, e.g. `weapon.updated`), target entity ID, timestamp, and useful before/after snapshots. Categories include `game_data`, `user_access`, `user_moderation`, `identity`, `role_management`.
-3. Capture changes to the primary row and its relationships. Include meaningful previous and resulting sets for linked records.
-4. Create audit records only after validation succeeds. Rejected or failed requests must not appear as successful mutation events.
-5. Never include password hashes, session tokens, magic-link tokens, OAuth state, passkey public-key bytes, SMTP credentials, or environment secrets in audit snapshots.
-6. Audit visibility is controlled by `audit.view`. The read-only `Auditor` role grants `isac.access` and `audit.view` without granting mutation permissions.
-7. Audit reversion is a compensating action, never a history rewrite. Require `audit.revert`, confirmation, current-state comparison, relationship validation, and a new `audit.reverted` event.
-8. Tests for an ISAC mutation must confirm its audit event contains the correct actor, category, action, target, and change evidence.
+1. Use the shared audit utilities in `src/lib/server/audit.ts`; do not write
+   directly to `audit_log`.
+2. Record the authenticated operator ID, stable category, specific action
+   (namespaced past tense, e.g. `weapon.updated`), target entity ID, timestamp,
+   and useful before/after snapshots. Categories include `game_data`,
+   `user_access`, `user_moderation`, `identity`, `role_management`.
+3. Capture changes to the primary row and its relationships. Include meaningful
+   previous and resulting sets for linked records.
+4. Create audit records only after validation succeeds. Rejected or failed
+   requests must not appear as successful mutation events.
+5. Never include password hashes, session tokens, magic-link tokens, OAuth
+   state, passkey public-key bytes, SMTP credentials, or environment secrets in
+   audit snapshots.
+6. Audit visibility is controlled by `audit.view`. The read-only `Auditor` role
+   grants `isac.access` and `audit.view` without granting mutation permissions.
+7. Audit reversion is a compensating action, never a history rewrite. Require
+   `audit.revert`, confirmation, current-state comparison, relationship
+   validation, and a new `audit.reverted` event.
+8. Tests for an ISAC mutation must confirm its audit event contains the correct
+   actor, category, action, target, and change evidence.
 
 ## Prototype compatibility
 
-Treat application data and client payloads as prototype formats until the project owner declares a production-stable format.
+Treat application data and client payloads as prototype formats until the
+project owner declares a production-stable format.
 
-1. Prefer one current validated schema over compatibility readers, repair branches, dual writes, or fallback parsing for obsolete formats.
-2. Remove incompatible local drafts, saved builds, calibration snapshots, and other derived records through a backed-up migration when the current model cannot represent them safely.
-3. Preserve authored game data whenever the new model can retain it without guessing.
-4. Follow the database-preservation rules before removing or reshaping persistent data.
-5. Add compatibility support only when the project owner requires it for a production-stable format.
+1. Prefer one current validated schema over compatibility readers, repair
+   branches, dual writes, or fallback parsing for obsolete formats.
+2. Remove incompatible local drafts, saved builds, calibration snapshots, and
+   other derived records through a backed-up migration when the current model
+   cannot represent them safely.
+3. Preserve authored game data whenever the new model can retain it without
+   guessing.
+4. Follow the database-preservation rules before removing or reshaping
+   persistent data.
+5. Add compatibility support only when the project owner requires it for a
+   production-stable format.
 
 ## Talent mechanic conventions
 
-Before importing a Talent or changing its mechanic program, read `docs/TALENT_MECHANIC_RULES.md`. Treat the confirmed lifecycle, trigger, cooldown, and targeting rules in that document as authoritative game behavior. Do not mark a mechanic `requires_assumptions` for behavior that the document resolves. When the project owner clarifies another Talent mechanic, record the answer in `docs/TALENT_MECHANIC_RULES.md`.
+Before importing a Talent or changing its mechanic program, read
+`docs/TALENT_MECHANIC_RULES.md`. Treat the confirmed lifecycle, trigger,
+cooldown, and targeting rules in that document as authoritative game behavior.
+Do not mark a mechanic `requires_assumptions` for behavior that the document
+resolves. When the project owner clarifies another Talent mechanic, record the
+answer in `docs/TALENT_MECHANIC_RULES.md`.
 
 ## Database preservation
 
-Development data is valuable. Treat embedded database files as persistent user data, not disposable build artifacts.
+Treat embedded database files as persistent user data, not disposable build
+artifacts.
 
-Before destructive work on the database, stop the dev server, then create a verified timestamped JSON backup with `npm run db:backup`. Keep backups out of Git (they can contain user records). Prefer additive, repeatable schema migrations over database recreation. Report the backup path when completing database-destructive work.
+Before destructive work on the database, stop the dev server, then create a
+verified timestamped JSON backup with `npm run db:backup`. Keep backups out of
+Git (they can contain user records). Prefer additive, repeatable schema
+migrations over database recreation. Report the backup path when completing
+database-destructive work.
 
-Use `npm run db:restore -- <backup-file>` only with an empty, migrated target database — it refuses to merge into a populated database.
+Use `npm run db:restore -- <backup-file>` only with an empty, migrated target
+database. The command refuses to merge into a populated database.
 
 ## Development database maintenance
 
-1. Stop only this project's development-server process tree.
+1. Stop this project's tracked development-server task with `bg_kill <task-id>`.
 2. Run and verify `npm run db:backup`. Retain and report the backup path.
-3. Apply the migration or maintenance operation. Verify schema state, record counts, and critical entities.
-4. If an operation fails, preserve logs and the verified backup rather than improvising against the database.
+3. Apply the migration or maintenance operation. Verify schema state, record
+   counts, and critical entities.
+4. If an operation fails, preserve logs and the verified backup rather than
+   improvising against the database.
 5. Restart the dev server, then confirm a basic health or page check.
 
-Production and staging backups and deployment are defined in `docs/DEPLOYMENT.md`.
+Production and staging backups and deployment are defined in
+`docs/DEPLOYMENT.md`.

CONTEXT.md

@@ -0,0 +1,271 @@
+# SHD.build Domain
+
+SHD.build is an independent community intelligence platform for _The Division
+Resurgence_. This glossary defines the language used for player planning, shared
+content, Game Data, governance, equipment, progression, and modeled mechanics.
+
+## Product and people
+
+**SHD.build**: The community platform described by this glossary. Always
+capitalize `SHD` and write the product name as `SHD.build`. _Avoid_: SHD Build,
+SHD Builder
+
+**Agent**: Any person using SHD.build, whether anonymous or authenticated.
+_Avoid_: User, visitor, player when referring to product access
+
+**Anonymous Agent**: An Agent who is not signed in to SHD.build. _Avoid_:
+Visitor, guest
+
+**Registered Agent**: An Agent with an SHD.build account. _Avoid_: Registered
+user, member
+
+**Modeling Session**: An interactive agentic work session that prepares one
+Mechanic Program at a time for a Registered Agent to confirm in chat before the
+session submits it through an existing ISAC action. _Avoid_: Agent, Modeling
+Client, bulk job
+
+**Contributor**: A Registered Agent who has accepted the contributor guidelines
+and may submit proposed Game Data changes for review. _Avoid_: Editor when the
+Agent cannot change Canonical Game Data directly
+
+**Operator**: A Registered Agent performing an authorized task in ISAC.
+Contributor, reviewer, moderator, and administrator authority remain distinct
+from this situational term. _Avoid_: Admin as a generic name for anyone using
+ISAC
+
+**Oversight**: The human review function for proposed Game Data, moderated
+Community Content, and identity assets. Use the qualified names Data Oversight,
+Community Oversight, Guide Oversight, and Avatar Oversight when the review area
+matters. _Avoid_: Moderation as a name for every review function
+
+## Planning and shared content
+
+**Builder**: The planning tool an Agent uses to configure a Loadout and inspect
+supported calculations. _Avoid_: Build when referring to the tool
+
+**Loadout**: A complete planned character configuration, including selected
+Equipment, progression choices, and combat assumptions. A Loadout may exist
+without becoming a saved Build. _Avoid_: Build when persistence, ownership, or
+sharing matters
+
+**Loadout Draft**: An editable Loadout that has not become a saved Build.
+Anonymous and Registered Agents may both work with drafts. _Avoid_: Build draft
+
+**Build**: A saved, owned, and shareable planning artifact whose central content
+is a Loadout. A Build may be Private, Unlisted, or Public and may derive from
+another Build. _Avoid_: Loadout when persistence, ownership, or sharing matters
+
+**Guide**: A revisioned long-form community article that may include snapshots
+of one or more Builds. A Guide is prose-led content rather than a Loadout
+container. _Avoid_: Build guide when referring to every Guide
+
+**News Article**: A revisioned editorial or syndicated article published through
+the News channel. _Avoid_: Guide, post
+
+**Article Revision**: An immutable edition of a Guide or News Article. Editors
+select one revision for publication while later revisions may await review.
+_Avoid_: Version when referring to published article history
+
+**Community Content**: Agent-authored comments, profile biographies, custom
+avatars, and Guides governed by the shared moderation lifecycle. _Avoid_:
+User-generated content, UGC
+
+**Community Note**: A visible comment that Community Oversight pins to a Public
+Database discussion. It remains Community Content and follows the same removal
+rules as other comments. _Avoid_: Official correction, staff note
+
+**Content Report**: An Agent's request for Oversight to review visible Community
+Content, with no immediate change to the content's visibility. _Avoid_: Takedown
+request
+
+**Public Database**: The Agent-facing reference view of Canonical Game Data.
+_Avoid_: Database when the term could mean application storage
+
+## Game Data and governance
+
+**Game Data**: Community-maintained structured facts about _The Division
+Resurgence_ used by the Public Database, Builder, Builds, and contribution
+workflow. _Avoid_: Source data, builder data, reference data
+
+**Canonical Game Data**: The authoritative, approved body of Game Data. _Avoid_:
+Live data, production data
+
+**Canonical Record**: One authoritative record within Canonical Game Data.
+_Avoid_: Approved proposal
+
+**Contribution Proposal**: A pending request from a Contributor to create or
+change Canonical Game Data. Approval still requires the proposed change to
+satisfy the canonical rules for its record family. _Avoid_: Draft record,
+pending record
+
+**ISAC**: The operational console for Game Data, contribution review, community
+governance, identity and access management, audit history, and system
+operations. _Avoid_: Admin panel, calculation engine
+
+**Registry**: An ISAC workspace containing one family of related records and its
+management controls. _Avoid_: Table, list page
+
+**Audit Event**: An immutable account of a consequential operation or review
+decision, including the actor, target, and change evidence. _Avoid_: Audit-log
+row, activity log
+
+**Compensating Reversion**: A new operation that restores an earlier state while
+preserving the original Audit Event and recording the reversal. _Avoid_:
+Rollback, undo when either implies rewriting history
+
+## Equipment and progression
+
+**Equipment**: The items and enhancements selected for a Loadout, including
+Weapons, Gear, Weapon Mods, Gear Mods, Skill Chips, and an OS Protocol. _Avoid_:
+Item when the equipment relationship matters
+
+**Gear**: Equippable protective equipment assigned to a character slot. Gear may
+provide core values, Attributes, a Brand Set, a Talent, and augmentation
+capacity. _Avoid_: Armor as a collective name for all Gear
+
+**Body Armor**: The canonical name for the equippable torso Gear slot. _Avoid_:
+Vest
+
+**Weapon**: An equippable firearm with a Weapon Category, damage and handling
+properties, progression values, and applicable Talents and Mods. _Avoid_: Gun
+when referring to the modeled record
+
+**Weapon Category**: The classification that groups Weapons as Shotgun, Rifle,
+MMR, AR, LMG, or SMG. _Avoid_: Weapon type, weapon family
+
+**Weapon Mod**: An enhancement fitted to a compatible Weapon slot. Regular and
+Exotic Weapon Mods follow different selection rules. _Avoid_: Attachment
+
+**Gear Mod**: An enhancement fitted to Gear according to the Gear's available
+mod capacity. _Avoid_: Tactical Augment
+
+**Tactical Augment**: A numbered augmentation position recorded on selected Gear
+in a Loadout. _Avoid_: Gear Mod
+
+**Attribute**: A named measurable game property with defined units and
+calculation meaning. _Avoid_: Stat when referring to the canonical Attribute
+catalog
+
+**Core Attribute**: One of the three primary character alignments: Firepower,
+Toughness, or Engineering. _Avoid_: Main stat, primary stat
+
+**Brand Set**: A Gear identity whose bonuses depend on how many pieces from that
+set the Loadout equips. _Avoid_: Gear set
+
+**Quality**: The item classification Standard, Specialized, Superior, or
+High-end. Quality governs available or scaled properties for applicable
+Equipment. _Avoid_: Rarity
+
+**Exotic**: A special scope used by certain Weapons, Talents, and Weapon Mods.
+Exotic is not a fifth Quality. _Avoid_: Exotic quality
+
+**Item Level**: An Equipment progression coordinate used to resolve
+level-dependent values. _Avoid_: Tier, Quality
+
+**Equipment Tier**: The T0, T1, or T2 progression band that controls Equipment
+capabilities and values. _Avoid_: Talent Tier, Item Level
+
+**Talent Tier**: The Tier I or Tier II value variant of a Talent. _Avoid_:
+Equipment Tier, T1, T2 when the distinction could be unclear
+
+**Reference Level**: The Item Level at which an observed value or range applies.
+_Avoid_: Base level
+
+**Hidden Base**: A level-independent value inferred from observed Equipment
+values and the game's progression rules. _Avoid_: Displayed Value, Raw Value
+
+**Raw Value**: A calculated value before the presentation rules that reproduce
+the game's displayed number. _Avoid_: Hidden Base, Displayed Value
+
+**Displayed Value**: The player-visible number produced after applying the
+game's presentation rules to a Raw Value. _Avoid_: Raw Value
+
+**OS Protocol**: A single equipped progression item with a Quality, Core
+Attribute alignment, primary effect, inherited secondary profile, and
+upgradeable Talent. _Avoid_: Protocol when the operating-system meaning could be
+inferred
+
+**Skill**: A selectable combat capability associated with a Specialization.
+Skills may own Skill Chip Sets and may have explicit compatibility relationships
+with another Skill. _Avoid_: Ability or Specialization Ability for the
+selectable game concept
+
+**Signature Skill**: A Specialization's defining Skill, distinguished from its
+other selectable Skills. _Avoid_: Signature ability
+
+**Skill Chip**: An Equipment selection that modifies the Skill occupying its
+Loadout position. Skill Chips belong to a Skill Chip Set and may provide
+primary, secondary, and set effects. _Avoid_: Chip when the equipment family is
+unclear
+
+**Skill Chip Set**: A reusable Skill Chip definition associated with a Skill,
+including its set bonus and optional Talent. An explicit compatibility
+relationship may let another Skill equip the set. _Avoid_: Skill set
+
+**Specialization**: A character progression identity containing Focuses, Skills,
+and progression choices. _Avoid_: Class
+
+**Focus**: A path within a Specialization aligned to one Core Attribute and
+defining a selection of Skills and progression choices. _Avoid_: Subclass,
+specialization path
+
+**Talent**: A named conditional behavior owned by its source, such as a Weapon,
+Gear item, OS Protocol, or Skill Chip Set. Different Talent sources may use
+different progression variants. _Avoid_: Perk, passive
+
+## Modeled mechanics
+
+**Mechanic Program**: The structured, source-owned description of a Talent or
+other conditional behavior. It captures the conditions, state changes, and
+outcomes needed to evaluate that behavior. _Avoid_: Script, Trigger record
+
+**Event**: An observed occurrence on a combat timeline that a Mechanic Program
+may inspect. _Avoid_: Trigger when referring to the occurrence itself
+
+**Trigger Condition**: The criteria that an Event must satisfy before a mechanic
+can proceed toward Activation. A Trigger Condition is part of a Mechanic
+Program, not a standalone Game Data record. _Avoid_: Trigger as an entity
+
+**Activation**: A successful mechanic occurrence after its Event, conditions,
+chance, and Cooldown requirements resolve. _Avoid_: Proc when precision matters
+
+**Cooldown**: The period after a successful Activation during which the same
+mechanic cannot activate again. A failed chance does not begin the Cooldown.
+_Avoid_: Delay
+
+**Mechanic State**: A value retained across Events for one mechanic, such as a
+flag, count, stack, duration, mark, or resource. _Avoid_: Runtime state when
+discussing game behavior
+
+**Outcome**: The effect emitted by an activated mechanic, such as an Attribute
+change, damage, restoration, resource change, or marker. _Avoid_: Effect when
+the source Talent and emitted result could be confused
+
+**Combat Profile**: The encounter assumptions and observed rates used to project
+a Loadout's combat performance. _Avoid_: Simulation when no event simulation
+occurs
+
+**Scenario Input**: An explicit encounter assumption required to evaluate a
+mechanic whose result cannot be determined from the Loadout alone. _Avoid_:
+Guess, default assumption
+
+**Ready**: The mechanic readiness state indicating that typed Game Data can
+evaluate the mechanic without additional Scenario Inputs. _Avoid_: Complete
+
+**Requires Assumptions**: The mechanic readiness state indicating that
+evaluation needs one or more explicit Scenario Inputs. _Avoid_: Ready,
+unsupported
+
+**Captured Only**: The mechanic readiness state indicating that SHD.build
+preserves the authored behavior but cannot calculate it. _Avoid_: Unsupported
+when the behavior has still been recorded
+
+**Extra Health**: Temporary Health granted in addition to an Agent's normal
+Health. Each grant remains distinct from later changes to the current Extra
+Health total. _Avoid_: Health, healing, bonus armor
+
+**Hit Taken**: A hit received by an Agent, including one absorbed by Extra
+Health. A Hit Taken does not require normal Health loss. _Avoid_: Taking Damage
+
+**Taking Damage**: A loss of an Agent's normal Health. A hit absorbed by Extra
+Health does not count as Taking Damage. _Avoid_: Hit Taken

Dockerfile

@@ -2,7 +2,8 @@
 FROM node:24-bookworm-slim AS dependencies
 WORKDIR /app
 COPY package.json package-lock.json .npmrc ./
-RUN npm ci
+COPY scripts/prepare.mjs ./scripts/prepare.mjs
+RUN npm ci --ignore-scripts && npm rebuild argon2
 
 FROM dependencies AS build
 COPY vite.config.ts tsconfig.json ./
@@ -13,24 +14,42 @@ RUN npm run build:app
 FROM node:24-bookworm-slim AS runtime-dependencies
 WORKDIR /app
 COPY package.json package-lock.json .npmrc ./
-RUN npm ci --omit=dev && npm cache clean --force
+COPY scripts/prepare.mjs ./scripts/prepare.mjs
+RUN npm ci --omit=dev --ignore-scripts && npm rebuild argon2 && npm cache clean --force
 
 FROM node:24-bookworm-slim AS runtime
+ARG TARGETARCH=amd64
+ARG INFISICAL_CLI_VERSION=0.43.116
 LABEL org.opencontainers.image.title="shd-build"
 ENV NODE_ENV=production \
 	HOST=0.0.0.0 \
 	PORT=3000 \
+	INFISICAL_DOMAIN=https://secrets.jb.codes \
+	INFISICAL_DISABLE_UPDATE_CHECK=true \
 	TDR_DATABASE_PATH=/app/data/shd-build.db \
 	TDR_AVATAR_STORAGE_PATH=/app/data/avatars \
 	TDR_GAME_ICON_STORAGE_PATH=/app/data/game-icons
 WORKDIR /app
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends ca-certificates curl fonts-dejavu-core gosu \
+	&& useradd --uid 10001 --gid node --no-create-home --shell /usr/sbin/nologin shd-runtime \
+	&& case "$TARGETARCH" in \
+		amd64) infisical_sha256=53abc96a3bc872ade81efe156275bd30c53f9ee8b52965b0c9cb320a9c814fbc ;; \
+		arm64) infisical_sha256=0111d8e7daa5f3c498a8cc6cb9852bde2c5c21e53c935d4738ddd80c764554cc ;; \
+		*) echo "Unsupported Infisical CLI architecture: $TARGETARCH" >&2; exit 1 ;; \
+	esac \
+	&& curl -fsSL "https://github.com/Infisical/cli/releases/download/v${INFISICAL_CLI_VERSION}/cli_${INFISICAL_CLI_VERSION}_linux_${TARGETARCH}.tar.gz" -o /tmp/infisical.tar.gz \
+	&& echo "$infisical_sha256  /tmp/infisical.tar.gz" | sha256sum -c - \
+	&& tar -xzf /tmp/infisical.tar.gz -C /usr/local/bin infisical \
+	&& chmod 755 /usr/local/bin/infisical \
+	&& rm -f /tmp/infisical.tar.gz \
+	&& rm -rf /var/lib/apt/lists/*
 COPY --from=runtime-dependencies --chown=node:node /app/node_modules ./node_modules
 COPY --from=build --chown=node:node /app/build ./build
 COPY --chown=node:node database ./database
 COPY --chown=node:node scripts ./scripts
 COPY --chown=node:node deploy/container-entrypoint.sh ./deploy/container-entrypoint.sh
-RUN chmod 755 ./deploy/container-entrypoint.sh && mkdir -p /app/data && chown node:node /app/data
-USER node
+RUN chmod 755 ./deploy/container-entrypoint.sh ./scripts/runtime-launcher.mjs && mkdir -p /app/data && chown node:node /app/data && chmod 0770 /app/data
 EXPOSE 3000
 VOLUME ["/app/data"]
 ENTRYPOINT ["./deploy/container-entrypoint.sh"]

PRODUCT.md

@@ -8,7 +8,7 @@ web
 
 ## Users
 
-SHD.build serves active *The Division Resurgence* players who need reliable game
+SHD.build serves active _The Division Resurgence_ players who need reliable game
 data, accurate loadout planning, build sharing, and community guides.
 
 Registered players can save and share builds, publish guides, participate in
@@ -21,8 +21,8 @@ administrators manage users, roles, system configuration, and operations.
 
 ## Product Purpose
 
-SHD.build is an independent community intelligence platform for *The Division
-Resurgence*. It includes a public game database, calculated loadout builder,
+SHD.build is an independent community intelligence platform for _The Division
+Resurgence_. It includes a public game database, calculated loadout builder,
 shared builds, guides, news, and community participation.
 
 Players should understand game systems, create accurate loadouts, learn from
@@ -41,7 +41,8 @@ Player-facing planning and reference experiences use the same moderated data.
 
 Players use the site to plan characters, compare drops, reproduce in-game
 equipment, browse community recommendations, and respond to game updates. The
-interface must work from mobile devices through high-resolution desktop displays.
+interface must work from mobile devices through high-resolution desktop
+displays.
 
 The principal public channels are News, Database, Builds, Guides, and Builder.
 Account management includes authentication methods, profile identity, avatars,
@@ -58,12 +59,12 @@ connect proposed records to pending records before approval.
 - The application is built with SvelteKit and Svelte.
 - Persistent application data uses the embedded `@tursodatabase/database`
   package. Turso Cloud is not required.
-- Development, staging, and production use distinct databases. Embedded
-  database files and uploaded assets are persistent user data and must survive
+- Development, staging, and production use distinct databases. Embedded database
+  files and uploaded assets are persistent user data and must survive
   deployments and additive schema migrations.
 - Authentication supports passkeys, emailed magic links, Discord OAuth, and
-  optional username/password credentials. An account must always retain at
-  least one usable sign-in method.
+  optional username/password credentials. An account must always retain at least
+  one usable sign-in method.
 - Anonymous builder drafts may use local storage. Database-backed sharing
   requires an account.
 - Saved builds support private, unlisted, and public visibility.
@@ -78,13 +79,13 @@ connect proposed records to pending records before approval.
 - Major data changes preserve contributor-entered data through verified backups
   and additive migrations with minimal development-server downtime.
 - SHD.build is an independent fan site. Ubisoft and the relevant owners retain
-  rights to *Tom Clancy's The Division*, *The Division Resurgence*, and their
+  rights to _Tom Clancy's The Division_, _The Division Resurgence_, and their
   associated intellectual property and assets.
 
 ## Brand Commitments
 
 The product name is `SHD.build`, with `SHD` capitalized. The product serves the
-full *The Division Resurgence* community, including loadout planning.
+full _The Division Resurgence_ community, including loadout planning.
 
 Use restrained in-universe operational language such as agent, ISAC, Oversight,
 intelligence, access, transmission, and registry when it improves comprehension.
@@ -134,8 +135,8 @@ identity controls must follow their respective provider requirements.
 
 SHD.build targets WCAG 2.2 AA. Interfaces must support keyboard navigation,
 clear focus-visible states, screen-reader semantics, sufficient contrast,
-reduced-motion preferences, and layouts that work from mobile screens through
-4K desktop displays.
+reduced-motion preferences, and layouts that work from mobile screens through 4K
+desktop displays.
 
 State and meaning cannot depend on color, icons, hover, or motion alone.
 Controls need usable touch targets. User identity must support non-ASCII display

README.md

@@ -1,8 +1,8 @@
 # SHD.build
 
-A SvelteKit community application for *The Division Resurgence*. SHD.build
-combines a public game database, loadout builder, shared builds, guides,
-account management, and the ISAC data-management console.
+A SvelteKit community application for _The Division Resurgence_. SHD.build
+combines a public game database, loadout builder, shared builds, guides, account
+management, and the ISAC data-management console.
 
 See `docs/architecture.md` for the implementation model.
 
@@ -17,13 +17,12 @@ Create or update the local database:
 npm run db:migrate
 ```
 
-The default file is `data/shd-build.db`. Copy `.env.example` to `.env` and
-set a different location if needed.
+The Infisical `dev` environment sets the local file to
+`./data/shd-build-development.db`.
 
 Store custom avatars as metadata-free 256 × 256 WebP files. Set
-`TDR_AVATAR_STORAGE_PATH` to a persistent, writable directory in production;
-it defaults to `data/avatars`. The same configuration works on Windows and
-Linux.
+`TDR_AVATAR_STORAGE_PATH` to a persistent, writable directory in production; it
+defaults to `data/avatars`. The same configuration works on Windows and Linux.
 
 Seed the initial local accounts once:
 
@@ -31,9 +30,10 @@ Seed the initial local accounts once:
 npm run db:seed-users
 ```
 
-The seed creates administrator `Aewyn` and standard user `Quartermaster`.
-It generates and displays strong temporary passwords once, then stores only
-salted Argon2id hashes.
+The seed creates `Aewyn` and `Quartermaster` with the standard user role. It
+generates and displays strong temporary passwords once, then stores only salted
+Argon2id hashes. The separate bootstrap policy promotes the first authenticated
+account when no administrator exists.
 
 ## Develop
 
@@ -41,30 +41,28 @@ salted Argon2id hashes.
 npm run dev
 ```
 
-## Encrypted environment files
+## Infisical secrets
 
-Keep development, staging, and production settings in the committed, encrypted
-`.env.development`, `.env.staging`, and `.env.production` files. Keep private
-decryption keys only in the ignored `.env.keys` file and back it up in a
-password manager.
+The committed `.infisical.json` connects the project to the self-hosted
+Infisical instance at `https://secrets.jb.codes`. Authenticate the local CLI
+once. The CLI uses its configured system vault and can fall back to an encrypted
+file vault when the operating-system keyring is unavailable.
 
 ```sh
-npm run env:decrypt              # decrypt all environment files for editing
-npm run env:encrypt              # encrypt all environment files again
-npm run env:stage                # encrypt and git-add all environment files
-npm run env:decrypt:development  # operate on one environment
-npm run env:decrypt:staging
-npm run env:decrypt:production
-npm run env:sync:staging-credentials # copy shared Discord/SMTP values from development
+npx infisical login --domain=https://secrets.jb.codes
+npm run dev
 ```
 
-The repository pre-commit hook runs `env:stage` and replaces staged plaintext
-environment files with encrypted versions. Git has no pre-add hook. Use
-`npm run env:stage` instead of directly adding these two files.
+Local commands use the `dev` environment. Application configuration lives under
+`/app`; the scheduler bearer token lives under `/shared/scheduler`. Staging and
+production commands select the `staging` and `prod` environments explicitly.
+`npm run check`, `npm test`, and `npm run build` do not contact Infisical.
 
-Keep `.env.keys` out of Git and retain a backup. Production deployments receive
-`DOTENV_PRIVATE_KEY_PRODUCTION` through their secret manager; do not copy the
-keys file to the server.
+Staging and production containers authenticate at startup with separate
+Universal Auth identities. Gitea stores each client secret, while repository
+variables hold the matching non-secret client IDs. The containers fetch current
+values before migration or startup and stop if authentication or validation
+fails.
 
 ## Containers and staging deployment
 
@@ -73,23 +71,25 @@ The application uses the official SvelteKit Node adapter and a multi-stage
 game-data icons under `/app/data` on a persistent volume. Inject runtime secrets
 when the container starts; keep them out of the image.
 
-[docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) documents the staging Compose topology
-and Gitea Actions deployment. A push to `main` validates the application,
-builds the candidate image while staging stays online, stops the application
-and scheduler for the database backup and migration, then starts the release.
+[docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) documents the staging and production
+Compose topologies. A push to `main` triggers both deployment workflows. Each
+workflow validates Infisical access and the candidate image while the current
+service stays online, then stops its application and scheduler for backup and
+migration.
 
 ## Passwordless authentication
 
 Use passkeys as the preferred sign-in method. Set `APP_ORIGIN` to the exact
 public origin for registration and authentication. Set `PASSKEY_RP_ID` to that
 hostname or a registrable parent domain. Hosted environments use `shd.build`,
-which permits credentials on `shd.build` and `dev.shd.build`. Use `localhost`
-for direct local development.
+which permits credentials on `shd.build`, `stage.shd.build`, and
+`dev.shd.build`. Use `localhost` for direct local development.
 
-Magic links require `SMTP_HOST`, `SMTP_PORT`, `SMTP_SECURE`, `SMTP_USER`,
-`SMTP_PASSWORD`, and `SMTP_FROM`. Use `SMTP_SECURE=true` on port 465. Use
-`false` on port 587 and upgrade with STARTTLS. An account owner activates an
-email identity by following a 15-minute, single-use verification link.
+Magic links require `SMTP_HOST` and `SMTP_FROM`. `SMTP_PORT` defaults to `587`.
+Set `SMTP_SECURE=true` for implicit TLS, normally on port 465; the default
+`false` uses STARTTLS. If the SMTP server requires authentication, set both
+`SMTP_USER` and `SMTP_PASSWORD`. An account owner activates an email identity by
+following a 15-minute, single-use verification link.
 
 ## Validate
 
@@ -98,46 +98,6 @@ npm run check
 npm run build
 ```
 
-[`sv`](https://github.com/sveltejs/cli) creates and configures Svelte projects.
-
-## Creating a project
-
-```sh
-# create a new project
-npx sv create my-app
-```
-
-To recreate this project with the same configuration:
-
-```sh
-# recreate this project
-npx sv@0.16.5 create --template minimal --types ts --install npm .
-```
-
-## Developing
-
-Install dependencies with `npm install` (or `pnpm install` or `yarn`), then
-start a development server:
-
-```sh
-npm run dev
-
-# or start the server and open the app in a new browser tab
-npm run dev -- --open
-```
-
-## Building
-
-Build a production version:
-
-```sh
-npm run build
-```
-
-Preview the production build with `npm run preview`.
-
-> Deployments may require an [adapter](https://svelte.dev/docs/kit/adapters) for the target environment.
-
 The shared visual language and dashboard conventions are documented in
 [docs/DESIGN_SYSTEM.md](docs/DESIGN_SYSTEM.md).
 

database/schema.sql

@@ -138,14 +138,212 @@ CREATE INDEX IF NOT EXISTS oversight_notification_queue_due_idx ON oversight_not
 CREATE INDEX IF NOT EXISTS oversight_notification_queue_user_category_idx ON oversight_notification_queue(user_id, oversight_category, delivered_at);
 CREATE INDEX IF NOT EXISTS avatar_reviews_status_submitted_idx ON avatar_reviews(status, submitted_at DESC);
 CREATE INDEX IF NOT EXISTS avatar_reviews_user_submitted_idx ON avatar_reviews(user_id, submitted_at DESC);
-  CREATE TABLE IF NOT EXISTS builds (id TEXT PRIMARY KEY, owner_id TEXT NOT NULL REFERENCES users(id), title TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, visibility TEXT NOT NULL DEFAULT 'private', summary TEXT, guide_body TEXT, source_build_id TEXT REFERENCES builds(id), loadout_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
+  CREATE TABLE IF NOT EXISTS builds (id TEXT PRIMARY KEY, owner_id TEXT NOT NULL REFERENCES users(id), title TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, visibility TEXT NOT NULL DEFAULT 'private' CHECK(visibility IN ('private','unlisted','public')), source_build_id TEXT REFERENCES builds(id), loadout_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
   CREATE INDEX IF NOT EXISTS builds_visibility_updated_idx ON builds(visibility, updated_at DESC);
 CREATE TABLE IF NOT EXISTS build_items (id TEXT PRIMARY KEY, build_id TEXT NOT NULL REFERENCES builds(id) ON DELETE CASCADE, slot_id TEXT NOT NULL, item_definition_id TEXT NOT NULL, configuration_json TEXT NOT NULL);
 CREATE TABLE IF NOT EXISTS ratings (user_id TEXT NOT NULL REFERENCES users(id), build_id TEXT NOT NULL REFERENCES builds(id) ON DELETE CASCADE, value INTEGER NOT NULL CHECK(value BETWEEN 1 AND 5), PRIMARY KEY(user_id, build_id));
+CREATE TABLE IF NOT EXISTS articles (
+	id TEXT PRIMARY KEY,
+	kind TEXT NOT NULL CHECK(kind IN ('guide','news')),
+	owner_id TEXT NOT NULL REFERENCES users(id),
+	slug TEXT NOT NULL,
+	visibility TEXT NOT NULL DEFAULT 'private' CHECK(visibility IN ('private','unlisted','public')),
+	published_revision_id TEXT REFERENCES article_revisions(id),
+	pending_revision_id TEXT REFERENCES article_revisions(id),
+	moderation_hold INTEGER NOT NULL DEFAULT 0 CHECK(moderation_hold IN (0,1)),
+	created_at TEXT NOT NULL,
+	updated_at TEXT NOT NULL,
+	published_at TEXT,
+	deleted_at TEXT,
+	deleted_by TEXT REFERENCES users(id),
+	UNIQUE(kind,slug),
+	CHECK(published_revision_id IS NOT NULL OR visibility='private'),
+	CHECK(deleted_at IS NULL OR visibility='private')
+);
+CREATE INDEX IF NOT EXISTS articles_owner_kind_updated_idx ON articles(owner_id,kind,updated_at DESC);
+CREATE INDEX IF NOT EXISTS articles_public_kind_published_idx ON articles(kind,published_at DESC)
+	WHERE visibility='public' AND deleted_at IS NULL AND published_revision_id IS NOT NULL;
+CREATE TABLE IF NOT EXISTS article_drafts (
+	article_id TEXT PRIMARY KEY REFERENCES articles(id) ON DELETE CASCADE,
+	title TEXT NOT NULL DEFAULT '',
+	deck TEXT NOT NULL DEFAULT '',
+	document_json TEXT NOT NULL CHECK(json_valid(document_json)),
+	tags_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(tags_json)),
+	channel TEXT,
+	cover_image_id TEXT REFERENCES managed_images(id) ON DELETE SET NULL,
+	cover_alt TEXT NOT NULL DEFAULT '',
+	cover_caption TEXT NOT NULL DEFAULT '',
+	version INTEGER NOT NULL DEFAULT 1 CHECK(version>=1),
+	updated_by TEXT NOT NULL REFERENCES users(id),
+	updated_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS article_revisions (
+	id TEXT PRIMARY KEY,
+	article_id TEXT NOT NULL REFERENCES articles(id),
+	revision_number INTEGER NOT NULL CHECK(revision_number>=1),
+	title TEXT NOT NULL CHECK(length(trim(title)) BETWEEN 2 AND 140),
+	deck TEXT NOT NULL DEFAULT '',
+	document_json TEXT NOT NULL CHECK(json_valid(document_json)),
+	plain_text TEXT NOT NULL,
+	channel TEXT,
+	cover_image_id TEXT REFERENCES managed_images(id) ON DELETE SET NULL,
+	cover_alt TEXT NOT NULL DEFAULT '',
+	cover_caption TEXT NOT NULL DEFAULT '',
+	snapshot_hash TEXT NOT NULL CHECK(length(snapshot_hash)=64),
+	created_from_draft_version INTEGER NOT NULL CHECK(created_from_draft_version>=1),
+	created_by TEXT NOT NULL REFERENCES users(id),
+	created_at TEXT NOT NULL,
+	UNIQUE(article_id,revision_number)
+);
+CREATE INDEX IF NOT EXISTS article_revisions_article_created_idx ON article_revisions(article_id,created_at DESC);
+CREATE TABLE IF NOT EXISTS article_revision_build_embeds (
+	revision_id TEXT NOT NULL REFERENCES article_revisions(id) ON DELETE CASCADE,
+	embed_key TEXT NOT NULL,
+	ordinal INTEGER NOT NULL CHECK(ordinal>=0),
+	build_id TEXT NOT NULL REFERENCES builds(id),
+	owner_shared INTEGER NOT NULL DEFAULT 0 CHECK(owner_shared IN (0,1)),
+	build_snapshot_json TEXT NOT NULL CHECK(json_valid(build_snapshot_json)),
+	PRIMARY KEY(revision_id,embed_key),
+	UNIQUE(revision_id,ordinal)
+);
+CREATE INDEX IF NOT EXISTS article_revision_build_embeds_build_idx ON article_revision_build_embeds(build_id,revision_id);
+CREATE TABLE IF NOT EXISTS article_media (
+	article_id TEXT NOT NULL REFERENCES articles(id) ON DELETE CASCADE,
+	image_id TEXT NOT NULL UNIQUE REFERENCES managed_images(id) ON DELETE CASCADE,
+	uploaded_by TEXT NOT NULL REFERENCES users(id),
+	created_at TEXT NOT NULL,
+	PRIMARY KEY(article_id,image_id)
+);
+CREATE TABLE IF NOT EXISTS article_tags (
+	id TEXT PRIMARY KEY,
+	group_name TEXT NOT NULL CHECK(group_name IN ('topic','activity','difficulty','specialization','focus','weapon','news_channel')),
+	name TEXT NOT NULL,
+	slug TEXT NOT NULL UNIQUE,
+	source_type TEXT,
+	source_id TEXT,
+	active INTEGER NOT NULL DEFAULT 1 CHECK(active IN (0,1)),
+	UNIQUE(source_type,source_id)
+);
+CREATE TABLE IF NOT EXISTS article_revision_tags (
+	revision_id TEXT NOT NULL REFERENCES article_revisions(id) ON DELETE CASCADE,
+	tag_id TEXT NOT NULL REFERENCES article_tags(id),
+	ordinal INTEGER NOT NULL CHECK(ordinal>=0),
+	PRIMARY KEY(revision_id,tag_id),
+	UNIQUE(revision_id,ordinal)
+);
+CREATE INDEX IF NOT EXISTS article_revision_tags_tag_idx ON article_revision_tags(tag_id,revision_id);
+CREATE TABLE IF NOT EXISTS article_publication_requests (
+	id TEXT PRIMARY KEY,
+	article_id TEXT NOT NULL REFERENCES articles(id),
+	revision_id TEXT NOT NULL REFERENCES article_revisions(id),
+	base_published_revision_id TEXT REFERENCES article_revisions(id),
+	requested_visibility TEXT NOT NULL CHECK(requested_visibility IN ('unlisted','public')),
+	status TEXT NOT NULL CHECK(status IN ('scanning','pending_review','approved','rejected','superseded')),
+	scan_id TEXT UNIQUE REFERENCES content_moderation_scans(id),
+	requested_by TEXT NOT NULL REFERENCES users(id),
+	requested_at TEXT NOT NULL,
+	decided_by TEXT REFERENCES users(id),
+	decided_at TEXT,
+	decision_reason TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS article_publication_requests_active_idx ON article_publication_requests(article_id)
+	WHERE status IN ('scanning','pending_review');
+CREATE TABLE IF NOT EXISTS guide_curations (
+	article_id TEXT PRIMARY KEY REFERENCES articles(id) ON DELETE CASCADE,
+	pinned_order INTEGER CHECK(pinned_order IS NULL OR pinned_order>=0),
+	featured INTEGER NOT NULL DEFAULT 0 CHECK(featured IN (0,1)),
+	recommended INTEGER NOT NULL DEFAULT 0 CHECK(recommended IN (0,1)),
+	curated_revision_id TEXT NOT NULL REFERENCES article_revisions(id),
+	curated_by TEXT NOT NULL REFERENCES users(id),
+	curated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS guide_curations_discovery_idx ON guide_curations(pinned_order,featured,recommended,curated_at DESC);
+CREATE TABLE IF NOT EXISTS anonymous_visitors (
+	token_hash TEXT PRIMARY KEY CHECK(length(token_hash)=64),
+	created_at TEXT NOT NULL,
+	last_seen_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS anonymous_activity_limits (
+	identity_hash TEXT NOT NULL,
+	action_type TEXT NOT NULL CHECK(action_type IN ('guide_rating','guide_report')),
+	window_started_at TEXT NOT NULL,
+	action_count INTEGER NOT NULL DEFAULT 0,
+	PRIMARY KEY(identity_hash,action_type)
+);
+CREATE TABLE IF NOT EXISTS guide_ratings (
+	id TEXT PRIMARY KEY,
+	article_id TEXT NOT NULL REFERENCES articles(id) ON DELETE CASCADE,
+	revision_id TEXT NOT NULL REFERENCES article_revisions(id),
+	rater_user_id TEXT REFERENCES users(id),
+	anonymous_token_hash TEXT REFERENCES anonymous_visitors(token_hash),
+	value INTEGER NOT NULL CHECK(value BETWEEN 1 AND 5),
+	created_at TEXT NOT NULL,
+	updated_at TEXT NOT NULL,
+	CHECK((rater_user_id IS NOT NULL AND anonymous_token_hash IS NULL) OR (rater_user_id IS NULL AND anonymous_token_hash IS NOT NULL))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS guide_ratings_user_idx ON guide_ratings(article_id,rater_user_id) WHERE rater_user_id IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS guide_ratings_anonymous_idx ON guide_ratings(article_id,anonymous_token_hash) WHERE anonymous_token_hash IS NOT NULL;
+CREATE INDEX IF NOT EXISTS guide_ratings_article_idx ON guide_ratings(article_id,value);
+CREATE TABLE IF NOT EXISTS article_search (
+	article_id TEXT PRIMARY KEY REFERENCES articles(id) ON DELETE CASCADE,
+	title TEXT NOT NULL,
+	deck TEXT NOT NULL,
+	body TEXT NOT NULL,
+	tags TEXT NOT NULL
+);
+INSERT OR IGNORE INTO users(id,username,role,created_at) VALUES(
+	'7e2a8a20-9bbd-4f1e-9124-a3fb71f7de55','ubisoft-news-service','user','2026-08-01T00:00:00.000Z'
+);
+INSERT OR IGNORE INTO user_profiles(user_id,display_name,is_public,updated_at) VALUES(
+	'7e2a8a20-9bbd-4f1e-9124-a3fb71f7de55','Ubisoft Official News',0,'2026-08-01T00:00:00.000Z'
+);
+CREATE TABLE IF NOT EXISTS external_news_sources (
+	article_id TEXT PRIMARY KEY REFERENCES articles(id) ON DELETE CASCADE,
+	provider TEXT NOT NULL CHECK(provider IN ('ubisoft')),
+	external_id TEXT NOT NULL,
+	canonical_url TEXT NOT NULL,
+	thumbnail_url TEXT,
+	thumbnail_alt TEXT NOT NULL DEFAULT '',
+	source_published_at TEXT NOT NULL,
+	content_hash TEXT NOT NULL CHECK(length(content_hash)=64),
+	first_seen_at TEXT NOT NULL,
+	last_seen_at TEXT NOT NULL,
+	last_synced_at TEXT NOT NULL,
+	UNIQUE(provider,external_id)
+);
+CREATE INDEX IF NOT EXISTS external_news_sources_last_seen_idx
+	ON external_news_sources(provider,last_seen_at DESC);
+CREATE TABLE IF NOT EXISTS external_news_sync_state (
+	provider TEXT PRIMARY KEY CHECK(provider IN ('ubisoft')),
+	last_attempt_at TEXT,
+	last_success_at TEXT,
+	next_check_at TEXT NOT NULL,
+	consecutive_failures INTEGER NOT NULL DEFAULT 0 CHECK(consecutive_failures>=0),
+	last_error TEXT
+);
+INSERT OR IGNORE INTO article_tags(id,group_name,name,slug,source_type,source_id,active) VALUES
+	('guide-builds','topic','Builds','builds','static','builds',1),
+	('guide-pve','activity','PvE','pve','static','pve',1),
+	('guide-pvp','activity','PvP','pvp','static','pvp',1),
+	('guide-dark-zone','activity','Dark Zone','dark-zone','static','dark-zone',1),
+	('guide-conflict','activity','Conflict','conflict','static','conflict',1),
+	('guide-elite','difficulty','Elite','elite','static','elite',1),
+	('guide-heroic','difficulty','Heroic','heroic','static','heroic',1),
+	('guide-shotgun','weapon','Shotgun','shotgun','weapon_category','Shotgun',1),
+	('guide-rifle','weapon','Rifle','rifle','weapon_category','Rifle',1),
+	('guide-mmr','weapon','MMR','mmr','weapon_category','MMR',1),
+	('guide-ar','weapon','AR','ar','weapon_category','AR',1),
+	('guide-lmg','weapon','LMG','lmg','weapon_category','LMG',1),
+	('guide-smg','weapon','SMG','smg','weapon_category','SMG',1),
+	('news-official','news_channel','Official Game News','official-game-news','news_channel','official',1),
+	('news-patch','news_channel','Patch & Data Updates','patch-data-updates','news_channel','patch',1),
+	('news-community','news_channel','Community Reports','community-reports','news_channel','community',1),
+	('news-shd','news_channel','SHD.build Development','shd-build-development','news_channel','shd',1);
 CREATE TABLE IF NOT EXISTS comment_threads (
 	id TEXT PRIMARY KEY,
-	target_type TEXT NOT NULL CHECK(target_type IN ('build', 'guide', 'profile')),
+	target_type TEXT NOT NULL CHECK(target_type IN ('build', 'guide', 'news', 'profile', 'game_data')),
 	target_id TEXT NOT NULL,
+	pinned_comment_id TEXT REFERENCES comments(id) ON DELETE SET NULL,
 	created_at TEXT NOT NULL,
 	UNIQUE(target_type, target_id)
 );
@@ -267,6 +465,7 @@ CREATE TABLE IF NOT EXISTS content_moderation_scans (
 	author_id TEXT NOT NULL REFERENCES users(id),
 	content_hash TEXT NOT NULL CHECK(length(content_hash)>0),
 	revision_id TEXT REFERENCES moderated_content_revisions(id),
+	article_revision_id TEXT REFERENCES article_revisions(id),
 	policy_version INTEGER NOT NULL CHECK(policy_version>=1),
 	provider TEXT NOT NULL CHECK(length(trim(provider))>0),
 	model TEXT NOT NULL CHECK(length(trim(model))>0),
@@ -281,10 +480,10 @@ CREATE TABLE IF NOT EXISTS content_moderation_scans (
 	completed_at TEXT,
 	error_code TEXT,
 	error_message TEXT,
-	UNIQUE(content_type,content_id,content_hash,policy_version,provider,model),
 	CHECK(
-		(content_type IN ('comment','avatar') AND revision_id IS NULL)
-		OR (content_type IN ('profile_bio','guide') AND revision_id IS NOT NULL)
+		(content_type IN ('comment','avatar') AND revision_id IS NULL AND article_revision_id IS NULL)
+		OR (content_type='profile_bio' AND revision_id IS NOT NULL AND article_revision_id IS NULL)
+		OR (content_type='guide' AND revision_id IS NULL AND article_revision_id IS NOT NULL)
 	),
 	CHECK(
 		(status='error' AND error_code IS NOT NULL)
@@ -296,6 +495,13 @@ CREATE INDEX IF NOT EXISTS content_moderation_scans_pending_queue_idx
 	WHERE status IN ('review','priority_review');
 CREATE INDEX IF NOT EXISTS content_moderation_scans_content_idx
 	ON content_moderation_scans(content_type,content_id,created_at DESC);
+CREATE UNIQUE INDEX IF NOT EXISTS content_moderation_scans_direct_unique_idx
+	ON content_moderation_scans(content_type,content_id,content_hash,policy_version,provider,model)
+	WHERE content_type IN ('comment','avatar');
+CREATE UNIQUE INDEX IF NOT EXISTS content_moderation_scans_profile_unique_idx
+	ON content_moderation_scans(revision_id,policy_version,provider,model) WHERE content_type='profile_bio';
+CREATE UNIQUE INDEX IF NOT EXISTS content_moderation_scans_guide_unique_idx
+	ON content_moderation_scans(article_revision_id,policy_version,provider,model) WHERE content_type='guide';
 CREATE TABLE IF NOT EXISTS content_moderation_reviews (
 	id TEXT PRIMARY KEY,
 	scan_id TEXT NOT NULL REFERENCES content_moderation_scans(id),
@@ -308,11 +514,14 @@ CREATE INDEX IF NOT EXISTS content_moderation_reviews_scan_created_idx
 	ON content_moderation_reviews(scan_id,created_at DESC);
 CREATE INDEX IF NOT EXISTS content_moderation_reviews_reviewer_created_idx
 	ON content_moderation_reviews(reviewer_id,created_at DESC);
+CREATE UNIQUE INDEX IF NOT EXISTS content_moderation_reviews_scan_unique_idx ON content_moderation_reviews(scan_id);
 CREATE TABLE IF NOT EXISTS user_content_reports (
 	id TEXT PRIMARY KEY,
 	content_type TEXT NOT NULL CHECK(content_type IN ('comment','profile_bio','guide','avatar')),
 	content_id TEXT NOT NULL,
-	reporter_id TEXT NOT NULL REFERENCES users(id),
+	reporter_id TEXT REFERENCES users(id),
+	anonymous_token_hash TEXT REFERENCES anonymous_visitors(token_hash),
+	article_revision_id TEXT REFERENCES article_revisions(id),
 	category TEXT NOT NULL CHECK(category IN (
 		'spam','harassment','hate','sexual','violence','self_harm','privacy','other'
 	)),
@@ -322,6 +531,8 @@ CREATE TABLE IF NOT EXISTS user_content_reports (
 	reviewed_at TEXT,
 	reviewed_by TEXT REFERENCES users(id),
 	resolution_reason TEXT,
+	CHECK((reporter_id IS NOT NULL AND anonymous_token_hash IS NULL) OR (reporter_id IS NULL AND anonymous_token_hash IS NOT NULL)),
+	CHECK((content_type='guide' AND article_revision_id IS NOT NULL) OR (content_type<>'guide' AND article_revision_id IS NULL)),
 	CHECK(
 		(status='pending' AND reviewed_at IS NULL AND reviewed_by IS NULL AND resolution_reason IS NULL)
 		OR (status IN ('resolved','dismissed') AND reviewed_at IS NOT NULL AND reviewed_by IS NOT NULL
@@ -335,7 +546,10 @@ CREATE INDEX IF NOT EXISTS user_content_reports_content_idx
 	ON user_content_reports(content_type,content_id,created_at DESC);
 CREATE UNIQUE INDEX IF NOT EXISTS user_content_reports_one_pending_idx
 	ON user_content_reports(reporter_id,content_type,content_id)
-	WHERE status='pending';
+	WHERE status='pending' AND reporter_id IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS user_content_reports_one_anonymous_pending_idx
+	ON user_content_reports(anonymous_token_hash,content_type,content_id)
+	WHERE status='pending' AND anonymous_token_hash IS NOT NULL;
 CREATE TABLE IF NOT EXISTS favorites (user_id TEXT NOT NULL REFERENCES users(id), build_id TEXT NOT NULL REFERENCES builds(id) ON DELETE CASCADE, created_at TEXT NOT NULL, PRIMARY KEY(user_id, build_id));
 CREATE TABLE IF NOT EXISTS equipment_types (id TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE, category TEXT NOT NULL);
 CREATE TABLE IF NOT EXISTS stat_definitions (id TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE, value_kind TEXT NOT NULL, min_value REAL, max_value REAL, unit TEXT, active INTEGER NOT NULL DEFAULT 1);
@@ -453,6 +667,9 @@ INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-images
 INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-avatars-review','avatars.review','Review and remove custom user avatars');
 INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-community-comments-moderate','community.comments.moderate','Review and moderate public build, guide, and agent-profile comments');
 INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-community-profiles-moderate','community.profiles.moderate','Review and hide public agent-profile biographies');
+INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-community-guides-moderate','community.guides.moderate','Review, hide, and restore public Guide revisions');
+INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-guides-curate','guides.curate','Pin, feature, and recommend published Guides');
+INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-news-manage','news.manage','Create, edit, publish, and remove News articles');
 INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-calculation-publish','calculation.publish','Activate combat calculation revisions used by every loadout');
 INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-ai-mechanic-generate','ai.mechanic.generate','Use the OpenAI-assisted mechanic drafting workflow');
 INSERT OR IGNORE INTO permissions(id,name,description) VALUES('permission-ai-calculation-generate','ai.calculation.generate','Use the OpenAI-assisted combat calculation revision drafting workflow');
@@ -490,6 +707,8 @@ INSERT OR IGNORE INTO role_permissions(role_id,permission_id) VALUES('role-moder
 INSERT OR IGNORE INTO role_permissions(role_id,permission_id) VALUES('role-moderator','permission-avatars-review');
 INSERT OR IGNORE INTO role_permissions(role_id,permission_id) VALUES('role-moderator','permission-community-comments-moderate');
 INSERT OR IGNORE INTO role_permissions(role_id,permission_id) VALUES('role-moderator','permission-community-profiles-moderate');
+INSERT OR IGNORE INTO role_permissions(role_id,permission_id) VALUES('role-moderator','permission-community-guides-moderate');
+INSERT OR IGNORE INTO role_permissions(role_id,permission_id) VALUES('role-moderator','permission-guides-curate');
 CREATE TABLE IF NOT EXISTS oauth_states (state_hash TEXT PRIMARY KEY, provider TEXT NOT NULL, mode TEXT NOT NULL, user_id TEXT REFERENCES users(id) ON DELETE CASCADE, expires_at TEXT NOT NULL, created_at TEXT NOT NULL);
 CREATE TABLE IF NOT EXISTS data_change_proposals (
 	id TEXT PRIMARY KEY,
@@ -499,6 +718,7 @@ CREATE TABLE IF NOT EXISTS data_change_proposals (
 	draft_entity_id TEXT,
 	applied_entity_id TEXT,
 	summary TEXT NOT NULL,
+	contributor_note TEXT,
 	payload_json TEXT NOT NULL,
 	status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending','approved','rejected','failed')),
 	proposed_by TEXT NOT NULL REFERENCES users(id),
@@ -549,15 +769,12 @@ CREATE TABLE IF NOT EXISTS stat_attributes (
 	weapon_min REAL,
 	weapon_max REAL,
 	weapon_reference_level INTEGER NOT NULL DEFAULT 50 CHECK(weapon_reference_level BETWEEN 1 AND 50),
-	skill_chip_min REAL,
-	skill_chip_max REAL,
 	cap_value REAL,
 	active INTEGER NOT NULL DEFAULT 1,
 	created_at TEXT NOT NULL,
 	updated_at TEXT NOT NULL,
 	CHECK((gear_min IS NULL AND gear_max IS NULL) OR (gear_min IS NOT NULL AND gear_max IS NOT NULL AND gear_min <= gear_max)),
 	CHECK((weapon_min IS NULL AND weapon_max IS NULL) OR (weapon_min IS NOT NULL AND weapon_max IS NOT NULL AND weapon_min <= weapon_max)),
-	CHECK((skill_chip_min IS NULL AND skill_chip_max IS NULL) OR (skill_chip_min IS NOT NULL AND skill_chip_max IS NOT NULL AND skill_chip_min <= skill_chip_max)),
 	CHECK(cap_value IS NULL OR cap_value >= 0)
 );
 CREATE UNIQUE INDEX IF NOT EXISTS stat_attributes_name_unit_nocase_idx ON stat_attributes(name COLLATE NOCASE, unit);
@@ -686,6 +903,7 @@ CREATE TABLE IF NOT EXISTS conditional_effect_outcomes (
 	delivery_mode TEXT NOT NULL DEFAULT 'instant' CHECK(delivery_mode IN ('instant','continuous')),
 	delivery_duration_seconds REAL CHECK(delivery_duration_seconds IS NULL OR delivery_duration_seconds>0),
 	targeting_json TEXT,
+	probability_percent REAL CHECK(probability_percent IS NULL OR (probability_percent>=0 AND probability_percent<=100)),
 	min_state_value REAL,
 	max_state_value REAL,
 	description_slot INTEGER CHECK(description_slot IS NULL OR description_slot>=1),
@@ -948,14 +1166,30 @@ CREATE TABLE IF NOT EXISTS skill_chip_two_piece_bonuses (
 	CHECK(max_value >= min_value)
 );
 CREATE TABLE IF NOT EXISTS skill_chip_primary_options (
-	skill_chip_set_id TEXT NOT NULL REFERENCES skill_chip_sets(id) ON DELETE CASCADE,
-	stat_attribute_id TEXT NOT NULL REFERENCES stat_attributes(id),
-	PRIMARY KEY(skill_chip_set_id, stat_attribute_id)
+	stat_attribute_id TEXT PRIMARY KEY REFERENCES stat_attributes(id)
+);
+CREATE TABLE IF NOT EXISTS skill_chip_primary_quality_values (
+	stat_attribute_id TEXT NOT NULL,
+	quality TEXT NOT NULL CHECK(quality IN ('Standard','Specialized','Superior','High-end')),
+	min_value REAL NOT NULL,
+	max_value REAL NOT NULL,
+	PRIMARY KEY(stat_attribute_id,quality),
+	FOREIGN KEY(stat_attribute_id) REFERENCES skill_chip_primary_options(stat_attribute_id) ON DELETE CASCADE,
+	CHECK(max_value>=min_value),
+	CHECK(min_value>=0)
 );
 CREATE TABLE IF NOT EXISTS skill_chip_secondary_options (
-	skill_chip_set_id TEXT NOT NULL REFERENCES skill_chip_sets(id) ON DELETE CASCADE,
-	stat_attribute_id TEXT NOT NULL REFERENCES stat_attributes(id),
-	PRIMARY KEY(skill_chip_set_id, stat_attribute_id)
+	stat_attribute_id TEXT PRIMARY KEY REFERENCES stat_attributes(id)
+);
+CREATE TABLE IF NOT EXISTS skill_chip_secondary_quality_values (
+	stat_attribute_id TEXT NOT NULL,
+	quality TEXT NOT NULL CHECK(quality IN ('Specialized','Superior','High-end')),
+	min_value REAL NOT NULL,
+	max_value REAL NOT NULL,
+	PRIMARY KEY(stat_attribute_id,quality),
+	FOREIGN KEY(stat_attribute_id) REFERENCES skill_chip_secondary_options(stat_attribute_id) ON DELETE CASCADE,
+	CHECK(max_value>=min_value),
+	CHECK(min_value>=0)
 );
 CREATE TABLE IF NOT EXISTS skill_chip_talents (
 	id TEXT PRIMARY KEY,
@@ -1012,19 +1246,21 @@ CREATE TABLE IF NOT EXISTS weapon_mod_quality_values (
 	CHECK(primary_level_20_max>=primary_level_1_max)
 );
 CREATE TABLE IF NOT EXISTS weapon_mod_secondary_options (
-	weapon_mod_id TEXT NOT NULL REFERENCES weapon_mods(id) ON DELETE CASCADE,
-	stat_attribute_id TEXT NOT NULL REFERENCES stat_attributes(id),
-	PRIMARY KEY(weapon_mod_id,stat_attribute_id)
+	stat_attribute_id TEXT PRIMARY KEY REFERENCES stat_attributes(id)
 );
 CREATE TABLE IF NOT EXISTS weapon_mod_secondary_quality_values (
-	weapon_mod_id TEXT NOT NULL,
 	stat_attribute_id TEXT NOT NULL,
-	quality TEXT NOT NULL CHECK(quality IN ('Standard','Specialized','Superior','High-end')),
-	min_value REAL NOT NULL,
-	max_value REAL NOT NULL,
-	PRIMARY KEY(weapon_mod_id,stat_attribute_id,quality),
-	FOREIGN KEY(weapon_mod_id,stat_attribute_id) REFERENCES weapon_mod_secondary_options(weapon_mod_id,stat_attribute_id) ON DELETE CASCADE,
-	CHECK(max_value>=min_value)
+	quality TEXT NOT NULL CHECK(quality IN ('Specialized','Superior','High-end')),
+	level_1_min REAL NOT NULL,
+	level_1_max REAL NOT NULL,
+	level_20_min REAL NOT NULL,
+	level_20_max REAL NOT NULL,
+	PRIMARY KEY(stat_attribute_id,quality),
+	FOREIGN KEY(stat_attribute_id) REFERENCES weapon_mod_secondary_options(stat_attribute_id) ON DELETE CASCADE,
+	CHECK(level_1_max>=level_1_min),
+	CHECK(level_20_max>=level_20_min),
+	CHECK(level_20_min>=level_1_min),
+	CHECK(level_20_max>=level_1_max)
 );
 CREATE TABLE IF NOT EXISTS weapon_mod_exotic_attributes (
 	id TEXT PRIMARY KEY,
@@ -1072,19 +1308,21 @@ CREATE TABLE IF NOT EXISTS gear_mod_quality_values (
 	CHECK(primary_level_20_max>=primary_level_1_max)
 );
 CREATE TABLE IF NOT EXISTS gear_mod_secondary_options (
-	gear_mod_id TEXT NOT NULL REFERENCES gear_mods(id) ON DELETE CASCADE,
-	stat_attribute_id TEXT NOT NULL REFERENCES stat_attributes(id),
-	PRIMARY KEY(gear_mod_id,stat_attribute_id)
+	stat_attribute_id TEXT PRIMARY KEY REFERENCES stat_attributes(id)
 );
 CREATE TABLE IF NOT EXISTS gear_mod_secondary_quality_values (
-	gear_mod_id TEXT NOT NULL,
 	stat_attribute_id TEXT NOT NULL,
-	quality TEXT NOT NULL CHECK(quality IN ('Standard','Specialized','Superior','High-end')),
-	min_value REAL NOT NULL,
-	max_value REAL NOT NULL,
-	PRIMARY KEY(gear_mod_id,stat_attribute_id,quality),
-	FOREIGN KEY(gear_mod_id,stat_attribute_id) REFERENCES gear_mod_secondary_options(gear_mod_id,stat_attribute_id) ON DELETE CASCADE,
-	CHECK(max_value>=min_value)
+	quality TEXT NOT NULL CHECK(quality IN ('Specialized','Superior','High-end')),
+	level_1_min REAL NOT NULL,
+	level_1_max REAL NOT NULL,
+	level_20_min REAL NOT NULL,
+	level_20_max REAL NOT NULL,
+	PRIMARY KEY(stat_attribute_id,quality),
+	FOREIGN KEY(stat_attribute_id) REFERENCES gear_mod_secondary_options(stat_attribute_id) ON DELETE CASCADE,
+	CHECK(level_1_max>=level_1_min),
+	CHECK(level_20_max>=level_20_min),
+	CHECK(level_20_min>=level_1_min),
+	CHECK(level_20_max>=level_1_max)
 );
 CREATE TABLE IF NOT EXISTS specialization_progression_config (
 	id TEXT PRIMARY KEY CHECK(id='default'),
@@ -1184,6 +1422,17 @@ CREATE TABLE IF NOT EXISTS specialization_ability_attacks (
 	CHECK(charge_policy<>'none' OR charge_count=1)
 );
 CREATE INDEX IF NOT EXISTS specialization_abilities_specialization_idx ON specialization_abilities(specialization_id,name);
+CREATE TABLE IF NOT EXISTS specialization_ability_skill_chip_links (
+	ability_id TEXT NOT NULL REFERENCES specialization_abilities(id) ON DELETE CASCADE,
+	compatible_ability_id TEXT NOT NULL REFERENCES specialization_abilities(id) ON DELETE CASCADE,
+	PRIMARY KEY(ability_id,compatible_ability_id),
+	CHECK(ability_id<compatible_ability_id)
+);
+CREATE INDEX IF NOT EXISTS specialization_ability_skill_chip_links_compatible_idx
+	ON specialization_ability_skill_chip_links(compatible_ability_id,ability_id);
+-- db-migrate.mjs installs insert/update triggers for active same-specialization
+-- endpoints and one-pair-per-ability enforcement. Trigger bodies cannot live in
+-- this semicolon-delimited schema file.
 CREATE TABLE IF NOT EXISTS specialization_ability_effects (
 	id TEXT PRIMARY KEY,
 	ability_id TEXT NOT NULL REFERENCES specialization_abilities(id) ON DELETE CASCADE,
@@ -1408,7 +1657,7 @@ INSERT OR IGNORE INTO calculation_stages(id,revision_id,stage_key,label,operator
 INSERT OR IGNORE INTO calculation_stages(id,revision_id,stage_key,label,operator,display_order,locked_position)
 	VALUES('calculation-stage-cycle-1','calculation-revision-1','firing_cycle','Firing cycle','firing_cycle',9,'last');
 CREATE TABLE IF NOT EXISTS game_data_icons (
-	entity_type TEXT NOT NULL CHECK(entity_type IN ('talent', 'brand_set', 'os_protocol', 'skill_chip', 'specialization', 'specialization_ability', 'specialization_node')),
+	entity_type TEXT NOT NULL CHECK(entity_type IN ('talent', 'brand_set', 'os_protocol', 'skill_chip', 'specialization', 'specialization_ability', 'specialization_node', 'weapon_mod_slot')),
 	entity_id TEXT NOT NULL,
 	storage_key TEXT NOT NULL UNIQUE,
 	byte_size INTEGER NOT NULL CHECK(byte_size > 0),

deploy/bootstrap-production.sh

@@ -7,23 +7,45 @@ if [ -z "$bundle_path" ] || [ ! -f "$bundle_path" ]; then
 	echo "Usage: bootstrap-production.sh <bootstrap-bundle.json> [deployment-directory]" >&2
 	exit 2
 fi
+bundle_path=$(readlink -f "$bundle_path")
 
 compose_file="$deployment_directory/compose.production.yml"
 deploy_environment="$deployment_directory/.env.deploy"
+volume_bundle_path=/app/data/.production-bootstrap-import.json
+remove_volume_bundle=false
 compose() {
 	docker compose --env-file "$deploy_environment" -f "$compose_file" "$@"
 }
-restart_services() {
-	compose up -d --no-build app scheduler
+cleanup() {
+	status=$?
+	trap - EXIT HUP INT TERM
+	set +e
+	if [ "$remove_volume_bundle" = true ]; then
+		compose run --rm --no-deps --entrypoint rm --user root app -f "$volume_bundle_path"
+	fi
+	if ! compose up -d --no-build app scheduler; then status=1; fi
+	exit "$status"
 }
-trap restart_services EXIT
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
 
 echo "Stopping production before the one-time database bootstrap."
-compose stop scheduler app || true
+compose stop scheduler app
+compose create app >/dev/null
+app_container=$(compose ps --all --quiet app)
+if [ -z "$app_container" ]; then
+	echo "The stopped production app container could not be found." >&2
+	exit 1
+fi
+docker cp "$bundle_path" "$app_container:$volume_bundle_path"
+remove_volume_bundle=true
+compose run --rm --no-deps --entrypoint sh --user root app -c \
+	'chown shd-runtime:node "$1" && chmod 600 "$1"' sh "$volume_bundle_path"
 compose run --rm --no-deps \
 	-e ALLOW_PRODUCTION_BOOTSTRAP=true \
-	-v "$bundle_path:/import/production-bootstrap.json:ro" \
 	app node scripts/environment-bootstrap-import.mjs \
-	/import/production-bootstrap.json --target production --confirm-empty-target-replace
+	"$volume_bundle_path" --target production --confirm-empty-target-replace
 
 echo "Production bootstrap completed."

deploy/bootstrap-staging.sh

@@ -7,23 +7,45 @@ if [ -z "$bundle_path" ] || [ ! -f "$bundle_path" ]; then
 	echo "Usage: bootstrap-staging.sh <bootstrap-bundle.json> [deployment-directory]" >&2
 	exit 2
 fi
+bundle_path=$(readlink -f "$bundle_path")
 
 compose_file="$deployment_directory/compose.staging.yml"
 deploy_environment="$deployment_directory/.env.deploy"
+volume_bundle_path=/app/data/.staging-bootstrap-import.json
+remove_volume_bundle=false
 compose() {
 	docker compose --env-file "$deploy_environment" -f "$compose_file" "$@"
 }
-restart_services() {
-	compose up -d --no-build app scheduler
+cleanup() {
+	status=$?
+	trap - EXIT HUP INT TERM
+	set +e
+	if [ "$remove_volume_bundle" = true ]; then
+		compose run --rm --no-deps --entrypoint rm --user root app -f "$volume_bundle_path"
+	fi
+	if ! compose up -d --no-build app scheduler; then status=1; fi
+	exit "$status"
 }
-trap restart_services EXIT
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
 
 echo "Stopping staging before the one-time database bootstrap."
-compose stop scheduler app || true
+compose stop scheduler app
+compose create app >/dev/null
+app_container=$(compose ps --all --quiet app)
+if [ -z "$app_container" ]; then
+	echo "The stopped staging app container could not be found." >&2
+	exit 1
+fi
+docker cp "$bundle_path" "$app_container:$volume_bundle_path"
+remove_volume_bundle=true
+compose run --rm --no-deps --entrypoint sh --user root app -c \
+	'chown shd-runtime:node "$1" && chmod 600 "$1"' sh "$volume_bundle_path"
 compose run --rm --no-deps \
 	-e ALLOW_STAGING_BOOTSTRAP=true \
-	-v "$bundle_path:/import/staging-bootstrap.json:ro" \
 	app node scripts/stage-bootstrap-import.mjs \
-	/import/staging-bootstrap.json --confirm-empty-staging-replace
+	"$volume_bundle_path" --confirm-empty-staging-replace
 
 echo "Staging bootstrap completed."

deploy/compose.production.yml

@@ -3,27 +3,31 @@ name: shd-build-production
 services:
   app:
     image: ${SHD_IMAGE:-shd-build-production:local}
-    restart: unless-stopped
+    restart: always
     init: true
-    env_file:
-      - .env.production.runtime
     environment:
-      HOST: 0.0.0.0
-      PORT: 3000
-      BODY_SIZE_LIMIT: 6M
-      SKIP_DEFAULT_USERS: "true"
-      TDR_DATABASE_PATH: /app/data/shd-build-production.db
-      TDR_AVATAR_STORAGE_PATH: /app/data/avatars
-      TDR_GAME_ICON_STORAGE_PATH: /app/data/game-icons
+      INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
+      INFISICAL_ENVIRONMENT: prod
+      INFISICAL_RUNTIME_SCOPE: app
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: /run/secrets/infisical_client_id
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: /run/secrets/infisical_client_secret
       SHD_BUILD_NUMBER: ${SHD_BUILD_NUMBER:-0}
-      APP_ORIGIN: https://shd.build
-      ORIGIN: https://shd.build
-      PASSKEY_RP_ID: shd.build
-      DISCORD_REDIRECT_URI: https://shd.build/auth/discord/callback
+      SHD_COMMIT_SHA: ${SHD_COMMIT_SHA:-}
     ports:
-      - "0.0.0.0:${SHD_PRODUCTION_PORT:-3102}:3000"
+      - '0.0.0.0:${SHD_PRODUCTION_PORT:-3102}:3000'
     volumes:
       - shd_production_data:/app/data
+    secrets:
+      - source: infisical_app_client_id
+        target: infisical_client_id
+        uid: '0'
+        gid: '0'
+        mode: 0400
+      - source: infisical_app_client_secret
+        target: infisical_client_secret
+        uid: '0'
+        gid: '0'
+        mode: 0400
     healthcheck:
       test:
         - CMD
@@ -38,14 +42,27 @@ services:
 
   scheduler:
     image: ${SHD_IMAGE:-shd-build-production:local}
-    restart: unless-stopped
+    restart: always
     init: true
     command:
       - scheduler
-    env_file:
-      - .env.production.runtime
     environment:
-      SCHEDULER_URL: http://app:3000/api/internal/scheduler
+      INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
+      INFISICAL_ENVIRONMENT: prod
+      INFISICAL_RUNTIME_SCOPE: scheduler
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: /run/secrets/infisical_client_id
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: /run/secrets/infisical_client_secret
+    secrets:
+      - source: infisical_scheduler_client_id
+        target: infisical_client_id
+        uid: '0'
+        gid: '0'
+        mode: 0400
+      - source: infisical_scheduler_client_secret
+        target: infisical_client_secret
+        uid: '0'
+        gid: '0'
+        mode: 0400
     depends_on:
       app:
         condition: service_healthy
@@ -54,3 +71,13 @@ services:
 volumes:
   shd_production_data:
     name: shd-build-production-data
+
+secrets:
+  infisical_app_client_id:
+    file: .infisical.app.client-id
+  infisical_app_client_secret:
+    file: .infisical.app.client-secret
+  infisical_scheduler_client_id:
+    file: .infisical.scheduler.client-id
+  infisical_scheduler_client_secret:
+    file: .infisical.scheduler.client-secret

deploy/compose.staging.yml

@@ -5,21 +5,29 @@ services:
     image: ${SHD_IMAGE:-shd-build-stage:local}
     restart: unless-stopped
     init: true
-    env_file:
-      - .env.staging.runtime
     environment:
-      HOST: 0.0.0.0
-      PORT: 3000
-      BODY_SIZE_LIMIT: 6M
-      SKIP_DEFAULT_USERS: "true"
-      TDR_DATABASE_PATH: /app/data/shd-build-staging.db
-      TDR_AVATAR_STORAGE_PATH: /app/data/avatars
-      TDR_GAME_ICON_STORAGE_PATH: /app/data/game-icons
+      INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
+      INFISICAL_ENVIRONMENT: staging
+      INFISICAL_RUNTIME_SCOPE: app
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: /run/secrets/infisical_client_id
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: /run/secrets/infisical_client_secret
       SHD_BUILD_NUMBER: ${SHD_BUILD_NUMBER:-0}
+      SHD_COMMIT_SHA: ${SHD_COMMIT_SHA:-}
     ports:
-      - "0.0.0.0:${SHD_STAGE_PORT:-5569}:3000"
+      - '0.0.0.0:${SHD_STAGE_PORT:-5569}:3000'
     volumes:
       - shd_stage_data:/app/data
+    secrets:
+      - source: infisical_app_client_id
+        target: infisical_client_id
+        uid: '0'
+        gid: '0'
+        mode: 0400
+      - source: infisical_app_client_secret
+        target: infisical_client_secret
+        uid: '0'
+        gid: '0'
+        mode: 0400
     healthcheck:
       test:
         - CMD
@@ -38,10 +46,23 @@ services:
     init: true
     command:
       - scheduler
-    env_file:
-      - .env.staging.runtime
     environment:
-      SCHEDULER_URL: http://app:3000/api/internal/scheduler
+      INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
+      INFISICAL_ENVIRONMENT: staging
+      INFISICAL_RUNTIME_SCOPE: scheduler
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: /run/secrets/infisical_client_id
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: /run/secrets/infisical_client_secret
+    secrets:
+      - source: infisical_scheduler_client_id
+        target: infisical_client_id
+        uid: '0'
+        gid: '0'
+        mode: 0400
+      - source: infisical_scheduler_client_secret
+        target: infisical_client_secret
+        uid: '0'
+        gid: '0'
+        mode: 0400
     depends_on:
       app:
         condition: service_healthy
@@ -50,3 +71,13 @@ services:
 volumes:
   shd_stage_data:
     name: shd-build-stage-data
+
+secrets:
+  infisical_app_client_id:
+    file: .infisical.app.client-id
+  infisical_app_client_secret:
+    file: .infisical.app.client-secret
+  infisical_scheduler_client_id:
+    file: .infisical.scheduler.client-id
+  infisical_scheduler_client_secret:
+    file: .infisical.scheduler.client-secret

deploy/container-entrypoint.sh

@@ -1,13 +1,118 @@
 #!/bin/sh
 set -eu
 
-if [ "${1:-}" = "serve" ]; then
-	node scripts/db-migrate.mjs
-	exec node build
+project_id=${INFISICAL_PROJECT_ID:?INFISICAL_PROJECT_ID is required}
+environment=${INFISICAL_ENVIRONMENT:?INFISICAL_ENVIRONMENT is required}
+runtime_scope=${INFISICAL_RUNTIME_SCOPE:?INFISICAL_RUNTIME_SCOPE is required}
+client_id_file=${INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE:?INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE is required}
+client_secret_file=${INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE:?INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE is required}
+build_number=${SHD_BUILD_NUMBER:-0}
+commit_sha=${SHD_COMMIT_SHA:-}
+secret_file=
+shared_secret_file=
+
+cleanup() {
+	if [ -n "$secret_file" ]; then rm -f "$secret_file"; fi
+	if [ -n "$shared_secret_file" ]; then rm -f "$shared_secret_file"; fi
+}
+
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+if [ ! -r "$client_id_file" ] || [ ! -r "$client_secret_file" ]; then
+	echo "Infisical Universal Auth credential files are not readable." >&2
+	exit 1
 fi
 
-if [ "${1:-}" = "scheduler" ]; then
-	exec node scripts/scheduler-client.mjs
+if [ "$(id -u)" -eq 0 ]; then
+	runtime_uid=$(id -u shd-runtime)
+	for credential_file in "$client_id_file" "$client_secret_file"; do
+		credential_uid=$(stat -c '%u' "$credential_file")
+		credential_mode=$(stat -c '%a' "$credential_file")
+		if [ "$credential_uid" -eq "$runtime_uid" ] || [ $((credential_mode % 100)) -ne 0 ]; then
+			echo "Infisical credential files must not be readable by the application runtime user." >&2
+			exit 1
+		fi
+	done
+	if [ "$runtime_scope" = app ] && ! { [ "${1:-}" = node ] && [ "${2:-}" = scripts/validate-runtime-environment.mjs ]; }; then
+		chgrp -R node /app/data
+		chmod -R g+rwX /app/data
+	fi
 fi
 
-exec "$@"
+client_id=$(cat "$client_id_file")
+client_secret=$(cat "$client_secret_file")
+if [ -z "$client_id" ] || [ -z "$client_secret" ]; then
+	echo "Infisical Universal Auth credential files must not be empty." >&2
+	exit 1
+fi
+
+unset INFISICAL_TOKEN INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN TOKEN
+access_token=$(
+	INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$client_id" \
+		INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$client_secret" \
+		infisical login --method=universal-auth --silent --plain
+)
+unset client_id client_secret
+
+if [ -z "$access_token" ]; then
+	echo "Infisical Universal Auth returned an empty access token." >&2
+	exit 1
+fi
+
+umask 077
+secret_file=$(mktemp /tmp/shd-infisical-app.XXXXXX)
+
+case "$runtime_scope" in
+	app)
+		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
+			--projectId="$project_id" \
+			--env="$environment" \
+			--path=/app \
+			--format=json \
+			--output-file="$secret_file" \
+			--silent
+		shared_secret_file=$(mktemp /tmp/shd-infisical-shared.XXXXXX)
+		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
+			--projectId="$project_id" \
+			--env="$environment" \
+			--path=/shared/scheduler \
+			--format=json \
+			--output-file="$shared_secret_file" \
+			--silent
+		;;
+	scheduler)
+		INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN="$access_token" infisical export \
+			--projectId="$project_id" \
+			--env="$environment" \
+			--path=/shared/scheduler \
+			--format=json \
+			--output-file="$secret_file" \
+			--silent
+		;;
+	*)
+		echo "Unsupported INFISICAL_RUNTIME_SCOPE: $runtime_scope" >&2
+		exit 2
+		;;
+esac
+
+unset access_token \
+	INFISICAL_TOKEN \
+	INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN \
+	INFISICAL_UNIVERSAL_AUTH_CLIENT_ID \
+	INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET
+
+if [ "$runtime_scope" = app ]; then
+	if [ "$(id -u)" -eq 0 ]; then
+		chown shd-runtime:node "$secret_file" "$shared_secret_file"
+		exec gosu shd-runtime node scripts/runtime-launcher.mjs app "$environment" "$build_number" "$commit_sha" "$secret_file" "$shared_secret_file" -- "$@"
+	fi
+	exec node scripts/runtime-launcher.mjs app "$environment" "$build_number" "$commit_sha" "$secret_file" "$shared_secret_file" -- "$@"
+fi
+if [ "$(id -u)" -eq 0 ]; then
+	chown shd-runtime:node "$secret_file"
+	exec gosu shd-runtime node scripts/runtime-launcher.mjs scheduler "$environment" "$build_number" "$commit_sha" "$secret_file" -- "$@"
+fi
+exec node scripts/runtime-launcher.mjs scheduler "$environment" "$build_number" "$commit_sha" "$secret_file" -- "$@"

deploy/deploy-production.sh

@@ -4,48 +4,154 @@ set -eu
 deployment_directory=${1:-/opt/shd-build-production}
 source_directory=${2:-}
 candidate_image=${3:-}
-if [ -z "$source_directory" ] || [ ! -f "$source_directory/Dockerfile" ] || [ -z "$candidate_image" ]; then
-	echo "Usage: deploy-production.sh <deployment-directory> <source-directory> <candidate-image>" >&2
+candidate_directory=${4:-}
+if [ -z "$source_directory" ] || [ ! -f "$source_directory/Dockerfile" ] || [ -z "$candidate_image" ] || [ ! -f "$candidate_directory/compose.production.yml" ] || [ ! -f "$candidate_directory/.env.deploy" ]; then
+	echo "Usage: deploy-production.sh <deployment-directory> <source-directory> <candidate-image> <candidate-directory>" >&2
 	exit 2
 fi
-compose_file="$deployment_directory/compose.production.yml"
-deploy_environment="$deployment_directory/.env.deploy"
+case "$candidate_directory" in
+	"$deployment_directory"/candidate-*) ;;
+	*) echo "Candidate directory must be a candidate-* child of the deployment directory." >&2; exit 2 ;;
+esac
+candidate_compose_file="$candidate_directory/compose.production.yml"
+candidate_environment="$candidate_directory/.env.deploy"
+canonical_compose_file="$deployment_directory/compose.production.yml"
+canonical_environment="$deployment_directory/.env.deploy"
+previous_directory="$deployment_directory/.previous-release"
+healthy_marker="$deployment_directory/.deployment-healthy"
+release_files="compose.production.yml .env.deploy .infisical.app.client-id .infisical.app.client-secret .infisical.scheduler.client-id .infisical.scheduler.client-secret deploy-production.sh bootstrap-production.sh sync-production-isac-to-staging.sh"
+rollback_required=false
+candidate_promoted=false
+had_previous_release=false
 
-compose() {
-	docker compose --env-file "$deploy_environment" -f "$compose_file" "$@"
+candidate_compose() {
+	docker compose --env-file "$candidate_environment" -f "$candidate_compose_file" "$@"
 }
 
+canonical_compose() {
+	docker compose --env-file "$canonical_environment" -f "$canonical_compose_file" "$@"
+}
+
+release_is_healthy() {
+	health_environment=$1
+	health_compose_file=$2
+	health_attempt=0
+	while [ "$health_attempt" -lt 30 ]; do
+		health_app_container=$(docker compose --env-file "$health_environment" -f "$health_compose_file" ps -q app)
+		health_scheduler_container=$(docker compose --env-file "$health_environment" -f "$health_compose_file" ps -q scheduler)
+		health_app_status=missing
+		health_scheduler_status=missing
+		if [ -n "$health_app_container" ]; then
+			health_app_status=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$health_app_container" 2>/dev/null || echo missing)
+		fi
+		if [ -n "$health_scheduler_container" ]; then
+			health_scheduler_status=$(docker inspect --format '{{.State.Status}}' "$health_scheduler_container" 2>/dev/null || echo missing)
+		fi
+		if [ "$health_app_status" = healthy ] && [ "$health_scheduler_status" = running ]; then return 0; fi
+		if [ "$health_app_status" = unhealthy ] || [ "$health_app_status" = exited ] || [ "$health_app_status" = dead ] || [ "$health_scheduler_status" = exited ] || [ "$health_scheduler_status" = dead ]; then return 1; fi
+		health_attempt=$((health_attempt + 1))
+		sleep 2
+	done
+	return 1
+}
+
+copy_release() {
+	copy_source=$1
+	copy_target=$2
+	copy_status=0
+	for release_file in $release_files; do
+		if [ -f "$copy_source/$release_file" ]; then
+			copy_temporary=$(mktemp "$copy_target/.release.XXXXXX") || return 1
+			if cp -p "$copy_source/$release_file" "$copy_temporary"; then
+				mv "$copy_temporary" "$copy_target/$release_file" || copy_status=1
+			else
+				rm -f "$copy_temporary"
+				copy_status=1
+			fi
+		else
+			rm -f "$copy_target/$release_file" || copy_status=1
+		fi
+	done
+	return "$copy_status"
+}
+
+cleanup_candidate() {
+	case "$candidate_directory" in
+		"$deployment_directory"/candidate-*) rm -rf "$candidate_directory" ;;
+	esac
+}
+
+rollback() {
+	rollback_exit_status=$?
+	trap - EXIT HUP INT TERM
+	set +e
+	if [ "$rollback_required" = true ]; then
+		echo "Restoring the previous healthy production release." >&2
+		restore_status=0
+		candidate_compose stop scheduler app >/dev/null 2>&1 || restore_status=1
+		if [ "$candidate_promoted" = true ]; then copy_release "$previous_directory" "$deployment_directory" || restore_status=1; fi
+		if [ "$had_previous_release" = true ]; then
+			canonical_compose up -d --no-build app scheduler || restore_status=1
+			if [ "$restore_status" -eq 0 ] && ! release_is_healthy "$canonical_environment" "$canonical_compose_file"; then restore_status=1; fi
+		else
+			echo "No previous production release is available." >&2
+			restore_status=1
+		fi
+		if [ "$restore_status" -ne 0 ]; then
+			echo "The previous production release could not be restored." >&2
+			if [ "$rollback_exit_status" -eq 0 ]; then rollback_exit_status=1; fi
+		fi
+	fi
+	cleanup_candidate
+	exit "$rollback_exit_status"
+}
+
+trap rollback EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
 echo "Building the candidate image while production remains online."
 docker build --label org.opencontainers.image.title=shd-build -t "$candidate_image" "$source_directory"
 
+echo "Validating Infisical access and the candidate runtime configuration."
+candidate_compose run --rm --no-deps app node scripts/validate-runtime-environment.mjs app
+candidate_compose run --rm --no-deps scheduler node scripts/validate-runtime-environment.mjs scheduler
+
+rm -rf "$previous_directory"
+mkdir -p "$previous_directory"
+if [ -f "$canonical_compose_file" ] && [ -f "$canonical_environment" ]; then
+	had_previous_release=true
+	copy_release "$deployment_directory" "$previous_directory"
+fi
+
 echo "Stopping only SHD production processes before accessing the embedded database."
-compose stop scheduler app || true
+rollback_required=true
+candidate_compose stop scheduler app
 
 echo "Creating a timestamped production backup when the database exists."
-compose run --rm --no-deps app sh -c \
+candidate_compose run --rm --no-deps app sh -c \
 	'if [ -f "$TDR_DATABASE_PATH" ]; then node scripts/db-backup.mjs; else echo "No production database exists yet; skipping backup."; fi'
 
 echo "Applying additive schema migrations."
-compose run --rm --no-deps app node scripts/db-migrate.mjs
+candidate_compose run --rm --no-deps app node scripts/db-migrate.mjs
+
+candidate_promoted=true
+copy_release "$candidate_directory" "$deployment_directory"
 
 echo "Starting production."
-compose up -d --no-build --remove-orphans app scheduler
+canonical_compose up -d --no-build --remove-orphans app scheduler
 
-container_id=$(compose ps -q app)
-attempt=0
-while [ "$attempt" -lt 30 ]; do
-	status=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")
-	if [ "$status" = "healthy" ]; then
-		echo "SHD production deployment is healthy."
-		exit 0
-	fi
-	if [ "$status" = "unhealthy" ] || [ "$status" = "exited" ] || [ "$status" = "dead" ]; then
-		break
-	fi
-	attempt=$((attempt + 1))
-	sleep 2
-done
+if release_is_healthy "$canonical_environment" "$canonical_compose_file"; then
+	echo "SHD production deployment is healthy."
+	rollback_required=false
+	umask 077
+	: > "$healthy_marker"
+	cleanup_candidate
+	trap - EXIT HUP INT TERM
+	exit 0
+fi
 
 echo "SHD production failed its health check."
-compose logs --tail=150 app
+canonical_compose logs --tail=150 app scheduler
 exit 1

deploy/deploy-staging.sh

@@ -4,48 +4,154 @@ set -eu
 deployment_directory=${1:-/opt/shd-build-stage}
 source_directory=${2:-}
 candidate_image=${3:-}
-if [ -z "$source_directory" ] || [ ! -f "$source_directory/Dockerfile" ] || [ -z "$candidate_image" ]; then
-	echo "Usage: deploy-staging.sh <deployment-directory> <source-directory> <candidate-image>" >&2
+candidate_directory=${4:-}
+if [ -z "$source_directory" ] || [ ! -f "$source_directory/Dockerfile" ] || [ -z "$candidate_image" ] || [ ! -f "$candidate_directory/compose.staging.yml" ] || [ ! -f "$candidate_directory/.env.deploy" ]; then
+	echo "Usage: deploy-staging.sh <deployment-directory> <source-directory> <candidate-image> <candidate-directory>" >&2
 	exit 2
 fi
-compose_file="$deployment_directory/compose.staging.yml"
-deploy_environment="$deployment_directory/.env.deploy"
+case "$candidate_directory" in
+	"$deployment_directory"/candidate-*) ;;
+	*) echo "Candidate directory must be a candidate-* child of the deployment directory." >&2; exit 2 ;;
+esac
+candidate_compose_file="$candidate_directory/compose.staging.yml"
+candidate_environment="$candidate_directory/.env.deploy"
+canonical_compose_file="$deployment_directory/compose.staging.yml"
+canonical_environment="$deployment_directory/.env.deploy"
+previous_directory="$deployment_directory/.previous-release"
+healthy_marker="$deployment_directory/.deployment-healthy"
+release_files="compose.staging.yml .env.deploy .infisical.app.client-id .infisical.app.client-secret .infisical.scheduler.client-id .infisical.scheduler.client-secret deploy-staging.sh bootstrap-staging.sh"
+rollback_required=false
+candidate_promoted=false
+had_previous_release=false
 
-compose() {
-	docker compose --env-file "$deploy_environment" -f "$compose_file" "$@"
+candidate_compose() {
+	docker compose --env-file "$candidate_environment" -f "$candidate_compose_file" "$@"
 }
 
+canonical_compose() {
+	docker compose --env-file "$canonical_environment" -f "$canonical_compose_file" "$@"
+}
+
+release_is_healthy() {
+	health_environment=$1
+	health_compose_file=$2
+	health_attempt=0
+	while [ "$health_attempt" -lt 30 ]; do
+		health_app_container=$(docker compose --env-file "$health_environment" -f "$health_compose_file" ps -q app)
+		health_scheduler_container=$(docker compose --env-file "$health_environment" -f "$health_compose_file" ps -q scheduler)
+		health_app_status=missing
+		health_scheduler_status=missing
+		if [ -n "$health_app_container" ]; then
+			health_app_status=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$health_app_container" 2>/dev/null || echo missing)
+		fi
+		if [ -n "$health_scheduler_container" ]; then
+			health_scheduler_status=$(docker inspect --format '{{.State.Status}}' "$health_scheduler_container" 2>/dev/null || echo missing)
+		fi
+		if [ "$health_app_status" = healthy ] && [ "$health_scheduler_status" = running ]; then return 0; fi
+		if [ "$health_app_status" = unhealthy ] || [ "$health_app_status" = exited ] || [ "$health_app_status" = dead ] || [ "$health_scheduler_status" = exited ] || [ "$health_scheduler_status" = dead ]; then return 1; fi
+		health_attempt=$((health_attempt + 1))
+		sleep 2
+	done
+	return 1
+}
+
+copy_release() {
+	copy_source=$1
+	copy_target=$2
+	copy_status=0
+	for release_file in $release_files; do
+		if [ -f "$copy_source/$release_file" ]; then
+			copy_temporary=$(mktemp "$copy_target/.release.XXXXXX") || return 1
+			if cp -p "$copy_source/$release_file" "$copy_temporary"; then
+				mv "$copy_temporary" "$copy_target/$release_file" || copy_status=1
+			else
+				rm -f "$copy_temporary"
+				copy_status=1
+			fi
+		else
+			rm -f "$copy_target/$release_file" || copy_status=1
+		fi
+	done
+	return "$copy_status"
+}
+
+cleanup_candidate() {
+	case "$candidate_directory" in
+		"$deployment_directory"/candidate-*) rm -rf "$candidate_directory" ;;
+	esac
+}
+
+rollback() {
+	rollback_exit_status=$?
+	trap - EXIT HUP INT TERM
+	set +e
+	if [ "$rollback_required" = true ]; then
+		echo "Restoring the previous healthy staging release." >&2
+		restore_status=0
+		candidate_compose stop scheduler app >/dev/null 2>&1 || restore_status=1
+		if [ "$candidate_promoted" = true ]; then copy_release "$previous_directory" "$deployment_directory" || restore_status=1; fi
+		if [ "$had_previous_release" = true ]; then
+			canonical_compose up -d --no-build app scheduler || restore_status=1
+			if [ "$restore_status" -eq 0 ] && ! release_is_healthy "$canonical_environment" "$canonical_compose_file"; then restore_status=1; fi
+		else
+			echo "No previous staging release is available." >&2
+			restore_status=1
+		fi
+		if [ "$restore_status" -ne 0 ]; then
+			echo "The previous staging release could not be restored." >&2
+			if [ "$rollback_exit_status" -eq 0 ]; then rollback_exit_status=1; fi
+		fi
+	fi
+	cleanup_candidate
+	exit "$rollback_exit_status"
+}
+
+trap rollback EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
 echo "Building the candidate image while the current staging service remains online."
 docker build --label org.opencontainers.image.title=shd-build -t "$candidate_image" "$source_directory"
 
+echo "Validating Infisical access and the candidate runtime configuration."
+candidate_compose run --rm --no-deps app node scripts/validate-runtime-environment.mjs app
+candidate_compose run --rm --no-deps scheduler node scripts/validate-runtime-environment.mjs scheduler
+
+rm -rf "$previous_directory"
+mkdir -p "$previous_directory"
+if [ -f "$canonical_compose_file" ] && [ -f "$canonical_environment" ]; then
+	had_previous_release=true
+	copy_release "$deployment_directory" "$previous_directory"
+fi
+
 echo "Stopping SHD staging processes before accessing the embedded database."
-compose stop scheduler app || true
+rollback_required=true
+candidate_compose stop scheduler app
 
 echo "Creating a timestamped database backup when a staging database exists."
-compose run --rm --no-deps app sh -c \
+candidate_compose run --rm --no-deps app sh -c \
 	'if [ -f "$TDR_DATABASE_PATH" ]; then node scripts/db-backup.mjs; else echo "No staging database exists yet; skipping backup."; fi'
 
 echo "Applying additive schema migrations."
-compose run --rm --no-deps app node scripts/db-migrate.mjs
+candidate_compose run --rm --no-deps app node scripts/db-migrate.mjs
+
+candidate_promoted=true
+copy_release "$candidate_directory" "$deployment_directory"
 
 echo "Starting the application and notification scheduler."
-compose up -d --no-build --remove-orphans app scheduler
+canonical_compose up -d --no-build --remove-orphans app scheduler
 
-container_id=$(compose ps -q app)
-attempt=0
-while [ "$attempt" -lt 30 ]; do
-	status=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")
-	if [ "$status" = "healthy" ]; then
-		echo "SHD staging deployment is healthy."
-		exit 0
-	fi
-	if [ "$status" = "unhealthy" ] || [ "$status" = "exited" ] || [ "$status" = "dead" ]; then
-		break
-	fi
-	attempt=$((attempt + 1))
-	sleep 2
-done
+if release_is_healthy "$canonical_environment" "$canonical_compose_file"; then
+	echo "SHD staging deployment is healthy."
+	rollback_required=false
+	umask 077
+	: > "$healthy_marker"
+	cleanup_candidate
+	trap - EXIT HUP INT TERM
+	exit 0
+fi
 
 echo "SHD staging failed its health check."
-compose logs --tail=150 app
+canonical_compose logs --tail=150 app scheduler
 exit 1

deploy/runtime-start.test.ts

@@ -0,0 +1,400 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import {
+  copyFile,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  writeFile,
+} from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+const repositoryRoot = resolve(import.meta.dirname, '..');
+const schedulerToken = 'scheduler-token-with-at-least-32-characters';
+
+const infisicalStub = `#!/bin/sh
+set -eu
+
+case "\${1:-}" in
+  login)
+    printf '%s\n' "$@" > "$STUB_LOGIN_LOG"
+    if [ "\${INFISICAL_UNIVERSAL_AUTH_CLIENT_ID:-}" != "$STUB_EXPECTED_CLIENT_ID" ] || \
+       [ "\${INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET:-}" != "$STUB_EXPECTED_CLIENT_SECRET" ]; then
+      printf '%s\n' 'credentials=incorrect' >> "$STUB_LOGIN_LOG"
+      exit 26
+    fi
+    printf '%s\n' 'credentials=ok' >> "$STUB_LOGIN_LOG"
+    case "\${STUB_LOGIN_RESULT:-success}" in
+      fail) exit 23 ;;
+      empty) exit 0 ;;
+      *) printf '%s\n' stub-access-token ;;
+    esac
+    ;;
+  export)
+    [ "\${INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN:-}" = stub-access-token ] || exit 27
+    secret_path=
+    output_file=
+    for argument in "$@"; do
+      case "$argument" in
+        --path=*) secret_path=\${argument#--path=} ;;
+        --output-file=*) output_file=\${argument#--output-file=} ;;
+      esac
+    done
+    [ -n "$secret_path" ] && [ -n "$output_file" ] || exit 28
+    printf '%s|%s\n' "$secret_path" "$output_file" >> "$STUB_EXPORT_LOG"
+    case "$secret_path" in
+      /app) cp "$STUB_APP_EXPORT" "$output_file" ;;
+      /shared/scheduler) cp "$STUB_SHARED_EXPORT" "$output_file" ;;
+      *) exit 29 ;;
+    esac
+    ;;
+  *) exit 25 ;;
+esac
+`;
+
+const environmentCapture = `#!/bin/sh
+env > "$CAPTURE_ENV_PATH"
+`;
+
+const gosuStub = `#!/bin/sh
+set -eu
+[ "\${1:-}" = shd-runtime ] || exit 30
+printf '%s\n' 'target=shd-runtime' > "$STUB_GOSU_LOG"
+shift
+exec "$@"
+`;
+
+const idStub = `#!/bin/sh
+if [ "\${1:-}" = -u ] && [ "\${2:-}" = shd-runtime ]; then
+  printf '%s\n' 10001
+  exit 0
+fi
+exec /usr/bin/id "$@"
+`;
+
+const ownershipStub = `#!/bin/sh
+exit 0
+`;
+
+describe('container runtime startup', () => {
+  let temporaryRoot: string;
+  let clientIdFile: string;
+  let clientSecretFile: string;
+  let loginLog: string;
+  let exportLog: string;
+  let gosuLog: string;
+  let capturedEnvironment: string;
+  let appExport: string;
+  let sharedExport: string;
+
+  beforeEach(async () => {
+    temporaryRoot = await mkdtemp(join(tmpdir(), 'shd-runtime-start-'));
+    const deployDirectory = join(temporaryRoot, 'deploy');
+    const scriptsDirectory = join(temporaryRoot, 'scripts');
+    await mkdir(deployDirectory);
+    await mkdir(scriptsDirectory);
+    await Promise.all([
+      copyFile(
+        join(repositoryRoot, 'deploy/container-entrypoint.sh'),
+        join(deployDirectory, 'container-entrypoint.sh'),
+      ),
+      copyFile(
+        join(repositoryRoot, 'scripts/runtime-launcher.mjs'),
+        join(scriptsDirectory, 'runtime-launcher.mjs'),
+      ),
+      copyFile(
+        join(repositoryRoot, 'scripts/runtime-environment.js'),
+        join(scriptsDirectory, 'runtime-environment.js'),
+      ),
+    ]);
+
+    clientIdFile = join(temporaryRoot, 'client-id');
+    clientSecretFile = join(temporaryRoot, 'client-secret');
+    loginLog = join(temporaryRoot, 'login.log');
+    exportLog = join(temporaryRoot, 'export.log');
+    gosuLog = join(temporaryRoot, 'gosu.log');
+    capturedEnvironment = join(temporaryRoot, 'child.env');
+    appExport = join(temporaryRoot, 'app-export.json');
+    sharedExport = join(temporaryRoot, 'shared-export.json');
+
+    await Promise.all([
+      writeFile(clientIdFile, 'universal-client-id\n', { mode: 0o600 }),
+      writeFile(clientSecretFile, 'universal-client-secret\n', { mode: 0o600 }),
+      writeFile(join(temporaryRoot, 'infisical'), infisicalStub, {
+        mode: 0o755,
+      }),
+      writeFile(
+        join(temporaryRoot, 'capture-environment'),
+        environmentCapture,
+        {
+          mode: 0o755,
+        },
+      ),
+      writeFile(join(temporaryRoot, 'gosu'), gosuStub, { mode: 0o755 }),
+      writeFile(join(temporaryRoot, 'id'), idStub, { mode: 0o755 }),
+      writeFile(join(temporaryRoot, 'chgrp'), ownershipStub, { mode: 0o755 }),
+      writeFile(join(temporaryRoot, 'chmod'), ownershipStub, { mode: 0o755 }),
+      writeFile(join(temporaryRoot, 'chown'), ownershipStub, { mode: 0o755 }),
+      writeExport(appExport, [
+        { key: 'APP_ORIGIN', value: 'https://exported.invalid' },
+        { key: 'DISCORD_CLIENT_ID', value: 'exported-discord-client' },
+        { key: 'DISCORD_CLIENT_SECRET', value: 'exported-discord-secret' },
+        {
+          key: 'MFA_TOTP_ENCRYPTION_KEYS',
+          value: 'totp-encryption-keyring',
+        },
+      ]),
+      writeExport(sharedExport, [
+        { key: 'SCHEDULER_TOKEN', value: schedulerToken },
+      ]),
+    ]);
+  });
+
+  afterEach(async () => {
+    await rm(temporaryRoot, { recursive: true, force: true });
+  });
+
+  function runtimeEnvironment(
+    scope: 'app' | 'scheduler',
+  ): Record<string, string> {
+    return {
+      PATH: `${temporaryRoot}:${process.env.PATH ?? ''}`,
+      INFISICAL_PROJECT_ID: 'project-id',
+      INFISICAL_ENVIRONMENT: 'staging',
+      INFISICAL_RUNTIME_SCOPE: scope,
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: clientIdFile,
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: clientSecretFile,
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID: 'bootstrap-client-id',
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET: 'bootstrap-client-secret',
+      INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN: 'bootstrap-access-token',
+      INFISICAL_TOKEN: 'bootstrap-token',
+      TOKEN: 'generic-bootstrap-token',
+      STUB_EXPECTED_CLIENT_ID: 'universal-client-id',
+      STUB_EXPECTED_CLIENT_SECRET: 'universal-client-secret',
+      STUB_LOGIN_LOG: loginLog,
+      STUB_EXPORT_LOG: exportLog,
+      STUB_GOSU_LOG: gosuLog,
+      STUB_APP_EXPORT: appExport,
+      STUB_SHARED_EXPORT: sharedExport,
+      CAPTURE_ENV_PATH: capturedEnvironment,
+      SHD_BUILD_NUMBER: '42',
+      SHD_COMMIT_SHA: 'abc123',
+      APP_ORIGIN: 'https://parent.invalid',
+      SCHEDULER_URL: 'https://parent.invalid/scheduler',
+      BASH_ENV: '',
+      CDPATH: temporaryRoot,
+      ENV: '',
+      IFS: 'hostile-ifs',
+      LD_LIBRARY_PATH: temporaryRoot,
+      LD_PRELOAD: '',
+      NODE_OPTIONS: '--no-warnings',
+      NODE_PATH: temporaryRoot,
+      PYTHONPATH: temporaryRoot,
+    };
+  }
+
+  function start(environment: Record<string, string>) {
+    return spawnSync(
+      '/bin/sh',
+      ['./deploy/container-entrypoint.sh', 'capture-environment'],
+      {
+        cwd: temporaryRoot,
+        env: environment,
+        encoding: 'utf8',
+      },
+    );
+  }
+
+  it('exports app and shared secrets into a scrubbed app child environment', async () => {
+    const result = start(runtimeEnvironment('app'));
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(await exportPaths()).toEqual(['/app', '/shared/scheduler']);
+    expect(await readFile(loginLog, 'utf8')).toBe(
+      'login\n--method=universal-auth\n--silent\n--plain\ncredentials=ok\n',
+    );
+
+    const childEnvironment = parseEnvironment(
+      await readFile(capturedEnvironment, 'utf8'),
+    );
+    expect(childEnvironment).toMatchObject({
+      APP_ORIGIN: 'https://stage.shd.build',
+      DISCORD_CLIENT_ID: 'exported-discord-client',
+      DISCORD_CLIENT_SECRET: 'exported-discord-secret',
+      MFA_TOTP_ENCRYPTION_KEYS: 'totp-encryption-keyring',
+      ORIGIN: 'https://stage.shd.build',
+      PASSKEY_RP_ID: 'shd.build',
+      SCHEDULER_TOKEN: schedulerToken,
+      SHD_BUILD_NUMBER: '42',
+      SHD_COMMIT_SHA: 'abc123',
+      TDR_AVATAR_STORAGE_PATH: '/app/data/avatars',
+      TDR_DATABASE_PATH: '/app/data/shd-build-staging.db',
+      TDR_GAME_ICON_STORAGE_PATH: '/app/data/game-icons',
+    });
+    for (const name of removedEnvironmentNames) {
+      expect(childEnvironment).not.toHaveProperty(name);
+    }
+    await expectSecretFilesRemoved();
+    await expectRootPrivilegeDrop();
+  });
+
+  it('exports only shared secrets into the scheduler child environment', async () => {
+    const result = start(runtimeEnvironment('scheduler'));
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(await exportPaths()).toEqual(['/shared/scheduler']);
+    expect(
+      parseEnvironment(await readFile(capturedEnvironment, 'utf8')),
+    ).toMatchObject({
+      SCHEDULER_TOKEN: schedulerToken,
+      SCHEDULER_URL: 'http://app:3000/api/internal/scheduler',
+    });
+    await expectSecretFilesRemoved();
+    await expectRootPrivilegeDrop();
+  });
+
+  it('fails closed on an unknown secret before launching the child', async () => {
+    await writeExport(appExport, [
+      { key: 'DISCORD_CLIENT_ID', value: 'exported-discord-client' },
+      { key: 'UNKNOWN_SECRET', value: 'must-not-reach-child' },
+    ]);
+
+    const result = start(runtimeEnvironment('app'));
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain(
+      'Infisical secret UNKNOWN_SECRET is not allowed in this runtime scope.',
+    );
+    expect(existsSync(capturedEnvironment)).toBe(false);
+    await expectSecretFilesRemoved();
+  });
+
+  it('fails closed when a credential file setting is missing', () => {
+    const environment = runtimeEnvironment('app');
+    delete environment.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE;
+
+    const result = start(environment);
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain(
+      'INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE is required',
+    );
+    expect(existsSync(exportLog)).toBe(false);
+    expect(existsSync(capturedEnvironment)).toBe(false);
+  });
+
+  it('fails closed when either credential is empty', async () => {
+    for (const credentialFile of [clientIdFile, clientSecretFile]) {
+      await writeFile(credentialFile, '');
+
+      const result = start(runtimeEnvironment('app'));
+
+      expect(result.status).not.toBe(0);
+      expect(result.stderr).toContain('credential files must not be empty');
+      expect(existsSync(exportLog)).toBe(false);
+      expect(existsSync(capturedEnvironment)).toBe(false);
+      await writeFile(
+        credentialFile,
+        credentialFile === clientIdFile
+          ? 'universal-client-id\n'
+          : 'universal-client-secret\n',
+      );
+    }
+  });
+
+  it.each(['fail', 'empty'])(
+    'fails closed when login returns %s',
+    (loginResult) => {
+      const result = start({
+        ...runtimeEnvironment('app'),
+        STUB_LOGIN_RESULT: loginResult,
+      });
+
+      expect(result.status).not.toBe(0);
+      expect(existsSync(exportLog)).toBe(false);
+      expect(existsSync(capturedEnvironment)).toBe(false);
+    },
+  );
+
+  it('fails closed on a malformed export and removes every secret file', async () => {
+    await writeFile(appExport, '{not-json');
+
+    const result = start(runtimeEnvironment('app'));
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain(
+      'Infisical returned an unreadable secret export.',
+    );
+    expect(existsSync(capturedEnvironment)).toBe(false);
+    await expectSecretFilesRemoved();
+  });
+
+  async function exportPaths() {
+    return (await exportRecords()).map(([path]) => path);
+  }
+
+  async function expectSecretFilesRemoved() {
+    for (const [, file] of await exportRecords()) {
+      expect(existsSync(file)).toBe(false);
+    }
+  }
+
+  async function exportRecords() {
+    return (await readFile(exportLog, 'utf8'))
+      .trim()
+      .split('\n')
+      .map((line) => line.split('|'));
+  }
+
+  async function expectRootPrivilegeDrop() {
+    if (typeof process.getuid === 'function' && process.getuid() === 0) {
+      expect(await readFile(gosuLog, 'utf8')).toBe('target=shd-runtime\n');
+    } else {
+      expect(existsSync(gosuLog)).toBe(false);
+    }
+  }
+});
+
+const removedEnvironmentNames = [
+  'BASH_ENV',
+  'CDPATH',
+  'ENV',
+  'IFS',
+  'INFISICAL_ENVIRONMENT',
+  'INFISICAL_PROJECT_ID',
+  'INFISICAL_RUNTIME_SCOPE',
+  'INFISICAL_TOKEN',
+  'INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN',
+  'INFISICAL_UNIVERSAL_AUTH_CLIENT_ID',
+  'INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE',
+  'INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET',
+  'INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE',
+  'LD_LIBRARY_PATH',
+  'LD_PRELOAD',
+  'NODE_OPTIONS',
+  'NODE_PATH',
+  'PYTHONPATH',
+  'TOKEN',
+];
+
+function writeExport(
+  file: string,
+  entries: Array<{ key: string; value: string }>,
+) {
+  return writeFile(file, `${JSON.stringify(entries)}\n`);
+}
+
+function parseEnvironment(value: string) {
+  return Object.fromEntries(
+    value
+      .trim()
+      .split('\n')
+      .map((line) => {
+        const separator = line.indexOf('=');
+        return [line.slice(0, separator), line.slice(separator + 1)];
+      }),
+  );
+}

deploy/sync-production-isac-to-staging.sh

@@ -14,7 +14,11 @@ production_environment="$production_directory/.env.deploy"
 staging_compose_file="$staging_directory/compose.staging.yml"
 staging_environment="$staging_directory/.env.deploy"
 snapshot_name="isac-production-$(date -u +%Y-%m-%dT%H-%M-%SZ).json"
-snapshot_path="/tmp/$snapshot_name"
+snapshot_path=$(mktemp "/tmp/$snapshot_name.XXXXXX")
+production_snapshot_path="/app/data/exports/$snapshot_name"
+staging_snapshot_path="/app/data/$snapshot_name"
+remove_production_snapshot=false
+remove_staging_snapshot=false
 
 production_compose() {
 	docker compose --env-file "$production_environment" -f "$production_compose_file" "$@"
@@ -22,22 +26,54 @@ production_compose() {
 staging_compose() {
 	docker compose --env-file "$staging_environment" -f "$staging_compose_file" "$@"
 }
-restart_services() {
-	production_compose up -d --no-build app scheduler || true
-	staging_compose up -d --no-build app scheduler || true
-	rm -f "$snapshot_path"
+cleanup() {
+	exit_status=$?
+	trap - EXIT
+	if [ "$remove_production_snapshot" = true ]; then
+		production_compose run --rm --no-deps app rm -f "$production_snapshot_path" || true
+	fi
+	if [ "$remove_staging_snapshot" = true ]; then
+		staging_compose run --rm --no-deps app rm -f "$staging_snapshot_path" || true
+	fi
+	rm -f "$snapshot_path" || true
+	if ! production_compose up -d --no-build app scheduler; then
+		if [ "$exit_status" -eq 0 ]; then exit_status=1; fi
+	fi
+	if ! staging_compose up -d --no-build app scheduler; then
+		if [ "$exit_status" -eq 0 ]; then exit_status=1; fi
+	fi
+	exit "$exit_status"
 }
-trap restart_services EXIT
+trap cleanup EXIT
 
 echo "Stopping production writers for a consistent canonical export."
 production_compose stop scheduler app
-production_compose run --rm --no-deps -v "/tmp:/export" app \
-	node scripts/isac-data-export.mjs "/export/$snapshot_name"
+production_app_container=$(production_compose ps --all --quiet app)
+if [ -z "$production_app_container" ]; then
+	echo "The stopped production app container could not be found." >&2
+	exit 1
+fi
+remove_production_snapshot=true
+production_compose run --rm --no-deps app \
+	node scripts/isac-data-export.mjs "$production_snapshot_path"
+docker cp "$production_app_container:$production_snapshot_path" "$snapshot_path"
+production_compose run --rm --no-deps app rm -f "$production_snapshot_path"
+remove_production_snapshot=false
 production_compose up -d --no-build app scheduler
 
 echo "Stopping staging writers before its automatic full and ISAC safety backups."
 staging_compose stop scheduler app
-staging_compose run --rm --no-deps -v "/tmp:/import:ro" app \
-	node scripts/isac-data-import.mjs "/import/$snapshot_name" --confirm-replace-isac-data
+staging_app_container=$(staging_compose ps --all --quiet app)
+if [ -z "$staging_app_container" ]; then
+	echo "The stopped staging app container could not be found." >&2
+	exit 1
+fi
+remove_staging_snapshot=true
+docker cp "$snapshot_path" "$staging_app_container:$staging_snapshot_path"
+staging_compose run --rm --no-deps app \
+	node scripts/isac-data-import.mjs "$staging_snapshot_path" --confirm-replace-isac-data
+staging_compose run --rm --no-deps app rm -f "$staging_snapshot_path"
+remove_staging_snapshot=false
+rm -f "$snapshot_path"
 
 echo "Production ISAC data was safely synchronized into staging."

docs/CONTENT_MODERATION.md

@@ -1,14 +1,20 @@
 # Community content moderation
 
 SHD.build applies one moderation lifecycle to public comments, profile
-biographies, custom avatars, guides, and build descriptions. The shared server
-service lives in `src/lib/server/community-moderation.ts`. Content save actions
-must use that service before publication.
+biographies, custom avatars, and Guides. The shared server service lives in
+`src/lib/server/community-moderation.ts`. Content save actions must use that
+service before publication.
+
+Public database records also host one moderated discussion thread. The thread
+uses the existing `comment` content type and accepts only visible comments from
+authenticated Agents. Community moderators may pin one visible comment as the
+record's Community Note. Pinning and unpinning append `community_note.pinned`
+and `community_note.unpinned` audit events; a pinned comment remains ordinary
+community text and follows the same removal rules as every other comment.
 
 ## Publication decisions
 
-The moderation service combines local rules with the configured provider
-result:
+The moderation service combines local rules with the configured provider result:
 
 - Clean content publishes without human review when automatic publication is
   enabled.
@@ -18,8 +24,8 @@ result:
   enabled.
 - An allow term can suppress the matching local term rule. It cannot override a
   provider flag or threshold.
-- A user report sends visible content to Oversight. One report does not hide
-  the content because reports can be mistaken or abusive.
+- A user report sends visible content to Oversight. One report does not hide the
+  content because reports can be mistaken or abusive.
 
 The service records every automated scan in `content_moderation_scans`.
 Automated scans do not write to the human ISAC audit log. Human policy changes
@@ -33,13 +39,20 @@ Comments use an explicit status:
 - `pending_review`: hidden while Oversight decides
 - `removed`: unavailable after author removal or an Oversight decision
 
-Long-form content uses immutable pending revisions. Profile and guide edits that
-need review go into `moderated_content_revisions`; the public row keeps its last
-approved text. Approval copies the reviewed revision into the public row.
-Rejection preserves the revision and review evidence without publishing it.
+Long-form content uses immutable pending revisions. Profile biographies keep
+text candidates in `moderated_content_revisions`. Guides use the complete
+structured snapshot in `article_revisions`, including title, deck, document,
+tags, media references, and Build snapshots. The public article keeps its last
+approved revision while another revision waits for review. Rejection retains the
+submitted revision and evidence without publishing it.
 
-Custom avatar uploads remain active after a clean image scan. A flagged image
-or fail-closed scan error creates an `avatar_reviews` item and is unavailable
+News articles do not use automated content moderation. The `news.manage`
+permission gates News creation, editing, publication, and deletion. Comments on
+News articles remain community content and use the standard comment moderation
+lifecycle.
+
+Custom avatar uploads remain active after a clean image scan. A flagged image or
+fail-closed scan error creates an `avatar_reviews` item and is unavailable
 through the public avatar route until approval. An Agent report also creates a
 review item, but leaves an already-published avatar visible while Oversight
 decides.
@@ -69,8 +82,8 @@ applicable, and records a specific ISAC audit event with before and after
 evidence. Unsaved changes in other categories remain local drafts.
 
 Site Controls requires `site.settings.manage`. Community Oversight handles text
-decisions through the existing comment and profile permissions. Avatar
-Oversight handles custom images through `avatars.review`.
+decisions through the existing comment and profile permissions. Avatar Oversight
+handles custom images through `avatars.review`.
 
 Moderators must record a reason when they approve, reject, remove, restore,
 dismiss, or resolve a queued item. The action must append an audit event after
@@ -78,10 +91,14 @@ the content and review records change.
 
 ## User reports
 
-Authenticated Agents can report visible content they do not own. The report
-control must identify the content type and stable content ID, validate that the
-content remains public, and create a pending `user_content_reports` row.
-Duplicate pending reports from the same Agent for the same content are rejected.
+Authenticated Agents can report visible comments, biographies, and avatars they
+do not own. Registered and anonymous visitors can report visible Guides. A Guide
+report records the exact published `article_revision_id`; a decision cannot hide
+a newer revision. Anonymous reports use a random HTTP-only browser token whose
+domain-separated SHA-256 hash supplies duplicate suppression. The server applies
+rate limits and requests Turnstile verification after repeated anonymous
+activity. SHD.build does not use device fingerprinting or retain a raw IP
+address as the reporter identity.
 
 A reviewer either dismisses the report and keeps the content or resolves the
 report through a moderation action. Report details must not copy authentication
@@ -89,8 +106,7 @@ secrets or unnecessary personal information into the audit log.
 
 ## Adding a public UGC field
 
-Guide authoring, build descriptions, and later public text fields must complete
-this checklist:
+Guide authoring and later public text fields must complete this checklist:
 
 1. Normalize and validate the submitted text before scanning.
 2. Call `moderateCommunityText` with a supported content type.
@@ -98,14 +114,15 @@ this checklist:
 4. Publish only an `approved` result.
 5. Store held long-form text as an immutable revision so the last approved
    version remains public.
-6. Call `recordCommunityModerationScan` with the stable content ID, author, hash,
-   policy version, provider evidence, and local-rule matches.
+6. Call `recordCommunityModerationScan` with the stable content ID, exact
+   article revision, author, hash, policy version, provider evidence, and
+   local-rule matches.
 7. Add the content type to the Community Oversight queue and permission checks.
 8. Add the shared report control to the public rendering.
 9. Delay follower, owner, or reply notifications until the content becomes
    public.
 10. Add approval, rejection, report dismissal, author notification, and audit
-   tests.
+    tests.
 11. Confirm every public query selects approved content explicitly.
 
 Do not add a route-specific word filter, provider client, threshold table, or
@@ -127,9 +144,9 @@ option, update the legal copy before sending user content under that setting.
 
 Threshold changes increment the policy version. Stored scans retain their model
 and policy version so reviewers can interpret older decisions. Test threshold
-changes against representative Division terminology before activation,
-including weapon names, damage descriptions, kills, status effects, and build
-strategy language.
+changes against representative Division terminology before activation, including
+weapon names, damage descriptions, kills, status effects, and build strategy
+language.
 
 Database migrations that add moderation states or revision storage follow the
 repository database-preservation procedure: stop this project's development

docs/DEPLOYMENT.md

@@ -2,8 +2,8 @@
 
 SHD.build runs in a Node 24 container through the official SvelteKit Node
 adapter. The image includes application code, migration and notification
-scripts, and native runtime dependencies. Environment files, databases,
-backups, and user uploads remain outside the image.
+scripts, the Infisical CLI, and native runtime dependencies. Databases, backups,
+user uploads, and Universal Auth bootstrap credentials remain outside the image.
 
 ## Persistent data
 
@@ -16,8 +16,8 @@ mounted at `/app/data`. It contains:
 - uploaded game-data icons under `game-icons/`.
 
 Keep this volume during routine deployments. `docker compose down` without
-`--volumes` preserves it. Before a manual backup or restore, stop the `app`
-and `scheduler` services because both access the embedded database.
+`--volumes` preserves it. Before a manual backup or restore, stop the `app` and
+`scheduler` services because both access the embedded database.
 
 ## Staging environment
 
@@ -29,25 +29,74 @@ Staging defaults to:
 - Passkey relying-party ID: `shd.build`
 - Adapter canonical origin: `https://stage.shd.build`
 
-Edit its encrypted configuration locally:
+Guide ratings and reports use Cloudflare Turnstile after repeated anonymous
+activity. Configure both values under `/app` in each Infisical environment:
 
-```sh
-npm run env:decrypt:staging
-# Fill in Discord and SMTP values.
-npm run env:encrypt:staging
+```text
+TURNSTILE_SITE_KEY=<public site key>
+TURNSTILE_SECRET_KEY=<server verification secret>
+```
+
+Register the exact staging and production hostnames in the Turnstile widget. The
+browser receives only `TURNSTILE_SITE_KEY`. The server sends a challenge token
+and the request address to Cloudflare for verification; it never exposes
+`TURNSTILE_SECRET_KEY` or stores the raw address as visitor identity. Without a
+valid secret, a visitor who reaches the challenge threshold cannot submit more
+anonymous ratings or Guide reports.
+
+Edit staging configuration in Infisical project
+`2ee94b27-e599-4194-9797-3372d42e53f6`:
+
+```text
+Environment: staging
+Application path: /app
+Scheduler path: /shared/scheduler
 ```
 
 Add `https://stage.shd.build/auth/discord/callback` to the Discord application's
-allowed OAuth redirect URIs. Point the staging DNS record at the deployment
-host and configure the host's TLS reverse proxy to forward
-`stage.shd.build` to port `5569` on the staging host. Docker publishes this
-port on the host interfaces so a containerized reverse proxy or tunnel can
-reach it; firewall the port to trusted LAN/tunnel sources when the host is
-reachable from other networks.
+allowed OAuth redirect URIs. Point the staging DNS record at the deployment host
+and configure the host's TLS reverse proxy to forward `stage.shd.build` to port
+`5569` on the staging host. Docker publishes this port on the host interfaces so
+a containerized reverse proxy or tunnel can reach it; firewall the port to
+trusted LAN/tunnel sources when the host is reachable from other networks.
 
-The trusted staging runner decrypts `.env.staging` into a mode-`0600` runtime
-file. Gitea Actions holds the decryption key; Git and the container image do
-not.
+The trusted staging runner writes separate mode-`0600` Universal Auth client-ID
+and client-secret files for the app and scheduler. Compose mounts each pair only
+into its assigned service. Each container exchanges those credentials for a
+short-lived access token and writes the assigned paths to mode-`0600` temporary
+JSON files. The entrypoint rejects unknown secret names, deletes the token,
+transfers the exports to the dedicated `shd-runtime` UID 10001, and drops root
+before parsing them. The launcher deletes the files before validation,
+migration, or startup. Startup fails if the mounted credential files are
+readable by UID 10001 or by their group or other users. Runtime-created data
+retains group access for rollback to the previous container UID.
+
+| Machine identity                 | Environment | Injected paths              | Gitea variable                             | Gitea secret                                   |
+| -------------------------------- | ----------- | --------------------------- | ------------------------------------------ | ---------------------------------------------- |
+| `shd-build-staging-app`          | `staging`   | `/app`, `/shared/scheduler` | `INFISICAL_STAGING_APP_CLIENT_ID`          | `INFISICAL_STAGING_APP_CLIENT_SECRET`          |
+| `shd-build-staging-scheduler`    | `staging`   | `/shared/scheduler`         | `INFISICAL_STAGING_SCHEDULER_CLIENT_ID`    | `INFISICAL_STAGING_SCHEDULER_CLIENT_SECRET`    |
+| `shd-build-production-app`       | `prod`      | `/app`, `/shared/scheduler` | `INFISICAL_PRODUCTION_APP_CLIENT_ID`       | `INFISICAL_PRODUCTION_APP_CLIENT_SECRET`       |
+| `shd-build-production-scheduler` | `prod`      | `/shared/scheduler`         | `INFISICAL_PRODUCTION_SCHEDULER_CLIENT_ID` | `INFISICAL_PRODUCTION_SCHEDULER_CLIENT_SECRET` |
+
+The self-hosted Free plan allows five machine identities and does not include
+Custom Project Roles. The four runtime identities use the built-in Viewer role,
+which can read the complete project. Service-specific paths limit injected
+values, but they do not restrict what a stolen root credential could request.
+Use an Enterprise license with Custom Project Roles, or split runtime scopes
+into separate projects, before treating identity authorization as least
+privilege.
+
+An Infisical outage does not stop a running container. A new container or direct
+restart fails closed until `https://secrets.jb.codes` becomes available and the
+identity can authenticate.
+
+Keep the old `.env.*.runtime` files and `DOTENV_PRIVATE_KEY_*` Gitea secrets
+only through the first successful staging and production cutovers. The rollback
+path may need them to start the previous image. After both environments pass
+direct restart checks, rotate every migrated provider credential in Infisical,
+remove the old dotenv private keys and `SCHEDULER_TOKEN_PRODUCTION` from Gitea,
+and delete local and hosted dotenv key material. Removing encrypted files from
+the current Git tree does not revoke values stored in Git history.
 
 The staging container disables default-user seeding. On a brand-new staging
 database, the existing bootstrap policy grants Admin to the first real account
@@ -55,10 +104,10 @@ that signs in instead of writing generated credentials into deployment logs.
 
 ## Gitea Actions runner
 
-Gitea Actions requires an `act_runner`. Register a trusted runner on the
-staging host from the repository's **Settings → Actions → Runners** page. The
-host needs Node/npm, Docker Engine, and Docker Compose v2. The runner account
-must be able to use Docker and write to the deployment directory.
+Gitea Actions requires an `act_runner`. Register a trusted runner on the staging
+host from the repository's **Settings → Actions → Runners** page. The host needs
+Node/npm, Docker Engine, and Docker Compose v2. The runner account must be able
+to use Docker and write to the deployment directory.
 
 Use runner labels that provide an isolated validation job and a host deployment
 job:
@@ -85,41 +134,76 @@ Restart the runner session after adding it to the Docker group.
 
 In `https://git.jb.codes/jb/shd.build/settings/actions`:
 
-1. Add repository secret `DOTENV_PRIVATE_KEY_STAGING`, using the matching value
-   from the ignored local `.env.keys`.
-2. Optionally add repository variable `STAGE_DEPLOY_PATH`. It defaults to
+1. Add repository secrets `INFISICAL_STAGING_APP_CLIENT_SECRET` and
+   `INFISICAL_STAGING_SCHEDULER_CLIENT_SECRET`.
+2. Add repository variables `INFISICAL_STAGING_APP_CLIENT_ID` and
+   `INFISICAL_STAGING_SCHEDULER_CLIENT_ID`.
+3. Optionally add repository variable `STAGE_DEPLOY_PATH`. It defaults to
    `/opt/shd-build-stage`.
-3. Optionally add repository variable `STAGE_PORT`. It defaults to `5569`.
-4. Ensure Actions are enabled and the `stage-deploy` runner is online.
+4. Optionally add repository variable `STAGE_PORT`. It defaults to `5569`.
+5. Ensure Actions are enabled and the `stage-deploy` runner is online.
 
 `.gitea/workflows/deploy-staging.yml` runs for pushes to `main` and manual
-dispatches. The trusted staging runner builds each commit-tagged image locally,
-so the workflow needs no registry credentials. Gitea assigns
-`gitea.run_number` to `SHD_BUILD_NUMBER`; each new workflow run receives the
-next integer, while retries of the same run retain their number.
+dispatches. The trusted staging runner builds each image locally with a tag that
+contains the commit, workflow run, and attempt, so the workflow needs no
+registry credentials and a retry cannot overwrite the active image. Gitea
+assigns `gitea.run_number` to `SHD_BUILD_NUMBER`; each new workflow run receives
+the next integer, while retries of the same run retain their number.
+
+Staging and production deployments, ISAC exports, and production-to-staging
+synchronization share the `shd-build-host-maintenance` concurrency group. Gitea
+runs only one of these database maintenance workflows on the deployment host at
+a time and never cancels one in progress.
 
 ## Deployment lifecycle
 
-The workflow:
+The workflow stages Compose, credentials, and release metadata in an isolated
+candidate directory. It leaves the canonical deployment files unchanged until
+the candidate passes preflight, backup, and migration. The workflow then:
 
-1. installs dependencies, runs `npm run check`, and produces the Node build;
+1. installs dependencies, runs `npm run check` and `npm test`, and produces the
+   Node build;
 2. builds the candidate container while the current site remains online;
-3. stops only the staging application and notification scheduler;
-4. creates a timestamped JSON backup if the staging database exists;
-5. applies additive, repeatable migrations;
-6. starts the application and scheduler with the new image;
-7. waits for `/api/health` to report healthy;
-8. retains the logs and exits unsuccessfully if health verification fails.
+3. starts one-off app and scheduler containers to verify Infisical access and
+   validate the candidate environment;
+4. stops only the staging application and notification scheduler;
+5. creates a timestamped JSON backup if the staging database exists;
+6. applies additive, repeatable migrations in a one-off container;
+7. promotes the candidate files to the canonical deployment paths;
+8. starts the application and scheduler with the new image;
+9. validates the app environment and reruns the repeatable migration in the app
+   entrypoint before serving;
+10. verifies `/api/health` and scheduler liveness;
+11. restores the previous canonical files and verifies the previous app and
+    scheduler after a failed stop, backup, migration, startup, or health check.
+
+On a failed health check, the deploy script prints the final 150 application log
+lines and exits unsuccessfully. It does not create a separate log artifact.
 
 The outage covers backup, migration, and container startup. Migrations may also
 remove records that use retired data formats when a release explicitly ends
 compatibility. The deployment backup remains the recovery source for those
-records; the application does not repair or reinterpret them at runtime.
-The scheduler calls a bearer-authenticated endpoint on the application service
-once per minute. Scheduled message delivery therefore uses the web process's
-existing embedded-database connection instead of opening the locked database
-from a second process. The endpoint runs automated system messages, Oversight
-consolidation, and email digest checks and is not published through a host port.
+records; the application does not repair or reinterpret them at runtime. The
+scheduler calls a bearer-authenticated endpoint on the application service once
+per minute. Scheduled message delivery therefore uses the web process's existing
+embedded-database connection instead of opening the locked database from a
+second process. The endpoint runs automated system messages, Oversight
+consolidation, email digest checks, and the Ubisoft News importer. Docker does
+not publish the endpoint through a host port.
+
+When enabled in production, the Ubisoft importer keeps its own persisted due
+time, so the one-minute tick starts a feed synchronization no more than once per
+hour after a successful run. When a synchronization fails, the importer stores
+the last error and consecutive failure count, then retries after 15 minutes with
+exponential backoff capped at six hours. Source items that disappear from the
+feed remain published; the importer performs no automatic removal. The scheduler
+runs notification delivery before it starts the bounded Ubisoft request, so a
+slow provider does not postpone notifications for the current tick.
+
+The runtime launcher sets `UBISOFT_NEWS_IMPORT_ENABLED=true` for production and
+`false` for staging. Development does not set the flag, so the importer remains
+disabled because it requires the exact value `true`. The application process
+evaluates the flag when it handles `/api/internal/scheduler`.
 
 ## Prelaunch operation
 
@@ -131,8 +215,8 @@ for a database that does not contain the row:
 - News, Database, Builds, Guides, and Builder: enabled
 
 The migration uses an insert-if-missing seed. Later deployments preserve the
-operator's settings, and configuration changes take effect without a restart.
-A full environment bootstrap copies the source row. Canonical ISAC game-data
+operator's settings, and configuration changes take effect without a restart. A
+full environment bootstrap copies the source row. Canonical ISAC game-data
 imports leave the target environment's launch settings unchanged.
 
 Use this operator flow after the first deployment:
@@ -149,13 +233,13 @@ Use this operator flow after the first deployment:
    session before public release. Sign in and verify the same disabled routes
    remain unavailable.
 
-Keep Coming Soon enabled while preparing production. Section controls can be
-set in advance because the launch gate takes precedence for signed-out traffic.
-Set Account Creation to Disabled if prelaunch access must remain limited to
-existing identities. Switch the Launch Gate to Public Launch after verification.
-Disabled sections remain absent from navigation and unavailable by direct URL
-for every user, including authenticated agents. Authentication bypasses only
-the Coming Soon gate.
+Keep Coming Soon enabled while preparing production. Section controls can be set
+in advance because the launch gate takes precedence for signed-out traffic. Set
+Account Creation to Disabled if prelaunch access must remain limited to existing
+identities. Switch the Launch Gate to Public Launch after verification. Disabled
+sections remain absent from navigation and unavailable by direct URL for every
+user, including authenticated agents. Authentication bypasses only the Coming
+Soon gate.
 
 Turn Coming Soon on to restore the promotional gate. Site-control changes append
 `system_configuration / site_access.updated` audit events, including the
@@ -177,21 +261,21 @@ open while its complete transfer bundle is created:
 npm run stage:bootstrap:export
 ```
 
-The command writes a timestamped, ignored JSON bundle under `data/backups/`.
-The bundle includes user records and password hashes. Transfer it over an
-encrypted channel, keep it out of Git, then copy it to the staging host and run:
+The command writes a timestamped, ignored JSON bundle under `data/backups/`. The
+bundle includes user records and password hashes. Transfer it over an encrypted
+channel, keep it out of Git, then copy it to the staging host and run:
 
 ```sh
 /opt/shd-build-stage/bootstrap-staging.sh \
   /secure/path/shd-stage-bootstrap-YYYY-MM-DDTHH-MM-SSZ.json
 ```
 
-The bootstrap flow stops the app and scheduler, creates a safety backup of the
-target, verifies that staging is unused, imports the entire development
-database and uploads, and restarts both services. Delete the transfer copy from
-the staging host after verifying the imported record counts and critical
-entities. The copy under the local ignored backup directory remains the
-recovery source.
+The bootstrap flow requires both services to stop, copies the bundle into the
+private data volume, assigns it to the runtime UID, creates a safety backup,
+verifies that staging is unused, imports the entire development database and
+uploads, deletes the volume copy, and restarts both services. Delete the host
+transfer copy after verifying the imported record counts and critical entities.
+The copy under the local ignored backup directory remains the recovery source.
 
 Because this is a full initial clone, development session tokens and account
 data also enter staging. Staging and development remain independent from that
@@ -250,16 +334,21 @@ environment, port, and deployment workflow:
 - Database: `/app/data/shd-build-production.db`
 - Persistent volume: `shd-build-production-data`
 
-Routine pushes leave production data unchanged. The production deploy stops its
-application and scheduler, creates a timestamped JSON backup, applies repeatable
-migrations, restarts, and verifies database health. Keep
-`docker compose down --volumes` away from production.
+Routine pushes preserve production data unless an included migration removes a
+retired prototype format. The production deploy stops its application and
+scheduler, creates a timestamped JSON backup, applies repeatable migrations,
+restarts, and verifies database health. Keep `docker compose down --volumes`
+away from production.
 
 Add these repository Action secrets:
 
-- `DOTENV_PRIVATE_KEY_PRODUCTION`, matching the ignored local `.env.keys`
-- `SCHEDULER_TOKEN_PRODUCTION`, a long random value used only by the internal
-  scheduler endpoint
+- `INFISICAL_PRODUCTION_APP_CLIENT_SECRET`
+- `INFISICAL_PRODUCTION_SCHEDULER_CLIENT_SECRET`
+
+Add the matching repository variables:
+
+- `INFISICAL_PRODUCTION_APP_CLIENT_ID`
+- `INFISICAL_PRODUCTION_SCHEDULER_CLIENT_ID`
 
 Optional repository variables are `PRODUCTION_DEPLOY_PATH` (default
 `/opt/shd-build-production`) and `PRODUCTION_PORT` (default `3102`). The
@@ -270,12 +359,12 @@ workflow run number supplies the production `SHD_BUILD_NUMBER`.
 Prepare the host directory once from an interactive SSH session:
 
 ```sh
-sudo install -d -o jb -g jb -m 0750 /opt/shd-build-production
+sudo install -d -o act_runner -g act_runner -m 0750 /opt/shd-build-production
 ```
 
-Generate the scheduler secret locally without printing it into a shared log,
-then enter it directly in Gitea's repository-secret form. Do not commit it or
-reuse the staging scheduler token.
+Store a separate production `SCHEDULER_TOKEN` under Infisical path
+`/shared/scheduler`. The application and scheduler fetch the same value from
+that path. Do not reuse the staging token.
 
 ### Initial production bootstrap
 
@@ -293,9 +382,34 @@ Copy the resulting ignored JSON bundle to the deployment host over SSH, then:
   /secure/path/shd-production-bootstrap-YYYY-MM-DDTHH-MM-SSZ.json
 ```
 
-The importer verifies the bundle target, creates a production safety backup,
-and refuses to replace a production database containing users, builds, audit
-events, or proposals. Remove the remote transfer copy after verification.
+The bootstrap script requires both services to stop, stages the bundle in the
+private data volume with runtime-only access, and removes that copy after the
+import. The importer verifies the bundle target, creates a production safety
+backup, and refuses to replace a production database containing users, builds,
+audit events, or proposals. Remove the remote host copy after verification.
+
+### Promote one News article
+
+Export a locally authored News article by ID or slug while the development
+server is stopped:
+
+```sh
+npm run article:export -- <article-id-or-slug>
+```
+
+The ignored bundle contains the article draft, immutable revisions, search row,
+managed-image metadata, and image bytes. It excludes comments, reports, user
+records, Builds, and ISAC data.
+
+After deploying the matching application schema, stop the production app and
+scheduler. Copy the transferred bundle into `/app/data` with `docker cp`, assign
+it to `shd-runtime:node` with mode `0600` through a root one-off container, then
+run `scripts/article-transfer.mjs import` with `ARTICLE_IMPORT_ENABLED=true` and
+`--confirm-article-import`. The importer creates a production database backup
+before opening the database, resolves the article owner by stable ID or
+username, rejects ID and slug conflicts, verifies image checksums, and appends
+`editorial_content / news.promoted`. Remove both bundle copies, restart the app
+and scheduler, and health-check both services.
 
 ### Pull production ISAC data into development
 
@@ -312,29 +426,29 @@ notifications, settings, and audit history untouched.
 
 ### Pull production ISAC data into staging
 
-Manually run **Replace staging ISAC data from production** in Gitea Actions.
-The workflow exports a consistent production snapshot, restarts production,
-then stops staging and imports it. The staging importer creates full and
-ISAC-only safety backups before replacement. Deployments do not run this flow.
+Manually run **Replace staging ISAC data from production** in Gitea Actions. The
+workflow exports a consistent production snapshot, restarts production, then
+stops staging and imports it. The staging importer creates full and ISAC-only
+safety backups before replacement. Deployments do not run this flow.
 
 ### Promote managed images without replacing other data
 
 Image Library assets use stable IDs and can be promoted additively from local
 development. Export a bundle after finishing local uploads and metadata edits:
 
-Set the server-only `REMOVE_BG_API_KEY` in each encrypted environment that
-accepts ISAC uploads. It is sent only from the server in the `X-Api-Key` header.
-Transparent icon uploads skip remove.bg. Opaque sources use its preview output,
-then pass through local trimming, white normalization, WebP conversion, and
-storage.
+Set the server-only `REMOVE_BG_API_KEY` under `/app` in each Infisical
+environment that accepts ISAC uploads. The server sends it only in the
+`X-Api-Key` header. Transparent icon uploads skip remove.bg. Opaque sources use
+its preview output, then pass through local trimming, white normalization, WebP
+conversion, and storage.
 
 The application stores a remove.bg capacity snapshot and refreshes it from the
 internal scheduler. `REMOVE_BG_CREDIT_CHECK_HOURS` controls the account lookup
 interval and defaults to six hours. Low-capacity alerts require both remaining
 pools to cross their thresholds: `REMOVE_BG_LOW_CREDIT_THRESHOLD` defaults to
 five paid credits, and `REMOVE_BG_LOW_FREE_CALL_THRESHOLD` defaults to ten free
-calls. Alerts are mandatory ISAC notifications for active Administrators and
-are deduplicated for each warning or critical episode.
+calls. Alerts are mandatory ISAC notifications for active Administrators and are
+deduplicated for each warning or critical episode.
 
 ```sh
 npm run images:export
@@ -348,19 +462,33 @@ embedded database is unlocked, and run the merge using the target image:
 ```sh
 # Staging
 cd /opt/shd-build-stage
-docker compose -f compose.staging.yml stop scheduler app
-docker compose -f compose.staging.yml run --rm \
-  -v /secure/path:/import:ro app \
-  node scripts/managed-images-import.mjs /import/managed-images.json --confirm-merge
-docker compose -f compose.staging.yml up -d app scheduler
+docker compose --env-file .env.deploy -f compose.staging.yml stop scheduler app
+docker compose --env-file .env.deploy -f compose.staging.yml create app
+app_container=$(docker compose --env-file .env.deploy -f compose.staging.yml ps --all --quiet app)
+docker cp /secure/path/managed-images.json "$app_container:/app/data/.managed-images-import.json"
+docker compose --env-file .env.deploy -f compose.staging.yml run --rm --no-deps \
+  --entrypoint sh --user root app -c \
+  'chown shd-runtime:node /app/data/.managed-images-import.json && chmod 600 /app/data/.managed-images-import.json'
+docker compose --env-file .env.deploy -f compose.staging.yml run --rm --no-deps app \
+  node scripts/managed-images-import.mjs /app/data/.managed-images-import.json --confirm-merge
+docker compose --env-file .env.deploy -f compose.staging.yml run --rm --no-deps \
+  --entrypoint rm --user root app -f /app/data/.managed-images-import.json
+docker compose --env-file .env.deploy -f compose.staging.yml up -d app scheduler
 
 # Production
 cd /opt/shd-build-production
-docker compose -f compose.production.yml stop scheduler app
-docker compose -f compose.production.yml run --rm \
-  -v /secure/path:/import:ro app \
-  node scripts/managed-images-import.mjs /import/managed-images.json --confirm-merge
-docker compose -f compose.production.yml up -d app scheduler
+docker compose --env-file .env.deploy -f compose.production.yml stop scheduler app
+docker compose --env-file .env.deploy -f compose.production.yml create app
+app_container=$(docker compose --env-file .env.deploy -f compose.production.yml ps --all --quiet app)
+docker cp /secure/path/managed-images.json "$app_container:/app/data/.managed-images-import.json"
+docker compose --env-file .env.deploy -f compose.production.yml run --rm --no-deps \
+  --entrypoint sh --user root app -c \
+  'chown shd-runtime:node /app/data/.managed-images-import.json && chmod 600 /app/data/.managed-images-import.json'
+docker compose --env-file .env.deploy -f compose.production.yml run --rm --no-deps app \
+  node scripts/managed-images-import.mjs /app/data/.managed-images-import.json --confirm-merge
+docker compose --env-file .env.deploy -f compose.production.yml run --rm --no-deps \
+  --entrypoint rm --user root app -f /app/data/.managed-images-import.json
+docker compose --env-file .env.deploy -f compose.production.yml up -d app scheduler
 ```
 
 Each import creates a full target database backup before changes. The importer
@@ -368,12 +496,11 @@ adds new stable IDs, skips identical assets, and blocks conflicting records.
 After reviewing an intentional metadata or file replacement, add
 `--update-existing`. Imported changes append `image.imported` or
 `image.import_updated` audit events. Remove the transferred bundle after
-verifying both environments because it may contain unpublished visual assets
-and creator identifiers.
+verifying both environments because it may contain unpublished visual assets and
+creator identifiers.
 
-The `.env.staging` and `.env.production` npm import commands are intended for
-maintenance performed directly in an environment where those database and
-storage paths are mounted:
+The staging and production npm import commands fetch `/app` from Infisical. Run
+them only where the target database and storage paths are mounted:
 
 ```sh
 npm run images:import:staging -- /path/to/bundle.json --confirm-merge

docs/TALENT_MECHANIC_RULES.md

@@ -26,8 +26,8 @@ Use these event boundaries:
 - **Healing:** Count each healing event. A heal-over-time effect counts each
   tick as a separate event.
 - **Extra Health gained:** Count every Extra Health grant, including a grant
-  received while the Agent already has Extra Health. Use
-  `extra_health_granted` for the grant action.
+  received while the Agent already has Extra Health. Use `extra_health_granted`
+  for the grant action.
 - **Extra Health state changed:** `extra_health_changed` is Agent-scoped. Emit
   it when the Agent receives a grant, when the remaining amount changes, and
   when it is depleted to zero. Every event requires the boolean
@@ -35,8 +35,8 @@ Use these event boundaries:
   `values.currentExtraHealth`, which must agree with that status. This state
   event is distinct from the `extra_health_granted` grant action.
 - **Reloading:** Trigger on reload completion when the weapon had at least one
-  round to load. A canceled reload does not count. A weapon that loads one
-  round at a time produces one completed-reload event for each round.
+  round to load. A canceled reload does not count. A weapon that loads one round
+  at a time produces one completed-reload event for each round.
 - **Taking damage:** Require Health loss. A hit absorbed by Extra Health does
   not count as taking damage.
 
@@ -59,8 +59,8 @@ Inspiration and Crossfire use a binary deployed-Skill state:
 
 - The benefit remains active while the Agent has at least one persistent
   deployed Skill object.
-- Destruction or timed expiration removes that object from the active count.
-  The benefit ends when no qualifying objects remain.
+- Destruction or timed expiration removes that object from the active count. The
+  benefit ends when no qualifying objects remain.
 - Instant-use Skills do not qualify.
 - Multiple deployed Skill objects do not multiply the benefit.
 
@@ -75,10 +75,28 @@ meters:
 
 - Moving within 30 meters of an ally who is already downed qualifies.
 - Each qualifying presence refreshes the ten-second duration.
-- Leaving the radius or reviving the ally does not cancel the current
-  ten-second duration.
+- Leaving the radius or reviving the ally does not cancel the current ten-second
+  duration.
 - The wearer does not count as an ally.
 
+## Close and Personal
+
+Close and Personal uses a proximity-snapshot qualifying set:
+
+- Include each distinct allied Agent whose distance from the source Agent is
+  less than or equal to 30 meters and who has at least one buff granted by that
+  source Agent.
+- Count an ally once when several of the source Agent's buffs qualify.
+- Do not include an ally whose qualifying buffs come only from other sources.
+
+Record the resolved non-negative integer count in
+`proximity_snapshot.values.alliesWithin30MetersWithAgentGrantedBuff`. The
+calculation builder supplies it from the
+`allies-within-30m-with-agent-granted-buff` scenario input. The confirmed rule
+defines this qualifying set but does not provide Close and Personal's base
+percentage. Keep that percentage unresolved until source evidence or an author's
+clarification supplies it.
+
 ## Emergency Retreat
 
 Emergency Retreat activates whenever at least one enemy is within 20 meters and
@@ -93,9 +111,9 @@ qualifies when the weapon had at least one round to load. This includes each
 round inserted by a weapon that reloads one round at a time. A canceled reload
 does not qualify.
 
-Resolve the Extra Health amount from the Agent's displayed Firepower when
-Second Wind activates. Include all equipped-item and active-buff contributions
-in that Firepower value:
+Resolve the Extra Health amount from the Agent's displayed Firepower when Second
+Wind activates. Include all equipped-item and active-buff contributions in that
+Firepower value:
 
 - Tier I grants Extra Health equal to 600% of displayed Firepower.
 - Tier II grants Extra Health equal to 840% of displayed Firepower.
@@ -103,19 +121,39 @@ in that Firepower value:
 Second Wind adds its Extra Health to Extra Health from other sources. Its
 five-second duration and five-second cooldown start when it activates. Expiry
 removes only the Second Wind contribution. At the five-second boundary, the
-prior grant can expire as a qualifying reload completion grants a new amount.
-If Second Wind supplies the Agent's only Extra Health, the old amount expires
-and the new amount begins at that boundary.
+prior grant can expire as a qualifying reload completion grants a new amount. If
+Second Wind supplies the Agent's only Extra Health, the old amount expires and
+the new amount begins at that boundary.
 
 ## Nothing to Lose
 
 Nothing to Lose uses a forward-looking deployment window:
 
-- Each Health-damage instance makes its own 50% activation roll. Damage
-  absorbed by Extra Health does not roll.
+- Each Health-damage instance makes its own 50% activation roll. Damage absorbed
+  by Extra Health does not roll.
 - A successful activation applies to every Skill deployed during the five
-  seconds after that damage instance. Several Skills can qualify during the
-  same window.
+  seconds after that damage instance. Several Skills can qualify during the same
+  window.
 - Calculate each reduction from the Skill's total cooldown after equipment
   modifiers.
 - A Skill can receive no more than three reductions during one cooldown cycle.
+
+## OS Protocol Talents
+
+Happy Survival restores Health once per second while it has a qualifying nearby
+enemy count. Each restoration resolves 0.5% of maximum Health per enemy within
+10 meters, capped at 2.5% before OS Protocol upgrade scaling.
+
+Explosive Charge requires three seconds of uninterrupted firing. Completion
+opens an eight-second window to deploy the next Skill. The window ends when the
+Agent deploys that Skill. Only the enhanced Skill's first damaging hit creates
+the five-meter explosion. The shared Talent cooldown rule starts its five-second
+cooldown when that explosion activates.
+
+Heavy Armor and Pummeling Shield replace and refresh their own active Extra
+Health grant when the same Talent activates again. Extra Health grants from
+different sources remain separate.
+
+Pummeling Shield counts confirmed weapon hits while the Agent possesses Extra
+Health. Losing all Extra Health resets the hit count. The full-Health condition
+checks Health immediately before the incoming hit resolves.

docs/agents/domain.md

@@ -0,0 +1,60 @@
+# Domain docs
+
+Engineering skills must consult this repository's domain documentation before
+exploring code.
+
+## Read before exploring
+
+- Read `CONTEXT.md` at the repository root.
+- If `CONTEXT-MAP.md` exists, use it to find the `CONTEXT.md` files relevant to
+  the task.
+- Read ADRs under `docs/adr/` that affect the area you will change. In a
+  multi-context repository, also check `src/<context>/docs/adr/`.
+
+If these files do not exist, proceed without comment. Do not suggest creating
+them before the project resolves domain terms or architectural decisions. The
+`/domain-modeling` skill, reached through `/grill-with-docs` and
+`/improve-codebase-architecture`, creates them when needed.
+
+## File structure
+
+This repository uses the single-context layout:
+
+```text
+/
+├── CONTEXT.md
+├── docs/adr/
+│   ├── 0001-event-sourced-orders.md
+│   └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+A repository with multiple bounded contexts can use this layout:
+
+```text
+/
+├── CONTEXT-MAP.md
+├── docs/adr/
+└── src/
+    ├── ordering/
+    │   ├── CONTEXT.md
+    │   └── docs/adr/
+    └── billing/
+        ├── CONTEXT.md
+        └── docs/adr/
+```
+
+## Use glossary terms
+
+Use the terms defined in `CONTEXT.md` in issue titles, refactor proposals,
+hypotheses, and test names. Do not substitute synonyms that the glossary
+rejects.
+
+If a needed concept is absent, reconsider whether the project uses that concept.
+If it represents a real gap, record it for `/domain-modeling`.
+
+## Flag ADR conflicts
+
+Call out any proposal that conflicts with an ADR:
+
+> _Contradicts ADR-0007 (event-sourced orders), but worth reopening because…_

docs/agents/issue-tracker.md

@@ -0,0 +1,106 @@
+# Issue tracker: Gitea
+
+Issues and specs for this repo live as Gitea issues. Use the
+[`tea`](https://gitea.com/gitea/tea) CLI for all operations.
+
+## Repository context
+
+Run commands inside the clone so `tea` can infer the repository and login from
+its Git remote. If the clone has multiple Gitea remotes or logins, pass
+`--remote <name>` or `--login <name>`. Use `--repo <owner>/<repo>` only outside
+the clone.
+
+Before the first operation, verify the instance with
+`tea logins list --output json`. If it is missing, ask the user to run
+`tea login add`; never ask for or handle their access token.
+
+## Conventions
+
+- **Create an issue**: `tea issues create --title "..." --description "..."`.
+  For a multi-line body, use shell command substitution around a quoted heredoc:
+
+  ```bash
+  tea issues create --title "..." --description "$(cat <<'EOF'
+  Multi-line issue body.
+  EOF
+  )"
+  ```
+
+- **Read an issue with comments**:
+  `tea issues <number> --comments --fields index,state,author,url,title,body,assignees,labels,comments --output json`.
+- **List issues**:
+  `tea issues list --state open --fields index,state,author,url,title,body,assignees,labels,comments --output json`,
+  adding `--labels "label-one,label-two"`, `--assignee <user>`, or another
+  supported filter as needed. Paginate with `--page` and `--limit`; do not
+  assume the default first 30 results are complete.
+- **Comment on an issue**: `tea comments add <number> --description "..."`.
+- **Apply or remove labels**: `tea issues edit <number> --add-labels "..."` or
+  `--remove-labels "..."`. Separate multiple labels with commas.
+- **Assign or unassign**: `tea issues edit <number> --add-assignees "..."` or
+  `--remove-assignees "..."`.
+- **Close**: post the closing explanation with
+  `tea comments add <number> --description "..."`, then run
+  `tea issues close <number>`.
+- **Reopen**: `tea issues reopen <number>`.
+- **Raw API fallback**: use `tea api '<endpoint>'` only for a Gitea feature
+  without a first-class `tea` command. Prefer `{owner}` and `{repo}`
+  placeholders so repository context remains explicit.
+
+Use `--output json` for machine-readable reads. Do not scrape table output.
+
+## Pull requests as a triage surface
+
+**PRs as a request surface: no.** _(Set this to `yes` if this repo treats
+external pull requests as feature requests; `/triage` reads this flag.)_
+
+When set to `yes`, PRs use the same labels and states as issues:
+
+- **Read a PR with comments and diff**:
+  `tea pulls <number> --comments --fields index,state,author,url,title,body,diff,assignees,labels,comments --output json`.
+- **List open PRs**:
+  `tea pulls list --state open --fields index,state,author,author-id,url,title,body,assignees,labels,comments --output json`.
+  Determine whether an author is external from the repository's Gitea membership
+  data; the PR listing does not classify author membership.
+- **Comment**: `tea comments add <number> --description "..."`.
+- **Apply or remove labels**: `tea pulls edit <number> --add-labels "..."` or
+  `--remove-labels "..."`.
+- **Close**: `tea pulls close <number>`.
+
+Gitea pull requests use the repository's issue index space, so `#42` may refer
+to either surface. If the context is unclear, inspect it with
+`tea pulls 42 --output json`; if that command reports no PR, read it with
+`tea issues 42 --output json`.
+
+## When a skill says "publish to the issue tracker"
+
+Create a Gitea issue with `tea issues create`.
+
+## When a skill says "fetch the relevant ticket"
+
+Run
+`tea issues <number> --comments --fields index,state,author,url,title,body,assignees,labels,comments --output json`.
+
+## Wayfinding operations
+
+`/wayfinder` uses one **map** issue with linked **child** issues. These
+conventions store relationships in issue bodies, so they work across Gitea
+versions.
+
+- **Map**: create one issue labelled `wayfinder:map` containing the Notes,
+  Decisions-so-far, and Fog sections. Use
+  `tea issues create --labels "wayfinder:map"` with its title and description.
+- **Child ticket**: start the body with `Part of #<map>` and apply a
+  `wayfinder:<type>` label: `research`, `prototype`, `grilling`, or `task`. Add
+  each child as a task-list item in the map body to preserve frontier order.
+- **Blocking**: put `Blocked by: #<n>, #<n>` near the top of the child body. A
+  ticket becomes unblocked after every referenced blocker closes.
+- **Frontier query**: list all open children, order them by the map's task list,
+  and discard tickets with an open blocker or an assignee. Select the first
+  remaining ticket. Fetch each referenced blocker; do not infer its state from
+  map text.
+- **Claim**: resolve the active username with `tea whoami`, then run
+  `tea issues edit <n> --add-assignees "<username>"` as the session's first
+  write. Do not assume `@me` works.
+- **Resolve**: run `tea comments add <n> --description "<answer>"`, close the
+  child with `tea issues close <n>`, then append a context pointer and link to
+  the map's Decisions-so-far section.

docs/agents/triage-labels.md

@@ -0,0 +1,14 @@
+# Triage labels
+
+Engineering skills use five canonical triage roles. This table maps each role to
+the label string in this repository's issue tracker.
+
+| Canonical role    | Tracker label     | Meaning                                |
+| ----------------- | ----------------- | -------------------------------------- |
+| `needs-triage`    | `needs-triage`    | A maintainer must evaluate the issue   |
+| `needs-info`      | `needs-info`      | Waiting for more information           |
+| `ready-for-agent` | `ready-for-agent` | Fully specified and ready for an agent |
+| `ready-for-human` | `ready-for-human` | Requires human implementation          |
+| `wontfix`         | `wontfix`         | Maintainers will not act on the issue  |
+
+When a skill names a canonical role, use the corresponding tracker label.

package.json

@@ -1,82 +1,84 @@
 {
-	"name": "shd-build",
-	"private": true,
-	"version": "0.0.1",
-	"type": "module",
-	"scripts": {
-		"dev": "dotenvx run -f .env.development -- vite dev --host 0.0.0.0",
-		"build:app": "vite build",
-		"build:staging": "dotenvx run -f .env.staging -- vite build",
-		"build": "dotenvx run -f .env.production -- vite build",
-		"brand:render": "node scripts/render-brand-assets.mjs",
-		"start": "node build",
-		"preview": "node build",
-		"db:migrate": "dotenvx run -f .env.development -- node scripts/db-migrate.mjs",
-		"db:migrate:staging": "dotenvx run -f .env.staging -- node scripts/db-migrate.mjs",
-		"db:migrate:production": "dotenvx run -f .env.production -- node scripts/db-migrate.mjs",
-		"db:seed-users": "dotenvx run -f .env.development -- node scripts/seed-initial-users.mjs",
-		"db:seed-users:reset": "dotenvx run -f .env.development -- node scripts/seed-initial-users.mjs --reset-passwords",
-		"db:backup": "dotenvx run -f .env.development -- node scripts/db-backup.mjs",
-		"db:backup:staging": "dotenvx run -f .env.staging -- node scripts/db-backup.mjs",
-		"db:backup:production": "dotenvx run -f .env.production -- node scripts/db-backup.mjs",
-		"db:restore": "dotenvx run -f .env.development -- node scripts/db-restore.mjs",
-		"db:restore:production": "dotenvx run -f .env.production -- node scripts/db-restore.mjs",
-		"isac:export": "dotenvx run -f .env.development -- node scripts/isac-data-export.mjs",
-		"isac:import": "dotenvx run -f .env.development -- node scripts/isac-data-import.mjs",
-		"isac:attributes:import": "dotenvx run -f .env.development -- node scripts/import-resurgence-attributes.mjs",
-		"isac:export:staging": "dotenvx run -f .env.staging -- node scripts/isac-data-export.mjs",
-		"images:export": "dotenvx run -f .env.development -- node scripts/managed-images-export.mjs",
-		"images:import": "dotenvx run -f .env.development -- node scripts/managed-images-import.mjs",
-		"images:import:staging": "dotenvx run -f .env.staging -- node scripts/managed-images-import.mjs",
-		"images:import:production": "dotenvx run -f .env.production -- node scripts/managed-images-import.mjs",
-		"stage:bootstrap:export": "dotenvx run -f .env.development -- node scripts/stage-bootstrap-export.mjs",
-		"production:bootstrap:export": "dotenvx run -f .env.development -- node scripts/environment-bootstrap-export.mjs production",
-		"notifications:digest": "dotenvx run -f .env.development -- node scripts/notification-digest.mjs",
-		"notifications:digest:production": "dotenvx run -f .env.production -- node scripts/notification-digest.mjs",
-		"notifications:oversight": "dotenvx run -f .env.development -- node scripts/oversight-notification-dispatch.mjs",
-		"notifications:oversight:production": "dotenvx run -f .env.production -- node scripts/oversight-notification-dispatch.mjs",
-		"notifications:system": "dotenvx run -f .env.development -- node scripts/system-notification-dispatch.mjs",
-		"notifications:system:production": "dotenvx run -f .env.production -- node scripts/system-notification-dispatch.mjs",
-		"notifications:seed-test": "dotenvx run -f .env.development -- node scripts/seed-test-notifications.mjs",
-		"assets:trim-icons": "node scripts/trim-static-icons.mjs",
-		"env:encrypt": "node scripts/env-files.mjs encrypt",
-		"env:decrypt": "node scripts/env-files.mjs decrypt",
-		"env:encrypt:development": "dotenvx encrypt -f .env.development",
-		"env:decrypt:development": "dotenvx decrypt -f .env.development",
-		"env:encrypt:staging": "dotenvx encrypt -f .env.staging",
-		"env:decrypt:staging": "dotenvx decrypt -f .env.staging",
-		"env:sync:staging-credentials": "dotenvx run -f .env.development -- node scripts/sync-staging-credentials.mjs",
-		"env:encrypt:production": "dotenvx encrypt -f .env.production",
-		"env:decrypt:production": "dotenvx decrypt -f .env.production",
-		"env:stage": "node scripts/env-files.mjs stage",
-		"prepare": "svelte-kit sync || echo ''",
-		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-		"test": "vitest run",
-		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"
-	},
-	"devDependencies": {
-		"@dotenvx/dotenvx": "^2.17.4",
-		"@sveltejs/adapter-node": "^5.5.7",
-		"@sveltejs/kit": "^2.63.0",
-		"@sveltejs/vite-plugin-svelte": "^7.1.2",
-		"@types/node": "^26.1.1",
-		"@types/nodemailer": "^8.0.1",
-		"opentype.js": "^2.0.0",
-		"svelte": "^5.56.1",
-		"svelte-check": "^4.6.0",
-		"typescript": "^6.0.3",
-		"vite": "^8.0.16",
-		"vitest": "^4.1.10"
-	},
-	"dependencies": {
-		"@fontsource/barlow": "^5.3.0",
-		"@fontsource/source-serif-4": "^5.3.0",
-		"@simplewebauthn/browser": "^13.3.0",
-		"@simplewebauthn/server": "^13.3.2",
-		"@tursodatabase/database": "^0.7.1",
-		"argon2": "^0.45.1",
-		"nodemailer": "^9.0.3",
-		"openai": "^6.49.0",
-		"sharp": "^0.35.3"
-	}
+  "name": "shd-build",
+  "private": true,
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "dev": "infisical run --env=dev --path=/app --path=/shared/scheduler -- vite dev --host 0.0.0.0",
+    "build:app": "vite build",
+    "build:staging": "vite build",
+    "build": "vite build",
+    "brand:render": "node scripts/render-brand-assets.mjs",
+    "start": "node build",
+    "preview": "node build",
+    "db:migrate": "infisical run --env=dev --path=/app --path=/shared/scheduler -- node scripts/db-migrate.mjs",
+    "db:migrate:staging": "infisical run --env=staging --path=/app --path=/shared/scheduler -- node scripts/db-migrate.mjs",
+    "db:migrate:production": "infisical run --env=prod --path=/app --path=/shared/scheduler -- node scripts/db-migrate.mjs",
+    "db:seed-users": "infisical run --env=dev --path=/app -- node scripts/seed-initial-users.mjs",
+    "db:seed-users:reset": "infisical run --env=dev --path=/app -- node scripts/seed-initial-users.mjs --reset-passwords",
+    "db:backup": "infisical run --env=dev --path=/app -- node scripts/db-backup.mjs",
+    "db:backup:staging": "infisical run --env=staging --path=/app -- node scripts/db-backup.mjs",
+    "db:backup:production": "infisical run --env=prod --path=/app -- node scripts/db-backup.mjs",
+    "db:restore": "infisical run --env=dev --path=/app -- node scripts/db-restore.mjs",
+    "db:restore:production": "infisical run --env=prod --path=/app -- node scripts/db-restore.mjs",
+    "article:export": "infisical run --env=dev --path=/app -- node scripts/article-transfer.mjs export",
+    "isac:export": "infisical run --env=dev --path=/app -- node scripts/isac-data-export.mjs",
+    "isac:import": "infisical run --env=dev --path=/app -- node scripts/isac-data-import.mjs",
+    "isac:attributes:import": "infisical run --env=dev --path=/app -- node scripts/import-resurgence-attributes.mjs",
+    "isac:export:staging": "infisical run --env=staging --path=/app -- node scripts/isac-data-export.mjs",
+    "images:export": "infisical run --env=dev --path=/app -- node scripts/managed-images-export.mjs",
+    "images:import": "infisical run --env=dev --path=/app -- node scripts/managed-images-import.mjs",
+    "images:import:staging": "infisical run --env=staging --path=/app -- node scripts/managed-images-import.mjs",
+    "images:import:production": "infisical run --env=prod --path=/app -- node scripts/managed-images-import.mjs",
+    "stage:bootstrap:export": "infisical run --env=dev --path=/app -- node scripts/stage-bootstrap-export.mjs",
+    "production:bootstrap:export": "infisical run --env=dev --path=/app -- node scripts/environment-bootstrap-export.mjs production",
+    "notifications:digest": "infisical run --env=dev --path=/app -- node scripts/notification-digest.mjs",
+    "notifications:digest:production": "infisical run --env=prod --path=/app -- node scripts/notification-digest.mjs",
+    "notifications:oversight": "infisical run --env=dev --path=/app -- node scripts/oversight-notification-dispatch.mjs",
+    "notifications:oversight:production": "infisical run --env=prod --path=/app -- node scripts/oversight-notification-dispatch.mjs",
+    "notifications:system": "infisical run --env=dev --path=/app -- node scripts/system-notification-dispatch.mjs",
+    "notifications:system:production": "infisical run --env=prod --path=/app -- node scripts/system-notification-dispatch.mjs",
+    "notifications:seed-test": "infisical run --env=dev --path=/app -- node scripts/seed-test-notifications.mjs",
+    "assets:trim-icons": "node scripts/trim-static-icons.mjs",
+    "prepare": "node scripts/prepare.mjs",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "test": "vitest run",
+    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"
+  },
+  "lint-staged": {
+    "**/*": "prettier --write --ignore-unknown"
+  },
+  "devDependencies": {
+    "@infisical/cli": "0.43.116",
+    "@sveltejs/adapter-node": "^5.5.7",
+    "@sveltejs/kit": "^2.63.0",
+    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@types/node": "^26.1.1",
+    "@types/nodemailer": "^8.0.1",
+    "husky": "^9.1.7",
+    "lint-staged": "^16.4.0",
+    "opentype.js": "^2.0.0",
+    "prettier": "3.9.6",
+    "svelte": "^5.56.1",
+    "svelte-check": "^4.6.0",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.16",
+    "vitest": "^4.1.10"
+  },
+  "dependencies": {
+    "@fontsource/barlow": "^5.3.0",
+    "@fontsource/source-serif-4": "^5.3.0",
+    "@simplewebauthn/browser": "^13.3.0",
+    "@simplewebauthn/server": "^13.3.2",
+    "@tiptap/core": "3.29.2",
+    "@tiptap/extension-link": "3.29.2",
+    "@tiptap/extensions": "3.29.2",
+    "@tiptap/pm": "3.29.2",
+    "@tiptap/starter-kit": "3.29.2",
+    "@tursodatabase/database": "^0.7.1",
+    "argon2": "^0.45.1",
+    "nodemailer": "^9.0.3",
+    "openai": "^6.49.0",
+    "sharp": "^0.35.3"
+  }
 }

paseo.json

@@ -0,0 +1,5 @@
+{
+  "worktree": {
+    "setup": "npm install"
+  }
+}

scripts/article-transfer.mjs

@@ -0,0 +1,425 @@
+import { connect } from '@tursodatabase/database';
+import { spawnSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, link, rm, writeFile } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import process from 'node:process';
+
+const mode = process.argv[2];
+const subject = process.argv[3];
+const confirmation = '--confirm-article-import';
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-development.db',
+);
+const imageDirectory = resolve(
+  process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons',
+);
+const UUID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const STORAGE_KEY_PATTERN = /^library-[0-9a-f-]{36}\.webp$/i;
+
+const failUsage = () => {
+  console.error(
+    'Usage: node scripts/article-transfer.mjs export <article-id-or-slug> [output.json]',
+  );
+  console.error(
+    `   or: ARTICLE_IMPORT_ENABLED=true node scripts/article-transfer.mjs import <bundle.json> ${confirmation}`,
+  );
+  process.exit(2);
+};
+
+if (!['export', 'import'].includes(mode) || !subject) failUsage();
+
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const quoteIdentifier = (identifier) =>
+  `"${String(identifier).replaceAll('"', '""')}"`;
+const isRecord = (value) =>
+  Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+async function insertRow(database, table, row) {
+  const columns = Object.keys(row);
+  if (!columns.length) throw new Error(`Cannot insert an empty ${table} row.`);
+  await (
+    await database.prepare(
+      `INSERT INTO ${quoteIdentifier(table)} (${columns.map(quoteIdentifier).join(',')}) VALUES (${columns.map(() => '?').join(',')})`,
+    )
+  ).run(...columns.map((column) => row[column]));
+}
+
+async function exportArticle() {
+  const database = await connect(databasePath);
+  const article = await (
+    await database.prepare(
+      `SELECT * FROM articles WHERE id=? OR slug=? ORDER BY CASE WHEN id=? THEN 0 ELSE 1 END LIMIT 1`,
+    )
+  ).get(subject, subject, subject);
+  if (!article) throw new Error('Article not found.');
+  if (article.kind !== 'news')
+    throw new Error('Only News articles can use this transfer command.');
+  if (article.deleted_at)
+    throw new Error('Deleted News articles cannot be transferred.');
+  const external = await (
+    await database.prepare(
+      'SELECT article_id FROM external_news_sources WHERE article_id=?',
+    )
+  ).get(article.id);
+  if (external)
+    throw new Error(
+      'Syndicated News articles must come from their source feed.',
+    );
+  const embeds = await (
+    await database.prepare(
+      `SELECT COUNT(*) AS count FROM article_revision_build_embeds
+       WHERE revision_id IN (SELECT id FROM article_revisions WHERE article_id=?)`,
+    )
+  ).get(article.id);
+  if (Number(embeds?.count ?? 0) > 0)
+    throw new Error('News article transfers cannot contain Build embeds.');
+
+  const owner = await (
+    await database.prepare('SELECT id,username FROM users WHERE id=?')
+  ).get(article.owner_id);
+  if (!owner?.username)
+    throw new Error('The article owner does not have a transferable username.');
+  const draft = await (
+    await database.prepare('SELECT * FROM article_drafts WHERE article_id=?')
+  ).get(article.id);
+  const revisions = await (
+    await database.prepare(
+      'SELECT * FROM article_revisions WHERE article_id=? ORDER BY revision_number',
+    )
+  ).all(article.id);
+  if (!draft || !revisions.length)
+    throw new Error('The article is missing its draft or revision history.');
+  const revisionIds = revisions.map((revision) => String(revision.id));
+  const placeholders = revisionIds.map(() => '?').join(',');
+  const revisionTags = await (
+    await database.prepare(
+      `SELECT * FROM article_revision_tags WHERE revision_id IN (${placeholders}) ORDER BY revision_id,ordinal`,
+    )
+  ).all(...revisionIds);
+  const media = await (
+    await database.prepare(
+      'SELECT * FROM article_media WHERE article_id=? ORDER BY image_id',
+    )
+  ).all(article.id);
+  const search = await (
+    await database.prepare('SELECT * FROM article_search WHERE article_id=?')
+  ).get(article.id);
+  const imageIds = [...new Set(media.map((row) => String(row.image_id)))];
+  const images = imageIds.length
+    ? await (
+        await database.prepare(
+          `SELECT * FROM managed_images WHERE id IN (${imageIds.map(() => '?').join(',')}) ORDER BY id`,
+        )
+      ).all(...imageIds)
+    : [];
+  if (images.length !== imageIds.length)
+    throw new Error('The article references missing managed-image metadata.');
+  const files = [];
+  for (const image of images) {
+    const storageKey = String(image.storage_key);
+    if (!STORAGE_KEY_PATTERN.test(storageKey))
+      throw new Error('The article uses an unsupported managed-image key.');
+    const bytes = await readFile(join(imageDirectory, storageKey));
+    if (bytes.byteLength !== Number(image.byte_size))
+      throw new Error(`Managed image ${image.id} has an invalid byte size.`);
+    files.push({
+      storageKey,
+      byteSize: bytes.byteLength,
+      sha256: hash(bytes),
+      contentBase64: bytes.toString('base64'),
+    });
+  }
+
+  const bundle = {
+    format: 'shd-build-article-transfer',
+    version: 1,
+    createdAt: new Date().toISOString(),
+    owner: { sourceId: String(owner.id), username: String(owner.username) },
+    article,
+    draft,
+    revisions,
+    revisionTags,
+    media,
+    search: search ?? null,
+    images,
+    files,
+  };
+  const timestamp = new Date()
+    .toISOString()
+    .replaceAll(':', '-')
+    .replace(/\.\d{3}Z$/, 'Z');
+  const outputPath = resolve(
+    process.argv[4] ||
+      `./data/backups/article-${String(article.slug)}-${timestamp}.json`,
+  );
+  await mkdir(dirname(outputPath), { recursive: true });
+  await writeFile(outputPath, `${JSON.stringify(bundle, null, 2)}\n`, {
+    encoding: 'utf8',
+    flag: 'wx',
+    mode: 0o600,
+  });
+  console.log(
+    `Exported News article "${article.slug}" with ${revisions.length} revisions and ${files.length} images.`,
+  );
+  console.log(`Article bundle: ${outputPath}`);
+}
+
+function validateBundle(bundle) {
+  if (
+    !isRecord(bundle) ||
+    bundle.format !== 'shd-build-article-transfer' ||
+    bundle.version !== 1 ||
+    !isRecord(bundle.owner) ||
+    !isRecord(bundle.article) ||
+    !isRecord(bundle.draft) ||
+    !Array.isArray(bundle.revisions) ||
+    !Array.isArray(bundle.revisionTags) ||
+    !Array.isArray(bundle.media) ||
+    !Array.isArray(bundle.images) ||
+    !Array.isArray(bundle.files) ||
+    bundle.article.kind !== 'news' ||
+    !UUID_PATTERN.test(String(bundle.article.id)) ||
+    !bundle.owner.username ||
+    !bundle.revisions.length
+  ) {
+    throw new Error(
+      'The selected file is not a supported News article bundle.',
+    );
+  }
+  const articleId = String(bundle.article.id);
+  if (
+    bundle.draft.article_id !== articleId ||
+    bundle.revisions.some(
+      (revision) =>
+        !isRecord(revision) ||
+        revision.article_id !== articleId ||
+        !UUID_PATTERN.test(String(revision.id)),
+    ) ||
+    bundle.media.some(
+      (row) => !isRecord(row) || row.article_id !== articleId,
+    ) ||
+    bundle.images.some(
+      (image) =>
+        !isRecord(image) ||
+        !UUID_PATTERN.test(String(image.id)) ||
+        !STORAGE_KEY_PATTERN.test(String(image.storage_key)) ||
+        image.source_entity_type !== null ||
+        image.source_entity_id !== null,
+    )
+  ) {
+    throw new Error('The News article bundle contains inconsistent records.');
+  }
+  const imageIds = new Set(bundle.images.map((image) => String(image.id)));
+  const files = new Map();
+  for (const file of bundle.files) {
+    if (
+      !isRecord(file) ||
+      !STORAGE_KEY_PATTERN.test(String(file.storageKey)) ||
+      !Number.isInteger(file.byteSize) ||
+      file.byteSize <= 0 ||
+      typeof file.sha256 !== 'string' ||
+      !/^[0-9a-f]{64}$/.test(file.sha256) ||
+      typeof file.contentBase64 !== 'string'
+    ) {
+      throw new Error(
+        'The News article bundle contains an invalid image file.',
+      );
+    }
+    const bytes = Buffer.from(file.contentBase64, 'base64');
+    if (bytes.byteLength !== file.byteSize || hash(bytes) !== file.sha256)
+      throw new Error('The News article bundle contains a corrupt image file.');
+    files.set(String(file.storageKey), bytes);
+  }
+  if (
+    bundle.images.some((image) => !files.has(String(image.storage_key))) ||
+    bundle.media.some((row) => !imageIds.has(String(row.image_id)))
+  ) {
+    throw new Error('The News article bundle is missing image dependencies.');
+  }
+  const revisionIds = new Set(
+    bundle.revisions.map((revision) => String(revision.id)),
+  );
+  if (
+    !revisionIds.has(String(bundle.article.published_revision_id)) ||
+    (bundle.article.pending_revision_id &&
+      !revisionIds.has(String(bundle.article.pending_revision_id))) ||
+    bundle.revisionTags.some((row) => !revisionIds.has(String(row.revision_id)))
+  ) {
+    throw new Error('The News article bundle has invalid revision pointers.');
+  }
+  return files;
+}
+
+async function importArticle() {
+  if (
+    process.env.ARTICLE_IMPORT_ENABLED !== 'true' ||
+    !process.argv.includes(confirmation)
+  ) {
+    failUsage();
+  }
+  const bundlePath = resolve(subject);
+  const bundle = JSON.parse(await readFile(bundlePath, 'utf8'));
+  const files = validateBundle(bundle);
+
+  const safetyBackup = spawnSync(process.execPath, ['scripts/db-backup.mjs'], {
+    cwd: process.cwd(),
+    stdio: 'inherit',
+    env: process.env,
+  });
+  if (safetyBackup.error) throw safetyBackup.error;
+  if (safetyBackup.status !== 0)
+    throw new Error('Article import stopped because its safety backup failed.');
+
+  const database = await connect(databasePath);
+  const existing = await (
+    await database.prepare(
+      'SELECT id,slug FROM articles WHERE id=? OR (kind=? AND slug=?)',
+    )
+  ).get(bundle.article.id, bundle.article.kind, bundle.article.slug);
+  if (existing) {
+    if (
+      existing.id === bundle.article.id &&
+      existing.slug === bundle.article.slug
+    ) {
+      console.log(`News article "${existing.slug}" is already present.`);
+      return;
+    }
+    throw new Error('The target already contains a conflicting News article.');
+  }
+  const owner = await (
+    await database.prepare(
+      'SELECT id,username FROM users WHERE id=? OR lower(username)=lower(?) ORDER BY CASE WHEN id=? THEN 0 ELSE 1 END LIMIT 1',
+    )
+  ).get(bundle.owner.sourceId, bundle.owner.username, bundle.owner.sourceId);
+  if (!owner)
+    throw new Error(
+      `The target does not contain Agent "${bundle.owner.username}".`,
+    );
+  const tagIds = [
+    ...new Set(bundle.revisionTags.map((row) => String(row.tag_id))),
+  ];
+  if (tagIds.length) {
+    const available = await (
+      await database.prepare(
+        `SELECT COUNT(*) AS count FROM article_tags WHERE id IN (${tagIds.map(() => '?').join(',')})`,
+      )
+    ).get(...tagIds);
+    if (Number(available?.count ?? 0) !== tagIds.length)
+      throw new Error('The target is missing one or more article tags.');
+  }
+  const imageIds = bundle.images.map((image) => String(image.id));
+  if (imageIds.length) {
+    const collision = await (
+      await database.prepare(
+        `SELECT id FROM managed_images WHERE id IN (${imageIds.map(() => '?').join(',')}) OR storage_key IN (${imageIds.map(() => '?').join(',')}) LIMIT 1`,
+      )
+    ).get(...imageIds, ...bundle.images.map((image) => image.storage_key));
+    if (collision)
+      throw new Error('The target contains a conflicting managed image.');
+  }
+
+  await mkdir(imageDirectory, { recursive: true });
+  const createdFiles = [];
+  let transactionStarted = false;
+  try {
+    for (const image of bundle.images) {
+      const storageKey = String(image.storage_key);
+      const temporaryPath = join(
+        imageDirectory,
+        `.${storageKey}.${randomUUID()}.tmp`,
+      );
+      await writeFile(temporaryPath, files.get(storageKey), {
+        flag: 'wx',
+        mode: 0o600,
+      });
+      const finalPath = join(imageDirectory, storageKey);
+      try {
+        await link(temporaryPath, finalPath);
+        createdFiles.push(finalPath);
+      } finally {
+        await rm(temporaryPath, { force: true });
+      }
+    }
+    await database.exec('BEGIN IMMEDIATE');
+    transactionStarted = true;
+    for (const image of bundle.images) {
+      await insertRow(database, 'managed_images', {
+        ...image,
+        created_by: owner.id,
+      });
+    }
+    await insertRow(database, 'articles', {
+      ...bundle.article,
+      owner_id: owner.id,
+      visibility: 'private',
+      published_revision_id: null,
+      pending_revision_id: null,
+    });
+    await insertRow(database, 'article_drafts', {
+      ...bundle.draft,
+      updated_by: owner.id,
+    });
+    for (const revision of bundle.revisions) {
+      await insertRow(database, 'article_revisions', {
+        ...revision,
+        created_by: owner.id,
+      });
+    }
+    for (const row of bundle.revisionTags)
+      await insertRow(database, 'article_revision_tags', row);
+    for (const row of bundle.media) {
+      await insertRow(database, 'article_media', {
+        ...row,
+        uploaded_by: owner.id,
+      });
+    }
+    if (bundle.search)
+      await insertRow(database, 'article_search', bundle.search);
+    await (
+      await database.prepare(
+        `UPDATE articles SET visibility=?,published_revision_id=?,pending_revision_id=? WHERE id=?`,
+      )
+    ).run(
+      bundle.article.visibility,
+      bundle.article.published_revision_id,
+      bundle.article.pending_revision_id,
+      bundle.article.id,
+    );
+    await insertRow(database, 'audit_log', {
+      id: randomUUID(),
+      actor_id: owner.id,
+      entity_type: 'editorial_content',
+      entity_id: bundle.article.id,
+      action: 'news.promoted',
+      before_json: null,
+      after_json: JSON.stringify({
+        sourceBundle: basename(bundlePath),
+        slug: bundle.article.slug,
+        publishedRevisionId: bundle.article.published_revision_id,
+        revisions: bundle.revisions.length,
+        images: bundle.images.length,
+      }),
+      created_at: new Date().toISOString(),
+    });
+    await database.exec('COMMIT');
+    transactionStarted = false;
+  } catch (error) {
+    if (transactionStarted) {
+      try {
+        await database.exec('ROLLBACK');
+      } catch {
+        // Preserve the import error.
+      }
+    }
+    for (const file of createdFiles) await rm(file, { force: true });
+    throw error;
+  }
+  console.log(
+    `Imported News article "${bundle.article.slug}" with ${bundle.revisions.length} revisions and ${bundle.images.length} images for ${owner.username}.`,
+  );
+}
+
+if (mode === 'export') await exportArticle();
+else await importArticle();

scripts/data/resurgence-attributes.json

@@ -1,40 +1,304 @@
 [
-  {"name":"Weapon Critical Hit Chance","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive","gearRange":[2.4,6]},
-  {"name":"Weapon Critical Hit Damage","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive","gearRange":[4,10],"weaponRange":[8,20]},
-  {"name":"Weapon Damage","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive","gearRange":[2,5],"weaponRange":[4,10]},
-  {"name":"Weapon Multi-Shot Chance","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive","gearRange":[2,5],"weaponRange":[4,10]},
-  {"name":"Skill Critical Chance","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","gearRange":[2.4,6]},
-  {"name":"Skill Critical Damage","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","gearRange":[4,10],"weaponRange":[8,20]},
-  {"name":"Skill Intensity","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","gearRange":[2,5],"weaponRange":[4,10]},
-  {"name":"Skill Multi-Shot Chance","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","gearRange":[2,5],"weaponRange":[4,10]},
-  {"name":"Headshot Damage","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive","gearRange":[4.8,12],"weaponRange":[9.6,24]},
-  {"name":"Max Health","unit":"%","type":"Defensive","category":"Character","calculationType":"Additive","gearRange":[4,10],"weaponRange":[8,20]},
-  {"name":"Armor","unit":"%","type":"Defensive","category":"Character","calculationType":"Additive","gearRange":[4.66,11.66],"weaponRange":[9.33,23.33]},
-  {"name":"Damage Reduction","unit":"%","type":"Defensive","category":"Character","calculationType":"Multiplicative","gearRange":[2,5],"weaponRange":[4,10]},
-  {"name":"Received Healing","unit":"%","type":"Defensive","category":"Character","calculationType":"Additive","gearRange":[4.8,12],"weaponRange":[9.6,24]},
-  {"name":"Damage to Elites","unit":"%","type":"Offensive","category":"Character","calculationType":"Additive","gearRange":[2.4,6],"weaponRange":[4.8,12]},
-  {"name":"Signature Ability Charge Efficiency","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","gearRange":[4,10]},
-  {"name":"Skill Duration","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","gearRange":[3.2,8]},
-  {"name":"Skill Radius","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","gearRange":[4,10]},
-  {"name":"Skill Cooldown Recovery","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","gearRange":[-5,-2]},
-  {"name":"Weapon Blast Damage","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive","weaponRange":[4,10]},
-  {"name":"Weapon Piercing Damage","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive","weaponRange":[4,10]},
-  {"name":"Weapon Shredding Damage","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive","weaponRange":[4,10]},
-  {"name":"Skill Blast Damage","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","weaponRange":[4,10]},
-  {"name":"Skill Piercing Damage","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","weaponRange":[4,10]},
-  {"name":"Skill Shredding Damage","unit":"%","type":"Offensive","category":"Skill","calculationType":"Additive","weaponRange":[4,10]},
-  {"name":"Rate of Fire","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"Reload Speed","unit":"%","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"Health","unit":"","type":"Defensive","category":"Character","calculationType":"Additive"},
-  {"name":"Armor","unit":"","type":"Defensive","category":"Character","calculationType":"Additive"},
-  {"name":"Movement Speed","unit":"%","type":"Defensive","category":"Character","calculationType":"Additive"},
-  {"name":"Piercing Damage","unit":"","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"RPM","unit":"Shots","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"Optimal Range","unit":"m","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"ADS Speed","unit":"s","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"Reload Speed","unit":"s","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"Magazine Size","unit":"Shots","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"Handling Speed","unit":"s","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"Accuracy","unit":"","type":"Offensive","category":"Weapon","calculationType":"Additive"},
-  {"name":"Vertical Stability","unit":"","type":"Offensive","category":"Weapon","calculationType":"Additive"}
+  {
+    "name": "Weapon Critical Hit Chance",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive",
+    "gearRange": [2.4, 6]
+  },
+  {
+    "name": "Weapon Critical Hit Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive",
+    "gearRange": [4, 10],
+    "weaponRange": [8, 20]
+  },
+  {
+    "name": "Weapon Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive",
+    "gearRange": [2, 5],
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Weapon Multi-Shot Chance",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive",
+    "gearRange": [2, 5],
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Skill Critical Chance",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "gearRange": [2.4, 6]
+  },
+  {
+    "name": "Skill Critical Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "gearRange": [4, 10],
+    "weaponRange": [8, 20]
+  },
+  {
+    "name": "Skill Intensity",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "gearRange": [2, 5],
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Skill Multi-Shot Chance",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "gearRange": [2, 5],
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Headshot Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive",
+    "gearRange": [4.8, 12],
+    "weaponRange": [9.6, 24]
+  },
+  {
+    "name": "Max Health",
+    "unit": "%",
+    "type": "Defensive",
+    "category": "Character",
+    "calculationType": "Additive",
+    "gearRange": [4, 10],
+    "weaponRange": [8, 20]
+  },
+  {
+    "name": "Armor",
+    "unit": "%",
+    "type": "Defensive",
+    "category": "Character",
+    "calculationType": "Additive",
+    "gearRange": [4.66, 11.66],
+    "weaponRange": [9.33, 23.33]
+  },
+  {
+    "name": "Damage Reduction",
+    "unit": "%",
+    "type": "Defensive",
+    "category": "Character",
+    "calculationType": "Multiplicative",
+    "gearRange": [2, 5],
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Received Healing",
+    "unit": "%",
+    "type": "Defensive",
+    "category": "Character",
+    "calculationType": "Additive",
+    "gearRange": [4.8, 12],
+    "weaponRange": [9.6, 24]
+  },
+  {
+    "name": "Damage to Elites",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Character",
+    "calculationType": "Additive",
+    "gearRange": [2.4, 6],
+    "weaponRange": [4.8, 12]
+  },
+  {
+    "name": "Signature Ability Charge Efficiency",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "gearRange": [4, 10]
+  },
+  {
+    "name": "Skill Duration",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "gearRange": [3.2, 8]
+  },
+  {
+    "name": "Skill Radius",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "gearRange": [4, 10]
+  },
+  {
+    "name": "Skill Cooldown Recovery",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "gearRange": [-5, -2]
+  },
+  {
+    "name": "Weapon Blast Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive",
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Weapon Piercing Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive",
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Weapon Shredding Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive",
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Skill Blast Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Skill Piercing Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Skill Shredding Damage",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Skill",
+    "calculationType": "Additive",
+    "weaponRange": [4, 10]
+  },
+  {
+    "name": "Rate of Fire",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Reload Speed",
+    "unit": "%",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Health",
+    "unit": "",
+    "type": "Defensive",
+    "category": "Character",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Armor",
+    "unit": "",
+    "type": "Defensive",
+    "category": "Character",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Movement Speed",
+    "unit": "%",
+    "type": "Defensive",
+    "category": "Character",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Piercing Damage",
+    "unit": "",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "RPM",
+    "unit": "Shots",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Optimal Range",
+    "unit": "m",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "ADS Speed",
+    "unit": "s",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Reload Speed",
+    "unit": "s",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Magazine Size",
+    "unit": "Shots",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Handling Speed",
+    "unit": "s",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Accuracy",
+    "unit": "",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  },
+  {
+    "name": "Vertical Stability",
+    "unit": "",
+    "type": "Offensive",
+    "category": "Weapon",
+    "calculationType": "Additive"
+  }
 ]

scripts/db-backup.mjs

@@ -3,19 +3,25 @@ import { mkdir, writeFile } from 'node:fs/promises';
 import { basename, dirname, resolve } from 'node:path';
 import process from 'node:process';
 
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || './data/shd-build-development.db');
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-development.db',
+);
 const requestedOutput = process.argv[2];
-const timestamp = new Date().toISOString().replaceAll(':', '-').replace(/\.\d{3}Z$/, 'Z');
+const timestamp = new Date()
+  .toISOString()
+  .replaceAll(':', '-')
+  .replace(/\.\d{3}Z$/, 'Z');
 const databaseName = basename(databasePath).replace(/\.[^.]+$/, '');
 const outputPath = resolve(
-	requestedOutput || `./data/backups/${databaseName}-${timestamp}.json`
+  requestedOutput || `./data/backups/${databaseName}-${timestamp}.json`,
 );
-const quoteIdentifier = (identifier) => `"${String(identifier).replaceAll('"', '""')}"`;
+const quoteIdentifier = (identifier) =>
+  `"${String(identifier).replaceAll('"', '""')}"`;
 
 await mkdir(dirname(outputPath), { recursive: true });
 const database = await connect(databasePath);
 const tableRows = await (
-	await database.prepare(`
+  await database.prepare(`
 		SELECT name
 		FROM sqlite_master
 		WHERE type = 'table'
@@ -27,23 +33,25 @@ const tableRows = await (
 const tables = [];
 let totalRows = 0;
 for (const tableRow of tableRows) {
-	const name = String(tableRow.name);
-	const rows = await (await database.prepare(`SELECT * FROM ${quoteIdentifier(name)}`)).all();
-	tables.push({ name, rowCount: rows.length, rows });
-	totalRows += rows.length;
+  const name = String(tableRow.name);
+  const rows = await (
+    await database.prepare(`SELECT * FROM ${quoteIdentifier(name)}`)
+  ).all();
+  tables.push({ name, rowCount: rows.length, rows });
+  totalRows += rows.length;
 }
 
 const backup = {
-	format: 'shd-build-database-backup',
-	version: 1,
-	createdAt: new Date().toISOString(),
-	sourceDatabase: basename(databasePath),
-	totalRows,
-	tables
+  format: 'shd-build-database-backup',
+  version: 1,
+  createdAt: new Date().toISOString(),
+  sourceDatabase: basename(databasePath),
+  totalRows,
+  tables,
 };
 await writeFile(outputPath, `${JSON.stringify(backup, null, 2)}\n`, {
-	encoding: 'utf8',
-	flag: 'wx'
+  encoding: 'utf8',
+  flag: 'wx',
 });
 
 console.log(`Backed up ${totalRows} rows from ${tables.length} tables.`);

scripts/db-restore.mjs

@@ -5,53 +5,134 @@ import process from 'node:process';
 
 const backupArgument = process.argv[2];
 if (!backupArgument) {
-	console.error('Usage: npm run db:restore -- <backup-file>');
-	process.exit(2);
+  console.error('Usage: npm run db:restore -- <backup-file>');
+  process.exit(2);
 }
 
 const backupPath = resolve(backupArgument);
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || './data/shd-build-development.db');
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-development.db',
+);
 const backup = JSON.parse(await readFile(backupPath, 'utf8'));
-if (backup?.format !== 'shd-build-database-backup' || backup?.version !== 1 || !Array.isArray(backup.tables)) {
-	throw new Error('The selected file is not a supported SHD.build database backup.');
+if (
+  backup?.format !== 'shd-build-database-backup' ||
+  backup?.version !== 1 ||
+  !Array.isArray(backup.tables)
+) {
+  throw new Error(
+    'The selected file is not a supported SHD.build database backup.',
+  );
 }
 
-const quoteIdentifier = (identifier) => `"${String(identifier).replaceAll('"', '""')}"`;
+const quoteIdentifier = (identifier) =>
+  `"${String(identifier).replaceAll('"', '""')}"`;
 const database = await connect(databasePath);
 
 // Restores are deliberately limited to empty databases. This prevents an
 // accidental merge from overwriting contributor-entered records.
 for (const table of backup.tables) {
-	const existing = await (
-		await database.prepare(`SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}`)
-	).get();
-	if (Number(existing?.count) > 0) {
-		throw new Error(
-			`Restore refused: table "${table.name}" is not empty. Use a new migrated database.`
-		);
-	}
+  const existing = await (
+    await database.prepare(
+      `SELECT COUNT(*) AS count FROM ${quoteIdentifier(table.name)}`,
+    )
+  ).get();
+  if (Number(existing?.count) > 0) {
+    throw new Error(
+      `Restore refused: table "${table.name}" is not empty. Use a new migrated database.`,
+    );
+  }
 }
 
 let restoredRows = 0;
+const attributeTable = backup.tables.find(
+  (table) => table.name === 'stat_attributes',
+);
+const legacySkillChipProfiles = attributeTable?.rows.some(
+  (row) => 'skill_chip_min' in row || 'skill_chip_max' in row,
+);
+const legacySkillChipRanges = new Map(
+  (attributeTable?.rows ?? []).map((row) => [
+    String(row.id),
+    { min: row.skill_chip_min, max: row.skill_chip_max },
+  ]),
+);
+const restoredLegacySecondaries = new Set();
 await database.exec('BEGIN');
 try {
-	for (const table of backup.tables) {
-		for (const row of table.rows) {
-			const columns = Object.keys(row);
-			if (!columns.length) continue;
-			const columnSql = columns.map(quoteIdentifier).join(', ');
-			const placeholders = columns.map(() => '?').join(', ');
-			const insert = await database.prepare(
-				`INSERT INTO ${quoteIdentifier(table.name)} (${columnSql}) VALUES (${placeholders})`
-			);
-			await insert.run(...columns.map((column) => row[column]));
-			restoredRows++;
-		}
-	}
-	await database.exec('COMMIT');
+  for (const table of backup.tables) {
+    for (const row of table.rows) {
+      if (
+        legacySkillChipProfiles &&
+        table.name === 'skill_chip_primary_options'
+      )
+        continue;
+      const restoredRow = { ...row };
+      if (legacySkillChipProfiles && table.name === 'stat_attributes') {
+        delete restoredRow.skill_chip_min;
+        delete restoredRow.skill_chip_max;
+      }
+      if (
+        legacySkillChipProfiles &&
+        table.name === 'skill_chip_secondary_options'
+      ) {
+        delete restoredRow.skill_chip_set_id;
+        const statId = String(restoredRow.stat_attribute_id ?? '');
+        if (restoredLegacySecondaries.has(statId)) continue;
+        restoredLegacySecondaries.add(statId);
+      }
+      const columns = Object.keys(restoredRow);
+      if (!columns.length) continue;
+      const columnSql = columns.map(quoteIdentifier).join(', ');
+      const placeholders = columns.map(() => '?').join(', ');
+      const insert = await database.prepare(
+        `INSERT INTO ${quoteIdentifier(table.name)} (${columnSql}) VALUES (${placeholders})`,
+      );
+      await insert.run(...columns.map((column) => restoredRow[column]));
+      restoredRows++;
+    }
+  }
+  if (legacySkillChipProfiles) {
+    const primaryAttributes = await (
+      await database.prepare(`SELECT id,active FROM stat_attributes WHERE name IN (
+        'Skill Duration','Skill Radius','Skill Cooldown Recovery','Skill Intensity'
+      )`)
+    ).all();
+    if (
+      primaryAttributes.length !== 4 ||
+      primaryAttributes.some((attribute) => Number(attribute.active) !== 1)
+    )
+      throw new Error(
+        'Legacy restore requires exactly four active fixed Skill Chip primary Attributes.',
+      );
+    for (const attribute of primaryAttributes) {
+      const statId = String(attribute.id);
+      await (
+        await database.prepare(
+          'INSERT INTO skill_chip_primary_options(stat_attribute_id) VALUES(?)',
+        )
+      ).run(statId);
+      const range = legacySkillChipRanges.get(statId);
+      if (!range || range.min === null || range.max === null) continue;
+      for (const quality of ['Standard', 'Specialized', 'Superior', 'High-end'])
+        await (
+          await database.prepare(`INSERT INTO skill_chip_primary_quality_values
+            (stat_attribute_id,quality,min_value,max_value) VALUES(?,?,?,?)`)
+        ).run(statId, quality, range.min, range.max);
+    }
+    for (const statId of restoredLegacySecondaries) {
+      const range = legacySkillChipRanges.get(statId);
+      if (!range || range.min === null || range.max === null) continue;
+      for (const quality of ['Specialized', 'Superior', 'High-end'])
+        await (
+          await database.prepare(`INSERT INTO skill_chip_secondary_quality_values
+            (stat_attribute_id,quality,min_value,max_value) VALUES(?,?,?,?)`)
+        ).run(statId, quality, range.min, range.max);
+    }
+  }
+  await database.exec('COMMIT');
 } catch (error) {
-	await database.exec('ROLLBACK');
-	throw error;
+  await database.exec('ROLLBACK');
+  throw error;
 }
 
 console.log(`Restored ${restoredRows} rows into ${databasePath}.`);

scripts/default-users.mjs

@@ -2,30 +2,30 @@ import { argon2id, hash } from 'argon2';
 import { randomBytes, randomUUID } from 'node:crypto';
 
 export const defaultUsers = [
-	{
-		username: 'Aewyn',
-		role: 'user',
-		passwordEnvironmentKey: 'DEFAULT_ADMIN_PASSWORD'
-	},
-	{
-		username: 'Quartermaster',
-		role: 'user',
-		passwordEnvironmentKey: 'DEFAULT_USER_PASSWORD'
-	}
+  {
+    username: 'Aewyn',
+    role: 'user',
+    passwordEnvironmentKey: 'DEFAULT_ADMIN_PASSWORD',
+  },
+  {
+    username: 'Quartermaster',
+    role: 'user',
+    passwordEnvironmentKey: 'DEFAULT_USER_PASSWORD',
+  },
 ];
 
 function temporaryPassword() {
-	// 120 bits of entropy encoded without punctuation that is awkward to paste.
-	return randomBytes(15).toString('base64url');
+  // 120 bits of entropy encoded without punctuation that is awkward to paste.
+  return randomBytes(15).toString('base64url');
 }
 
 async function secureHash(password) {
-	return hash(password, {
-		type: argon2id,
-		memoryCost: 19_456,
-		timeCost: 2,
-		parallelism: 1
-	});
+  return hash(password, {
+    type: argon2id,
+    memoryCost: 19_456,
+    timeCost: 2,
+    parallelism: 1,
+  });
 }
 
 /**
@@ -33,61 +33,78 @@ async function secureHash(password) {
  * users keep their IDs and related records but receive new password hashes.
  */
 export async function initializeDefaultUsers(database, options = {}) {
-	const resetPasswords = options.resetPasswords === true;
-	const findUser = await database.prepare(
-		'SELECT id, username, role FROM users WHERE login_username = ? COLLATE NOCASE OR username = ? COLLATE NOCASE'
-	);
-	const insertUser = await database.prepare(
-		'INSERT INTO users (id, username, login_username, password_hash, role, created_at) VALUES (?, ?, ?, ?, ?, ?)'
-	);
-	const updateCredential = await database.prepare(
-		'UPDATE users SET login_username = ?, password_hash = ?, role = ? WHERE id = ?'
-	);
-	const credentials = [];
+  const resetPasswords = options.resetPasswords === true;
+  const findUser = await database.prepare(
+    'SELECT id, username, role FROM users WHERE login_username = ? COLLATE NOCASE OR username = ? COLLATE NOCASE',
+  );
+  const insertUser = await database.prepare(
+    'INSERT INTO users (id, username, login_username, password_hash, role, created_at) VALUES (?, ?, ?, ?, ?, ?)',
+  );
+  const updateCredential = await database.prepare(
+    'UPDATE users SET login_username = ?, password_hash = ?, role = ? WHERE id = ?',
+  );
+  const credentials = [];
 
-	for (const definition of defaultUsers) {
-		const existing = await findUser.get(definition.username, definition.username);
-		if (existing && !resetPasswords) {
-			console.log(`${definition.username}: already exists (${existing.role}); left unchanged`);
-			continue;
-		}
+  for (const definition of defaultUsers) {
+    const existing = await findUser.get(
+      definition.username,
+      definition.username,
+    );
+    if (existing && !resetPasswords) {
+      console.log(
+        `${definition.username}: already exists (${existing.role}); left unchanged`,
+      );
+      continue;
+    }
 
-		const configuredPassword = process.env[definition.passwordEnvironmentKey]?.trim();
-		const password = configuredPassword || temporaryPassword();
-		if (password.length < 12 || password.length > 128) {
-			throw new Error(`${definition.passwordEnvironmentKey} must be between 12 and 128 characters.`);
-		}
-		const passwordHash = await secureHash(password);
+    const configuredPassword =
+      process.env[definition.passwordEnvironmentKey]?.trim();
+    const password = configuredPassword || temporaryPassword();
+    if (password.length < 12 || password.length > 128) {
+      throw new Error(
+        `${definition.passwordEnvironmentKey} must be between 12 and 128 characters.`,
+      );
+    }
+    const passwordHash = await secureHash(password);
 
-		if (existing) {
-			await updateCredential.run(definition.username, passwordHash, String(existing.role), existing.id);
-			console.log(`${definition.username}: credentials reset; role and related data preserved`);
-		} else {
-			await insertUser.run(
-				randomUUID(),
-				definition.username,
-				definition.username,
-				passwordHash,
-				definition.role,
-				new Date().toISOString()
-			);
-			console.log(`${definition.username}: default account created`);
-		}
-		credentials.push({
-			username: definition.username,
-			role: existing ? String(existing.role) : definition.role,
-			password,
-			generated: !configuredPassword
-		});
-	}
+    if (existing) {
+      await updateCredential.run(
+        definition.username,
+        passwordHash,
+        String(existing.role),
+        existing.id,
+      );
+      console.log(
+        `${definition.username}: credentials reset; role and related data preserved`,
+      );
+    } else {
+      await insertUser.run(
+        randomUUID(),
+        definition.username,
+        definition.username,
+        passwordHash,
+        definition.role,
+        new Date().toISOString(),
+      );
+      console.log(`${definition.username}: default account created`);
+    }
+    credentials.push({
+      username: definition.username,
+      role: existing ? String(existing.role) : definition.role,
+      password,
+      generated: !configuredPassword,
+    });
+  }
 
-	if (credentials.length) {
-		console.log('\nDefault user credentials (shown once):');
-		for (const credential of credentials) {
-			console.log(`${credential.username} (${credential.role}): ${credential.password}${credential.generated ? ' [generated]' : ' [from environment]'}`);
-		}
-		console.log('Change generated passwords after the first sign-in.\n');
-	}
+  if (credentials.length) {
+    console.log('\nDefault user credentials (shown once):');
+    for (const credential of credentials) {
+      console.log(
+        `${credential.username} (${credential.role}): ${credential.password}${credential.generated ? ' [generated]' : ' [from environment]'}`,
+      );
+    }
+    console.log('Change generated passwords after the first sign-in.\n');
+  }
 
-	return credentials;
+  return credentials;
 }

scripts/env-files.mjs

@@ -1,32 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { resolve } from 'node:path';
-import process from 'node:process';
-
-const files = ['.env.development', '.env.staging', '.env.production'];
-const action = process.argv[2];
-const gitCommand = process.platform === 'win32' ? 'git.exe' : 'git';
-const dotenvxCli = resolve('node_modules/@dotenvx/dotenvx/src/cli/dotenvx.js');
-
-function run(command, args) {
-	const result = spawnSync(command, args, { cwd: process.cwd(), stdio: 'inherit' });
-	if (result.error) throw result.error;
-	if (result.status !== 0) process.exit(result.status ?? 1);
-}
-
-function dotenvx(command, file) {
-	run(process.execPath, [dotenvxCli, command, '-f', file]);
-}
-
-if (!['encrypt', 'decrypt', 'stage'].includes(action)) {
-	console.error('Usage: node scripts/env-files.mjs <encrypt|decrypt|stage>');
-	process.exit(2);
-}
-
-for (const file of files) {
-	dotenvx(action === 'decrypt' ? 'decrypt' : 'encrypt', file);
-}
-
-if (action === 'stage') {
-	run(gitCommand, ['add', '--', ...files]);
-	console.log('Encrypted and staged environment files.');
-}

scripts/environment-bootstrap-export.mjs

@@ -5,50 +5,81 @@ import process from 'node:process';
 
 const target = process.argv[2];
 if (!['staging', 'production'].includes(target)) {
-	console.error('Usage: node scripts/environment-bootstrap-export.mjs <staging|production> [output.json]');
-	process.exit(2);
+  console.error(
+    'Usage: node scripts/environment-bootstrap-export.mjs <staging|production> [output.json]',
+  );
+  process.exit(2);
 }
 const outputArgument = process.argv[3];
-const timestamp = new Date().toISOString().replaceAll(':', '-').replace(/\.\d{3}Z$/, 'Z');
-const outputPath = resolve(outputArgument || `./data/backups/shd-${target}-bootstrap-${timestamp}.json`);
+const timestamp = new Date()
+  .toISOString()
+  .replaceAll(':', '-')
+  .replace(/\.\d{3}Z$/, 'Z');
+const outputPath = resolve(
+  outputArgument || `./data/backups/shd-${target}-bootstrap-${timestamp}.json`,
+);
 const temporaryBackupPath = `${outputPath}.database.json`;
-const databaseBackup = spawnSync(process.execPath, ['scripts/db-backup.mjs', temporaryBackupPath], {
-	cwd: process.cwd(),
-	stdio: 'inherit',
-	env: process.env
-});
+const databaseBackup = spawnSync(
+  process.execPath,
+  ['scripts/db-backup.mjs', temporaryBackupPath],
+  {
+    cwd: process.cwd(),
+    stdio: 'inherit',
+    env: process.env,
+  },
+);
 if (databaseBackup.error) throw databaseBackup.error;
-if (databaseBackup.status !== 0) throw new Error(`Database backup failed; no ${target} bootstrap bundle was created.`);
+if (databaseBackup.status !== 0)
+  throw new Error(
+    `Database backup failed; no ${target} bootstrap bundle was created.`,
+  );
 
 async function collectFiles(directory, pattern) {
-	try {
-		const names = (await readdir(directory)).filter((name) => pattern.test(name)).sort();
-		return await Promise.all(names.map(async (name) => ({
-			name,
-			contentBase64: (await readFile(join(directory, name))).toString('base64')
-		})));
-	} catch (error) {
-		if (error?.code === 'ENOENT') return [];
-		throw error;
-	}
+  try {
+    const names = (await readdir(directory))
+      .filter((name) => pattern.test(name))
+      .sort();
+    return await Promise.all(
+      names.map(async (name) => ({
+        name,
+        contentBase64: (await readFile(join(directory, name))).toString(
+          'base64',
+        ),
+      })),
+    );
+  } catch (error) {
+    if (error?.code === 'ENOENT') return [];
+    throw error;
+  }
 }
 
 try {
-	const database = JSON.parse(await readFile(temporaryBackupPath, 'utf8'));
-	const avatars = await collectFiles(resolve(process.env.TDR_AVATAR_STORAGE_PATH || './data/avatars'), /^[0-9a-f-]{36}\.webp$/i);
-	const gameIcons = await collectFiles(resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons'), /^[a-z_]+-[0-9a-f-]{36}\.webp$/i);
-	const bundle = {
-		format: 'shd-build-environment-bootstrap',
-		version: 1,
-		target,
-		createdAt: new Date().toISOString(),
-		database,
-		files: { avatars, gameIcons }
-	};
-	await mkdir(dirname(outputPath), { recursive: true });
-	await writeFile(outputPath, `${JSON.stringify(bundle, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
-	console.log(`${target} bootstrap bundle includes ${avatars.length} avatars and ${gameIcons.length} managed image assets.`);
-	console.log(`Bootstrap bundle: ${outputPath}`);
+  const database = JSON.parse(await readFile(temporaryBackupPath, 'utf8'));
+  const avatars = await collectFiles(
+    resolve(process.env.TDR_AVATAR_STORAGE_PATH || './data/avatars'),
+    /^[0-9a-f-]{36}\.webp$/i,
+  );
+  const gameIcons = await collectFiles(
+    resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons'),
+    /^[a-z_]+-[0-9a-f-]{36}\.webp$/i,
+  );
+  const bundle = {
+    format: 'shd-build-environment-bootstrap',
+    version: 1,
+    target,
+    createdAt: new Date().toISOString(),
+    database,
+    files: { avatars, gameIcons },
+  };
+  await mkdir(dirname(outputPath), { recursive: true });
+  await writeFile(outputPath, `${JSON.stringify(bundle, null, 2)}\n`, {
+    encoding: 'utf8',
+    flag: 'wx',
+  });
+  console.log(
+    `${target} bootstrap bundle includes ${avatars.length} avatars and ${gameIcons.length} managed image assets.`,
+  );
+  console.log(`Bootstrap bundle: ${outputPath}`);
 } finally {
-	await rm(temporaryBackupPath, { force: true });
+  await rm(temporaryBackupPath, { force: true });
 }

scripts/environment-bootstrap-import.mjs

@@ -4,112 +4,178 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import process from 'node:process';
 
-const bundleArgument = process.argv.slice(2).find((argument) => !argument.startsWith('--'));
+const bundleArgument = process.argv
+  .slice(2)
+  .find((argument) => !argument.startsWith('--'));
 const targetIndex = process.argv.indexOf('--target');
 const target = targetIndex >= 0 ? process.argv[targetIndex + 1] : '';
-const allowed = target === 'staging'
-	? process.env.ALLOW_STAGING_BOOTSTRAP === 'true'
-	: target === 'production'
-		? process.env.ALLOW_PRODUCTION_BOOTSTRAP === 'true'
-		: false;
-if (!bundleArgument || !process.argv.includes('--confirm-empty-target-replace') || !allowed) {
-	console.error('Environment bootstrap requires the matching ALLOW_*_BOOTSTRAP=true guard and:');
-	console.error('node scripts/environment-bootstrap-import.mjs <bundle.json> --target <staging|production> --confirm-empty-target-replace');
-	process.exit(2);
+const allowed =
+  target === 'staging'
+    ? process.env.ALLOW_STAGING_BOOTSTRAP === 'true'
+    : target === 'production'
+      ? process.env.ALLOW_PRODUCTION_BOOTSTRAP === 'true'
+      : false;
+if (
+  !bundleArgument ||
+  !process.argv.includes('--confirm-empty-target-replace') ||
+  !allowed
+) {
+  console.error(
+    'Environment bootstrap requires the matching ALLOW_*_BOOTSTRAP=true guard and:',
+  );
+  console.error(
+    'node scripts/environment-bootstrap-import.mjs <bundle.json> --target <staging|production> --confirm-empty-target-replace',
+  );
+  process.exit(2);
 }
 
 const bundlePath = resolve(bundleArgument);
 const bundle = JSON.parse(await readFile(bundlePath, 'utf8'));
-if (bundle?.format !== 'shd-build-environment-bootstrap' || bundle?.version !== 1 || bundle?.target !== target
-	|| bundle.database?.format !== 'shd-build-database-backup' || bundle.database?.version !== 1
-	|| !Array.isArray(bundle.database.tables) || !Array.isArray(bundle.files?.avatars)
-	|| !Array.isArray(bundle.files?.gameIcons)) {
-	throw new Error('The selected file is not a supported SHD.build bootstrap bundle for the selected target.');
+if (
+  bundle?.format !== 'shd-build-environment-bootstrap' ||
+  bundle?.version !== 1 ||
+  bundle?.target !== target ||
+  bundle.database?.format !== 'shd-build-database-backup' ||
+  bundle.database?.version !== 1 ||
+  !Array.isArray(bundle.database.tables) ||
+  !Array.isArray(bundle.files?.avatars) ||
+  !Array.isArray(bundle.files?.gameIcons)
+) {
+  throw new Error(
+    'The selected file is not a supported SHD.build bootstrap bundle for the selected target.',
+  );
 }
 for (const file of bundle.files.avatars) {
-	if (typeof file.name !== 'string' || !/^[0-9a-f-]{36}\.webp$/i.test(file.name) || typeof file.contentBase64 !== 'string') {
-		throw new Error('The bootstrap bundle contains an invalid avatar file.');
-	}
+  if (
+    typeof file.name !== 'string' ||
+    !/^[0-9a-f-]{36}\.webp$/i.test(file.name) ||
+    typeof file.contentBase64 !== 'string'
+  ) {
+    throw new Error('The bootstrap bundle contains an invalid avatar file.');
+  }
 }
 for (const file of bundle.files.gameIcons) {
-	if (typeof file.name !== 'string' || !/^[a-z_]+-[0-9a-f-]{36}\.webp$/i.test(file.name) || typeof file.contentBase64 !== 'string') {
-		throw new Error('The bootstrap bundle contains an invalid game-data icon file.');
-	}
+  if (
+    typeof file.name !== 'string' ||
+    !/^[a-z_]+-[0-9a-f-]{36}\.webp$/i.test(file.name) ||
+    typeof file.contentBase64 !== 'string'
+  ) {
+    throw new Error(
+      'The bootstrap bundle contains an invalid game-data icon file.',
+    );
+  }
 }
 
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || `./data/shd-build-${target}.db`);
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || `./data/shd-build-${target}.db`,
+);
 const safetyBackup = spawnSync(process.execPath, ['scripts/db-backup.mjs'], {
-	cwd: process.cwd(),
-	stdio: 'inherit',
-	env: process.env
+  cwd: process.cwd(),
+  stdio: 'inherit',
+  env: process.env,
 });
 if (safetyBackup.error) throw safetyBackup.error;
-if (safetyBackup.status !== 0) throw new Error(`${target} safety backup failed; the target was not changed.`);
+if (safetyBackup.status !== 0)
+  throw new Error(
+    `${target} safety backup failed; the target was not changed.`,
+  );
 
 const database = await connect(databasePath);
-for (const tableName of ['users', 'builds', 'audit_log', 'data_change_proposals']) {
-	const row = await (await database.prepare(`SELECT COUNT(*) AS count FROM "${tableName}"`)).get();
-	if (Number(row?.count ?? 0) > 0) {
-		throw new Error(`${target} bootstrap refused: target table "${tableName}" is not empty.`);
-	}
+for (const tableName of [
+  'users',
+  'builds',
+  'audit_log',
+  'data_change_proposals',
+]) {
+  const row = await (
+    await database.prepare(`SELECT COUNT(*) AS count FROM "${tableName}"`)
+  ).get();
+  if (Number(row?.count ?? 0) > 0) {
+    throw new Error(
+      `${target} bootstrap refused: target table "${tableName}" is not empty.`,
+    );
+  }
 }
 
-const targetTables = await (await database.prepare(`
+const targetTables = await (
+  await database.prepare(`
 	SELECT name FROM sqlite_master
 	WHERE type='table' AND name NOT LIKE 'sqlite_%'
 	ORDER BY rowid
-`)).all();
+`)
+).all();
 const targetNames = new Set(targetTables.map((row) => String(row.name)));
-const sourceNames = new Set(bundle.database.tables.map((table) => String(table.name)));
+const sourceNames = new Set(
+  bundle.database.tables.map((table) => String(table.name)),
+);
 for (const row of targetTables) {
-	if (!sourceNames.has(String(row.name))) {
-		throw new Error(`Bootstrap snapshot is missing target-schema table "${String(row.name)}".`);
-	}
+  if (!sourceNames.has(String(row.name))) {
+    throw new Error(
+      `Bootstrap snapshot is missing target-schema table "${String(row.name)}".`,
+    );
+  }
 }
 const sourceOnlyTables = bundle.database.tables
-	.map((table) => String(table.name))
-	.filter((name) => !targetNames.has(name));
+  .map((table) => String(table.name))
+  .filter((name) => !targetNames.has(name));
 if (sourceOnlyTables.length) {
-	throw new Error(`Bootstrap snapshot contains tables outside the current target schema: ${sourceOnlyTables.join(', ')}`);
+  throw new Error(
+    `Bootstrap snapshot contains tables outside the current target schema: ${sourceOnlyTables.join(', ')}`,
+  );
 }
-const quoteIdentifier = (identifier) => `"${String(identifier).replaceAll('"', '""')}"`;
+const quoteIdentifier = (identifier) =>
+  `"${String(identifier).replaceAll('"', '""')}"`;
 let restoredRows = 0;
 await database.exec('PRAGMA foreign_keys=OFF');
 await database.exec('BEGIN');
 try {
-	for (const row of [...targetTables].reverse()) {
-		await database.exec(`DELETE FROM ${quoteIdentifier(row.name)}`);
-	}
-	for (const table of bundle.database.tables) {
-		for (const row of table.rows) {
-			const columns = Object.keys(row);
-			if (!columns.length) continue;
-			const insert = await database.prepare(
-				`INSERT INTO ${quoteIdentifier(table.name)} (${columns.map(quoteIdentifier).join(', ')})
-				VALUES (${columns.map(() => '?').join(', ')})`
-			);
-			await insert.run(...columns.map((column) => row[column]));
-			restoredRows++;
-		}
-	}
-	await database.exec('COMMIT');
+  for (const row of [...targetTables].reverse()) {
+    await database.exec(`DELETE FROM ${quoteIdentifier(row.name)}`);
+  }
+  for (const table of bundle.database.tables) {
+    for (const row of table.rows) {
+      const columns = Object.keys(row);
+      if (!columns.length) continue;
+      const insert = await database.prepare(
+        `INSERT INTO ${quoteIdentifier(table.name)} (${columns.map(quoteIdentifier).join(', ')})
+				VALUES (${columns.map(() => '?').join(', ')})`,
+      );
+      await insert.run(...columns.map((column) => row[column]));
+      restoredRows++;
+    }
+  }
+  await database.exec('COMMIT');
 } catch (error) {
-	await database.exec('ROLLBACK');
-	throw error;
+  await database.exec('ROLLBACK');
+  throw error;
 } finally {
-	await database.exec('PRAGMA foreign_keys=ON');
+  await database.exec('PRAGMA foreign_keys=ON');
 }
 
-const avatarDirectory = resolve(process.env.TDR_AVATAR_STORAGE_PATH || './data/avatars');
-const gameIconDirectory = resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons');
+const avatarDirectory = resolve(
+  process.env.TDR_AVATAR_STORAGE_PATH || './data/avatars',
+);
+const gameIconDirectory = resolve(
+  process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons',
+);
 await mkdir(avatarDirectory, { recursive: true });
 await mkdir(gameIconDirectory, { recursive: true });
 for (const file of bundle.files.avatars) {
-	await writeFile(join(avatarDirectory, file.name), Buffer.from(file.contentBase64, 'base64'), { mode: 0o600 });
+  await writeFile(
+    join(avatarDirectory, file.name),
+    Buffer.from(file.contentBase64, 'base64'),
+    { mode: 0o600 },
+  );
 }
 for (const file of bundle.files.gameIcons) {
-	await writeFile(join(gameIconDirectory, file.name), Buffer.from(file.contentBase64, 'base64'), { mode: 0o600 });
+  await writeFile(
+    join(gameIconDirectory, file.name),
+    Buffer.from(file.contentBase64, 'base64'),
+    { mode: 0o600 },
+  );
 }
 
-console.log(`Bootstrapped ${target} with ${restoredRows} database rows, ${bundle.files.avatars.length} avatars, and ${bundle.files.gameIcons.length} managed image assets.`);
+console.log(
+  `Bootstrapped ${target} with ${restoredRows} database rows, ${bundle.files.avatars.length} avatars, and ${bundle.files.gameIcons.length} managed image assets.`,
+);
 console.log(`Source bundle: ${bundlePath}`);

scripts/import-resurgence-attributes.mjs

@@ -4,121 +4,180 @@ import { randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { resolve } from 'node:path';
 
-const sourcePath = resolve(process.argv[2] || './scripts/data/resurgence-attributes.json');
+const sourcePath = resolve(
+  process.argv[2] || './scripts/data/resurgence-attributes.json',
+);
 const records = JSON.parse(await readFile(sourcePath, 'utf8'));
-if (!Array.isArray(records) || !records.length) throw new Error('The Attribute import source is empty or invalid.');
+if (!Array.isArray(records) || !records.length)
+  throw new Error('The Attribute import source is empty or invalid.');
 
 const identities = new Set();
 for (const record of records) {
-	const identity = `${String(record.name).normalize('NFKC').trim().toLocaleLowerCase()}\u0000${String(record.unit ?? '')}`;
-	if (identities.has(identity)) throw new Error(`Duplicate Attribute identity in import source: ${record.name} (${record.unit || 'flat'})`);
-	identities.add(identity);
-	if (!['Offensive', 'Defensive'].includes(record.type)
-		|| !['Weapon', 'Skill', 'Character'].includes(record.category)
-		|| !['Additive', 'Multiplicative'].includes(record.calculationType)
-		|| !['', '%', 's', 'Shots', 'm'].includes(record.unit ?? '')) {
-		throw new Error(`Invalid Attribute classification in import source: ${record.name}`);
-	}
-	for (const range of [record.gearRange, record.weaponRange]) {
-		if (range === undefined) continue;
-		if (!Array.isArray(range) || range.length !== 2 || !range.every(Number.isFinite) || range[0] > range[1]) {
-			throw new Error(`Invalid source range in import source: ${record.name}`);
-		}
-	}
+  const identity = `${String(record.name).normalize('NFKC').trim().toLocaleLowerCase()}\u0000${String(record.unit ?? '')}`;
+  if (identities.has(identity))
+    throw new Error(
+      `Duplicate Attribute identity in import source: ${record.name} (${record.unit || 'flat'})`,
+    );
+  identities.add(identity);
+  if (
+    !['Offensive', 'Defensive'].includes(record.type) ||
+    !['Weapon', 'Skill', 'Character'].includes(record.category) ||
+    !['Additive', 'Multiplicative'].includes(record.calculationType) ||
+    !['', '%', 's', 'Shots', 'm'].includes(record.unit ?? '')
+  ) {
+    throw new Error(
+      `Invalid Attribute classification in import source: ${record.name}`,
+    );
+  }
+  for (const range of [record.gearRange, record.weaponRange]) {
+    if (range === undefined) continue;
+    if (
+      !Array.isArray(range) ||
+      range.length !== 2 ||
+      !range.every(Number.isFinite) ||
+      range[0] > range[1]
+    ) {
+      throw new Error(`Invalid source range in import source: ${record.name}`);
+    }
+  }
 }
 
-const vite = await createServer({ server: { middlewareMode: true }, appType: 'custom', logLevel: 'error' });
+const vite = await createServer({
+  server: { middlewareMode: true },
+  appType: 'custom',
+  logLevel: 'error',
+});
 try {
-	const { getDatabase } = await vite.ssrLoadModule('/src/lib/server/database.ts');
-	const { auditRecord, recordIsacAudit } = await vite.ssrLoadModule('/src/lib/server/audit.ts');
-	const database = await getDatabase();
-	const actor = await (await database.prepare(`SELECT users.id FROM users
+  const { getDatabase } = await vite.ssrLoadModule(
+    '/src/lib/server/database.ts',
+  );
+  const { auditRecord, recordIsacAudit } = await vite.ssrLoadModule(
+    '/src/lib/server/audit.ts',
+  );
+  const database = await getDatabase();
+  const actor = await (
+    await database.prepare(`SELECT users.id FROM users
 		LEFT JOIN user_profiles profile ON profile.user_id=users.id
 		LEFT JOIN user_roles link ON link.user_id=users.id
 		WHERE users.role='admin' OR link.role_id='role-admin'
 		ORDER BY CASE WHEN users.username=? COLLATE NOCASE OR profile.display_name=? COLLATE NOCASE THEN 0 ELSE 1 END,users.created_at
-		LIMIT 1`)).get('Aewyn', 'Aewyn');
-	if (!actor?.id) throw new Error('No administrator account is available to own the Attribute import audit events.');
+		LIMIT 1`)
+  ).get('Aewyn', 'Aewyn');
+  if (!actor?.id)
+    throw new Error(
+      'No administrator account is available to own the Attribute import audit events.',
+    );
 
-	let created = 0;
-	let updated = 0;
-	let unchanged = 0;
-	await database.exec('BEGIN');
-	try {
-		for (const record of records) {
-			const name = String(record.name).normalize('NFKC').trim();
-			const unit = String(record.unit ?? '');
-			const existing = await (await database.prepare(
-				'SELECT * FROM stat_attributes WHERE name=? COLLATE NOCASE AND unit=?'
-			)).get(name, unit);
-			const id = String(existing?.id ?? randomUUID());
-			const now = new Date().toISOString();
-			const next = {
-				...(existing ?? {}),
-				id,
-				name,
-				description: existing?.description ?? null,
-				type: record.type,
-				category: record.category,
-				calculation_type: record.calculationType,
-				unit,
-				gear_min: record.gearRange?.[0] ?? existing?.gear_min ?? null,
-				gear_max: record.gearRange?.[1] ?? existing?.gear_max ?? null,
-				gear_reference_level: Number(existing?.gear_reference_level ?? 50),
-				weapon_min: record.weaponRange?.[0] ?? existing?.weapon_min ?? null,
-				weapon_max: record.weaponRange?.[1] ?? existing?.weapon_max ?? null,
-				weapon_reference_level: Number(existing?.weapon_reference_level ?? 50),
-				skill_chip_min: existing?.skill_chip_min ?? null,
-				skill_chip_max: existing?.skill_chip_max ?? null,
-				cap_value: existing?.cap_value ?? null,
-				active: 1,
-				created_at: String(existing?.created_at ?? now),
-				updated_at: now
-			};
-			const comparableExisting = existing ? { ...existing, updated_at: now } : null;
-			if (comparableExisting && isDeepStrictEqual(comparableExisting, next)) {
-				unchanged++;
-				continue;
-			}
-			const before = existing ? await auditRecord('stat_attributes', id) : null;
-			if (existing) {
-				await (await database.prepare(`UPDATE stat_attributes SET
+  let created = 0;
+  let updated = 0;
+  let unchanged = 0;
+  await database.exec('BEGIN');
+  try {
+    for (const record of records) {
+      const name = String(record.name).normalize('NFKC').trim();
+      const unit = String(record.unit ?? '');
+      const existing = await (
+        await database.prepare(
+          'SELECT * FROM stat_attributes WHERE name=? COLLATE NOCASE AND unit=?',
+        )
+      ).get(name, unit);
+      const id = String(existing?.id ?? randomUUID());
+      const now = new Date().toISOString();
+      const next = {
+        ...(existing ?? {}),
+        id,
+        name,
+        description: existing?.description ?? null,
+        type: record.type,
+        category: record.category,
+        calculation_type: record.calculationType,
+        unit,
+        gear_min: record.gearRange?.[0] ?? existing?.gear_min ?? null,
+        gear_max: record.gearRange?.[1] ?? existing?.gear_max ?? null,
+        gear_reference_level: Number(existing?.gear_reference_level ?? 50),
+        weapon_min: record.weaponRange?.[0] ?? existing?.weapon_min ?? null,
+        weapon_max: record.weaponRange?.[1] ?? existing?.weapon_max ?? null,
+        weapon_reference_level: Number(existing?.weapon_reference_level ?? 50),
+        cap_value: existing?.cap_value ?? null,
+        active: 1,
+        created_at: String(existing?.created_at ?? now),
+        updated_at: now,
+      };
+      const comparableExisting = existing
+        ? { ...existing, updated_at: now }
+        : null;
+      if (comparableExisting && isDeepStrictEqual(comparableExisting, next)) {
+        unchanged++;
+        continue;
+      }
+      const before = existing ? await auditRecord('stat_attributes', id) : null;
+      if (existing) {
+        await (
+          await database.prepare(`UPDATE stat_attributes SET
 					name=?,description=?,type=?,category=?,calculation_type=?,unit=?,
-					gear_min=?,gear_max=?,weapon_min=?,weapon_max=?,skill_chip_min=?,skill_chip_max=?,
-					cap_value=?,active=1,updated_at=? WHERE id=?`)).run(
-					next.name, next.description, next.type, next.category, next.calculation_type, next.unit,
-					next.gear_min, next.gear_max, next.weapon_min, next.weapon_max, next.skill_chip_min,
-					next.skill_chip_max, next.cap_value, now, id
-				);
-				updated++;
-			} else {
-				await (await database.prepare(`INSERT INTO stat_attributes(
+					gear_min=?,gear_max=?,weapon_min=?,weapon_max=?,
+					cap_value=?,active=1,updated_at=? WHERE id=?`)
+        ).run(
+          next.name,
+          next.description,
+          next.type,
+          next.category,
+          next.calculation_type,
+          next.unit,
+          next.gear_min,
+          next.gear_max,
+          next.weapon_min,
+          next.weapon_max,
+          next.cap_value,
+          now,
+          id,
+        );
+        updated++;
+      } else {
+        await (
+          await database.prepare(`INSERT INTO stat_attributes(
 					id,name,description,type,category,calculation_type,unit,
 					gear_min,gear_max,gear_reference_level,weapon_min,weapon_max,weapon_reference_level,
-					skill_chip_min,skill_chip_max,cap_value,active,created_at,updated_at
-				) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1,?,?)`)).run(
-					id, next.name, next.description, next.type, next.category, next.calculation_type, next.unit,
-					next.gear_min, next.gear_max, next.gear_reference_level, next.weapon_min, next.weapon_max,
-					next.weapon_reference_level, next.skill_chip_min, next.skill_chip_max, next.cap_value, now, now
-				);
-				created++;
-			}
-			await recordIsacAudit({
-				actorId: String(actor.id),
-				category: 'game_data',
-				action: existing ? 'attribute.updated' : 'attribute.created',
-				entityId: id,
-				before,
-				after: await auditRecord('stat_attributes', id)
-			});
-		}
-		await database.exec('COMMIT');
-	} catch (error) {
-		await database.exec('ROLLBACK');
-		throw error;
-	}
-	console.log(`Imported ${records.length} Attribute definitions: ${created} created, ${updated} updated, ${unchanged} unchanged.`);
-	console.log(`Source: ${sourcePath}`);
+					cap_value,active,created_at,updated_at
+				) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1,?,?)`)
+        ).run(
+          id,
+          next.name,
+          next.description,
+          next.type,
+          next.category,
+          next.calculation_type,
+          next.unit,
+          next.gear_min,
+          next.gear_max,
+          next.gear_reference_level,
+          next.weapon_min,
+          next.weapon_max,
+          next.weapon_reference_level,
+          next.cap_value,
+          now,
+          now,
+        );
+        created++;
+      }
+      await recordIsacAudit({
+        actorId: String(actor.id),
+        category: 'game_data',
+        action: existing ? 'attribute.updated' : 'attribute.created',
+        entityId: id,
+        before,
+        after: await auditRecord('stat_attributes', id),
+      });
+    }
+    await database.exec('COMMIT');
+  } catch (error) {
+    await database.exec('ROLLBACK');
+    throw error;
+  }
+  console.log(
+    `Imported ${records.length} Attribute definitions: ${created} created, ${updated} updated, ${unchanged} unchanged.`,
+  );
+  console.log(`Source: ${sourcePath}`);
 } finally {
-	await vite.close();
+  await vite.close();
 }

scripts/isac-data-export.mjs

@@ -2,51 +2,89 @@ import { connect } from '@tursodatabase/database';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 import process from 'node:process';
-import { ISAC_DATA_TABLES, quoteIdentifier } from './isac-data-tables.mjs';
+import {
+  ISAC_DATA_FORMAT_VERSION,
+  ISAC_DATA_TABLES,
+  quoteIdentifier,
+} from './isac-data-tables.mjs';
 
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || './data/shd-build-development.db');
-const iconDirectory = resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons');
-const timestamp = new Date().toISOString().replaceAll(':', '-').replace(/\.\d{3}Z$/, 'Z');
-const outputPath = resolve(process.argv[2] || `./data/backups/isac-data-${timestamp}.json`);
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-development.db',
+);
+const iconDirectory = resolve(
+  process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons',
+);
+const timestamp = new Date()
+  .toISOString()
+  .replaceAll(':', '-')
+  .replace(/\.\d{3}Z$/, 'Z');
+const outputPath = resolve(
+  process.argv[2] || `./data/backups/isac-data-${timestamp}.json`,
+);
 const database = await connect(databasePath);
 const tables = [];
 let totalRows = 0;
 
 for (const name of ISAC_DATA_TABLES) {
-	const exists = await (await database.prepare(
-		"SELECT 1 AS present FROM sqlite_master WHERE type='table' AND name=?"
-	)).get(name);
-	if (!exists) throw new Error(`ISAC export requires missing table "${name}". Run the schema migration first.`);
-	const rows = await (await database.prepare(`SELECT * FROM ${quoteIdentifier(name)}`)).all();
-	tables.push({ name, rowCount: rows.length, rows });
-	totalRows += rows.length;
+  const exists = await (
+    await database.prepare(
+      "SELECT 1 AS present FROM sqlite_master WHERE type='table' AND name=?",
+    )
+  ).get(name);
+  if (!exists)
+    throw new Error(
+      `ISAC export requires missing table "${name}". Run the schema migration first.`,
+    );
+  const rows = await (
+    await database.prepare(`SELECT * FROM ${quoteIdentifier(name)}`)
+  ).all();
+  tables.push({ name, rowCount: rows.length, rows });
+  totalRows += rows.length;
 }
 
 const icons = [];
 const exportedStorageKeys = new Set();
 const iconTable = tables.find((table) => table.name === 'game_data_icons');
-const managedImageTable = tables.find((table) => table.name === 'managed_images');
-for (const row of [...(iconTable?.rows ?? []), ...(managedImageTable?.rows ?? [])]) {
-	if (typeof row.storage_key !== 'string' || !/^[a-z_]+-[0-9a-f-]{36}\.webp$/i.test(row.storage_key)) {
-		throw new Error(`Invalid managed asset storage key "${String(row.storage_key)}".`);
-	}
-	if (exportedStorageKeys.has(row.storage_key)) continue;
-	exportedStorageKeys.add(row.storage_key);
-	const content = await readFile(join(iconDirectory, row.storage_key));
-	icons.push({ storageKey: row.storage_key, contentBase64: content.toString('base64') });
+const managedImageTable = tables.find(
+  (table) => table.name === 'managed_images',
+);
+for (const row of [
+  ...(iconTable?.rows ?? []),
+  ...(managedImageTable?.rows ?? []),
+]) {
+  if (
+    typeof row.storage_key !== 'string' ||
+    !/^[a-z_]+-[0-9a-f-]{36}\.webp$/i.test(row.storage_key)
+  ) {
+    throw new Error(
+      `Invalid managed asset storage key "${String(row.storage_key)}".`,
+    );
+  }
+  if (exportedStorageKeys.has(row.storage_key)) continue;
+  exportedStorageKeys.add(row.storage_key);
+  const content = await readFile(join(iconDirectory, row.storage_key));
+  icons.push({
+    storageKey: row.storage_key,
+    contentBase64: content.toString('base64'),
+  });
 }
 
 const snapshot = {
-	format: 'shd-build-isac-data',
-	version: 2,
-	createdAt: new Date().toISOString(),
-	sourceDatabase: basename(databasePath),
-	totalRows,
-	tables,
-	icons
+  format: 'shd-build-isac-data',
+  version: ISAC_DATA_FORMAT_VERSION,
+  createdAt: new Date().toISOString(),
+  sourceDatabase: basename(databasePath),
+  totalRows,
+  tables,
+  icons,
 };
 await mkdir(dirname(outputPath), { recursive: true });
-await writeFile(outputPath, `${JSON.stringify(snapshot, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
+await writeFile(outputPath, `${JSON.stringify(snapshot, null, 2)}\n`, {
+  encoding: 'utf8',
+  flag: 'wx',
+});
 
-console.log(`Exported ${totalRows} ISAC rows and ${icons.length} uploaded image assets.`);
+console.log(
+  `Exported ${totalRows} ISAC rows and ${icons.length} uploaded image assets.`,
+);
 console.log(`ISAC snapshot: ${outputPath}`);

scripts/isac-data-import.mjs

@@ -3,41 +3,310 @@ import { spawnSync } from 'node:child_process';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { basename, join, resolve } from 'node:path';
 import process from 'node:process';
-import { ISAC_DATA_TABLES, quoteIdentifier } from './isac-data-tables.mjs';
+import {
+  ISAC_DATA_FORMAT_VERSION,
+  ISAC_DATA_TABLES,
+  quoteIdentifier,
+} from './isac-data-tables.mjs';
 
-const snapshotArgument = process.argv.slice(2).find((argument) => !argument.startsWith('--'));
-if (!snapshotArgument || !process.argv.includes('--confirm-replace-isac-data')) {
-	console.error('Usage: node scripts/isac-data-import.mjs <snapshot.json> --confirm-replace-isac-data');
-	process.exit(2);
+const snapshotArgument = process.argv
+  .slice(2)
+  .find((argument) => !argument.startsWith('--'));
+if (
+  !snapshotArgument ||
+  !process.argv.includes('--confirm-replace-isac-data')
+) {
+  console.error(
+    'Usage: node scripts/isac-data-import.mjs <snapshot.json> --confirm-replace-isac-data',
+  );
+  process.exit(2);
 }
 
 const snapshotPath = resolve(snapshotArgument);
 const snapshot = JSON.parse(await readFile(snapshotPath, 'utf8'));
-if (snapshot?.format !== 'shd-build-isac-data' || snapshot?.version !== 2 || !Array.isArray(snapshot.tables) || !Array.isArray(snapshot.icons)) {
-	throw new Error('The selected file is not a supported SHD.build ISAC data snapshot.');
+if (
+  snapshot?.format !== 'shd-build-isac-data' ||
+  snapshot?.version !== ISAC_DATA_FORMAT_VERSION ||
+  !Array.isArray(snapshot.tables) ||
+  !Array.isArray(snapshot.icons)
+) {
+  throw new Error(
+    'The selected file is not a supported SHD.build ISAC data snapshot.',
+  );
 }
 const receivedNames = snapshot.tables.map((table) => table.name);
-if (receivedNames.length !== ISAC_DATA_TABLES.length || ISAC_DATA_TABLES.some((name, index) => receivedNames[index] !== name)) {
-	throw new Error('The ISAC snapshot table manifest is incomplete or out of order.');
+if (
+  receivedNames.length !== ISAC_DATA_TABLES.length ||
+  ISAC_DATA_TABLES.some((name, index) => receivedNames[index] !== name)
+) {
+  throw new Error(
+    'The ISAC snapshot table manifest is incomplete or out of order.',
+  );
+}
+const abilityRows = snapshot.tables.find(
+  (table) => table.name === 'specialization_abilities',
+).rows;
+const abilitiesById = new Map(
+  abilityRows.map((row) => [String(row.id ?? ''), row]),
+);
+const skillChipRows = snapshot.tables.find(
+  (table) => table.name === 'skill_chip_sets',
+).rows;
+const activeSkillChipCounts = new Map();
+for (const row of skillChipRows) {
+  const abilityId = String(row.specialization_ability_id ?? '');
+  if (!abilityId || !abilitiesById.has(abilityId)) {
+    throw new Error(
+      `The ISAC snapshot contains a Skill Chip definition with a missing ability reference "${abilityId}".`,
+    );
+  }
+  if (Number(row.active) !== 1) continue;
+  const count = (activeSkillChipCounts.get(abilityId) ?? 0) + 1;
+  if (count > 3) {
+    throw new Error(
+      `The ISAC snapshot assigns more than three active Skill Chip definitions to ability "${abilityId}".`,
+    );
+  }
+  activeSkillChipCounts.set(abilityId, count);
+}
+const skillChipLinks = snapshot.tables.find(
+  (table) => table.name === 'specialization_ability_skill_chip_links',
+).rows;
+const linkedAbilityIds = new Set();
+for (const row of skillChipLinks) {
+  const abilityId = row.ability_id;
+  const compatibleAbilityId = row.compatible_ability_id;
+  if (
+    typeof abilityId !== 'string' ||
+    !abilityId ||
+    typeof compatibleAbilityId !== 'string' ||
+    !compatibleAbilityId
+  ) {
+    throw new Error(
+      'The ISAC snapshot contains a Skill Chip sharing link with malformed ability references.',
+    );
+  }
+  if (abilityId === compatibleAbilityId) {
+    throw new Error(
+      `The ISAC snapshot contains a self-referencing Skill Chip sharing link for ability "${abilityId}".`,
+    );
+  }
+  if (abilityId >= compatibleAbilityId) {
+    throw new Error(
+      `The ISAC snapshot contains a Skill Chip sharing link that is not in canonical ability order: "${abilityId}", "${compatibleAbilityId}".`,
+    );
+  }
+  const ability = abilitiesById.get(abilityId);
+  const compatibleAbility = abilitiesById.get(compatibleAbilityId);
+  if (!ability || !compatibleAbility) {
+    throw new Error(
+      `The ISAC snapshot contains a Skill Chip sharing link with a missing ability reference: "${abilityId}", "${compatibleAbilityId}".`,
+    );
+  }
+  if (Number(ability.active) !== 1 || Number(compatibleAbility.active) !== 1) {
+    throw new Error(
+      `The ISAC snapshot contains a Skill Chip sharing link with an inactive ability: "${abilityId}", "${compatibleAbilityId}".`,
+    );
+  }
+  if (ability.specialization_id !== compatibleAbility.specialization_id) {
+    throw new Error(
+      `The ISAC snapshot contains a cross-specialization Skill Chip sharing link: "${abilityId}", "${compatibleAbilityId}".`,
+    );
+  }
+  if (
+    linkedAbilityIds.has(abilityId) ||
+    linkedAbilityIds.has(compatibleAbilityId)
+  ) {
+    throw new Error(
+      'The ISAC snapshot contains more than one Skill Chip sharing link touching an ability.',
+    );
+  }
+  linkedAbilityIds.add(abilityId);
+  linkedAbilityIds.add(compatibleAbilityId);
+}
+for (const kind of ['weapon', 'gear']) {
+  const options = snapshot.tables.find(
+    (table) => table.name === `${kind}_mod_secondary_options`,
+  ).rows;
+  const values = snapshot.tables.find(
+    (table) => table.name === `${kind}_mod_secondary_quality_values`,
+  ).rows;
+  const optionIds = options.map((row) => String(row.stat_attribute_id ?? ''));
+  if (
+    optionIds.some((id) => !id) ||
+    new Set(optionIds).size !== optionIds.length ||
+    (optionIds.length !== 0 &&
+      (optionIds.length < 2 || optionIds.length > 50)) ||
+    values.length !== optionIds.length * 3
+  ) {
+    throw new Error(
+      `The ISAC snapshot contains an incomplete shared ${kind} Mod secondary pool.`,
+    );
+  }
+  for (const statId of optionIds) {
+    const profile = values.filter(
+      (row) => String(row.stat_attribute_id) === statId,
+    );
+    if (
+      profile.length !== 3 ||
+      ['Specialized', 'Superior', 'High-end'].some(
+        (quality) => !profile.some((row) => row.quality === quality),
+      ) ||
+      profile.some((row) => {
+        const endpoints = [
+          row.level_1_min,
+          row.level_1_max,
+          row.level_20_min,
+          row.level_20_max,
+        ];
+        return (
+          endpoints.some(
+            (value) => typeof value !== 'number' || !Number.isFinite(value),
+          ) ||
+          endpoints[1] < endpoints[0] ||
+          endpoints[2] < endpoints[0] ||
+          endpoints[3] < endpoints[1] ||
+          endpoints[3] < endpoints[2]
+        );
+      })
+    ) {
+      throw new Error(
+        `The ISAC snapshot contains an invalid shared ${kind} Mod secondary profile for ${statId}.`,
+      );
+    }
+  }
+  if (
+    values.some(
+      (row) => !optionIds.includes(String(row.stat_attribute_id ?? '')),
+    )
+  ) {
+    throw new Error(
+      `The ISAC snapshot contains an orphaned shared ${kind} Mod secondary range.`,
+    );
+  }
+}
+for (const [profileName, qualities, requiredOptions] of [
+  ['primary', ['Standard', 'Specialized', 'Superior', 'High-end'], 4],
+  ['secondary', ['Specialized', 'Superior', 'High-end'], null],
+]) {
+  const options = snapshot.tables.find(
+    (table) => table.name === `skill_chip_${profileName}_options`,
+  ).rows;
+  const values = snapshot.tables.find(
+    (table) => table.name === `skill_chip_${profileName}_quality_values`,
+  ).rows;
+  const optionIds = options.map((row) => String(row.stat_attribute_id ?? ''));
+  const validCardinality = requiredOptions
+    ? optionIds.length === requiredOptions
+    : optionIds.length <= 50;
+  if (
+    !validCardinality ||
+    optionIds.some((id) => !id) ||
+    new Set(optionIds).size !== optionIds.length
+  ) {
+    throw new Error(
+      `The ISAC snapshot contains an incomplete shared Skill Chip ${profileName} profile.`,
+    );
+  }
+  if (profileName === 'primary' && optionIds.length) {
+    const attributes = snapshot.tables.find(
+      (table) => table.name === 'stat_attributes',
+    ).rows;
+    const expectedIds = attributes
+      .filter(
+        (row) =>
+          Number(row.active) === 1 &&
+          [
+            'Skill Duration',
+            'Skill Radius',
+            'Skill Cooldown Recovery',
+            'Skill Intensity',
+          ].includes(String(row.name)),
+      )
+      .map((row) => String(row.id))
+      .sort();
+    if (
+      expectedIds.length !== 4 ||
+      optionIds
+        .slice()
+        .sort()
+        .some((id, index) => id !== expectedIds[index])
+    )
+      throw new Error(
+        'The ISAC snapshot does not use the four fixed Skill Chip primary Attributes.',
+      );
+  }
+  for (const statId of optionIds) {
+    const rows = values.filter(
+      (row) => String(row.stat_attribute_id ?? '') === statId,
+    );
+    if (!rows.length) continue;
+    if (
+      rows.length !== qualities.length ||
+      qualities.some(
+        (quality) => !rows.some((row) => row.quality === quality),
+      ) ||
+      rows.some(
+        (row) =>
+          typeof row.min_value !== 'number' ||
+          !Number.isFinite(row.min_value) ||
+          typeof row.max_value !== 'number' ||
+          !Number.isFinite(row.max_value) ||
+          row.min_value < 0 ||
+          row.max_value < row.min_value,
+      )
+    ) {
+      throw new Error(
+        `The ISAC snapshot contains an invalid shared Skill Chip ${profileName} profile for ${statId}.`,
+      );
+    }
+  }
+  if (
+    values.some(
+      (row) => !optionIds.includes(String(row.stat_attribute_id ?? '')),
+    )
+  )
+    throw new Error(
+      `The ISAC snapshot contains an orphaned shared Skill Chip ${profileName} range.`,
+    );
 }
 for (const icon of snapshot.icons) {
-	if (typeof icon.storageKey !== 'string' || !/^[a-z_]+-[0-9a-f-]{36}\.webp$/i.test(icon.storageKey)
-		|| typeof icon.contentBase64 !== 'string') {
-		throw new Error('The ISAC snapshot contains an invalid uploaded icon.');
-	}
+  if (
+    typeof icon.storageKey !== 'string' ||
+    !/^[a-z_]+-[0-9a-f-]{36}\.webp$/i.test(icon.storageKey) ||
+    typeof icon.contentBase64 !== 'string'
+  ) {
+    throw new Error('The ISAC snapshot contains an invalid uploaded icon.');
+  }
 }
 
-const timestamp = new Date().toISOString().replaceAll(':', '-').replace(/\.\d{3}Z$/, 'Z');
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || './data/shd-build-development.db');
-const backupPath = resolve(`./data/backups/${basename(databasePath).replace(/\.[^.]+$/, '')}-before-isac-import-${timestamp}.json`);
-const isacBackupPath = resolve(`./data/backups/isac-data-before-import-${timestamp}.json`);
+const timestamp = new Date()
+  .toISOString()
+  .replaceAll(':', '-')
+  .replace(/\.\d{3}Z$/, 'Z');
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-development.db',
+);
+const backupPath = resolve(
+  `./data/backups/${basename(databasePath).replace(/\.[^.]+$/, '')}-before-isac-import-${timestamp}.json`,
+);
+const isacBackupPath = resolve(
+  `./data/backups/isac-data-before-import-${timestamp}.json`,
+);
 for (const [script, output] of [
-	['scripts/db-backup.mjs', backupPath],
-	['scripts/isac-data-export.mjs', isacBackupPath]
+  ['scripts/db-backup.mjs', backupPath],
+  ['scripts/isac-data-export.mjs', isacBackupPath],
 ]) {
-	const result = spawnSync(process.execPath, [script, output], { cwd: process.cwd(), stdio: 'inherit', env: process.env });
-	if (result.error) throw result.error;
-	if (result.status !== 0) throw new Error(`Safety backup failed in ${script}; no ISAC data was changed.`);
+  const result = spawnSync(process.execPath, [script, output], {
+    cwd: process.cwd(),
+    stdio: 'inherit',
+    env: process.env,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0)
+    throw new Error(
+      `Safety backup failed in ${script}; no ISAC data was changed.`,
+    );
 }
 
 const database = await connect(databasePath);
@@ -45,35 +314,43 @@ let importedRows = 0;
 await database.exec('PRAGMA foreign_keys=OFF');
 await database.exec('BEGIN');
 try {
-	for (const name of [...ISAC_DATA_TABLES].reverse()) {
-		await database.exec(`DELETE FROM ${quoteIdentifier(name)}`);
-	}
-	for (const table of snapshot.tables) {
-		for (const row of table.rows) {
-			const columns = Object.keys(row);
-			if (!columns.length) continue;
-			const insert = await database.prepare(
-				`INSERT INTO ${quoteIdentifier(table.name)} (${columns.map(quoteIdentifier).join(', ')})
-				VALUES (${columns.map(() => '?').join(', ')})`
-			);
-			await insert.run(...columns.map((column) => row[column]));
-			importedRows++;
-		}
-	}
-	await database.exec('COMMIT');
+  for (const name of [...ISAC_DATA_TABLES].reverse()) {
+    await database.exec(`DELETE FROM ${quoteIdentifier(name)}`);
+  }
+  for (const table of snapshot.tables) {
+    for (const row of table.rows) {
+      const columns = Object.keys(row);
+      if (!columns.length) continue;
+      const insert = await database.prepare(
+        `INSERT INTO ${quoteIdentifier(table.name)} (${columns.map(quoteIdentifier).join(', ')})
+				VALUES (${columns.map(() => '?').join(', ')})`,
+      );
+      await insert.run(...columns.map((column) => row[column]));
+      importedRows++;
+    }
+  }
+  await database.exec('COMMIT');
 } catch (error) {
-	await database.exec('ROLLBACK');
-	throw error;
+  await database.exec('ROLLBACK');
+  throw error;
 } finally {
-	await database.exec('PRAGMA foreign_keys=ON');
+  await database.exec('PRAGMA foreign_keys=ON');
 }
 
-const iconDirectory = resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons');
+const iconDirectory = resolve(
+  process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons',
+);
 await mkdir(iconDirectory, { recursive: true });
 for (const icon of snapshot.icons) {
-	await writeFile(join(iconDirectory, icon.storageKey), Buffer.from(icon.contentBase64, 'base64'), { mode: 0o600 });
+  await writeFile(
+    join(iconDirectory, icon.storageKey),
+    Buffer.from(icon.contentBase64, 'base64'),
+    { mode: 0o600 },
+  );
 }
 
-console.log(`Imported ${importedRows} ISAC rows and ${snapshot.icons.length} uploaded image assets from ${snapshotPath}.`);
+console.log(
+  `Imported ${importedRows} ISAC rows and ${snapshot.icons.length} uploaded image assets from ${snapshotPath}.`,
+);
 console.log(`Full pre-import backup: ${backupPath}`);
 console.log(`ISAC pre-import snapshot: ${isacBackupPath}`);

scripts/isac-data-tables.mjs

@@ -1,76 +1,82 @@
 export const ISAC_DATA_TABLES = [
-	'stat_attributes',
-	'talents',
-	'talent_tiers',
-	'conditional_effect_rules',
-	'conditional_effect_state_pools',
-	'conditional_effect_clauses',
-	'conditional_effect_outcomes',
-	'talent_tier_effects',
-	'talent_description_templates',
-	'talent_weapon_scopes',
-	'weapon_talent_slots',
-	'brand_sets',
-	'brand_set_effects',
-	'gear',
-	'gear_brand_sets',
-	'gear_talents',
-	'gear_tactical_augments',
-	'gear_tactical_augment_costs',
-	'weapons',
-	'core_attribute_tier_ranges',
-	'weapon_tier_ranges',
-	'weapon_talent_options',
-	'weapon_augmentation_effects',
-	'weapon_category_attribute_bonuses',
-	'os_protocols',
-	'os_protocol_primary_effects',
-	'os_protocol_secondary_profiles',
-	'os_protocol_secondary_effects',
-	'os_protocol_talents',
-	'os_protocol_talent_effects',
-	'skill_chip_sets',
-	'skill_chip_two_piece_bonuses',
-	'skill_chip_primary_options',
-	'skill_chip_secondary_options',
-	'skill_chip_talents',
-	'skill_chip_talent_effects',
-	'weapon_mods',
-	'weapon_mod_compatible_categories',
-	'weapon_mod_slots',
-	'weapon_mod_quality_values',
-	'weapon_mod_secondary_options',
-	'weapon_mod_secondary_quality_values',
-	'weapon_mod_exotic_attributes',
-	'weapon_mod_effects',
-	'weapon_mod_effect_quality_values',
-	'gear_mods',
-	'gear_mod_quality_values',
-	'gear_mod_secondary_options',
-	'gear_mod_secondary_quality_values',
-	'specialization_progression_config',
-	'specialization_rank_cost_profiles',
-	'upgrade_resources',
-	'specializations',
-	'specialization_combat_effects',
-	'specialization_focuses',
-	'specialization_abilities',
-	'specialization_ability_attacks',
-	'specialization_ability_effects',
-	'specialization_focus_abilities',
-	'specialization_tree_nodes',
-	'specialization_tree_node_ranks',
-	'specialization_tree_rank_effects',
-	'specialization_tree_rank_costs',
-	'specialization_tree_rank_combat_effects',
-	'specialization_tree_rank_combat_modifiers',
-	'calculation_revisions',
-	'calculation_stages',
-	'attribute_calculation_profiles',
-	'skill_attribute_calculation_profiles',
-	'calculation_calibration_cases',
-	'game_data_icons',
-	'managed_images'
+  'stat_attributes',
+  'talents',
+  'talent_tiers',
+  'conditional_effect_rules',
+  'conditional_effect_state_pools',
+  'conditional_effect_clauses',
+  'conditional_effect_outcomes',
+  'talent_tier_effects',
+  'talent_description_templates',
+  'talent_weapon_scopes',
+  'weapon_talent_slots',
+  'brand_sets',
+  'brand_set_effects',
+  'gear',
+  'gear_brand_sets',
+  'gear_talents',
+  'gear_tactical_augments',
+  'gear_tactical_augment_costs',
+  'weapons',
+  'core_attribute_tier_ranges',
+  'weapon_tier_ranges',
+  'weapon_talent_options',
+  'weapon_augmentation_effects',
+  'weapon_category_attribute_bonuses',
+  'os_protocols',
+  'os_protocol_primary_effects',
+  'os_protocol_secondary_profiles',
+  'os_protocol_secondary_effects',
+  'os_protocol_talents',
+  'os_protocol_talent_effects',
+  'skill_chip_sets',
+  'skill_chip_two_piece_bonuses',
+  'skill_chip_primary_options',
+  'skill_chip_primary_quality_values',
+  'skill_chip_secondary_options',
+  'skill_chip_secondary_quality_values',
+  'skill_chip_talents',
+  'skill_chip_talent_effects',
+  'weapon_mods',
+  'weapon_mod_compatible_categories',
+  'weapon_mod_slots',
+  'weapon_mod_quality_values',
+  'weapon_mod_secondary_options',
+  'weapon_mod_secondary_quality_values',
+  'weapon_mod_exotic_attributes',
+  'weapon_mod_effects',
+  'weapon_mod_effect_quality_values',
+  'gear_mods',
+  'gear_mod_quality_values',
+  'gear_mod_secondary_options',
+  'gear_mod_secondary_quality_values',
+  'specialization_progression_config',
+  'specialization_rank_cost_profiles',
+  'upgrade_resources',
+  'specializations',
+  'specialization_combat_effects',
+  'specialization_focuses',
+  'specialization_abilities',
+  'specialization_ability_skill_chip_links',
+  'specialization_ability_attacks',
+  'specialization_ability_effects',
+  'specialization_focus_abilities',
+  'specialization_tree_nodes',
+  'specialization_tree_node_ranks',
+  'specialization_tree_rank_effects',
+  'specialization_tree_rank_costs',
+  'specialization_tree_rank_combat_effects',
+  'specialization_tree_rank_combat_modifiers',
+  'calculation_revisions',
+  'calculation_stages',
+  'attribute_calculation_profiles',
+  'skill_attribute_calculation_profiles',
+  'calculation_calibration_cases',
+  'game_data_icons',
+  'managed_images',
 ];
 
-export const quoteIdentifier = (identifier) => `"${String(identifier).replaceAll('"', '""')}"`;
+export const ISAC_DATA_FORMAT_VERSION = 5;
+
+export const quoteIdentifier = (identifier) =>
+  `"${String(identifier).replaceAll('"', '""')}"`;

scripts/managed-images-export.mjs

@@ -2,28 +2,53 @@ import { connect } from '@tursodatabase/database';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { basename, dirname, join, resolve } from 'node:path';
 
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || './data/shd-build-development.db');
-const storageDirectory = resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons');
-const timestamp = new Date().toISOString().replaceAll(':', '-').replace(/\.\d{3}Z$/, 'Z');
-const outputPath = resolve(process.argv[2] || `./data/backups/managed-images-${timestamp}.json`);
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-development.db',
+);
+const storageDirectory = resolve(
+  process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons',
+);
+const timestamp = new Date()
+  .toISOString()
+  .replaceAll(':', '-')
+  .replace(/\.\d{3}Z$/, 'Z');
+const outputPath = resolve(
+  process.argv[2] || `./data/backups/managed-images-${timestamp}.json`,
+);
 const database = await connect(databasePath);
-const rows = await (await database.prepare('SELECT * FROM managed_images ORDER BY created_at')).all();
+const rows = await (
+  await database.prepare('SELECT * FROM managed_images ORDER BY created_at')
+).all();
 const images = [];
 for (const row of rows) {
-	if (typeof row.storage_key !== 'string'
-		|| !/^(?:library|talent|brand_set|os_protocol|skill_chip|specialization|specialization_ability|specialization_node)-[0-9a-f-]{36}\.webp$/i.test(row.storage_key)) {
-		throw new Error(`Invalid managed-image storage key "${String(row.storage_key)}".`);
-	}
-	images.push({ row, contentBase64: (await readFile(join(storageDirectory, row.storage_key))).toString('base64') });
+  if (
+    typeof row.storage_key !== 'string' ||
+    !/^(?:library|talent|brand_set|os_protocol|skill_chip|specialization|specialization_ability|specialization_node|weapon_mod_slot)-[0-9a-f-]{36}\.webp$/i.test(
+      row.storage_key,
+    )
+  ) {
+    throw new Error(
+      `Invalid managed-image storage key "${String(row.storage_key)}".`,
+    );
+  }
+  images.push({
+    row,
+    contentBase64: (
+      await readFile(join(storageDirectory, row.storage_key))
+    ).toString('base64'),
+  });
 }
 const bundle = {
-	format: 'shd-build-managed-images',
-	version: 1,
-	createdAt: new Date().toISOString(),
-	sourceDatabase: basename(databasePath),
-	images
+  format: 'shd-build-managed-images',
+  version: 1,
+  createdAt: new Date().toISOString(),
+  sourceDatabase: basename(databasePath),
+  images,
 };
 await mkdir(dirname(outputPath), { recursive: true });
-await writeFile(outputPath, `${JSON.stringify(bundle, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
+await writeFile(outputPath, `${JSON.stringify(bundle, null, 2)}\n`, {
+  encoding: 'utf8',
+  flag: 'wx',
+});
 console.log(`Exported ${images.length} managed image assets.`);
 console.log(`Image bundle: ${outputPath}`);

scripts/managed-images-import.mjs

@@ -4,47 +4,97 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { randomUUID } from 'node:crypto';
 
-const bundleArgument = process.argv.slice(2).find((argument) => !argument.startsWith('--'));
+const bundleArgument = process.argv
+  .slice(2)
+  .find((argument) => !argument.startsWith('--'));
 if (!bundleArgument || !process.argv.includes('--confirm-merge')) {
-	console.error('Usage: node scripts/managed-images-import.mjs <bundle.json> --confirm-merge [--update-existing]');
-	process.exit(2);
+  console.error(
+    'Usage: node scripts/managed-images-import.mjs <bundle.json> --confirm-merge [--update-existing]',
+  );
+  process.exit(2);
 }
 const updateExisting = process.argv.includes('--update-existing');
+const gameDataRenderSourceTypes = new Set([
+  'weapon_render',
+  'gear_render',
+  'weapon_mod_render',
+  'gear_mod_render',
+  'talent_render',
+  'brand_set_render',
+  'os_protocol_render',
+  'skill_chip_render',
+  'specialization_render',
+  'specialization_ability_render',
+  'specialization_node_render',
+]);
 const bundlePath = resolve(bundleArgument);
 const bundle = JSON.parse(await readFile(bundlePath, 'utf8'));
-if (bundle?.format !== 'shd-build-managed-images' || bundle?.version !== 1 || !Array.isArray(bundle.images)) {
-	throw new Error('The selected file is not a supported SHD.build managed-image bundle.');
+if (
+  bundle?.format !== 'shd-build-managed-images' ||
+  bundle?.version !== 1 ||
+  !Array.isArray(bundle.images)
+) {
+  throw new Error(
+    'The selected file is not a supported SHD.build managed-image bundle.',
+  );
 }
 for (const image of bundle.images) {
-	if (typeof image?.row?.id !== 'string' || !/^[0-9a-f-]{36}$/i.test(image.row.id)
-		|| typeof image.row.storage_key !== 'string'
-		|| !/^(?:library|talent|brand_set|os_protocol|skill_chip|specialization|specialization_ability|specialization_node)-[0-9a-f-]{36}\.webp$/i.test(image.row.storage_key)
-		|| typeof image.contentBase64 !== 'string') {
-		throw new Error('The bundle contains an invalid managed image.');
-	}
-	const isItemRender = ['weapon_render', 'gear_render'].includes(image.row.source_entity_type);
-	if (image.row.source_entity_type && (
-		typeof image.row.source_entity_id !== 'string'
-		|| !/^[0-9a-f-]{36}$/i.test(image.row.source_entity_id)
-		|| (isItemRender
-			? !image.row.storage_key.startsWith('library-')
-			: !image.row.storage_key.startsWith(`${image.row.source_entity_type}-`))
-	)) throw new Error('The bundle contains an invalid linked ISAC image.');
+  if (
+    typeof image?.row?.id !== 'string' ||
+    !/^[0-9a-f-]{36}$/i.test(image.row.id) ||
+    typeof image.row.storage_key !== 'string' ||
+    !/^(?:library|talent|brand_set|os_protocol|skill_chip|specialization|specialization_ability|specialization_node|weapon_mod_slot)-[0-9a-f-]{36}\.webp$/i.test(
+      image.row.storage_key,
+    ) ||
+    typeof image.contentBase64 !== 'string'
+  ) {
+    throw new Error('The bundle contains an invalid managed image.');
+  }
+  const isGameDataRender = gameDataRenderSourceTypes.has(
+    image.row.source_entity_type,
+  );
+  if (
+    image.row.source_entity_type &&
+    (typeof image.row.source_entity_id !== 'string' ||
+      !/^[0-9a-f-]{36}$/i.test(image.row.source_entity_id) ||
+      (isGameDataRender
+        ? !image.row.storage_key.startsWith('library-')
+        : !image.row.storage_key.startsWith(
+            `${image.row.source_entity_type}-`,
+          )))
+  )
+    throw new Error('The bundle contains an invalid linked ISAC image.');
 }
 
 const backup = spawnSync(process.execPath, ['scripts/db-backup.mjs'], {
-	cwd: process.cwd(), stdio: 'inherit', env: process.env
+  cwd: process.cwd(),
+  stdio: 'inherit',
+  env: process.env,
 });
 if (backup.error) throw backup.error;
-if (backup.status !== 0) throw new Error('Safety backup failed; no managed images were imported.');
-const assetBackup = spawnSync(process.execPath, ['scripts/isac-data-export.mjs'], {
-	cwd: process.cwd(), stdio: 'inherit', env: process.env
-});
+if (backup.status !== 0)
+  throw new Error('Safety backup failed; no managed images were imported.');
+const assetBackup = spawnSync(
+  process.execPath,
+  ['scripts/isac-data-export.mjs'],
+  {
+    cwd: process.cwd(),
+    stdio: 'inherit',
+    env: process.env,
+  },
+);
 if (assetBackup.error) throw assetBackup.error;
-if (assetBackup.status !== 0) throw new Error('Uploaded-asset safety snapshot failed; no managed images were imported.');
+if (assetBackup.status !== 0)
+  throw new Error(
+    'Uploaded-asset safety snapshot failed; no managed images were imported.',
+  );
 
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || './data/shd-build-development.db');
-const storageDirectory = resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons');
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-development.db',
+);
+const storageDirectory = resolve(
+  process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons',
+);
 const database = await connect(databasePath);
 await mkdir(storageDirectory, { recursive: true });
 let inserted = 0;
@@ -53,64 +103,140 @@ let unchanged = 0;
 
 const preflight = [];
 for (const image of bundle.images) {
-	const row = image.row;
-	const existing = await (await database.prepare('SELECT * FROM managed_images WHERE id=?')).get(row.id);
-	if (existing && !updateExisting) {
-		const same = ['name','category','tags_json','is_icon','force_white','storage_key','byte_size','width','height','source_entity_type','source_entity_id']
-			.every((key) => String(existing[key]) === String(row[key]));
-		if (!same) throw new Error(`Image ${row.id} already exists with different metadata. Re-run with --update-existing after review.`);
-		unchanged++;
-		continue;
-	}
-	const creator = await (await database.prepare('SELECT id FROM users WHERE id=?')).get(row.created_by);
-	if (!creator) throw new Error(`Image "${row.name}" references a creator that does not exist in the target database.`);
-	const nameConflict = await (await database.prepare('SELECT id FROM managed_images WHERE name=? COLLATE NOCASE AND id<>?')).get(row.name, row.id);
-	if (nameConflict) throw new Error(`Image name "${row.name}" is already assigned to a different target asset.`);
-	if (row.source_entity_type && row.source_entity_id) {
-		const sourceConflict = await (await database.prepare(
-			'SELECT id FROM managed_images WHERE source_entity_type=? AND source_entity_id=? AND id<>?'
-		)).get(row.source_entity_type, row.source_entity_id, row.id);
-		if (sourceConflict) throw new Error(`The ${row.source_entity_type} image ${row.source_entity_id} is already registered under a different library asset.`);
-	}
-	preflight.push({ image, existing });
+  const row = image.row;
+  const existing = await (
+    await database.prepare('SELECT * FROM managed_images WHERE id=?')
+  ).get(row.id);
+  if (existing && !updateExisting) {
+    const same = [
+      'name',
+      'category',
+      'tags_json',
+      'is_icon',
+      'force_white',
+      'storage_key',
+      'byte_size',
+      'width',
+      'height',
+      'source_entity_type',
+      'source_entity_id',
+    ].every((key) => String(existing[key]) === String(row[key]));
+    if (!same)
+      throw new Error(
+        `Image ${row.id} already exists with different metadata. Re-run with --update-existing after review.`,
+      );
+    unchanged++;
+    continue;
+  }
+  const creator = await (
+    await database.prepare('SELECT id FROM users WHERE id=?')
+  ).get(row.created_by);
+  if (!creator)
+    throw new Error(
+      `Image "${row.name}" references a creator that does not exist in the target database.`,
+    );
+  const nameConflict = await (
+    await database.prepare(
+      'SELECT id FROM managed_images WHERE name=? COLLATE NOCASE AND id<>?',
+    )
+  ).get(row.name, row.id);
+  if (nameConflict)
+    throw new Error(
+      `Image name "${row.name}" is already assigned to a different target asset.`,
+    );
+  if (row.source_entity_type && row.source_entity_id) {
+    const sourceConflict = await (
+      await database.prepare(
+        'SELECT id FROM managed_images WHERE source_entity_type=? AND source_entity_id=? AND id<>?',
+      )
+    ).get(row.source_entity_type, row.source_entity_id, row.id);
+    if (sourceConflict)
+      throw new Error(
+        `The ${row.source_entity_type} image ${row.source_entity_id} is already registered under a different library asset.`,
+      );
+  }
+  preflight.push({ image, existing });
 }
 
 await database.exec('BEGIN');
 try {
-for (const { image, existing } of preflight) {
-	const row = image.row;
-	await writeFile(join(storageDirectory, row.storage_key), Buffer.from(image.contentBase64, 'base64'), {
-		mode: 0o600, flag: existing || row.source_entity_type ? 'w' : 'wx'
-	});
-	if (existing) {
-		await (await database.prepare(`UPDATE managed_images SET
+  for (const { image, existing } of preflight) {
+    const row = image.row;
+    await writeFile(
+      join(storageDirectory, row.storage_key),
+      Buffer.from(image.contentBase64, 'base64'),
+      {
+        mode: 0o600,
+        flag: existing || row.source_entity_type ? 'w' : 'wx',
+      },
+    );
+    if (existing) {
+      await (
+        await database.prepare(`UPDATE managed_images SET
 			name=?,category=?,tags_json=?,is_icon=?,force_white=?,storage_key=?,original_filename=?,
-			byte_size=?,width=?,height=?,source_entity_type=?,source_entity_id=?,updated_at=? WHERE id=?`)).run(
-			row.name,row.category,row.tags_json,row.is_icon,row.force_white,row.storage_key,row.original_filename,
-			row.byte_size,row.width,row.height,row.source_entity_type ?? null,row.source_entity_id ?? null,row.updated_at,row.id
-		);
-		updated++;
-	} else {
-		await (await database.prepare(`INSERT INTO managed_images
+			byte_size=?,width=?,height=?,source_entity_type=?,source_entity_id=?,updated_at=? WHERE id=?`)
+      ).run(
+        row.name,
+        row.category,
+        row.tags_json,
+        row.is_icon,
+        row.force_white,
+        row.storage_key,
+        row.original_filename,
+        row.byte_size,
+        row.width,
+        row.height,
+        row.source_entity_type ?? null,
+        row.source_entity_id ?? null,
+        row.updated_at,
+        row.id,
+      );
+      updated++;
+    } else {
+      await (
+        await database.prepare(`INSERT INTO managed_images
 			(id,name,category,tags_json,is_icon,force_white,storage_key,original_filename,byte_size,width,height,
 			 source_entity_type,source_entity_id,created_by,created_at,updated_at)
-			VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)).run(
-			row.id,row.name,row.category,row.tags_json,row.is_icon,row.force_white,row.storage_key,row.original_filename,
-			row.byte_size,row.width,row.height,row.source_entity_type ?? null,row.source_entity_id ?? null,
-			row.created_by,row.created_at,row.updated_at
-		);
-		inserted++;
-	}
-	await (await database.prepare(`INSERT INTO audit_log
-		(id,actor_id,entity_type,entity_id,action,before_json,after_json,created_at) VALUES(?,?,?,?,?,?,?,?)`)).run(
-		randomUUID(), row.created_by, 'system_configuration', row.id,
-		existing ? 'image.import_updated' : 'image.imported',
-		existing ? JSON.stringify(existing) : null, JSON.stringify(row), new Date().toISOString()
-	);
-}
-await database.exec('COMMIT');
+			VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+      ).run(
+        row.id,
+        row.name,
+        row.category,
+        row.tags_json,
+        row.is_icon,
+        row.force_white,
+        row.storage_key,
+        row.original_filename,
+        row.byte_size,
+        row.width,
+        row.height,
+        row.source_entity_type ?? null,
+        row.source_entity_id ?? null,
+        row.created_by,
+        row.created_at,
+        row.updated_at,
+      );
+      inserted++;
+    }
+    await (
+      await database.prepare(`INSERT INTO audit_log
+		(id,actor_id,entity_type,entity_id,action,before_json,after_json,created_at) VALUES(?,?,?,?,?,?,?,?)`)
+    ).run(
+      randomUUID(),
+      row.created_by,
+      'system_configuration',
+      row.id,
+      existing ? 'image.import_updated' : 'image.imported',
+      existing ? JSON.stringify(existing) : null,
+      JSON.stringify(row),
+      new Date().toISOString(),
+    );
+  }
+  await database.exec('COMMIT');
 } catch (error) {
-	await database.exec('ROLLBACK');
-	throw error;
+  await database.exec('ROLLBACK');
+  throw error;
 }
-console.log(`Managed-image merge complete: ${inserted} inserted, ${updated} updated, ${unchanged} unchanged.`);
+console.log(
+  `Managed-image merge complete: ${inserted} inserted, ${updated} updated, ${unchanged} unchanged.`,
+);

scripts/notification-digest.mjs

@@ -2,40 +2,78 @@ import { connect } from '@tursodatabase/database';
 import nodemailer from 'nodemailer';
 import { resolve } from 'node:path';
 
-if (!process.env.SMTP_HOST || !process.env.SMTP_FROM) throw new Error('SMTP delivery is not configured.');
-const database = await connect(resolve(process.env.TDR_DATABASE_PATH || './data/shd-build.db'));
+if (!process.env.SMTP_HOST || !process.env.SMTP_FROM)
+  throw new Error('SMTP delivery is not configured.');
+const database = await connect(
+  resolve(process.env.TDR_DATABASE_PATH || './data/shd-build.db'),
+);
 const transport = nodemailer.createTransport({
-	host: process.env.SMTP_HOST,
-	port: Number(process.env.SMTP_PORT || 587),
-	secure: process.env.SMTP_SECURE === 'true',
-	auth: process.env.SMTP_USER ? { user: process.env.SMTP_USER, pass: process.env.SMTP_PASSWORD } : undefined,
-	requireTLS: process.env.SMTP_SECURE !== 'true',
-	disableFileAccess: true,
-	disableUrlAccess: true
+  host: process.env.SMTP_HOST,
+  port: Number(process.env.SMTP_PORT || 587),
+  secure: process.env.SMTP_SECURE === 'true',
+  auth: process.env.SMTP_USER
+    ? { user: process.env.SMTP_USER, pass: process.env.SMTP_PASSWORD }
+    : undefined,
+  requireTLS: process.env.SMTP_SECURE !== 'true',
+  disableFileAccess: true,
+  disableUrlAccess: true,
 });
-const origin = (process.env.APP_ORIGIN || 'http://localhost:5173').replace(/\/+$/, '');
-const recipients = await (await database.prepare(`SELECT DISTINCT n.user_id,e.email
+const origin = (process.env.APP_ORIGIN || 'http://localhost:5173').replace(
+  /\/+$/,
+  '',
+);
+const recipients = await (
+  await database.prepare(`SELECT DISTINCT n.user_id,e.email
 	FROM notifications n
 	JOIN notification_preferences p ON p.user_id=n.user_id AND p.category=n.category AND p.email_frequency='daily'
 	JOIN user_emails e ON e.user_id=n.user_id
-	WHERE n.emailed_at IS NULL AND n.created_at>=p.updated_at`)).all();
+	WHERE n.emailed_at IS NULL AND n.created_at>=p.updated_at`)
+).all();
 let sent = 0;
 for (const recipient of recipients) {
-	const items = await (await database.prepare(`SELECT n.id,n.title,n.body,n.link FROM notifications n
+  const items = await (
+    await database.prepare(`SELECT n.id,n.title,n.body,n.link FROM notifications n
 		JOIN notification_preferences p ON p.user_id=n.user_id AND p.category=n.category AND p.email_frequency='daily'
-		WHERE n.user_id=? AND n.emailed_at IS NULL AND n.created_at>=p.updated_at ORDER BY n.created_at LIMIT 100`)).all(recipient.user_id);
-	if (!items.length) continue;
-	const escape = (value) => String(value).replace(/[&<>"']/g, (character) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[character]);
-	const rows = items.map((item) => `<div style="border-top:1px solid #34393a;padding:16px 0"><strong>${escape(item.title)}</strong><p style="color:#a5aaab">${escape(item.body)}</p>${item.link ? `<a style="color:#f6a821" href="${origin}${item.link}">VIEW INTELLIGENCE</a>` : ''}</div>`).join('');
-	await transport.sendMail({
-		from: process.env.SMTP_FROM,
-		to: recipient.email,
-		subject: `SHD.build daily notification summary · ${items.length} update${items.length === 1 ? '' : 's'}`,
-		text: items.map((item) => `${item.title}\n${item.body}\n${item.link ? `${origin}${item.link}` : ''}`).join('\n\n'),
-		html: `<div style="background:#0a0c0d;color:#ecebe5;padding:28px;font-family:Arial,sans-serif"><p style="color:#f6a821;font-size:12px;letter-spacing:2px">SHD DAILY INTELLIGENCE</p><h1>${items.length} notification${items.length === 1 ? '' : 's'}</h1>${rows}</div>`
-	});
-	const now = new Date().toISOString();
-	for (const item of items) await (await database.prepare('UPDATE notifications SET emailed_at=? WHERE id=? AND emailed_at IS NULL')).run(now, item.id);
-	sent += 1;
+		WHERE n.user_id=? AND n.emailed_at IS NULL AND n.created_at>=p.updated_at ORDER BY n.created_at LIMIT 100`)
+  ).all(recipient.user_id);
+  if (!items.length) continue;
+  const escape = (value) =>
+    String(value).replace(
+      /[&<>"']/g,
+      (character) =>
+        ({
+          '&': '&amp;',
+          '<': '&lt;',
+          '>': '&gt;',
+          '"': '&quot;',
+          "'": '&#39;',
+        })[character],
+    );
+  const rows = items
+    .map(
+      (item) =>
+        `<div style="border-top:1px solid #34393a;padding:16px 0"><strong>${escape(item.title)}</strong><p style="color:#a5aaab">${escape(item.body)}</p>${item.link ? `<a style="color:#f6a821" href="${origin}${item.link}">VIEW INTELLIGENCE</a>` : ''}</div>`,
+    )
+    .join('');
+  await transport.sendMail({
+    from: process.env.SMTP_FROM,
+    to: recipient.email,
+    subject: `SHD.build daily notification summary · ${items.length} update${items.length === 1 ? '' : 's'}`,
+    text: items
+      .map(
+        (item) =>
+          `${item.title}\n${item.body}\n${item.link ? `${origin}${item.link}` : ''}`,
+      )
+      .join('\n\n'),
+    html: `<div style="background:#0a0c0d;color:#ecebe5;padding:28px;font-family:Arial,sans-serif"><p style="color:#f6a821;font-size:12px;letter-spacing:2px">SHD DAILY INTELLIGENCE</p><h1>${items.length} notification${items.length === 1 ? '' : 's'}</h1>${rows}</div>`,
+  });
+  const now = new Date().toISOString();
+  for (const item of items)
+    await (
+      await database.prepare(
+        'UPDATE notifications SET emailed_at=? WHERE id=? AND emailed_at IS NULL',
+      )
+    ).run(now, item.id);
+  sent += 1;
 }
 console.log(`Sent ${sent} daily notification digest${sent === 1 ? '' : 's'}.`);

scripts/oversight-notification-dispatch.mjs

@@ -3,67 +3,100 @@ import nodemailer from 'nodemailer';
 import { randomUUID } from 'node:crypto';
 import { resolve } from 'node:path';
 
-const database = await connect(resolve(process.env.TDR_DATABASE_PATH || './data/shd-build.db'));
+const database = await connect(
+  resolve(process.env.TDR_DATABASE_PATH || './data/shd-build.db'),
+);
 const now = new Date().toISOString();
-const due = await (await database.prepare(`SELECT * FROM oversight_notification_queue
-	WHERE delivered_at IS NULL AND deliver_after<=? ORDER BY user_id,oversight_category,created_at`)).all(now);
+const due = await (
+  await database.prepare(`SELECT * FROM oversight_notification_queue
+	WHERE delivered_at IS NULL AND deliver_after<=? ORDER BY user_id,oversight_category,created_at`)
+).all(now);
 const groups = new Map();
 for (const item of due) {
-	const key = `${item.user_id}:${item.oversight_category}:${item.frequency}:${item.deliver_after}`;
-	if (!groups.has(key)) groups.set(key, []);
-	groups.get(key).push(item);
+  const key = `${item.user_id}:${item.oversight_category}:${item.frequency}:${item.deliver_after}`;
+  if (!groups.has(key)) groups.set(key, []);
+  groups.get(key).push(item);
 }
 
 const smtpConfigured = Boolean(process.env.SMTP_HOST && process.env.SMTP_FROM);
-const transport = smtpConfigured ? nodemailer.createTransport({
-	host: process.env.SMTP_HOST,
-	port: Number(process.env.SMTP_PORT || 587),
-	secure: process.env.SMTP_SECURE === 'true',
-	auth: process.env.SMTP_USER ? { user: process.env.SMTP_USER, pass: process.env.SMTP_PASSWORD } : undefined,
-	requireTLS: process.env.SMTP_SECURE !== 'true',
-	disableFileAccess: true,
-	disableUrlAccess: true
-}) : null;
-const origin = (process.env.APP_ORIGIN || 'http://localhost:5173').replace(/\/+$/, '');
+const transport = smtpConfigured
+  ? nodemailer.createTransport({
+      host: process.env.SMTP_HOST,
+      port: Number(process.env.SMTP_PORT || 587),
+      secure: process.env.SMTP_SECURE === 'true',
+      auth: process.env.SMTP_USER
+        ? { user: process.env.SMTP_USER, pass: process.env.SMTP_PASSWORD }
+        : undefined,
+      requireTLS: process.env.SMTP_SECURE !== 'true',
+      disableFileAccess: true,
+      disableUrlAccess: true,
+    })
+  : null;
+const origin = (process.env.APP_ORIGIN || 'http://localhost:5173').replace(
+  /\/+$/,
+  '',
+);
 let delivered = 0;
 
 for (const items of groups.values()) {
-	const first = items[0];
-	const categoryLabel = first.oversight_category === 'avatars' ? 'avatar' : 'data change';
-	const title = `${items.length} ${categoryLabel} review${items.length === 1 ? '' : 's'} awaiting Oversight`;
-	const details = items.slice(0, 10).map((item) => `• ${item.summary}`).join('\n');
-	const remainder = items.length > 10 ? `\n• ${items.length - 10} additional review items` : '';
-	const body = `${details}${remainder}`;
-	const notificationId = randomUUID();
-	await (await database.prepare(`INSERT INTO notifications
+  const first = items[0];
+  const categoryLabel =
+    first.oversight_category === 'avatars' ? 'avatar' : 'data change';
+  const title = `${items.length} ${categoryLabel} review${items.length === 1 ? '' : 's'} awaiting Oversight`;
+  const details = items
+    .slice(0, 10)
+    .map((item) => `• ${item.summary}`)
+    .join('\n');
+  const remainder =
+    items.length > 10 ? `\n• ${items.length - 10} additional review items` : '';
+  const body = `${details}${remainder}`;
+  const notificationId = randomUUID();
+  await (
+    await database.prepare(`INSERT INTO notifications
 		(id,user_id,category,source,title,body,link,mandatory,created_at)
-		VALUES(?,?,'isac','ISAC OVERSIGHT NETWORK',?,?,?,1,?)`)).run(
-		notificationId, first.user_id, title, body, first.link, now
-	);
-	for (const item of items) {
-		await (await database.prepare('UPDATE oversight_notification_queue SET delivered_at=? WHERE id=? AND delivered_at IS NULL')).run(now, item.id);
-	}
-	const preference = await (await database.prepare(
-		"SELECT email_frequency FROM notification_preferences WHERE user_id=? AND category='isac'"
-	)).get(first.user_id);
-	if (transport && preference?.email_frequency === 'immediate') {
-		const identity = await (await database.prepare('SELECT email FROM user_emails WHERE user_id=?')).get(first.user_id);
-		if (typeof identity?.email === 'string') {
-			try {
-				await transport.sendMail({
-					from: process.env.SMTP_FROM,
-					to: identity.email,
-					subject: `SHD.build · ${title}`,
-					text: `${body}\n\n${origin}${first.link}`,
-					html: `<div style="background:#0a0c0d;color:#ecebe5;padding:28px;font-family:Arial,sans-serif"><p style="color:#f6a821;font-size:12px;letter-spacing:2px">ISAC OVERSIGHT NETWORK</p><h1>${title}</h1><p style="white-space:pre-line;color:#a5aaab">${body}</p><a style="color:#f6a821" href="${origin}${first.link}">OPEN OVERSIGHT QUEUE</a></div>`
-				});
-				await (await database.prepare('UPDATE notifications SET emailed_at=? WHERE id=?')).run(now, notificationId);
-			} catch (error) {
-				console.error(`Unable to email Oversight digest ${notificationId}`, error);
-			}
-		}
-	}
-	delivered += items.length;
+		VALUES(?,?,'isac','ISAC OVERSIGHT NETWORK',?,?,?,1,?)`)
+  ).run(notificationId, first.user_id, title, body, first.link, now);
+  for (const item of items) {
+    await (
+      await database.prepare(
+        'UPDATE oversight_notification_queue SET delivered_at=? WHERE id=? AND delivered_at IS NULL',
+      )
+    ).run(now, item.id);
+  }
+  const preference = await (
+    await database.prepare(
+      "SELECT email_frequency FROM notification_preferences WHERE user_id=? AND category='isac'",
+    )
+  ).get(first.user_id);
+  if (transport && preference?.email_frequency === 'immediate') {
+    const identity = await (
+      await database.prepare('SELECT email FROM user_emails WHERE user_id=?')
+    ).get(first.user_id);
+    if (typeof identity?.email === 'string') {
+      try {
+        await transport.sendMail({
+          from: process.env.SMTP_FROM,
+          to: identity.email,
+          subject: `SHD.build · ${title}`,
+          text: `${body}\n\n${origin}${first.link}`,
+          html: `<div style="background:#0a0c0d;color:#ecebe5;padding:28px;font-family:Arial,sans-serif"><p style="color:#f6a821;font-size:12px;letter-spacing:2px">ISAC OVERSIGHT NETWORK</p><h1>${title}</h1><p style="white-space:pre-line;color:#a5aaab">${body}</p><a style="color:#f6a821" href="${origin}${first.link}">OPEN OVERSIGHT QUEUE</a></div>`,
+        });
+        await (
+          await database.prepare(
+            'UPDATE notifications SET emailed_at=? WHERE id=?',
+          )
+        ).run(now, notificationId);
+      } catch (error) {
+        console.error(
+          `Unable to email Oversight digest ${notificationId}`,
+          error,
+        );
+      }
+    }
+  }
+  delivered += items.length;
 }
 
-console.log(`Delivered ${delivered} queued Oversight review alert${delivered === 1 ? '' : 's'} in ${groups.size} digest${groups.size === 1 ? '' : 's'}.`);
+console.log(
+  `Delivered ${delivered} queued Oversight review alert${delivered === 1 ? '' : 's'} in ${groups.size} digest${groups.size === 1 ? '' : 's'}.`,
+);

scripts/prepare.mjs

@@ -0,0 +1,11 @@
+const omitted = new Set(
+  String(process.env.npm_config_omit ?? '')
+    .split(',')
+    .map((value) => value.trim())
+    .filter(Boolean),
+);
+
+if (!omitted.has('dev') && process.env.NODE_ENV !== 'production') {
+  const { default: husky } = await import('husky');
+  husky();
+}

scripts/render-brand-assets.mjs

@@ -6,35 +6,47 @@ import sharp from 'sharp';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const outputDirectory = path.join(root, 'static', 'brand');
-const fontDirectory = path.join(root, 'node_modules', '@fontsource', 'barlow', 'files');
-const heavy = opentype.parse(fs.readFileSync(path.join(fontDirectory, 'barlow-latin-900-normal.woff')).buffer);
-const medium = opentype.parse(fs.readFileSync(path.join(fontDirectory, 'barlow-latin-700-normal.woff')).buffer);
+const fontDirectory = path.join(
+  root,
+  'node_modules',
+  '@fontsource',
+  'barlow',
+  'files',
+);
+const heavy = opentype.parse(
+  fs.readFileSync(path.join(fontDirectory, 'barlow-latin-900-normal.woff'))
+    .buffer,
+);
+const medium = opentype.parse(
+  fs.readFileSync(path.join(fontDirectory, 'barlow-latin-700-normal.woff'))
+    .buffer,
+);
 
 fs.mkdirSync(outputDirectory, { recursive: true });
 
 const colors = {
-	background: '#0a0c0d',
-	surface: '#111415',
-	border: '#303536',
-	grid: '#2a3031',
-	orange: '#f6a821',
-	white: '#ecebe5'
+  background: '#0a0c0d',
+  surface: '#111415',
+  border: '#303536',
+  grid: '#2a3031',
+  orange: '#f6a821',
+  white: '#ecebe5',
 };
 
 function trackedPath(font, value, x, baseline, size, tracking = 0) {
-	let cursor = x;
-	let data = '';
-	for (const character of value) {
-		const glyph = font.charToGlyph(character);
-		data += glyph.getPath(cursor, baseline, size).toPathData(2);
-		cursor += glyph.advanceWidth * size / font.unitsPerEm + tracking;
-	}
-	return { data, width: cursor - x - tracking };
+  let cursor = x;
+  let data = '';
+  for (const character of value) {
+    const glyph = font.charToGlyph(character);
+    data += glyph.getPath(cursor, baseline, size).toPathData(2);
+    cursor += (glyph.advanceWidth * size) / font.unitsPerEm + tracking;
+  }
+  return { data, width: cursor - x - tracking };
 }
 
 function emblem(x, y, size) {
-	const scale = size / 100;
-	return `
+  const scale = size / 100;
+  return `
 		<g transform="translate(${x} ${y}) scale(${scale})">
 			<g fill="none" stroke="${colors.orange}" stroke-width="12" stroke-linecap="butt">
 				<path d="M73 20A38 38 0 0 0 15 63"/>
@@ -47,10 +59,10 @@ function emblem(x, y, size) {
 }
 
 async function writePng(svg, filename, width, height) {
-	await sharp(Buffer.from(svg))
-		.resize(width, height, { fit: 'fill' })
-		.png({ compressionLevel: 9, adaptiveFiltering: true })
-		.toFile(path.join(outputDirectory, filename));
+  await sharp(Buffer.from(svg))
+    .resize(width, height, { fit: 'fill' })
+    .png({ compressionLevel: 9, adaptiveFiltering: true })
+    .toFile(path.join(outputDirectory, filename));
 }
 
 const transparentLogo = `
@@ -154,10 +166,17 @@ const inviteSplash = `
 await writePng(transparentLogo, 'shd-core-segments.png', 1024, 1024);
 await writePng(serverIcon, 'shd-build-discord-icon.png', 1024, 1024);
 await writePng(banner, 'shd-build-discord-banner-1920x1080.png', 1920, 1080);
-await writePng(inviteSplash, 'shd-build-discord-invite-background-1920x1080.png', 1920, 1080);
-await sharp(path.join(outputDirectory, 'shd-build-discord-banner-1920x1080.png'))
-	.resize(960, 540)
-	.png({ compressionLevel: 9, adaptiveFiltering: true })
-	.toFile(path.join(outputDirectory, 'shd-build-discord-banner-960x540.png'));
+await writePng(
+  inviteSplash,
+  'shd-build-discord-invite-background-1920x1080.png',
+  1920,
+  1080,
+);
+await sharp(
+  path.join(outputDirectory, 'shd-build-discord-banner-1920x1080.png'),
+)
+  .resize(960, 540)
+  .png({ compressionLevel: 9, adaptiveFiltering: true })
+  .toFile(path.join(outputDirectory, 'shd-build-discord-banner-960x540.png'));
 
 console.log(`Rendered brand assets to ${outputDirectory}`);

scripts/runtime-environment.js

@@ -0,0 +1,232 @@
+/** @typedef {'app' | 'scheduler'} RuntimeMode */
+/** @typedef {Record<string, string | undefined>} RuntimeEnvironment */
+
+const APP_REQUIRED = [
+  'APP_ORIGIN',
+  'ORIGIN',
+  'PASSKEY_RP_ID',
+  'SCHEDULER_TOKEN',
+  'TDR_DATABASE_PATH',
+  'TDR_AVATAR_STORAGE_PATH',
+  'TDR_GAME_ICON_STORAGE_PATH',
+];
+
+/**
+ * Validate environment variables after the runtime secret provider has injected them.
+ *
+ * @param {RuntimeMode} mode
+ * @param {RuntimeEnvironment} environment
+ * @returns {string[]}
+ */
+export function validateRuntimeEnvironment(mode, environment) {
+  if (mode !== 'app' && mode !== 'scheduler') {
+    throw new TypeError(`Unsupported runtime mode: ${mode}`);
+  }
+
+  const errors = [];
+  const get = (name) => environment[name]?.trim() ?? '';
+  const requireValues = (names) => {
+    for (const name of names) {
+      if (!get(name)) errors.push(`${name} is required.`);
+    }
+  };
+
+  if (mode === 'scheduler') {
+    requireValues(['SCHEDULER_URL', 'SCHEDULER_TOKEN']);
+    validateHttpUrl('SCHEDULER_URL', get('SCHEDULER_URL'), errors);
+    if (
+      get('SCHEDULER_URL') &&
+      get('SCHEDULER_URL') !== 'http://app:3000/api/internal/scheduler'
+    ) {
+      errors.push(
+        'SCHEDULER_URL must use the internal app scheduler endpoint.',
+      );
+    }
+    validateSchedulerToken(get('SCHEDULER_TOKEN'), errors);
+    return errors;
+  }
+
+  requireValues(APP_REQUIRED);
+  validateSchedulerToken(get('SCHEDULER_TOKEN'), errors);
+
+  const appOrigin = validateOrigin('APP_ORIGIN', get('APP_ORIGIN'), errors);
+  const adapterOrigin = validateOrigin('ORIGIN', get('ORIGIN'), errors);
+  if (
+    appOrigin &&
+    adapterOrigin &&
+    appOrigin.hostname !== adapterOrigin.hostname
+  ) {
+    errors.push('APP_ORIGIN and ORIGIN must use the same hostname.');
+  }
+
+  const rpId = get('PASSKEY_RP_ID').toLowerCase();
+  if (rpId && !isHostname(rpId)) {
+    errors.push('PASSKEY_RP_ID must be a hostname.');
+  } else if (
+    appOrigin &&
+    rpId &&
+    appOrigin.hostname !== rpId &&
+    !appOrigin.hostname.endsWith(`.${rpId}`)
+  ) {
+    errors.push(
+      'PASSKEY_RP_ID must equal APP_ORIGIN hostname or be its registrable parent domain.',
+    );
+  }
+
+  requirePair(
+    'DISCORD_CLIENT_ID',
+    get('DISCORD_CLIENT_ID'),
+    'DISCORD_CLIENT_SECRET',
+    get('DISCORD_CLIENT_SECRET'),
+    errors,
+  );
+  requirePair(
+    'TURNSTILE_SITE_KEY',
+    get('TURNSTILE_SITE_KEY'),
+    'TURNSTILE_SECRET_KEY',
+    get('TURNSTILE_SECRET_KEY'),
+    errors,
+  );
+
+  const smtpEnabled = [
+    'SMTP_HOST',
+    'SMTP_FROM',
+    'SMTP_USER',
+    'SMTP_PASSWORD',
+  ].some((name) => Boolean(get(name)));
+  if (smtpEnabled) {
+    requirePair(
+      'SMTP_HOST',
+      get('SMTP_HOST'),
+      'SMTP_FROM',
+      get('SMTP_FROM'),
+      errors,
+    );
+    requirePair(
+      'SMTP_USER',
+      get('SMTP_USER'),
+      'SMTP_PASSWORD',
+      get('SMTP_PASSWORD'),
+      errors,
+    );
+  }
+
+  const smtpPort = get('SMTP_PORT');
+  if (
+    smtpPort &&
+    (!/^\d+$/.test(smtpPort) ||
+      Number(smtpPort) < 1 ||
+      Number(smtpPort) > 65535)
+  ) {
+    errors.push('SMTP_PORT must be an integer from 1 through 65535.');
+  }
+
+  const smtpSecure = get('SMTP_SECURE');
+  if (smtpSecure && !['true', 'false'].includes(smtpSecure)) {
+    errors.push('SMTP_SECURE must be true or false.');
+  }
+
+  const discordRedirect = validateHttpUrl(
+    'DISCORD_REDIRECT_URI',
+    get('DISCORD_REDIRECT_URI'),
+    errors,
+  );
+  if (
+    appOrigin &&
+    discordRedirect &&
+    (discordRedirect.hostname !== appOrigin.hostname ||
+      discordRedirect.pathname !== '/auth/discord/callback')
+  ) {
+    errors.push(
+      'DISCORD_REDIRECT_URI must use APP_ORIGIN hostname and /auth/discord/callback.',
+    );
+  }
+
+  for (const name of [
+    'TDR_DATABASE_PATH',
+    'TDR_AVATAR_STORAGE_PATH',
+    'TDR_GAME_ICON_STORAGE_PATH',
+  ]) {
+    if (get(name) && !get(name).startsWith('/')) {
+      errors.push(`${name} must be an absolute hosted path.`);
+    }
+  }
+
+  return errors;
+}
+
+/**
+ * @param {string} firstName
+ * @param {string} firstValue
+ * @param {string} secondName
+ * @param {string} secondValue
+ * @param {string[]} errors
+ */
+function requirePair(firstName, firstValue, secondName, secondValue, errors) {
+  if (Boolean(firstValue) !== Boolean(secondValue)) {
+    errors.push(`${firstName} and ${secondName} must be configured together.`);
+  }
+}
+
+/**
+ * @param {string} name
+ * @param {string} value
+ * @param {string[]} errors
+ * @returns {URL | undefined}
+ */
+function validateHttpUrl(name, value, errors) {
+  if (!value) return undefined;
+  try {
+    const url = new URL(value);
+    if (!['http:', 'https:'].includes(url.protocol) || !url.hostname) {
+      throw new TypeError('not an HTTP URL');
+    }
+    return url;
+  } catch {
+    errors.push(`${name} must be a valid HTTP or HTTPS URL.`);
+    return undefined;
+  }
+}
+
+/**
+ * @param {string} name
+ * @param {string} value
+ * @param {string[]} errors
+ * @returns {URL | undefined}
+ */
+function validateOrigin(name, value, errors) {
+  const url = validateHttpUrl(name, value, errors);
+  if (!url) return undefined;
+  if (
+    url.username ||
+    url.password ||
+    url.pathname !== '/' ||
+    url.search ||
+    url.hash
+  ) {
+    errors.push(`${name} must contain only a URL origin.`);
+    return undefined;
+  }
+  return url;
+}
+
+/** @param {string} value */
+function isHostname(value) {
+  if (value === 'localhost') return true;
+  if (value.length > 253 || !value.includes('.')) return false;
+  return value
+    .split('.')
+    .every(
+      (label) =>
+        label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label),
+    );
+}
+
+/** @param {string} value @param {string[]} errors */
+function validateSchedulerToken(value, errors) {
+  if (value && (value.length < 32 || /\s/.test(value))) {
+    errors.push(
+      'SCHEDULER_TOKEN must contain at least 32 non-whitespace characters.',
+    );
+  }
+}

scripts/runtime-environment.test.ts

@@ -0,0 +1,161 @@
+import { describe, expect, it } from 'vitest';
+import { validateRuntimeEnvironment } from './runtime-environment.js';
+
+const validAppEnvironment = {
+  APP_ORIGIN: 'https://stage.shd.build',
+  ORIGIN: 'https://stage.shd.build',
+  PASSKEY_RP_ID: 'shd.build',
+  SCHEDULER_TOKEN: 'scheduler-secret-with-32-characters',
+  TDR_DATABASE_PATH: '/app/data/shd-build-staging.db',
+  TDR_AVATAR_STORAGE_PATH: '/app/data/avatars',
+  TDR_GAME_ICON_STORAGE_PATH: '/app/data/game-icons',
+};
+
+describe('validateRuntimeEnvironment', () => {
+  it('accepts the hosted app contract without optional providers', () => {
+    expect(validateRuntimeEnvironment('app', validAppEnvironment)).toEqual([]);
+  });
+
+  it('reports every missing required app value', () => {
+    expect(validateRuntimeEnvironment('app', {})).toEqual([
+      'APP_ORIGIN is required.',
+      'ORIGIN is required.',
+      'PASSKEY_RP_ID is required.',
+      'SCHEDULER_TOKEN is required.',
+      'TDR_DATABASE_PATH is required.',
+      'TDR_AVATAR_STORAGE_PATH is required.',
+      'TDR_GAME_ICON_STORAGE_PATH is required.',
+    ]);
+  });
+
+  it('validates canonical origins and passkey hostname scope', () => {
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        APP_ORIGIN: 'https://stage.shd.build/sign-in',
+      }),
+    ).toContain('APP_ORIGIN must contain only a URL origin.');
+
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        PASSKEY_RP_ID: 'example.com',
+      }),
+    ).toContain(
+      'PASSKEY_RP_ID must equal APP_ORIGIN hostname or be its registrable parent domain.',
+    );
+  });
+
+  it('rejects mismatched app and adapter hostnames', () => {
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        ORIGIN: 'https://other.shd.build',
+      }),
+    ).toContain('APP_ORIGIN and ORIGIN must use the same hostname.');
+  });
+
+  it('requires optional integration credentials only as pairs', () => {
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        DISCORD_CLIENT_ID: 'client-id',
+        TURNSTILE_SECRET_KEY: 'secret',
+      }),
+    ).toEqual([
+      'DISCORD_CLIENT_ID and DISCORD_CLIENT_SECRET must be configured together.',
+      'TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY must be configured together.',
+    ]);
+  });
+
+  it('allows SMTP defaults without enabling email and validates enabled SMTP', () => {
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        SMTP_PORT: '587',
+        SMTP_SECURE: 'false',
+      }),
+    ).toEqual([]);
+
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        SMTP_HOST: 'smtp.example.com',
+        SMTP_USER: 'agent',
+        SMTP_PORT: '70000',
+      }),
+    ).toEqual([
+      'SMTP_HOST and SMTP_FROM must be configured together.',
+      'SMTP_USER and SMTP_PASSWORD must be configured together.',
+      'SMTP_PORT must be an integer from 1 through 65535.',
+    ]);
+  });
+
+  it('validates optional redirect URLs when supplied', () => {
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        DISCORD_REDIRECT_URI: 'ftp://stage.shd.build/callback',
+      }),
+    ).toContain('DISCORD_REDIRECT_URI must be a valid HTTP or HTTPS URL.');
+
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        DISCORD_REDIRECT_URI: 'https://dev.shd.build/auth/discord/callback',
+      }),
+    ).toContain(
+      'DISCORD_REDIRECT_URI must use APP_ORIGIN hostname and /auth/discord/callback.',
+    );
+  });
+
+  it('validates hosted paths and SMTP TLS configuration', () => {
+    expect(
+      validateRuntimeEnvironment('app', {
+        ...validAppEnvironment,
+        SMTP_SECURE: 'yes',
+        TDR_DATABASE_PATH: './data/staging.db',
+      }),
+    ).toEqual([
+      'SMTP_SECURE must be true or false.',
+      'TDR_DATABASE_PATH must be an absolute hosted path.',
+    ]);
+  });
+
+  it('accepts a configured scheduler and rejects missing or invalid values', () => {
+    expect(
+      validateRuntimeEnvironment('scheduler', {
+        SCHEDULER_URL: 'http://app:3000/api/internal/scheduler',
+        SCHEDULER_TOKEN: 'scheduler-secret-with-32-characters',
+      }),
+    ).toEqual([]);
+
+    expect(
+      validateRuntimeEnvironment('scheduler', {
+        SCHEDULER_URL: 'not a URL',
+      }),
+    ).toEqual([
+      'SCHEDULER_TOKEN is required.',
+      'SCHEDULER_URL must be a valid HTTP or HTTPS URL.',
+      'SCHEDULER_URL must use the internal app scheduler endpoint.',
+    ]);
+  });
+
+  it('requires a strong scheduler token and fixed internal endpoint', () => {
+    expect(
+      validateRuntimeEnvironment('scheduler', {
+        SCHEDULER_URL: 'https://example.com/api/internal/scheduler',
+        SCHEDULER_TOKEN: 'too-short',
+      }),
+    ).toEqual([
+      'SCHEDULER_URL must use the internal app scheduler endpoint.',
+      'SCHEDULER_TOKEN must contain at least 32 non-whitespace characters.',
+    ]);
+  });
+
+  it('rejects unsupported runtime modes', () => {
+    expect(() =>
+      validateRuntimeEnvironment('worker' as 'app', validAppEnvironment),
+    ).toThrow('Unsupported runtime mode: worker');
+  });
+});

scripts/runtime-launcher.mjs

@@ -0,0 +1,252 @@
+#!/usr/bin/env node
+
+import { spawn } from 'node:child_process';
+import { readFile, unlink } from 'node:fs/promises';
+import process from 'node:process';
+import { validateRuntimeEnvironment } from './runtime-environment.js';
+
+const APP_SECRET_NAMES = new Set([
+  'APP_ORIGIN',
+  'DISCORD_CLIENT_ID',
+  'DISCORD_CLIENT_SECRET',
+  'DISCORD_REDIRECT_URI',
+  'OPENAI_MECHANIC_API_KEY',
+  'OPENAI_MECHANIC_MODEL',
+  'OPENAI_MECHANIC_REASONING_EFFORT',
+  'OPENAI_MODERATION_API_KEY',
+  'MFA_TOTP_ENCRYPTION_KEYS',
+  'ORIGIN',
+  'PASSKEY_RP_ID',
+  'REMOVE_BG_API_KEY',
+  'REMOVE_BG_CREDIT_CHECK_HOURS',
+  'REMOVE_BG_LOW_CREDIT_THRESHOLD',
+  'REMOVE_BG_LOW_FREE_CALL_THRESHOLD',
+  'SMTP_FROM',
+  'SMTP_HOST',
+  'SMTP_PASSWORD',
+  'SMTP_PORT',
+  'SMTP_SECURE',
+  'SMTP_USER',
+  'TDR_AVATAR_STORAGE_PATH',
+  'TDR_DATABASE_PATH',
+  'TDR_GAME_ICON_STORAGE_PATH',
+  'TURNSTILE_SECRET_KEY',
+  'TURNSTILE_SITE_KEY',
+]);
+const SHARED_SECRET_NAMES = new Set(['SCHEDULER_TOKEN']);
+const REMOVED_ENVIRONMENT_NAMES = [
+  'BASH_ENV',
+  'CDPATH',
+  'ENV',
+  'IFS',
+  'INFISICAL_ENVIRONMENT',
+  'INFISICAL_PROJECT_ID',
+  'INFISICAL_RUNTIME_SCOPE',
+  'INFISICAL_TOKEN',
+  'INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN',
+  'INFISICAL_UNIVERSAL_AUTH_CLIENT_ID',
+  'INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE',
+  'INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET',
+  'INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE',
+  'LD_LIBRARY_PATH',
+  'LD_PRELOAD',
+  'NODE_OPTIONS',
+  'NODE_PATH',
+  'PYTHONPATH',
+  'TOKEN',
+];
+
+const [runtimeScope, environment, buildNumber = '0', commitSha = '', ...rest] =
+  process.argv.slice(2);
+const separatorIndex = rest.indexOf('--');
+if (
+  !['app', 'scheduler'].includes(runtimeScope) ||
+  !['staging', 'prod'].includes(environment) ||
+  separatorIndex < 1
+) {
+  console.error(
+    'Usage: runtime-launcher.mjs <app|scheduler> <staging|prod> <build> <sha> <secret-files...> -- <command...>',
+  );
+  process.exit(2);
+}
+
+const secretFiles = rest.slice(0, separatorIndex);
+const requestedCommand = rest.slice(separatorIndex + 1);
+if (requestedCommand.length === 0) {
+  console.error('A runtime command is required.');
+  process.exit(2);
+}
+
+const expectedFileCount = runtimeScope === 'app' ? 2 : 1;
+if (secretFiles.length !== expectedFileCount) {
+  console.error(
+    `${runtimeScope} requires ${expectedFileCount} secret export file(s).`,
+  );
+  process.exit(2);
+}
+
+const secrets = {};
+try {
+  await loadSecretFile(
+    secretFiles[0],
+    runtimeScope === 'app' ? APP_SECRET_NAMES : SHARED_SECRET_NAMES,
+    secrets,
+  );
+  if (runtimeScope === 'app') {
+    await loadSecretFile(secretFiles[1], SHARED_SECRET_NAMES, secrets);
+  }
+} finally {
+  const deletionResults = await Promise.allSettled(
+    secretFiles.map((file) => unlink(file)),
+  );
+  const undeletedFiles = secretFiles.filter(
+    (_, index) => deletionResults[index].status === 'rejected',
+  );
+  if (undeletedFiles.length > 0) {
+    throw new Error(
+      `Failed to delete Infisical secret export: ${undeletedFiles.join(', ')}`,
+    );
+  }
+}
+
+const childEnvironment = { ...process.env, ...secrets };
+for (const name of REMOVED_ENVIRONMENT_NAMES) delete childEnvironment[name];
+Object.assign(
+  childEnvironment,
+  trustedRuntimeEnvironment(runtimeScope, environment, buildNumber, commitSha),
+);
+
+const errors = validateRuntimeEnvironment(runtimeScope, childEnvironment);
+if (errors.length > 0) {
+  console.error(
+    `Invalid ${runtimeScope} runtime environment:\n${errors.map((error) => `- ${error}`).join('\n')}`,
+  );
+  process.exit(1);
+}
+
+process.umask(0o007);
+
+if (requestedCommand[0] === 'serve') {
+  await runAsNode(['node', 'scripts/db-migrate.mjs'], childEnvironment);
+  await runAsNode(['node', 'build'], childEnvironment);
+} else if (requestedCommand[0] === 'scheduler') {
+  await runAsNode(['node', 'scripts/scheduler-client.mjs'], childEnvironment);
+} else {
+  await runAsNode(requestedCommand, childEnvironment);
+}
+
+async function loadSecretFile(file, allowedNames, target) {
+  let entries;
+  try {
+    entries = JSON.parse(await readFile(file, 'utf8'));
+  } catch {
+    throw new Error('Infisical returned an unreadable secret export.');
+  }
+  if (!Array.isArray(entries)) {
+    throw new Error('Infisical secret export must be an array.');
+  }
+  for (const entry of entries) {
+    const name = entry?.key;
+    const value = entry?.value;
+    if (typeof name !== 'string' || typeof value !== 'string') {
+      throw new Error('Infisical secret export contains an invalid entry.');
+    }
+    if (!allowedNames.has(name)) {
+      throw new Error(
+        `Infisical secret ${name} is not allowed in this runtime scope.`,
+      );
+    }
+    if (Object.hasOwn(target, name)) {
+      throw new Error(`Infisical secret ${name} was exported more than once.`);
+    }
+    target[name] = value;
+  }
+}
+
+function trustedRuntimeEnvironment(
+  scope,
+  targetEnvironment,
+  release,
+  revision,
+) {
+  const common = {
+    BODY_SIZE_LIMIT: '6M',
+    HOST: '0.0.0.0',
+    NODE_ENV: 'production',
+    PORT: '3000',
+    SHD_BUILD_NUMBER: release,
+    SHD_COMMIT_SHA: revision,
+  };
+  if (scope === 'scheduler') {
+    return {
+      ...common,
+      SCHEDULER_URL: 'http://app:3000/api/internal/scheduler',
+    };
+  }
+  if (targetEnvironment === 'staging') {
+    return {
+      ...common,
+      APP_ORIGIN: 'https://stage.shd.build',
+      DISCORD_REDIRECT_URI: 'https://stage.shd.build/auth/discord/callback',
+      ORIGIN: 'https://stage.shd.build',
+      PASSKEY_RP_ID: 'shd.build',
+      SKIP_DEFAULT_USERS: 'true',
+      TDR_AVATAR_STORAGE_PATH: '/app/data/avatars',
+      TDR_DATABASE_PATH: '/app/data/shd-build-staging.db',
+      TDR_GAME_ICON_STORAGE_PATH: '/app/data/game-icons',
+      UBISOFT_NEWS_IMPORT_ENABLED: 'false',
+    };
+  }
+  return {
+    ...common,
+    APP_ORIGIN: 'https://shd.build',
+    DISCORD_REDIRECT_URI: 'https://shd.build/auth/discord/callback',
+    ORIGIN: 'https://shd.build',
+    PASSKEY_RP_ID: 'shd.build',
+    SKIP_DEFAULT_USERS: 'true',
+    TDR_AVATAR_STORAGE_PATH: '/app/data/avatars',
+    TDR_DATABASE_PATH: '/app/data/shd-build-production.db',
+    TDR_GAME_ICON_STORAGE_PATH: '/app/data/game-icons',
+    UBISOFT_NEWS_IMPORT_ENABLED: 'true',
+  };
+}
+
+function runAsNode(command, environmentVariables) {
+  const usesPrivilegeDrop =
+    typeof process.getuid === 'function' && process.getuid() === 0;
+  const executable = usesPrivilegeDrop ? 'gosu' : command[0];
+  const args = usesPrivilegeDrop
+    ? ['shd-runtime', ...command]
+    : command.slice(1);
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, args, {
+      env: environmentVariables,
+      stdio: 'inherit',
+    });
+    const signalHandlers = new Map();
+    for (const signal of ['SIGHUP', 'SIGINT', 'SIGTERM']) {
+      const handler = () => child.kill(signal);
+      signalHandlers.set(signal, handler);
+      process.once(signal, handler);
+    }
+    const cleanup = () => {
+      for (const [signal, handler] of signalHandlers) {
+        process.off(signal, handler);
+      }
+    };
+    child.once('error', (error) => {
+      cleanup();
+      reject(error);
+    });
+    child.once('exit', (code, signal) => {
+      cleanup();
+      if (signal) {
+        process.kill(process.pid, signal);
+      } else if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`Runtime command exited with status ${code ?? 1}.`));
+      }
+    });
+  });
+}

scripts/scheduler-client.mjs

@@ -1,17 +1,19 @@
 const endpoint = process.env.SCHEDULER_URL;
 const token = process.env.SCHEDULER_TOKEN;
-if (!endpoint || !token) throw new Error('SCHEDULER_URL and SCHEDULER_TOKEN are required.');
+if (!endpoint || !token)
+  throw new Error('SCHEDULER_URL and SCHEDULER_TOKEN are required.');
 
 while (true) {
-	try {
-		const response = await fetch(endpoint, {
-			method: 'POST',
-			headers: { authorization: `Bearer ${token}` }
-		});
-		if (!response.ok) throw new Error(`Scheduler endpoint returned HTTP ${response.status}.`);
-		console.log(`Scheduler tick: ${JSON.stringify(await response.json())}`);
-	} catch (error) {
-		console.error('Scheduler tick failed', error);
-	}
-	await new Promise((resolve) => setTimeout(resolve, 60_000));
+  try {
+    const response = await fetch(endpoint, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${token}` },
+    });
+    if (!response.ok)
+      throw new Error(`Scheduler endpoint returned HTTP ${response.status}.`);
+    console.log(`Scheduler tick: ${JSON.stringify(await response.json())}`);
+  } catch (error) {
+    console.error('Scheduler tick failed', error);
+  }
+  await new Promise((resolve) => setTimeout(resolve, 60_000));
 }

scripts/seed-initial-users.mjs

@@ -3,7 +3,9 @@ import { resolve } from 'node:path';
 import process from 'node:process';
 import { initializeDefaultUsers } from './default-users.mjs';
 
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || './data/shd-build-development.db');
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-development.db',
+);
 const database = await connect(databasePath);
 const resetPasswords = process.argv.includes('--reset-passwords');
 

scripts/seed-test-notifications.mjs

@@ -3,22 +3,63 @@ import { randomUUID } from 'node:crypto';
 import { resolve } from 'node:path';
 
 const targetName = process.argv[2] || 'Aewyn';
-const database = await connect(resolve(process.env.TDR_DATABASE_PATH || './data/shd-build.db'));
-const user = await (await database.prepare(`SELECT users.id,COALESCE(user_profiles.display_name,users.username) AS display_name
+const database = await connect(
+  resolve(process.env.TDR_DATABASE_PATH || './data/shd-build.db'),
+);
+const user = await (
+  await database.prepare(`SELECT users.id,COALESCE(user_profiles.display_name,users.username) AS display_name
 	FROM users LEFT JOIN user_profiles ON user_profiles.user_id=users.id
 	WHERE users.login_username=? COLLATE NOCASE OR users.username=? COLLATE NOCASE OR user_profiles.display_name=? COLLATE NOCASE
-	LIMIT 1`)).get(targetName, targetName, targetName);
+	LIMIT 1`)
+).get(targetName, targetName, targetName);
 if (!user) throw new Error(`No user matched ${targetName}.`);
 const now = Date.now();
 const samples = [
-	['isac', 'ISAC AVATAR OVERSIGHT', '[TEST] Custom avatar removed', 'Your custom avatar did not meet SHD.build image requirements and was removed. Oversight reason: The image contained unrelated promotional text.', '/account#avatar', 1],
-	['contributions', 'ISAC DATA OVERSIGHT', '[TEST] Contribution approved', 'Quick Draw brand-set data was approved and deployed to the live builder registry.', '/isac/brands', 1],
-	['contributions', 'ISAC DATA OVERSIGHT', '[TEST] Contribution needs revision', 'A talent update was not approved. Oversight reason: Tier II effect value does not match the supplied game evidence.', '/isac/talents', 1],
-	['comments', 'SHD COMMUNITY', '[TEST] New comment on your build', 'An agent commented on “First Wave Vector Critical Build”: This setup worked really well in Legendary missions.', '/builds', 0]
+  [
+    'isac',
+    'ISAC AVATAR OVERSIGHT',
+    '[TEST] Custom avatar removed',
+    'Your custom avatar did not meet SHD.build image requirements and was removed. Oversight reason: The image contained unrelated promotional text.',
+    '/account#avatar',
+    1,
+  ],
+  [
+    'contributions',
+    'ISAC DATA OVERSIGHT',
+    '[TEST] Contribution approved',
+    'Quick Draw brand-set data was approved and deployed to the live builder registry.',
+    '/isac/brands',
+    1,
+  ],
+  [
+    'contributions',
+    'ISAC DATA OVERSIGHT',
+    '[TEST] Contribution needs revision',
+    'A talent update was not approved. Oversight reason: Tier II effect value does not match the supplied game evidence.',
+    '/isac/talents',
+    1,
+  ],
+  [
+    'comments',
+    'SHD COMMUNITY',
+    '[TEST] New comment on your build',
+    'An agent commented on “First Wave Vector Critical Build”: This setup worked really well in Legendary missions.',
+    '/builds',
+    0,
+  ],
 ];
 for (const [index, sample] of samples.entries()) {
-	await (await database.prepare(`INSERT INTO notifications
+  await (
+    await database.prepare(`INSERT INTO notifications
 		(id,user_id,category,source,title,body,link,mandatory,created_at)
-		VALUES(?,?,?,?,?,?,?,?,?)`)).run(randomUUID(), user.id, ...sample, new Date(now - index * 60_000).toISOString());
+		VALUES(?,?,?,?,?,?,?,?,?)`)
+  ).run(
+    randomUUID(),
+    user.id,
+    ...sample,
+    new Date(now - index * 60_000).toISOString(),
+  );
 }
-console.log(`Added ${samples.length} test notifications for ${user.display_name}.`);
+console.log(
+  `Added ${samples.length} test notifications for ${user.display_name}.`,
+);

scripts/stage-bootstrap-export.mjs

@@ -4,51 +4,74 @@ import { dirname, join, resolve } from 'node:path';
 import process from 'node:process';
 
 const outputArgument = process.argv[2];
-const timestamp = new Date().toISOString().replaceAll(':', '-').replace(/\.\d{3}Z$/, 'Z');
-const outputPath = resolve(outputArgument || `./data/backups/shd-stage-bootstrap-${timestamp}.json`);
+const timestamp = new Date()
+  .toISOString()
+  .replaceAll(':', '-')
+  .replace(/\.\d{3}Z$/, 'Z');
+const outputPath = resolve(
+  outputArgument || `./data/backups/shd-stage-bootstrap-${timestamp}.json`,
+);
 const temporaryBackupPath = `${outputPath}.database.json`;
-const databaseBackup = spawnSync(process.execPath, ['scripts/db-backup.mjs', temporaryBackupPath], {
-	cwd: process.cwd(),
-	stdio: 'inherit',
-	env: process.env
-});
+const databaseBackup = spawnSync(
+  process.execPath,
+  ['scripts/db-backup.mjs', temporaryBackupPath],
+  {
+    cwd: process.cwd(),
+    stdio: 'inherit',
+    env: process.env,
+  },
+);
 if (databaseBackup.error) throw databaseBackup.error;
-if (databaseBackup.status !== 0) throw new Error('Database backup failed; no staging bootstrap bundle was created.');
+if (databaseBackup.status !== 0)
+  throw new Error(
+    'Database backup failed; no staging bootstrap bundle was created.',
+  );
 
 async function collectFiles(directory, pattern) {
-	try {
-		const names = (await readdir(directory)).filter((name) => pattern.test(name)).sort();
-		return await Promise.all(names.map(async (name) => ({
-			name,
-			contentBase64: (await readFile(join(directory, name))).toString('base64')
-		})));
-	} catch (error) {
-		if (error?.code === 'ENOENT') return [];
-		throw error;
-	}
+  try {
+    const names = (await readdir(directory))
+      .filter((name) => pattern.test(name))
+      .sort();
+    return await Promise.all(
+      names.map(async (name) => ({
+        name,
+        contentBase64: (await readFile(join(directory, name))).toString(
+          'base64',
+        ),
+      })),
+    );
+  } catch (error) {
+    if (error?.code === 'ENOENT') return [];
+    throw error;
+  }
 }
 
 try {
-	const database = JSON.parse(await readFile(temporaryBackupPath, 'utf8'));
-	const avatars = await collectFiles(
-		resolve(process.env.TDR_AVATAR_STORAGE_PATH || './data/avatars'),
-		/^[0-9a-f-]{36}\.webp$/i
-	);
-	const gameIcons = await collectFiles(
-		resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons'),
-		/^[a-z_]+-[0-9a-f-]{36}\.webp$/i
-	);
-	const bundle = {
-		format: 'shd-build-stage-bootstrap',
-		version: 1,
-		createdAt: new Date().toISOString(),
-		database,
-		files: { avatars, gameIcons }
-	};
-	await mkdir(dirname(outputPath), { recursive: true });
-	await writeFile(outputPath, `${JSON.stringify(bundle, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
-	console.log(`Staging bootstrap bundle includes ${avatars.length} avatars and ${gameIcons.length} game-data icons.`);
-	console.log(`Bootstrap bundle: ${outputPath}`);
+  const database = JSON.parse(await readFile(temporaryBackupPath, 'utf8'));
+  const avatars = await collectFiles(
+    resolve(process.env.TDR_AVATAR_STORAGE_PATH || './data/avatars'),
+    /^[0-9a-f-]{36}\.webp$/i,
+  );
+  const gameIcons = await collectFiles(
+    resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons'),
+    /^[a-z_]+-[0-9a-f-]{36}\.webp$/i,
+  );
+  const bundle = {
+    format: 'shd-build-stage-bootstrap',
+    version: 1,
+    createdAt: new Date().toISOString(),
+    database,
+    files: { avatars, gameIcons },
+  };
+  await mkdir(dirname(outputPath), { recursive: true });
+  await writeFile(outputPath, `${JSON.stringify(bundle, null, 2)}\n`, {
+    encoding: 'utf8',
+    flag: 'wx',
+  });
+  console.log(
+    `Staging bootstrap bundle includes ${avatars.length} avatars and ${gameIcons.length} game-data icons.`,
+  );
+  console.log(`Bootstrap bundle: ${outputPath}`);
 } finally {
-	await rm(temporaryBackupPath, { force: true });
+  await rm(temporaryBackupPath, { force: true });
 }

scripts/stage-bootstrap-import.mjs

@@ -4,106 +4,165 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import process from 'node:process';
 
-const bundleArgument = process.argv.slice(2).find((argument) => !argument.startsWith('--'));
-if (!bundleArgument || !process.argv.includes('--confirm-empty-staging-replace')
-	|| process.env.ALLOW_STAGING_BOOTSTRAP !== 'true') {
-	console.error('Staging bootstrap requires ALLOW_STAGING_BOOTSTRAP=true and:');
-	console.error('node scripts/stage-bootstrap-import.mjs <bundle.json> --confirm-empty-staging-replace');
-	process.exit(2);
+const bundleArgument = process.argv
+  .slice(2)
+  .find((argument) => !argument.startsWith('--'));
+if (
+  !bundleArgument ||
+  !process.argv.includes('--confirm-empty-staging-replace') ||
+  process.env.ALLOW_STAGING_BOOTSTRAP !== 'true'
+) {
+  console.error('Staging bootstrap requires ALLOW_STAGING_BOOTSTRAP=true and:');
+  console.error(
+    'node scripts/stage-bootstrap-import.mjs <bundle.json> --confirm-empty-staging-replace',
+  );
+  process.exit(2);
 }
 
 const bundlePath = resolve(bundleArgument);
 const bundle = JSON.parse(await readFile(bundlePath, 'utf8'));
-if (bundle?.format !== 'shd-build-stage-bootstrap' || bundle?.version !== 1
-	|| bundle.database?.format !== 'shd-build-database-backup' || bundle.database?.version !== 1
-	|| !Array.isArray(bundle.database.tables) || !Array.isArray(bundle.files?.avatars)
-	|| !Array.isArray(bundle.files?.gameIcons)) {
-	throw new Error('The selected file is not a supported SHD.build staging bootstrap bundle.');
+if (
+  bundle?.format !== 'shd-build-stage-bootstrap' ||
+  bundle?.version !== 1 ||
+  bundle.database?.format !== 'shd-build-database-backup' ||
+  bundle.database?.version !== 1 ||
+  !Array.isArray(bundle.database.tables) ||
+  !Array.isArray(bundle.files?.avatars) ||
+  !Array.isArray(bundle.files?.gameIcons)
+) {
+  throw new Error(
+    'The selected file is not a supported SHD.build staging bootstrap bundle.',
+  );
 }
 for (const file of bundle.files.avatars) {
-	if (typeof file.name !== 'string' || !/^[0-9a-f-]{36}\.webp$/i.test(file.name) || typeof file.contentBase64 !== 'string') {
-		throw new Error('The bootstrap bundle contains an invalid avatar file.');
-	}
+  if (
+    typeof file.name !== 'string' ||
+    !/^[0-9a-f-]{36}\.webp$/i.test(file.name) ||
+    typeof file.contentBase64 !== 'string'
+  ) {
+    throw new Error('The bootstrap bundle contains an invalid avatar file.');
+  }
 }
 for (const file of bundle.files.gameIcons) {
-	if (typeof file.name !== 'string' || !/^[a-z_]+-[0-9a-f-]{36}\.webp$/i.test(file.name) || typeof file.contentBase64 !== 'string') {
-		throw new Error('The bootstrap bundle contains an invalid game-data icon file.');
-	}
+  if (
+    typeof file.name !== 'string' ||
+    !/^[a-z_]+-[0-9a-f-]{36}\.webp$/i.test(file.name) ||
+    typeof file.contentBase64 !== 'string'
+  ) {
+    throw new Error(
+      'The bootstrap bundle contains an invalid game-data icon file.',
+    );
+  }
 }
 
-const databasePath = resolve(process.env.TDR_DATABASE_PATH || './data/shd-build-staging.db');
+const databasePath = resolve(
+  process.env.TDR_DATABASE_PATH || './data/shd-build-staging.db',
+);
 const safetyBackup = spawnSync(process.execPath, ['scripts/db-backup.mjs'], {
-	cwd: process.cwd(),
-	stdio: 'inherit',
-	env: process.env
+  cwd: process.cwd(),
+  stdio: 'inherit',
+  env: process.env,
 });
 if (safetyBackup.error) throw safetyBackup.error;
-if (safetyBackup.status !== 0) throw new Error('Staging safety backup failed; the target was not changed.');
+if (safetyBackup.status !== 0)
+  throw new Error('Staging safety backup failed; the target was not changed.');
 
 const database = await connect(databasePath);
-for (const tableName of ['users', 'builds', 'audit_log', 'data_change_proposals']) {
-	const row = await (await database.prepare(`SELECT COUNT(*) AS count FROM "${tableName}"`)).get();
-	if (Number(row?.count ?? 0) > 0) {
-		throw new Error(`Staging bootstrap refused: target table "${tableName}" is not empty.`);
-	}
+for (const tableName of [
+  'users',
+  'builds',
+  'audit_log',
+  'data_change_proposals',
+]) {
+  const row = await (
+    await database.prepare(`SELECT COUNT(*) AS count FROM "${tableName}"`)
+  ).get();
+  if (Number(row?.count ?? 0) > 0) {
+    throw new Error(
+      `Staging bootstrap refused: target table "${tableName}" is not empty.`,
+    );
+  }
 }
 
-const targetTables = await (await database.prepare(`
+const targetTables = await (
+  await database.prepare(`
 	SELECT name FROM sqlite_master
 	WHERE type='table' AND name NOT LIKE 'sqlite_%'
 	ORDER BY rowid
-`)).all();
+`)
+).all();
 const targetNames = new Set(targetTables.map((row) => String(row.name)));
-const sourceNames = new Set(bundle.database.tables.map((table) => String(table.name)));
+const sourceNames = new Set(
+  bundle.database.tables.map((table) => String(table.name)),
+);
 for (const row of targetTables) {
-	if (!sourceNames.has(String(row.name))) {
-		throw new Error(`Bootstrap snapshot is missing target-schema table "${String(row.name)}".`);
-	}
+  if (!sourceNames.has(String(row.name))) {
+    throw new Error(
+      `Bootstrap snapshot is missing target-schema table "${String(row.name)}".`,
+    );
+  }
 }
 const sourceOnlyTables = bundle.database.tables
-	.map((table) => String(table.name))
-	.filter((name) => !targetNames.has(name));
+  .map((table) => String(table.name))
+  .filter((name) => !targetNames.has(name));
 if (sourceOnlyTables.length) {
-	throw new Error(`Bootstrap snapshot contains tables outside the current target schema: ${sourceOnlyTables.join(', ')}`);
+  throw new Error(
+    `Bootstrap snapshot contains tables outside the current target schema: ${sourceOnlyTables.join(', ')}`,
+  );
 }
-const quoteIdentifier = (identifier) => `"${String(identifier).replaceAll('"', '""')}"`;
+const quoteIdentifier = (identifier) =>
+  `"${String(identifier).replaceAll('"', '""')}"`;
 let restoredRows = 0;
 await database.exec('PRAGMA foreign_keys=OFF');
 await database.exec('BEGIN');
 try {
-	for (const row of [...targetTables].reverse()) {
-		await database.exec(`DELETE FROM ${quoteIdentifier(row.name)}`);
-	}
-	for (const table of bundle.database.tables) {
-		for (const row of table.rows) {
-			const columns = Object.keys(row);
-			if (!columns.length) continue;
-			const insert = await database.prepare(
-				`INSERT INTO ${quoteIdentifier(table.name)} (${columns.map(quoteIdentifier).join(', ')})
-				VALUES (${columns.map(() => '?').join(', ')})`
-			);
-			await insert.run(...columns.map((column) => row[column]));
-			restoredRows++;
-		}
-	}
-	await database.exec('COMMIT');
+  for (const row of [...targetTables].reverse()) {
+    await database.exec(`DELETE FROM ${quoteIdentifier(row.name)}`);
+  }
+  for (const table of bundle.database.tables) {
+    for (const row of table.rows) {
+      const columns = Object.keys(row);
+      if (!columns.length) continue;
+      const insert = await database.prepare(
+        `INSERT INTO ${quoteIdentifier(table.name)} (${columns.map(quoteIdentifier).join(', ')})
+				VALUES (${columns.map(() => '?').join(', ')})`,
+      );
+      await insert.run(...columns.map((column) => row[column]));
+      restoredRows++;
+    }
+  }
+  await database.exec('COMMIT');
 } catch (error) {
-	await database.exec('ROLLBACK');
-	throw error;
+  await database.exec('ROLLBACK');
+  throw error;
 } finally {
-	await database.exec('PRAGMA foreign_keys=ON');
+  await database.exec('PRAGMA foreign_keys=ON');
 }
 
-const avatarDirectory = resolve(process.env.TDR_AVATAR_STORAGE_PATH || './data/avatars');
-const gameIconDirectory = resolve(process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons');
+const avatarDirectory = resolve(
+  process.env.TDR_AVATAR_STORAGE_PATH || './data/avatars',
+);
+const gameIconDirectory = resolve(
+  process.env.TDR_GAME_ICON_STORAGE_PATH || './data/game-icons',
+);
 await mkdir(avatarDirectory, { recursive: true });
 await mkdir(gameIconDirectory, { recursive: true });
 for (const file of bundle.files.avatars) {
-	await writeFile(join(avatarDirectory, file.name), Buffer.from(file.contentBase64, 'base64'), { mode: 0o600 });
+  await writeFile(
+    join(avatarDirectory, file.name),
+    Buffer.from(file.contentBase64, 'base64'),
+    { mode: 0o600 },
+  );
 }
 for (const file of bundle.files.gameIcons) {
-	await writeFile(join(gameIconDirectory, file.name), Buffer.from(file.contentBase64, 'base64'), { mode: 0o600 });
+  await writeFile(
+    join(gameIconDirectory, file.name),
+    Buffer.from(file.contentBase64, 'base64'),
+    { mode: 0o600 },
+  );
 }
 
-console.log(`Bootstrapped staging with ${restoredRows} database rows, ${bundle.files.avatars.length} avatars, and ${bundle.files.gameIcons.length} game-data icons.`);
+console.log(
+  `Bootstrapped staging with ${restoredRows} database rows, ${bundle.files.avatars.length} avatars, and ${bundle.files.gameIcons.length} game-data icons.`,
+);
 console.log(`Source bundle: ${bundlePath}`);

scripts/sync-staging-credentials.mjs

@@ -1,46 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { readFile, writeFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import process from 'node:process';
-
-const stagingFile = resolve('.env.staging');
-const dotenvxCli = resolve('node_modules/@dotenvx/dotenvx/src/cli/dotenvx.js');
-const sharedKeys = [
-	'DISCORD_CLIENT_ID',
-	'DISCORD_CLIENT_SECRET',
-	'SMTP_HOST',
-	'SMTP_PORT',
-	'SMTP_SECURE',
-	'SMTP_USER',
-	'SMTP_PASSWORD',
-	'SMTP_FROM'
-];
-
-for (const key of sharedKeys) {
-	if (!process.env[key]) throw new Error(`Source environment is missing ${key}.`);
-}
-
-function dotenvx(action) {
-	const result = spawnSync(process.execPath, [dotenvxCli, action, '-f', stagingFile], {
-		cwd: process.cwd(),
-		stdio: 'inherit'
-	});
-	if (result.error) throw result.error;
-	if (result.status !== 0) throw new Error(`dotenvx ${action} failed.`);
-}
-
-dotenvx('decrypt');
-try {
-	let contents = await readFile(stagingFile, 'utf8');
-	for (const key of sharedKeys) {
-		const replacement = `${key}=${JSON.stringify(process.env[key])}`;
-		const pattern = new RegExp(`^${key}=.*$`, 'm');
-		if (!pattern.test(contents)) throw new Error(`Staging environment is missing ${key}.`);
-		contents = contents.replace(pattern, replacement);
-	}
-	await writeFile(stagingFile, contents, 'utf8');
-} finally {
-	dotenvx('encrypt');
-}
-
-console.log('Copied shared Discord and SMTP credentials into encrypted staging configuration.');

scripts/system-notification-dispatch.mjs

@@ -3,64 +3,102 @@ import nodemailer from 'nodemailer';
 import { randomUUID } from 'node:crypto';
 import { resolve } from 'node:path';
 
-const database = await connect(resolve(process.env.TDR_DATABASE_PATH || './data/shd-build.db'));
+const database = await connect(
+  resolve(process.env.TDR_DATABASE_PATH || './data/shd-build.db'),
+);
 const now = new Date().toISOString();
-const due = await (await database.prepare(`SELECT delivery.id AS delivery_id,delivery.user_id,message.*
+const due = await (
+  await database.prepare(`SELECT delivery.id AS delivery_id,delivery.user_id,message.*
 	FROM automated_system_message_deliveries delivery
 	JOIN automated_system_messages message ON message.id=delivery.message_id
 	WHERE delivery.delivered_at IS NULL AND delivery.scheduled_for<=? AND message.enabled=1
-	ORDER BY delivery.scheduled_for LIMIT 250`)).all(now);
+	ORDER BY delivery.scheduled_for LIMIT 250`)
+).all(now);
 const smtpConfigured = Boolean(process.env.SMTP_HOST && process.env.SMTP_FROM);
-const transport = smtpConfigured ? nodemailer.createTransport({
-	host: process.env.SMTP_HOST,
-	port: Number(process.env.SMTP_PORT || 587),
-	secure: process.env.SMTP_SECURE === 'true',
-	auth: process.env.SMTP_USER ? { user: process.env.SMTP_USER, pass: process.env.SMTP_PASSWORD } : undefined,
-	requireTLS: process.env.SMTP_SECURE !== 'true',
-	disableFileAccess: true,
-	disableUrlAccess: true
-}) : null;
-const origin = (process.env.APP_ORIGIN || 'http://localhost:5173').replace(/\/+$/, '');
-const escapeHtml = (value) => String(value).replace(/[&<>"']/g, (character) => ({
-	'&': '&amp;',
-	'<': '&lt;',
-	'>': '&gt;',
-	'"': '&quot;',
-	"'": '&#39;'
-})[character]);
+const transport = smtpConfigured
+  ? nodemailer.createTransport({
+      host: process.env.SMTP_HOST,
+      port: Number(process.env.SMTP_PORT || 587),
+      secure: process.env.SMTP_SECURE === 'true',
+      auth: process.env.SMTP_USER
+        ? { user: process.env.SMTP_USER, pass: process.env.SMTP_PASSWORD }
+        : undefined,
+      requireTLS: process.env.SMTP_SECURE !== 'true',
+      disableFileAccess: true,
+      disableUrlAccess: true,
+    })
+  : null;
+const origin = (process.env.APP_ORIGIN || 'http://localhost:5173').replace(
+  /\/+$/,
+  '',
+);
+const escapeHtml = (value) =>
+  String(value).replace(
+    /[&<>"']/g,
+    (character) =>
+      ({
+        '&': '&amp;',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#39;',
+      })[character],
+  );
 let delivered = 0;
 
 for (const message of due) {
-	const notificationId = randomUUID();
-	await (await database.prepare(`INSERT INTO notifications
+  const notificationId = randomUUID();
+  await (
+    await database.prepare(`INSERT INTO notifications
 		(id,user_id,category,source,title,body,link,actions_json,mandatory,created_at)
-		VALUES(?,?,'isac',?,?,?,?,?,1,?)`)).run(
-		notificationId, message.user_id, message.source, message.title, message.body,
-		message.link ?? null, message.actions_json ?? null, now
-	);
-	await (await database.prepare(`UPDATE automated_system_message_deliveries
-		SET delivered_at=?,notification_id=? WHERE id=? AND delivered_at IS NULL`))
-		.run(now, notificationId, message.delivery_id);
-	const preference = await (await database.prepare(
-		"SELECT email_frequency FROM notification_preferences WHERE user_id=? AND category='isac'"
-	)).get(message.user_id);
-	if (transport && preference?.email_frequency === 'immediate') {
-		const identity = await (await database.prepare('SELECT email FROM user_emails WHERE user_id=?')).get(message.user_id);
-		if (typeof identity?.email === 'string') {
-			try {
-				await transport.sendMail({
-					from: process.env.SMTP_FROM,
-					to: identity.email,
-					subject: `SHD.build · ${message.title}`,
-					text: `${message.body}\n\n${message.link ? `${origin}${message.link}` : origin}`,
-					html: `<div style="background:#0a0c0d;color:#ecebe5;padding:28px;font-family:Arial,sans-serif"><p style="color:#f6a821;font-size:12px;letter-spacing:2px">${escapeHtml(message.source)}</p><h1>${escapeHtml(message.title)}</h1><p style="color:#a5aaab">${escapeHtml(message.body)}</p>${message.link ? `<a style="color:#f6a821" href="${escapeHtml(`${origin}${message.link}`)}">OPEN SHD.BUILD</a>` : ''}</div>`
-				});
-				await (await database.prepare('UPDATE notifications SET emailed_at=? WHERE id=?')).run(now, notificationId);
-			} catch (error) {
-				console.error(`Unable to email automated notification ${notificationId}`, error);
-			}
-		}
-	}
-	delivered += 1;
+		VALUES(?,?,'isac',?,?,?,?,?,1,?)`)
+  ).run(
+    notificationId,
+    message.user_id,
+    message.source,
+    message.title,
+    message.body,
+    message.link ?? null,
+    message.actions_json ?? null,
+    now,
+  );
+  await (
+    await database.prepare(`UPDATE automated_system_message_deliveries
+		SET delivered_at=?,notification_id=? WHERE id=? AND delivered_at IS NULL`)
+  ).run(now, notificationId, message.delivery_id);
+  const preference = await (
+    await database.prepare(
+      "SELECT email_frequency FROM notification_preferences WHERE user_id=? AND category='isac'",
+    )
+  ).get(message.user_id);
+  if (transport && preference?.email_frequency === 'immediate') {
+    const identity = await (
+      await database.prepare('SELECT email FROM user_emails WHERE user_id=?')
+    ).get(message.user_id);
+    if (typeof identity?.email === 'string') {
+      try {
+        await transport.sendMail({
+          from: process.env.SMTP_FROM,
+          to: identity.email,
+          subject: `SHD.build · ${message.title}`,
+          text: `${message.body}\n\n${message.link ? `${origin}${message.link}` : origin}`,
+          html: `<div style="background:#0a0c0d;color:#ecebe5;padding:28px;font-family:Arial,sans-serif"><p style="color:#f6a821;font-size:12px;letter-spacing:2px">${escapeHtml(message.source)}</p><h1>${escapeHtml(message.title)}</h1><p style="color:#a5aaab">${escapeHtml(message.body)}</p>${message.link ? `<a style="color:#f6a821" href="${escapeHtml(`${origin}${message.link}`)}">OPEN SHD.BUILD</a>` : ''}</div>`,
+        });
+        await (
+          await database.prepare(
+            'UPDATE notifications SET emailed_at=? WHERE id=?',
+          )
+        ).run(now, notificationId);
+      } catch (error) {
+        console.error(
+          `Unable to email automated notification ${notificationId}`,
+          error,
+        );
+      }
+    }
+  }
+  delivered += 1;
 }
-console.log(`Delivered ${delivered} automated ISAC system notification${delivered === 1 ? '' : 's'}.`);
+console.log(
+  `Delivered ${delivered} automated ISAC system notification${delivered === 1 ? '' : 's'}.`,
+);

scripts/trim-static-icons.mjs

@@ -4,37 +4,41 @@ import { join, resolve } from 'node:path';
 
 const iconDirectory = resolve('./static');
 const iconFiles = (await readdir(iconDirectory))
-	.filter((file) => file.toLocaleLowerCase().endsWith('.png'))
-	.sort((left, right) => left.localeCompare(right));
+  .filter((file) => file.toLocaleLowerCase().endsWith('.png'))
+  .sort((left, right) => left.localeCompare(right));
 
 for (const file of iconFiles) {
-	const source = join(iconDirectory, file);
-	const temporary = join(iconDirectory, `.${file}.trimmed`);
-	const before = await sharp(source).metadata();
+  const source = join(iconDirectory, file);
+  const temporary = join(iconDirectory, `.${file}.trimmed`);
+  const before = await sharp(source).metadata();
 
-	try {
-		const result = await sharp(source)
-			.trim({ background: { r: 0, g: 0, b: 0, alpha: 0 } })
-			.extend({
-				top: 2,
-				right: 2,
-				bottom: 2,
-				left: 2,
-				background: { r: 0, g: 0, b: 0, alpha: 0 }
-			})
-			.png({ compressionLevel: 9, adaptiveFiltering: true })
-			.toFile(temporary);
+  try {
+    const result = await sharp(source)
+      .trim({ background: { r: 0, g: 0, b: 0, alpha: 0 } })
+      .extend({
+        top: 2,
+        right: 2,
+        bottom: 2,
+        left: 2,
+        background: { r: 0, g: 0, b: 0, alpha: 0 },
+      })
+      .png({ compressionLevel: 9, adaptiveFiltering: true })
+      .toFile(temporary);
 
-		if (!result.width || !result.height || result.channels !== 4) {
-			throw new Error(`${file} did not produce a valid transparent RGBA icon.`);
-		}
+    if (!result.width || !result.height || result.channels !== 4) {
+      throw new Error(`${file} did not produce a valid transparent RGBA icon.`);
+    }
 
-		await rename(temporary, source);
-		console.log(`${file}: ${before.width}x${before.height} -> ${result.width}x${result.height}`);
-	} catch (error) {
-		await unlink(temporary).catch(() => {});
-		throw error;
-	}
+    await rename(temporary, source);
+    console.log(
+      `${file}: ${before.width}x${before.height} -> ${result.width}x${result.height}`,
+    );
+  } catch (error) {
+    await unlink(temporary).catch(() => {});
+    throw error;
+  }
 }
 
-console.log(`Trimmed ${iconFiles.length} static PNG icons with a 2px transparent safety margin.`);
+console.log(
+  `Trimmed ${iconFiles.length} static PNG icons with a 2px transparent safety margin.`,
+);

scripts/validate-runtime-environment.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+
+import process from 'node:process';
+import { validateRuntimeEnvironment } from './runtime-environment.js';
+
+const mode = process.argv[2];
+if (mode !== 'app' && mode !== 'scheduler') {
+  console.error(
+    'Usage: node scripts/validate-runtime-environment.mjs <app|scheduler>',
+  );
+  process.exit(2);
+}
+
+const errors = validateRuntimeEnvironment(mode, process.env);
+if (errors.length > 0) {
+  console.error(
+    `Invalid ${mode} runtime environment:\n${errors.map((error) => `- ${error}`).join('\n')}`,
+  );
+  process.exit(1);
+}