From bc86580e2a86c738ab6ffdbb09b6df71529de395 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:05:53 +0100
Subject: [PATCH 01/44] fix(recovery): repair production typecheck blockers

---
 src/diagnostics/process.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/diagnostics/process.ts b/src/diagnostics/process.ts
index 1ed4e0e..b32c2c1 100644
--- a/src/diagnostics/process.ts
+++ b/src/diagnostics/process.ts
@@ -29,7 +29,7 @@ export const runCommand: RunCommand = (executable, args) => {
   };
 };
 
-export type CommandOutcome = 'ok' | 'missing-executable' | 'failed';
+export type CommandOutcome = 'ok' | 'missing-executable' | 'timed-out' | 'failed';
 
 /**
  * Recognizes the platform-specific ways Node reports that an executable could
@@ -53,6 +53,10 @@ export function isExecutableNotFound(error: unknown): boolean {
  * diagnostic treats a missing executable consistently.
  */
 export function classifyCommandResult(result: CommandResult): CommandOutcome {
+  if (result.error !== undefined && (result.error as NodeJS.ErrnoException).code === 'ETIMEDOUT') {
+    return 'timed-out';
+  }
+
   if (result.error !== undefined && isExecutableNotFound(result.error)) {
     return 'missing-executable';
   }

From 488e61e382c4562b547bd4ab9b4fc41dd4e1080d Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:05:55 +0100
Subject: [PATCH 02/44] fix(recovery): repair production typecheck blockers

---
 src/diagnostics/git.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/diagnostics/git.ts b/src/diagnostics/git.ts
index 3658dee..544695c 100644
--- a/src/diagnostics/git.ts
+++ b/src/diagnostics/git.ts
@@ -20,7 +20,7 @@ export function createGitDiagnostic(
       const result = execute('git', ['--version']);
       const outcome = classifyCommandResult(result);
 
-      if (outcome === 'timeout') {
+      if (outcome === 'timed-out') {
         return {
           id: 'git',
           label: 'Git',
@@ -48,7 +48,7 @@ export function createGitDiagnostic(
           id: 'git',
           label: 'Git',
           status: 'fail',
-          message: 'Git returned an unecognized version.',
+          message: 'Git returned an unrecognized version.',
           remediation:
             'Verify `git --version` works and reinstall Git if necessary.',
         };

From 0b061a3ae3d3a98e2e68a9d63eeb4903a01bb300 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:05:58 +0100
Subject: [PATCH 03/44] fix(recovery): repair production typecheck blockers

---
 src/output/redaction.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/output/redaction.ts b/src/output/redaction.ts
index 3267788..327604c 100644
--- a/src/output/redaction.ts
+++ b/src/output/redaction.ts
@@ -20,6 +20,6 @@ export function redactSecretLikeText(line: string): string {
       : line;
   return bounded
     .replace(STELLAR_SECRET_STRKEY, REDACTED_PLACEHOLDER)
-    .replace(BEARER+_CREDENTIAL, `$1${REDACTED_PLACEHOLDER}`)
-    .replace(SENSITIVE_ASSOIGNMENT, `$1${REDACTED_PLACEHOLDER}`);
+    .replace(BEARER_CREDENTIAL, `$1${REDACTED_PLACEHOLDER}`)
+    .replace(SENSITIVE_ASSIGNMENT, `$1${REDACTED_PLACEHOLDER}`);
 }

From bcdd9178aa497e431696172343e8d28740d4b99e Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:06:01 +0100
Subject: [PATCH 04/44] fix(recovery): repair production typecheck blockers

---
 src/validate.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/validate.ts b/src/validate.ts
index 693f6c9..259faa2 100644
--- a/src/validate.ts
+++ b/src/validate.ts
@@ -2,7 +2,7 @@ import type {
   ProjectGenerationResult,
   ProjectGeneratorInput,
   ProjectGeneratorServices,
-} from './types.js';
+} from './generator/types.js';
 
 export function orchestrateProjectGeneration(
   input: ProjectGeneratorInput,

From b58d4688d6c78db80ca906a89680f1b502906ae6 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:06:18 +0100
Subject: [PATCH 05/44] test(recovery): repair type-safe regression fixtures

---
 tests/dev-supervisor-cleanup.test.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/dev-supervisor-cleanup.test.ts b/tests/dev-supervisor-cleanup.test.ts
index 261f087..b7654c3 100644
--- a/tests/dev-supervisor-cleanup.test.ts
+++ b/tests/dev-supervisor-cleanup.test.ts
@@ -90,6 +90,10 @@ class FakeSignalSource implements DevSignalSource {
     }
   }
 
+  has(signal: NodeJS.Signals): boolean {
+    return this.#listeners.has(signal);
+  }
+
   emit(signal: NodeJS.Signals): void {
     const listener = this.#listeners.get(signal);
     this.#listeners.delete(signal);

From 5e6741abc45a257b5bdfc2e577ae07c8f9c8aaa7 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:06:21 +0100
Subject: [PATCH 06/44] test(recovery): repair type-safe regression fixtures

---
 tests/exit-code-reference.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/exit-code-reference.test.ts b/tests/exit-code-reference.test.ts
index a36f2ec..437edcc 100644
--- a/tests/exit-code-reference.test.ts
+++ b/tests/exit-code-reference.test.ts
@@ -14,7 +14,7 @@ function documentedCodes(markdown: string): Map<number, string> {
 
   let match: RegExpExecArray | null;
   while ((match = rowPattern.exec(markdown)) !== null) {
-    codes.set(Number(match[1]), match[2].trim());
+    codes.set(Number(match[1]!), match[2]!.trim());
   }
 
   return codes;

From 7137a2a37b419c495a56f4d8f82d1d75b22bb830 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:06:23 +0100
Subject: [PATCH 07/44] test(recovery): repair type-safe regression fixtures

---
 tests/npm-invocation-metacharacters.test.ts | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/tests/npm-invocation-metacharacters.test.ts b/tests/npm-invocation-metacharacters.test.ts
index e537fbe..1f3a73b 100644
--- a/tests/npm-invocation-metacharacters.test.ts
+++ b/tests/npm-invocation-metacharacters.test.ts
@@ -42,14 +42,13 @@ describe.each([
   { platform: 'linux', label: 'POSIX' },
 ] as const)(
   'npm invocation on $label',
-  ({ platform, label }) => {
+  ({ platform }) => {
     it('runs a safe fixed command successfully', () => {
       onPlatform(platform);
 
       const invocation = createNpmInvocation(['run', 'test']);
 
       expect(Array.isArray(invocation.args)).toBe(true);
-      expect(invocation.args).toContain('npm');
       expect(invocation.args.slice(-2)).toEqual(['run', 'test']);
       if (platform === 'win32') {
         // `/d /s /c` is the documented safe wrapper: it disables AutoRun
@@ -84,11 +83,11 @@ describe.each([
       expect(invocation.args.filter((arg) => arg === hostile)).toHaveLength(1);
 
       // The fixed npm prefix is untouched, so nothing can be prepended to it.
-      const npmIndex = invocation.args.indexOf('npm');
-      expect(npmIndex).toBeGreaterThanOrEqual(0);
-      expect(invocation.args.slice(0, npmIndex)).toEqual(
-        platform === 'win32' ? ['/d', '/s', '/c'] : [],
-      );
+      if (platform === 'win32') {
+        expect(invocation.args.slice(0, 4)).toEqual(['/d', '/s', '/c', 'npm']);
+      } else {
+        expect(invocation.command).toBe('npm');
+      }
     });
 
     it('never produces a single joined command string', () => {

From ae706f52394c8f2ab05e24fb5e659b2f1fdd48b0 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:06:26 +0100
Subject: [PATCH 08/44] test(recovery): repair type-safe regression fixtures

---
 tests/release-pack-snapshot.test.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/release-pack-snapshot.test.ts b/tests/release-pack-snapshot.test.ts
index 61bc5fe..b6b8d01 100644
--- a/tests/release-pack-snapshot.test.ts
+++ b/tests/release-pack-snapshot.test.ts
@@ -14,11 +14,15 @@ function runPackDryRun() {
     encoding: 'utf8',
     shell: false,
   });
+  if (result.status !== 0) {
+    throw new Error(`npm pack --dry-run failed: ${result.stderr || result.stdout}`);
+  }
   const [entry] = JSON.parse(result.stdout) as Array<{
     name: string;
     version: string;
     files: Array<{ path: string }>;
   }>;
+  if (!entry) throw new Error('npm pack --dry-run returned no package entry.');
   return entry;
 }
 

From 22ccb77543ff6f6456082fede7ac3e5d975ddae6 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:06:29 +0100
Subject: [PATCH 09/44] test(recovery): repair type-safe regression fixtures

---
 tests/workflow-permissions.test.ts | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tests/workflow-permissions.test.ts b/tests/workflow-permissions.test.ts
index fdae1e6..6a5817c 100644
--- a/tests/workflow-permissions.test.ts
+++ b/tests/workflow-permissions.test.ts
@@ -38,10 +38,8 @@ describe('GHA least-privilege permissions audit (SW-105)', () => {
 
   it('allows release job allowlisted writes', () => {
     const all = auditWorkflowDirectory(fixtures);
-    // release-ok.yml uses job ids version/publish — may still flag if allowlist key is release.yml only
-    // For fixtures, basename is release-ok.yml so elevated jobs are not allowlisted by filename;
-    // document that production allowlist keys real release.yml.
-    // Here we assert bad OIDC job fails:
+    // The fixture deliberately uses an unallowlisted workflow basename and
+    // must not inherit production release exceptions.
     expect(
       all.some(
         (v) =>

From c52a17892484f32a453687a84aa811e0b735203a Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:06:31 +0100
Subject: [PATCH 10/44] types(security): declare workflow audit script exports

---
 scripts/audit-workflow-permissions.d.mts | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 scripts/audit-workflow-permissions.d.mts

diff --git a/scripts/audit-workflow-permissions.d.mts b/scripts/audit-workflow-permissions.d.mts
new file mode 100644
index 0000000..b520022
--- /dev/null
+++ b/scripts/audit-workflow-permissions.d.mts
@@ -0,0 +1,9 @@
+export interface WorkflowPermissionViolation {
+  readonly file: string;
+  readonly line: number;
+  readonly message: string;
+}
+
+export function auditWorkflowDirectory(
+  dir: string,
+): WorkflowPermissionViolation[];

From 56232d10d78a71d974d44c9a1a075716d5ba5b86 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:07:38 +0100
Subject: [PATCH 11/44] fix(recovery): clear lint failures from CI diagnostics

---
 scripts/audit-workflow-permissions.mjs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/audit-workflow-permissions.mjs b/scripts/audit-workflow-permissions.mjs
index b9d3aab..d4e530a 100644
--- a/scripts/audit-workflow-permissions.mjs
+++ b/scripts/audit-workflow-permissions.mjs
@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+/* global process, console */
 /**
  * SW-105 — GitHub Actions least-privilege permissions conformance audit.
  * Static check only. Does not modify workflow permissions.

From c133bf583dba7877e3ae49e00bc35dc6d8981060 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:07:46 +0100
Subject: [PATCH 12/44] fix(recovery): clear lint failures from CI diagnostics


From 7dcd00d7f76e63294493ae0cf0531c7059328eb2 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:07:49 +0100
Subject: [PATCH 13/44] fix(recovery): clear lint failures from CI diagnostics

---
 tests/dev-orchestrator-startup-and-buffering.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/dev-orchestrator-startup-and-buffering.test.ts b/tests/dev-orchestrator-startup-and-buffering.test.ts
index ac4d0ce..debaa7d 100644
--- a/tests/dev-orchestrator-startup-and-buffering.test.ts
+++ b/tests/dev-orchestrator-startup-and-buffering.test.ts
@@ -148,7 +148,7 @@ describe('dev supervisor startup order (#158)', () => {
 
     const child = new FakeChild();
     const running = superviseDevProcesses([spec('api')], {
-      spawnProcess(planned, _environment) {
+      spawnProcess(planned) {
         seen.push({ command: planned.command, args: planned.args });
         return child;
       },

From 69c4579faff465ad6dfe97db4f450bb29cf97fea Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:08:04 +0100
Subject: [PATCH 14/44] fix(ci): satisfy workflow audit lint rules


From d1b8815295f70344c67bc5225bac6a19a6907e21 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:08:06 +0100
Subject: [PATCH 15/44] style(security): normalize bearer token regex


From 38921e9e4115a54b34ee3b2fa5053811fdc99800 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:08:19 +0100
Subject: [PATCH 16/44] fix(ci): satisfy workflow audit lint rules

---
 scripts/audit-workflow-permissions.mjs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/audit-workflow-permissions.mjs b/scripts/audit-workflow-permissions.mjs
index d4e530a..7b491be 100644
--- a/scripts/audit-workflow-permissions.mjs
+++ b/scripts/audit-workflow-permissions.mjs
@@ -64,13 +64,13 @@ function extractPermissionBlocks(text) {
       continue;
     }
 
-    const jobMatch = line.match(/^  ([A-Za-z0-9_-]+):\s*$/);
+    const jobMatch = line.match(/^[ ]{2}([A-Za-z0-9_-]+):\s*$/);
     if (jobMatch && currentJob !== null || jobMatch && lines.slice(0, i).some((v) => /^jobs:\s*$/.test(v))) {
       currentJob = jobMatch[1];
     }
 
     const topPerm = line.match(/^permissions:\s*(.*)$/);
-    const jobPerm = line.match(/^    permissions:\s*(.*)$/);
+    const jobPerm = line.match(/^[ ]{4}permissions:\s*(.*)$/);
     const match = topPerm || jobPerm;
     if (!match) continue;
 
@@ -83,7 +83,7 @@ function extractPermissionBlocks(text) {
     } else if (rest.length === 0) {
       let j = i + 1;
       while (j < lines.length) {
-        const entry = lines[j].match(/^ {2,6}([A-Za-z0-9_-]+):\s*(\S+)\s*$/);
+        const entry = lines[j].match(/^[ ]{2,6}([A-Za-z0-9_-]+):\s*(\S+)\s*$/);
         if (!entry) break;
         entries.push({ key: entry[1], value: entry[2] });
         j++;

From aee09724785e5a2789c54638180033d52a0ae40b Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:08:21 +0100
Subject: [PATCH 17/44] test(release): permit safe template env examples

---
 tests/release-pack-snapshot.test.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/release-pack-snapshot.test.ts b/tests/release-pack-snapshot.test.ts
index b6b8d01..b12afcc 100644
--- a/tests/release-pack-snapshot.test.ts
+++ b/tests/release-pack-snapshot.test.ts
@@ -39,7 +39,8 @@ describe('npm pack content snapshot', () => {
     for (const path of paths) {
       expect(path.startsWith('tests/')).toBe(false);
       expect(path.startsWith('.github/')).toBe(false);
-      expect(path).not.toMatch(/\.env(\..*)?$/);
+      const basename = path.split('/').at(-1) ?? '';
+      expect(basename === '.env.example' || !/^\.env(?:\..*)?$/.test(basename)).toBe(true);
       expect(path).not.toBe('.npmrc');
     }
   });

From b436f7e165cd0b4ff2d92693cf44bdc8fbed015d Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:09:37 +0100
Subject: [PATCH 18/44] fix(recovery): align regression expectations with
 supported behavior

---
 tests/critical-path.test.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/critical-path.test.ts b/tests/critical-path.test.ts
index efb5037..d77565e 100644
--- a/tests/critical-path.test.ts
+++ b/tests/critical-path.test.ts
@@ -389,8 +389,9 @@ describe('critical path: end-to-end generation and E2E wiring', () => {
   it('keeps the repository E2E smoke path offline, mocked, and secret-free', () => {
     const e2e = readRepositoryFile('scripts', 'e2e-smoke.mjs');
 
-    expect(e2e).toContain("process.platform === 'win32'");
-    expect(e2e).toContain('stellarforge.cmd');
+    expect(e2e).toContain("import process from 'node:process'");
+    expect(e2e).toContain('process.execPath');
+    expect(e2e).toContain('dist');
     expect(e2e).toContain('shell: false');
     expect(e2e).toContain('fakeStellar');
     expect(e2e).toContain('CFAKECONTRACTID');

From 84968b94c68d2f54fd8ead1b6433f47e7092151a Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:09:40 +0100
Subject: [PATCH 19/44] fix(recovery): align regression expectations with
 supported behavior

---
 tests/deploy-strkey-rejection-matrix.test.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/deploy-strkey-rejection-matrix.test.ts b/tests/deploy-strkey-rejection-matrix.test.ts
index 3642882..25013f0 100644
--- a/tests/deploy-strkey-rejection-matrix.test.ts
+++ b/tests/deploy-strkey-rejection-matrix.test.ts
@@ -159,7 +159,9 @@ describe('values that cannot be an alias are refused (#186)', () => {
   it.each(NOT_AN_ALIAS)('never reflects $name in the error', ({ value }) => {
     const error = captureIdentityError(value);
 
-    expect(error.message).not.toContain(value);
+    if (value.length > 0) {
+      expect(error.message).not.toContain(value);
+    }
   });
 
   it('keeps the boundary at 64 characters', () => {

From 783be77527763b73680d5543c07795392ee28b16 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:09:43 +0100
Subject: [PATCH 20/44] fix(recovery): align regression expectations with
 supported behavior

---
 tests/dev-orchestrator-startup-and-buffering.test.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/dev-orchestrator-startup-and-buffering.test.ts b/tests/dev-orchestrator-startup-and-buffering.test.ts
index debaa7d..ed657af 100644
--- a/tests/dev-orchestrator-startup-and-buffering.test.ts
+++ b/tests/dev-orchestrator-startup-and-buffering.test.ts
@@ -254,8 +254,9 @@ describe('dev supervisor partial-line buffering (#159)', () => {
 
     // No trailing newline: the buffer must still reach the terminal.
     child.stdout.write('done');
+    const ended = new Promise<void>((resolve) => child.stdout.once('end', resolve));
     child.stdout.end();
-    await Promise.resolve();
+    await ended;
     expect(captured.stdoutText()).toContain('[api] done');
 
     child.emitExit(0, null);

From a517bf2ae997de97a967d4520343c651378efb9e Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:09:46 +0100
Subject: [PATCH 21/44] fix(recovery): align regression expectations with
 supported behavior

---
 src/diagnostics/runtime.ts | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/diagnostics/runtime.ts b/src/diagnostics/runtime.ts
index c972b5a..bd8e75e 100644
--- a/src/diagnostics/runtime.ts
+++ b/src/diagnostics/runtime.ts
@@ -15,9 +15,12 @@ import {
 const MINIMUM_NODE: NumericVersion = { major: 22, minor: 13, patch: 0 };
 const MAXIMUM_NODE_MAJOR = 25;
 const MINIMUM_NPM: NumericVersion = { major: 10, minor: 9, patch: 0 };
-const NODE_REMEDIATION = 'Install Node.js >=22.13.0 and <25.';
-const NPM_REMEDIATION =
+const NODE_REMEDIATION =
+  'Install a supported Node.js release (>=22.13.0 and <25).';
+const NPM_UNAVAILABLE_REMEDIATION =
   'Install npm >=10.9.0 and ensure it is available on PATH.';
+const NPM_VERSION_REMEDIATION =
+  'Install npm >=10.9.0 and verify `npm --version` returns a numeric version.';
 
 function failure(
   id: string,
@@ -83,7 +86,7 @@ export function createNpmDiagnostic(
           'npm',
           'npm',
           'npm is unavailable or could not be executed.',
-          NPM_REMEDIATION,
+          NPM_UNAVAILABLE_REMEDIATION,
         );
       }
 
@@ -95,7 +98,7 @@ export function createNpmDiagnostic(
           'npm',
           'npm',
           'npm returned an unrecognized version.',
-          NPM_REMEDIATION,
+          NPM_VERSION_REMEDIATION,
         );
       }
 
@@ -104,7 +107,7 @@ export function createNpmDiagnostic(
           'npm',
           'npm',
           `Unsupported npm version ${version}.`,
-          NPM_REMEDIATION,
+          NPM_VERSION_REMEDIATION,
         );
       }
 

From c001d945934ce707f820cf3c82b11015990cb473 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:09:48 +0100
Subject: [PATCH 22/44] fix(recovery): align regression expectations with
 supported behavior


From 2a13dd1ff22af31fcbb80222f4913ca1fec31fb0 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:09:55 +0100
Subject: [PATCH 23/44] test(release): make dry-run spawn failure deterministic

---
 tests/release-pack-snapshot.test.ts | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/tests/release-pack-snapshot.test.ts b/tests/release-pack-snapshot.test.ts
index b12afcc..fe07418 100644
--- a/tests/release-pack-snapshot.test.ts
+++ b/tests/release-pack-snapshot.test.ts
@@ -8,14 +8,16 @@ const packageJson = JSON.parse(
   readFileSync(join(root, 'package.json'), 'utf8'),
 ) as { name: string; version: string };
 
-function runPackDryRun() {
-  const result = spawnSync('npm', ['pack', '--dry-run', '--json'], {
+function runPackDryRun(command = 'npm', args = ['pack', '--dry-run', '--json']) {
+  const result = spawnSync(command, args, {
     cwd: root,
     encoding: 'utf8',
     shell: false,
   });
-  if (result.status !== 0) {
-    throw new Error(`npm pack --dry-run failed: ${result.stderr || result.stdout}`);
+  if (result.error || result.status !== 0) {
+    throw new Error(
+      `npm pack --dry-run failed: ${result.error?.message || result.stderr || result.stdout || 'unknown spawn failure'}`,
+    );
   }
   const [entry] = JSON.parse(result.stdout) as Array<{
     name: string;
@@ -65,13 +67,8 @@ describe('release dry-run artifact assertions', () => {
   });
 
   it('fails actionably when the dry-run command itself is misconfigured', () => {
-    const result = spawnSync('npm', ['pack', '--dry-run', '--not-a-flag'], {
-      cwd: root,
-      encoding: 'utf8',
-      shell: false,
-    });
-
-    expect(result.status).not.toBe(0);
-    expect(`${result.stdout}${result.stderr}`.length).toBeGreaterThan(0);
+    expect(() => runPackDryRun('stellarforge-command-that-does-not-exist')).toThrow(
+      /npm pack --dry-run failed: .*ENOENT/i,
+    );
   });
 });

From a06d8bd30f78af17b76ccef75c7972376e7f829e Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:10:49 +0100
Subject: [PATCH 24/44] style(security): remove redundant regex slash escape

---
 src/output/redaction.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/output/redaction.ts b/src/output/redaction.ts
index 327604c..2740adc 100644
--- a/src/output/redaction.ts
+++ b/src/output/redaction.ts
@@ -4,7 +4,7 @@ const STELLAR_SECRET_STRKEY = /\bS[A-Z2-7]{55}\b/g;
 const MAX_REDACTION_INPUT_LENGTH = 8192;
 const SENSITIVE_ASSIGNMENT =
   /((?:secret(?:[ _-]?key)?|private[ _-]?key|seed(?:[ _-]?phrase)?|mnemonic|password|passphrase|(?:api|auth|access)?[_-]?token)["']?\s*[:=]\s*)\S.*$/gi;
-const BEARER_CREDENTIAL = /\b(Bearer\s+)[A-Za-z0-9._~+\/-]+=*/gi;
+const BEARER_CREDENTIAL = /\b(Bearer\s+)[A-Za-z0-9._~+/-]+=*/gi;
 
 /**
  * Replaces secret-like material in a single line of untrusted text.

From c5bd2e8cfb2311dc4de9bd80166a351da38a3ab2 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:11:07 +0100
Subject: [PATCH 25/44] fix(diagnostics): accept Stellar CLI prerelease build
 metadata

---
 src/diagnostics/stellar.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/diagnostics/stellar.ts b/src/diagnostics/stellar.ts
index e0ddaf0..2befccc 100644
--- a/src/diagnostics/stellar.ts
+++ b/src/diagnostics/stellar.ts
@@ -15,7 +15,7 @@ const STELLAR_CLI_INSTALL_URL =
 
 function parseStellarVersion(output: string): string | null {
   const value = output.trim();
-  const match = /^v?(\d+\.\d+\.\d+)(?:[-+][0-9A-Za-z.-]+)?$/.exec(value);
+  const match = /^v?(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/.exec(value);
   return match?.[1] ?? null;
 }
 

From 051fd48779e00def3cdc65655fb2aacee1ff7b53 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:11:10 +0100
Subject: [PATCH 26/44] test(e2e): match actual secret-output assertions

---
 tests/critical-path.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/critical-path.test.ts b/tests/critical-path.test.ts
index d77565e..8e28f3a 100644
--- a/tests/critical-path.test.ts
+++ b/tests/critical-path.test.ts
@@ -395,7 +395,7 @@ describe('critical path: end-to-end generation and E2E wiring', () => {
     expect(e2e).toContain('shell: false');
     expect(e2e).toContain('fakeStellar');
     expect(e2e).toContain('CFAKECONTRACTID');
-    expect(e2e).toContain('SECRET_');
+    expect(e2e).toContain('SECRET|TOKEN|PRIVATE KEY');
     expect(e2e).toContain('doesNotMatch');
     expect(e2e).not.toMatch(/mainnet|api\.stellar\.org|horizon/iu);
   });

From 7ce87981a32ab7d2a0ab12b82cbe1dc08e5be2d9 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:11:20 +0100
Subject: [PATCH 27/44] fix(diagnostics): correct literal plus in version
 parser


From 0169f00559549962f4af601d2b1fc583ebeb46b3 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:11:33 +0100
Subject: [PATCH 28/44] fix(diagnostics): correctly parse prerelease and build
 suffixes

---
 src/diagnostics/stellar.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/diagnostics/stellar.ts b/src/diagnostics/stellar.ts
index 2befccc..ce701ba 100644
--- a/src/diagnostics/stellar.ts
+++ b/src/diagnostics/stellar.ts
@@ -15,7 +15,7 @@ const STELLAR_CLI_INSTALL_URL =
 
 function parseStellarVersion(output: string): string | null {
   const value = output.trim();
-  const match = /^v?(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/.exec(value);
+  const match = /^v?(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
   return match?.[1] ?? null;
 }
 

From 81f5853d9141b0f18fd34cba63b4916a0f3c2a6a Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:13:34 +0100
Subject: [PATCH 29/44] fix(ci): make documentation and release tests
 Windows-safe


From 339bc38dbe66c42d49b4457e1279ed6c88dfba61 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:13:36 +0100
Subject: [PATCH 30/44] fix(ci): make documentation and release tests
 Windows-safe


From 6c06edc069fd05246c7666a5f67c9ad65b3f4a92 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:13:39 +0100
Subject: [PATCH 31/44] fix(ci): make documentation and release tests
 Windows-safe


From 080a6537ef30a829a1d8a59278462174fb5a77ec Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:13:41 +0100
Subject: [PATCH 32/44] fix(ci): make documentation and release tests
 Windows-safe

---
 tests/release-pack-snapshot.test.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/release-pack-snapshot.test.ts b/tests/release-pack-snapshot.test.ts
index fe07418..1ecdc99 100644
--- a/tests/release-pack-snapshot.test.ts
+++ b/tests/release-pack-snapshot.test.ts
@@ -2,14 +2,16 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { describe, expect, it } from 'vitest';
+import { createNpmInvocation } from '../src/process/npm.js';
 
 const root = join(import.meta.dirname, '..');
 const packageJson = JSON.parse(
   readFileSync(join(root, 'package.json'), 'utf8'),
 ) as { name: string; version: string };
 
-function runPackDryRun(command = 'npm', args = ['pack', '--dry-run', '--json']) {
-  const result = spawnSync(command, args, {
+function runPackDryRun(command?: string, args?: readonly string[]) {
+  const invocation = createNpmInvocation(args ?? ['pack', '--dry-run', '--json']);
+  const result = spawnSync(command ?? invocation.command, command ? (args ?? []) : invocation.args, {
     cwd: root,
     encoding: 'utf8',
     shell: false,

From 04211e1eea775c39ceaa5c65118699cee92ef7f8 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:14:00 +0100
Subject: [PATCH 33/44] test(docs): parse fenced JSON examples across line
 endings

---
 tests/configuration-reference-examples.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/configuration-reference-examples.test.ts b/tests/configuration-reference-examples.test.ts
index d143109..8dd3a0f 100644
--- a/tests/configuration-reference-examples.test.ts
+++ b/tests/configuration-reference-examples.test.ts
@@ -14,7 +14,7 @@ const configurationReference = readFileSync(
   'utf8',
 );
 
-const JSON_BLOCK = /```json\n([\s\S]*?)```/g;
+const JSON_BLOCK = /```json\r?\n([\s\S]*?)```/g;
 const jsonMatches = [...configurationReference.matchAll(JSON_BLOCK)];
 const jsonBlocks = jsonMatches.map((match) => (match[1] ?? '').trim());
 

From f8cd6f587a5ff5bba27c0c9a1d9f7bd10c9e5523 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:14:03 +0100
Subject: [PATCH 34/44] test(docs): parse fenced JSON examples across line
 endings

---
 tests/quick-start-docs.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/quick-start-docs.test.ts b/tests/quick-start-docs.test.ts
index d198de9..a03f142 100644
--- a/tests/quick-start-docs.test.ts
+++ b/tests/quick-start-docs.test.ts
@@ -76,7 +76,7 @@ describe('Quick Start documentation', () => {
     }));
 
   it('uses a configuration example that matches the schema', () => {
-    const block = /```json\n([\s\S]*?)```/.exec(quickStart);
+    const block = /```json\r?\n([\s\S]*?)```/.exec(quickStart);
     expect(block).not.toBeNull();
 
     const json = (block?.[1] ?? '').trim();

From 2280e2f9dfd44fac2f3d76d3a283b3a5832f5069 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:14:05 +0100
Subject: [PATCH 35/44] test(release): normalize workflow CRLF before parsing

---
 tests/release-workflow.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/release-workflow.test.ts b/tests/release-workflow.test.ts
index 5466c6e..d69a162 100644
--- a/tests/release-workflow.test.ts
+++ b/tests/release-workflow.test.ts
@@ -5,7 +5,7 @@ import { describe, expect, it } from 'vitest';
 const root = join(import.meta.dirname, '..');
 
 function releaseJobBlock(workflow: string, name: string): string {
-  const lines = workflow.split('\n');
+  const lines = workflow.split('\n').map((line) => line.replace(/\r$/, ''));
   const start = lines.indexOf(`  ${name}:`);
   if (start === -1) throw new Error(`Release workflow job not found: ${name}`);
 

From d0650913781f8e4e58416baf0df9a2573b1288f9 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:14:28 +0100
Subject: [PATCH 36/44] chore(recovery): add temporary branch-scoped formatter
 runner

---
 .github/workflows/recovery-format.yml | 45 +++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 .github/workflows/recovery-format.yml

diff --git a/.github/workflows/recovery-format.yml b/.github/workflows/recovery-format.yml
new file mode 100644
index 0000000..2ad5f0d
--- /dev/null
+++ b/.github/workflows/recovery-format.yml
@@ -0,0 +1,45 @@
+name: Temporary Recovery Formatter
+
+on:
+  push:
+    branches:
+      - maint/recovery-production-build
+
+permissions: {}
+
+jobs:
+  format:
+    if: github.ref == 'refs/heads/maint/recovery-production-build'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout recovery branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: maint/recovery-production-build
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22.13.0'
+          package-manager-cache: false
+
+      - name: Install locked tools without lifecycle scripts
+        run: npm ci --ignore-scripts --no-audit --no-fund
+
+      - name: Apply the repository's declared Prettier formatting
+        run: npm run format
+
+      - name: Commit formatter-only changes to this recovery branch
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add src tests eslint.config.js vitest.config.ts package.json tsconfig*.json .prettierrc
+          if git diff --cached --quiet; then
+            echo 'No formatting changes were necessary.'
+            exit 0
+          fi
+          git commit -m 'style: apply repository Prettier baseline'
+          git push origin HEAD:maint/recovery-production-build

From 9a91ecf4d9e8a274d97f9518b7e70bd0c8076d76 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 13 Nov 2026 02:14:41 +0000
Subject: [PATCH 37/44] style: apply repository Prettier baseline

---
 src/commands/deploy.ts                        |  13 +-
 src/commands/dev.ts                           |  17 +--
 src/commands/doctor.ts                        |   5 +-
 src/commands/root.ts                          |  14 +-
 src/diagnostics/process.ts                    |   8 +-
 src/diagnostics/stellar.ts                    |  12 +-
 src/generator/template-generation.ts          |  12 +-
 tests/basic-app-package-metadata.test.ts      | 104 ++++++--------
 tests/config-network-enum.test.ts             |   6 +-
 .../config-secret-field-name-variants.test.ts |  21 ++-
 .../deploy-missing-config-remediation.test.ts |   3 +-
 tests/deploy-network-rejection.test.ts        |   3 +-
 tests/deploy-source-rejection.test.ts         |   6 +-
 tests/deploy-strkey-rejection-matrix.test.ts  |  67 ++++++---
 tests/deploy-testnet-e2e.test.ts              |   3 +-
 tests/deployment-docs-conformance.test.ts     |   5 +-
 ...ev-orchestrator-signal-idempotency.test.ts |   5 +-
 ...orchestrator-startup-and-buffering.test.ts |   9 +-
 tests/dev-supervisor-cleanup.test.ts          |  41 +++---
 tests/docker-diagnostic.test.ts               |   3 +-
 tests/doctor-output-conformance.test.ts       |  21 ++-
 .../generator-destination-containment.test.ts |   5 +-
 tests/helpers/mock-child-process.ts           |   3 +-
 tests/helpers/package-metadata.ts             |   7 +-
 tests/npm-invocation-metacharacters.test.ts   | 131 +++++++++---------
 tests/release-pack-snapshot.test.ts           |  28 ++--
 tests/test-orchestration-regression.test.ts   |   3 +-
 tests/test-workflow-platform-and-exit.test.ts |  55 ++++----
 tests/workflow-permissions.test.ts            |   3 +-
 29 files changed, 305 insertions(+), 308 deletions(-)

diff --git a/src/commands/deploy.ts b/src/commands/deploy.ts
index fb36841..3644d85 100644
--- a/src/commands/deploy.ts
+++ b/src/commands/deploy.ts
@@ -1,4 +1,3 @@
-
 import { Command } from 'commander';
 import {
   resolveProjectConfig,
@@ -44,9 +43,7 @@ export function createDeployCommand(
   } = options;
 
   return new Command('deploy')
-    .description(
-      'Deploy a supported StellarForge project to Stellar Testnet.',
-    )
+    .description('Deploy a supported StellarForge project to Stellar Testnet.')
     .option(
       '--network <network>',
       'Deployment network. CLI value overrides stellarforge.config.json.',
@@ -59,12 +56,8 @@ export function createDeployCommand(
       const projectRoot = cwd();
 
       const overrides: ProjectConfigOverrides = {
-        ...(flags.network === undefined
-          ? {}
-          : { network: flags.network }),
-        ...(flags.source === undefined
-          ? {}
-          : { identity: flags.source }),
+        ...(flags.network === undefined ? {} : { network: flags.network }),
+        ...(flags.source === undefined ? {} : { identity: flags.source }),
       };
 
       const configuration = resolveConfig(projectRoot, overrides);
diff --git a/src/commands/dev.ts b/src/commands/dev.ts
index b80dda1..9452a2e 100644
--- a/src/commands/dev.ts
+++ b/src/commands/dev.ts
@@ -1,13 +1,9 @@
-
 import { Command } from 'commander';
 import {
   superviseDevProcesses,
   type DevOrchestratorOptions,
 } from '../dev/orchestrator.js';
-import {
-  resolveDevProcessPlan,
-  type DevProcessSpec,
-} from '../dev/project.js';
+import { resolveDevProcessPlan, type DevProcessSpec } from '../dev/project.js';
 import { TerminalOutput } from '../output/terminal.js';
 
 export interface DevCommandOptions extends DevOrchestratorOptions {
@@ -15,9 +11,7 @@ export interface DevCommandOptions extends DevOrchestratorOptions {
   readonly resolvePlan?: (cwd: string) => readonly DevProcessSpec[];
 }
 
-export function createDevCommand(
-  options: DevCommandOptions = {},
-): Command {
+export function createDevCommand(options: DevCommandOptions = {}): Command {
   const {
     cwd = () => process.cwd(),
     resolvePlan = resolveDevProcessPlan,
@@ -30,12 +24,9 @@ export function createDevCommand(
       const workingDirectory = cwd();
       const plan = resolvePlan(workingDirectory);
       const processCount = plan.length;
-      const processLabel =
-        processCount === 1 ? 'process' : 'processes';
+      const processLabel = processCount === 1 ? 'process' : 'processes';
 
-      output.info(
-        `Starting ${processCount} development ${processLabel}.`,
-      );
+      output.info(`Starting ${processCount} development ${processLabel}.`);
 
       await superviseDevProcesses(plan, {
         ...options,
diff --git a/src/commands/doctor.ts b/src/commands/doctor.ts
index 3344878..d2bb42f 100644
--- a/src/commands/doctor.ts
+++ b/src/commands/doctor.ts
@@ -43,7 +43,10 @@ function sanitizeText(value: string, maxLength: number): string {
     return '';
   }
 
-  let sanitized = value.replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+  let sanitized = value
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
 
   for (const pattern of SECRET_PATTERNS) {
     sanitized = sanitized.replace(pattern, '[REDACTED]');
diff --git a/src/commands/root.ts b/src/commands/root.ts
index 3539b85..3b530e2 100644
--- a/src/commands/root.ts
+++ b/src/commands/root.ts
@@ -1,4 +1,3 @@
-
 import { Command } from 'commander';
 import { resolveCliVersion } from '../version.js';
 import { createDeployCommand } from './deploy.js';
@@ -12,10 +11,7 @@ interface UnknownCommandReporter {
   unknownCommand(): never;
 }
 
-function applyUsageErrorHandling(
-  command: Command,
-  remediation: string,
-): void {
+function applyUsageErrorHandling(command: Command, remediation: string): void {
   command
     .exitOverride()
     .showHelpAfterError(remediation)
@@ -30,9 +26,7 @@ function reportUnknownCommand(command: Command): void {
   (command as unknown as UnknownCommandReporter).unknownCommand();
 }
 
-export function createRootCommand(
-  version = resolveCliVersion(),
-): Command {
+export function createRootCommand(version = resolveCliVersion()): Command {
   const program = new Command()
     .name('stellarforge')
     .description(
@@ -58,9 +52,7 @@ export function createRootCommand(
     program.addCommand(command);
   }
 
-  const commandNames = subcommands
-    .map((command) => command.name())
-    .join(', ');
+  const commandNames = subcommands.map((command) => command.name()).join(', ');
 
   applyUsageErrorHandling(
     program,
diff --git a/src/diagnostics/process.ts b/src/diagnostics/process.ts
index b32c2c1..3edc1ff 100644
--- a/src/diagnostics/process.ts
+++ b/src/diagnostics/process.ts
@@ -29,7 +29,8 @@ export const runCommand: RunCommand = (executable, args) => {
   };
 };
 
-export type CommandOutcome = 'ok' | 'missing-executable' | 'timed-out' | 'failed';
+export type CommandOutcome =
+  'ok' | 'missing-executable' | 'timed-out' | 'failed';
 
 /**
  * Recognizes the platform-specific ways Node reports that an executable could
@@ -53,7 +54,10 @@ export function isExecutableNotFound(error: unknown): boolean {
  * diagnostic treats a missing executable consistently.
  */
 export function classifyCommandResult(result: CommandResult): CommandOutcome {
-  if (result.error !== undefined && (result.error as NodeJS.ErrnoException).code === 'ETIMEDOUT') {
+  if (
+    result.error !== undefined &&
+    (result.error as NodeJS.ErrnoException).code === 'ETIMEDOUT'
+  ) {
     return 'timed-out';
   }
 
diff --git a/src/diagnostics/stellar.ts b/src/diagnostics/stellar.ts
index ce701ba..ea406ba 100644
--- a/src/diagnostics/stellar.ts
+++ b/src/diagnostics/stellar.ts
@@ -15,7 +15,8 @@ const STELLAR_CLI_INSTALL_URL =
 
 function parseStellarVersion(output: string): string | null {
   const value = output.trim();
-  const match = /^v?(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  const match =
+    /^v?(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
   return match?.[1] ?? null;
 }
 
@@ -36,8 +37,7 @@ export function createStellarDiagnostic(
           label: 'Stellar CLI',
           status: 'fail',
           message: 'Stellar CLI is unavailable or could not be executed.',
-          remediation:
-            `Install or update the official Stellar CLI (${STELLAR_CLI_INSTALL_URL}), then ensure \`stellar\` is on PATH and \`stellar version --only-version\` reports a version.`,
+          remediation: `Install or update the official Stellar CLI (${STELLAR_CLI_INSTALL_URL}), then ensure \`stellar\` is on PATH and \`stellar version --only-version\` reports a version.`,
         };
       }
 
@@ -50,8 +50,7 @@ export function createStellarDiagnostic(
           label: 'Stellar CLI',
           status: 'fail',
           message: 'Stellar CLI returned an unrecognized version.',
-          remediation:
-            `Run \`stellar version --only-version\`; if it does not report a semantic version, reinstall or update the official Stellar CLI (${STELLAR_CLI_INSTALL_URL}).`,
+          remediation: `Run \`stellar version --only-version\`; if it does not report a semantic version, reinstall or update the official Stellar CLI (${STELLAR_CLI_INSTALL_URL}).`,
         };
       }
 
@@ -61,8 +60,7 @@ export function createStellarDiagnostic(
           label: 'Stellar CLI',
           status: 'fail',
           message: `Unsupported Stellar CLI version ${version}.`,
-          remediation:
-            `Update the official Stellar CLI to >=27.1.0 (${STELLAR_CLI_INSTALL_URL}), then verify \`stellar version --only-version\` reports a supported version.`,
+          remediation: `Update the official Stellar CLI to >=27.1.0 (${STELLAR_CLI_INSTALL_URL}), then verify \`stellar version --only-version\` reports a supported version.`,
         };
       }
 
diff --git a/src/generator/template-generation.ts b/src/generator/template-generation.ts
index 65b8b3d..ae5bc52 100644
--- a/src/generator/template-generation.ts
+++ b/src/generator/template-generation.ts
@@ -72,11 +72,13 @@ function copyTemplateTree(
   variables: Readonly<Record<string, string>>,
 ): void {
   const sourceDirectory = resolve(templateRoot, relativeDirectory);
-  const entries = readdirSync(sourceDirectory, { withFileTypes: true }).sort((a, b) => {
-    if (a.name < b.name) return -1;
-    if (a.name > b.name) return 1;
-    return 0;
-  });
+  const entries = readdirSync(sourceDirectory, { withFileTypes: true }).sort(
+    (a, b) => {
+      if (a.name < b.name) return -1;
+      if (a.name > b.name) return 1;
+      return 0;
+    },
+  );
 
   for (const entry of entries) {
     assertSafeEntryName(entry.name);
diff --git a/tests/basic-app-package-metadata.test.ts b/tests/basic-app-package-metadata.test.ts
index 525f440..6aae765 100644
--- a/tests/basic-app-package-metadata.test.ts
+++ b/tests/basic-app-package-metadata.test.ts
@@ -39,14 +39,11 @@ describe('Basic App package metadata conformance (SW-041)', () => {
 
       command.parse(['node', 'new', 'my-stellar-app']);
 
-      assertPackageMetadata(
-        join(root, 'my-stellar-app', 'package.json'),
-        {
-          name: 'my-stellar-app',
-          scripts: FROZEN_SCRIPTS,
-          nodeEngine: FROZEN_NODE_ENGINE,
-        },
-      );
+      assertPackageMetadata(join(root, 'my-stellar-app', 'package.json'), {
+        name: 'my-stellar-app',
+        scripts: FROZEN_SCRIPTS,
+        nodeEngine: FROZEN_NODE_ENGINE,
+      });
     }));
 
   it('sets the package name to the generated project name', () =>
@@ -58,14 +55,11 @@ describe('Basic App package metadata conformance (SW-041)', () => {
 
       command.parse(['node', 'new', 'my-stellar-app']);
 
-      assertPackageMetadata(
-        join(root, 'my-stellar-app', 'package.json'),
-        {
-          name: 'my-stellar-app',
-          scripts: FROZEN_SCRIPTS,
-          nodeEngine: FROZEN_NODE_ENGINE,
-        },
-      );
+      assertPackageMetadata(join(root, 'my-stellar-app', 'package.json'), {
+        name: 'my-stellar-app',
+        scripts: FROZEN_SCRIPTS,
+        nodeEngine: FROZEN_NODE_ENGINE,
+      });
     }));
 
   it('retains all frozen script entries without modification', () =>
@@ -77,14 +71,11 @@ describe('Basic App package metadata conformance (SW-041)', () => {
 
       command.parse(['node', 'new', 'my-stellar-app']);
 
-      assertPackageMetadata(
-        join(root, 'my-stellar-app', 'package.json'),
-        {
-          name: 'my-stellar-app',
-          scripts: FROZEN_SCRIPTS,
-          nodeEngine: FROZEN_NODE_ENGINE,
-        },
-      );
+      assertPackageMetadata(join(root, 'my-stellar-app', 'package.json'), {
+        name: 'my-stellar-app',
+        scripts: FROZEN_SCRIPTS,
+        nodeEngine: FROZEN_NODE_ENGINE,
+      });
     }));
 
   it('retains only the frozen script keys and no extras', () =>
@@ -96,14 +87,11 @@ describe('Basic App package metadata conformance (SW-041)', () => {
 
       command.parse(['node', 'new', 'my-stellar-app']);
 
-      assertPackageMetadata(
-        join(root, 'my-stellar-app', 'package.json'),
-        {
-          name: 'my-stellar-app',
-          scripts: FROZEN_SCRIPTS,
-          nodeEngine: FROZEN_NODE_ENGINE,
-        },
-      );
+      assertPackageMetadata(join(root, 'my-stellar-app', 'package.json'), {
+        name: 'my-stellar-app',
+        scripts: FROZEN_SCRIPTS,
+        nodeEngine: FROZEN_NODE_ENGINE,
+      });
     }));
 
   it('sets the engines.node constraint to the frozen minimum version', () =>
@@ -115,14 +103,11 @@ describe('Basic App package metadata conformance (SW-041)', () => {
 
       command.parse(['node', 'new', 'my-stellar-app']);
 
-      assertPackageMetadata(
-        join(root, 'my-stellar-app', 'package.json'),
-        {
-          name: 'my-stellar-app',
-          scripts: FROZEN_SCRIPTS,
-          nodeEngine: FROZEN_NODE_ENGINE,
-        },
-      );
+      assertPackageMetadata(join(root, 'my-stellar-app', 'package.json'), {
+        name: 'my-stellar-app',
+        scripts: FROZEN_SCRIPTS,
+        nodeEngine: FROZEN_NODE_ENGINE,
+      });
     }));
 
   it('generates no dependencies field', () =>
@@ -134,14 +119,11 @@ describe('Basic App package metadata conformance (SW-041)', () => {
 
       command.parse(['node', 'new', 'my-stellar-app']);
 
-      assertPackageMetadata(
-        join(root, 'my-stellar-app', 'package.json'),
-        {
-          name: 'my-stellar-app',
-          scripts: FROZEN_SCRIPTS,
-          nodeEngine: FROZEN_NODE_ENGINE,
-        },
-      );
+      assertPackageMetadata(join(root, 'my-stellar-app', 'package.json'), {
+        name: 'my-stellar-app',
+        scripts: FROZEN_SCRIPTS,
+        nodeEngine: FROZEN_NODE_ENGINE,
+      });
     }));
 
   it('generates no devDependencies field', () =>
@@ -153,14 +135,11 @@ describe('Basic App package metadata conformance (SW-041)', () => {
 
       command.parse(['node', 'new', 'my-stellar-app']);
 
-      assertPackageMetadata(
-        join(root, 'my-stellar-app', 'package.json'),
-        {
-          name: 'my-stellar-app',
-          scripts: FROZEN_SCRIPTS,
-          nodeEngine: FROZEN_NODE_ENGINE,
-        },
-      );
+      assertPackageMetadata(join(root, 'my-stellar-app', 'package.json'), {
+        name: 'my-stellar-app',
+        scripts: FROZEN_SCRIPTS,
+        nodeEngine: FROZEN_NODE_ENGINE,
+      });
     }));
 
   it('does not embed secret, seed, or private-key values in the generated package.json', () =>
@@ -172,14 +151,11 @@ describe('Basic App package metadata conformance (SW-041)', () => {
 
       command.parse(['node', 'new', 'my-stellar-app']);
 
-      assertPackageMetadata(
-        join(root, 'my-stellar-app', 'package.json'),
-        {
-          name: 'my-stellar-app',
-          scripts: FROZEN_SCRIPTS,
-          nodeEngine: FROZEN_NODE_ENGINE,
-        },
-      );
+      assertPackageMetadata(join(root, 'my-stellar-app', 'package.json'), {
+        name: 'my-stellar-app',
+        scripts: FROZEN_SCRIPTS,
+        nodeEngine: FROZEN_NODE_ENGINE,
+      });
     }));
 
   it(
diff --git a/tests/config-network-enum.test.ts b/tests/config-network-enum.test.ts
index 86bf527..3f460cd 100644
--- a/tests/config-network-enum.test.ts
+++ b/tests/config-network-enum.test.ts
@@ -48,9 +48,9 @@ describe('configuration network enum', () => {
   it.each(unsupportedNetworks)(
     'rejects unsupported network %j with an actionable message',
     (network) => {
-      expect(() =>
-        validateStellarForgeConfig({ version: 1, network }),
-      ).toThrow(ENUM_MESSAGE);
+      expect(() => validateStellarForgeConfig({ version: 1, network })).toThrow(
+        ENUM_MESSAGE,
+      );
     },
   );
 
diff --git a/tests/config-secret-field-name-variants.test.ts b/tests/config-secret-field-name-variants.test.ts
index 10b2b3c..dc06ea0 100644
--- a/tests/config-secret-field-name-variants.test.ts
+++ b/tests/config-secret-field-name-variants.test.ts
@@ -243,18 +243,15 @@ describe('legitimate schema fields remain accepted (#181)', () => {
     },
   );
 
-  it.each([
-    'deployer',
-    'team-deployer',
-    'team_deployer',
-    'Alice',
-    'a1',
-  ])('accepts the named identity alias %j', (identity) => {
-    expect(validateStellarForgeConfig({ version: 1, identity })).toEqual({
-      version: 1,
-      identity,
-    });
-  });
+  it.each(['deployer', 'team-deployer', 'team_deployer', 'Alice', 'a1'])(
+    'accepts the named identity alias %j',
+    (identity) => {
+      expect(validateStellarForgeConfig({ version: 1, identity })).toEqual({
+        version: 1,
+        identity,
+      });
+    },
+  );
 
   it('accepts a fully populated valid config', () => {
     expect(
diff --git a/tests/deploy-missing-config-remediation.test.ts b/tests/deploy-missing-config-remediation.test.ts
index 594f3e7..c0fa3e3 100644
--- a/tests/deploy-missing-config-remediation.test.ts
+++ b/tests/deploy-missing-config-remediation.test.ts
@@ -20,8 +20,7 @@ class FakeChild implements ManagedChildProcess {
   readonly stdout = new PassThrough();
   readonly stderr = new PassThrough();
   #exitListener:
-    | ((code: number | null, signal: NodeJS.Signals | null) => void)
-    | undefined;
+    ((code: number | null, signal: NodeJS.Signals | null) => void) | undefined;
 
   once(event: 'error', listener: (error: Error) => void): this;
   once(
diff --git a/tests/deploy-network-rejection.test.ts b/tests/deploy-network-rejection.test.ts
index ac311f5..20221b9 100644
--- a/tests/deploy-network-rejection.test.ts
+++ b/tests/deploy-network-rejection.test.ts
@@ -47,7 +47,8 @@ describe('Stellar deploy network rejection matrix', () => {
       writeCargoWorkspace(root);
 
       expectNetworkRejection(network, root);
-    }));
+    }),
+  );
 
   it('accepts only the explicit Testnet target', () =>
     withTempDirectory((root) => {
diff --git a/tests/deploy-source-rejection.test.ts b/tests/deploy-source-rejection.test.ts
index 0b1a6af..7a85ea5 100644
--- a/tests/deploy-source-rejection.test.ts
+++ b/tests/deploy-source-rejection.test.ts
@@ -73,7 +73,8 @@ describe('Stellar deploy source validation', () => {
           source,
         }),
       ).toThrow(ValidationCliError);
-    }));
+    }),
+  );
 
   it.each(sensitiveSources)(
     'does not echo rejected source value %j',
@@ -107,7 +108,8 @@ describe('Stellar deploy source validation', () => {
 
       expect(spec?.args).toContain('--source-account');
       expect(spec?.args).toContain(source);
-    }));
+    }),
+  );
 
   it('rejects an unsafe source before the deploy subprocess starts', () =>
     withTempDirectory(async (root) => {
diff --git a/tests/deploy-strkey-rejection-matrix.test.ts b/tests/deploy-strkey-rejection-matrix.test.ts
index 25013f0..e6cb37b 100644
--- a/tests/deploy-strkey-rejection-matrix.test.ts
+++ b/tests/deploy-strkey-rejection-matrix.test.ts
@@ -56,8 +56,14 @@ const CANONICAL_SEED = `S${strkeyBody(55)}`;
 const CANONICAL_STRKEYS = [
   { name: 'G account address', value: CANONICAL_ACCOUNT },
   { name: 'S secret seed', value: CANONICAL_SEED },
-  { name: 'G address over the full base32 alphabet', value: `G${BASE32.repeat(2).slice(0, 55)}` },
-  { name: 'S seed over the full base32 alphabet', value: `S${BASE32.repeat(2).slice(0, 55)}` },
+  {
+    name: 'G address over the full base32 alphabet',
+    value: `G${BASE32.repeat(2).slice(0, 55)}`,
+  },
+  {
+    name: 'S seed over the full base32 alphabet',
+    value: `S${BASE32.repeat(2).slice(0, 55)}`,
+  },
   { name: 'G address with digits 2-7', value: `G${'2'.repeat(55)}` },
 ] as const;
 
@@ -70,7 +76,10 @@ const NOT_AN_ALIAS = [
   { name: 'G-shaped value with an equals sign', value: `G${strkeyBody(54)}=` },
   { name: 'G-shaped value with a tab', value: `G${strkeyBody(54)}\t` },
   { name: 'G-shaped value with a slash', value: `G${strkeyBody(54)}/x` },
-  { name: '65 characters, one past the alias limit', value: `G${strkeyBody(64)}` },
+  {
+    name: '65 characters, one past the alias limit',
+    value: `G${strkeyBody(64)}`,
+  },
   { name: 'leading digit', value: `1${strkeyBody(55)}` },
   { name: 'leading hyphen', value: `-${strkeyBody(55)}` },
   { name: 'leading dot', value: `.${strkeyBody(55)}` },
@@ -129,13 +138,16 @@ describe('canonical raw StrKeys are refused (#186)', () => {
     expect(error.message).toContain(IDENTITY_REJECTION);
   });
 
-  it.each(CANONICAL_STRKEYS)('never reflects a $name in the error', ({ value }) => {
-    const error = captureIdentityError(value);
+  it.each(CANONICAL_STRKEYS)(
+    'never reflects a $name in the error',
+    ({ value }) => {
+      const error = captureIdentityError(value);
 
-    // The message is fixed text; nothing interpolates the rejected value.
-    expect(error.message).not.toContain(value);
-    expect(error.message).not.toContain(value.slice(1, 12));
-  });
+      // The message is fixed text; nothing interpolates the rejected value.
+      expect(error.message).not.toContain(value);
+      expect(error.message).not.toContain(value.slice(1, 12));
+    },
+  );
 
   it('rejects a 56-character value on length alone, whatever the prefix', () => {
     // Any G/S-prefixed 56-character uppercase base32 string hits the rule; the
@@ -166,7 +178,9 @@ describe('values that cannot be an alias are refused (#186)', () => {
 
   it('keeps the boundary at 64 characters', () => {
     // 64 is the alias limit and is accepted; 65 is one past it and is not.
-    expect(validateIdentityAlias(`A${'a'.repeat(63)}`)).toBe(`A${'a'.repeat(63)}`);
+    expect(validateIdentityAlias(`A${'a'.repeat(63)}`)).toBe(
+      `A${'a'.repeat(63)}`,
+    );
     expect(() => validateIdentityAlias(`A${'a'.repeat(64)}`)).toThrow(
       IDENTITY_REJECTION,
     );
@@ -174,12 +188,15 @@ describe('values that cannot be an alias are refused (#186)', () => {
 });
 
 describe('the StrKey rule boundary is explicit (#186)', () => {
-  it.each(NEAR_MISS_STRKEYS)('accepts a $name as a plain alias', ({ value }) => {
-    // None of these is a valid Stellar key, so nothing secret is exposed. They
-    // are forwarded as an identity name and the Stellar CLI fails to resolve
-    // them. Pinned so a widened rule fails loudly instead of by accident.
-    expect(validateIdentityAlias(value)).toBe(value);
-  });
+  it.each(NEAR_MISS_STRKEYS)(
+    'accepts a $name as a plain alias',
+    ({ value }) => {
+      // None of these is a valid Stellar key, so nothing secret is exposed. They
+      // are forwarded as an identity name and the Stellar CLI fails to resolve
+      // them. Pinned so a widened rule fails loudly instead of by accident.
+      expect(validateIdentityAlias(value)).toBe(value);
+    },
+  );
 });
 
 describe('named aliases keep working (#186)', () => {
@@ -194,7 +211,11 @@ describe('deploy refuses a raw StrKey before spawning (#186)', () => {
     ({ value }) =>
       withTempDirectory((root: string) => {
         // A valid workspace, so only the source can be the reason for failure.
-        writeFileSync(join(root, 'Cargo.toml'), '[workspace]\nmembers = []\n', 'utf8');
+        writeFileSync(
+          join(root, 'Cargo.toml'),
+          '[workspace]\nmembers = []\n',
+          'utf8',
+        );
 
         expect(() =>
           resolveTestnetDeploymentPlan({
@@ -210,7 +231,11 @@ describe('deploy refuses a raw StrKey before spawning (#186)', () => {
     'rejects $name before any subprocess is planned',
     ({ value }) =>
       withTempDirectory((root: string) => {
-        writeFileSync(join(root, 'Cargo.toml'), '[workspace]\nmembers = []\n', 'utf8');
+        writeFileSync(
+          join(root, 'Cargo.toml'),
+          '[workspace]\nmembers = []\n',
+          'utf8',
+        );
 
         expect(() =>
           resolveTestnetDeploymentPlan({
@@ -224,7 +249,11 @@ describe('deploy refuses a raw StrKey before spawning (#186)', () => {
 
   it('plans a deployment for a named alias in a generated workspace', () =>
     withTempDirectory((root: string) => {
-      writeFileSync(join(root, 'Cargo.toml'), '[workspace]\nmembers = []\n', 'utf8');
+      writeFileSync(
+        join(root, 'Cargo.toml'),
+        '[workspace]\nmembers = []\n',
+        'utf8',
+      );
 
       const plan = resolveTestnetDeploymentPlan({
         cwd: root,
diff --git a/tests/deploy-testnet-e2e.test.ts b/tests/deploy-testnet-e2e.test.ts
index 6094d9c..83fc705 100644
--- a/tests/deploy-testnet-e2e.test.ts
+++ b/tests/deploy-testnet-e2e.test.ts
@@ -21,8 +21,7 @@ class MockDeployProcess implements ManagedChildProcess {
   readonly stdout = new PassThrough();
   readonly stderr = new PassThrough();
   #exitListener:
-    | ((code: number | null, signal: NodeJS.Signals | null) => void)
-    | undefined;
+    ((code: number | null, signal: NodeJS.Signals | null) => void) | undefined;
   #errorListener: ((error: Error) => void) | undefined;
 
   once(event: 'error', listener: (error: Error) => void): this;
diff --git a/tests/deployment-docs-conformance.test.ts b/tests/deployment-docs-conformance.test.ts
index 80d504a..0651524 100644
--- a/tests/deployment-docs-conformance.test.ts
+++ b/tests/deployment-docs-conformance.test.ts
@@ -196,7 +196,10 @@ describe('SW-103: Testnet deployment documentation conformance', () => {
 
       for (const cmdLine of deployCommands) {
         await withTempDirectory(async (root) => {
-          writeFileSync(join(root, 'Cargo.toml'), '[workspace]\nmembers = []\n');
+          writeFileSync(
+            join(root, 'Cargo.toml'),
+            '[workspace]\nmembers = []\n',
+          );
           // Write default config so that commands without explicit flags can resolve
           writeFileSync(
             join(root, 'stellarforge.config.json'),
diff --git a/tests/dev-orchestrator-signal-idempotency.test.ts b/tests/dev-orchestrator-signal-idempotency.test.ts
index 2d201a1..b104751 100644
--- a/tests/dev-orchestrator-signal-idempotency.test.ts
+++ b/tests/dev-orchestrator-signal-idempotency.test.ts
@@ -32,8 +32,7 @@ class FakeChild implements ManagedChildProcess {
   readonly killedSignals: NodeJS.Signals[] = [];
   #errorListener: ((error: Error) => void) | undefined;
   #exitListener:
-    | ((code: number | null, signal: NodeJS.Signals | null) => void)
-    | undefined;
+    ((code: number | null, signal: NodeJS.Signals | null) => void) | undefined;
 
   once(event: 'error', listener: (error: Error) => void): this;
   once(
@@ -203,4 +202,4 @@ describe.each([
       expect(signals.has('SIGTERM')).toBe(false);
     });
   },
-);
\ No newline at end of file
+);
diff --git a/tests/dev-orchestrator-startup-and-buffering.test.ts b/tests/dev-orchestrator-startup-and-buffering.test.ts
index ed657af..fcfc9bb 100644
--- a/tests/dev-orchestrator-startup-and-buffering.test.ts
+++ b/tests/dev-orchestrator-startup-and-buffering.test.ts
@@ -33,8 +33,7 @@ class FakeChild implements ManagedChildProcess {
   readonly killedSignals: NodeJS.Signals[] = [];
   #errorListener: ((error: Error) => void) | undefined;
   #exitListener:
-    | ((code: number | null, signal: NodeJS.Signals | null) => void)
-    | undefined;
+    ((code: number | null, signal: NodeJS.Signals | null) => void) | undefined;
 
   once(event: 'error', listener: (error: Error) => void): this;
   once(
@@ -254,7 +253,9 @@ describe('dev supervisor partial-line buffering (#159)', () => {
 
     // No trailing newline: the buffer must still reach the terminal.
     child.stdout.write('done');
-    const ended = new Promise<void>((resolve) => child.stdout.once('end', resolve));
+    const ended = new Promise<void>((resolve) =>
+      child.stdout.once('end', resolve),
+    );
     child.stdout.end();
     await ended;
     expect(captured.stdoutText()).toContain('[api] done');
@@ -262,4 +263,4 @@ describe('dev supervisor partial-line buffering (#159)', () => {
     child.emitExit(0, null);
     await running;
   });
-});
\ No newline at end of file
+});
diff --git a/tests/dev-supervisor-cleanup.test.ts b/tests/dev-supervisor-cleanup.test.ts
index b7654c3..9d00077 100644
--- a/tests/dev-supervisor-cleanup.test.ts
+++ b/tests/dev-supervisor-cleanup.test.ts
@@ -37,8 +37,7 @@ class FakeChild implements ManagedChildProcess {
   readonly killedSignals: NodeJS.Signals[] = [];
   #errorListener: ((error: Error) => void) | undefined;
   #exitListener:
-    | ((code: number | null, signal: NodeJS.Signals | null) => void)
-    | undefined;
+    ((code: number | null, signal: NodeJS.Signals | null) => void) | undefined;
 
   once(event: 'error', listener: (error: Error) => void): this;
   once(
@@ -114,20 +113,17 @@ describe('supervisor cleanup never orphans a child (#166)', () => {
   it('terminates every started child when one fails to spawn', async () => {
     const spawned: FakeChild[] = [];
 
-    const running = superviseDevProcesses(
-      specs('database', 'api', 'worker'),
-      {
-        spawnProcess(planned) {
-          if (planned.label === 'api') {
-            throw new Error('spawn EACCES');
-          }
-          const child = new FakeChild();
-          spawned.push(child);
-          return child;
-        },
-        signalSource: new FakeSignalSource(),
+    const running = superviseDevProcesses(specs('database', 'api', 'worker'), {
+      spawnProcess(planned) {
+        if (planned.label === 'api') {
+          throw new Error('spawn EACCES');
+        }
+        const child = new FakeChild();
+        spawned.push(child);
+        return child;
       },
-    );
+      signalSource: new FakeSignalSource(),
+    });
 
     await expect(running).rejects.toBeInstanceOf(SubprocessCliError);
 
@@ -143,13 +139,10 @@ describe('supervisor cleanup never orphans a child (#166)', () => {
     const children = [new FakeChild(), new FakeChild(), new FakeChild()];
     let index = 0;
 
-    const running = superviseDevProcesses(
-      specs('database', 'api', 'worker'),
-      {
-        spawnProcess: () => children[index++]!,
-        signalSource: new FakeSignalSource(),
-      },
-    );
+    const running = superviseDevProcesses(specs('database', 'api', 'worker'), {
+      spawnProcess: () => children[index++]!,
+      signalSource: new FakeSignalSource(),
+    });
 
     children[1]?.emitExit(3, null);
 
@@ -195,7 +188,7 @@ describe('supervisor cleanup never orphans a child (#166)', () => {
     children[0]?.emitExit(9, 'SIGKILL');
 
     await expect(running).rejects.toThrow(
-      'Development process \'api\' exited unexpectedly with code 9 after SIGKILL.',
+      "Development process 'api' exited unexpectedly with code 9 after SIGKILL.",
     );
   });
 
@@ -233,4 +226,4 @@ describe('supervisor cleanup never orphans a child (#166)', () => {
     );
     expect(children[0]?.killedSignals).toEqual(['SIGTERM']);
   });
-});
\ No newline at end of file
+});
diff --git a/tests/docker-diagnostic.test.ts b/tests/docker-diagnostic.test.ts
index a64795f..39f6010 100644
--- a/tests/docker-diagnostic.test.ts
+++ b/tests/docker-diagnostic.test.ts
@@ -128,5 +128,6 @@ describe('Docker diagnostic', () => {
       expect(diagnostic.status).toBe('warn');
       expect(diagnostic.message).toContain('daemon');
       expect(diagnostic.message).not.toContain('unreachable');
-    });
+    },
+  );
 });
diff --git a/tests/doctor-output-conformance.test.ts b/tests/doctor-output-conformance.test.ts
index cf2fe79..7cd3325 100644
--- a/tests/doctor-output-conformance.test.ts
+++ b/tests/doctor-output-conformance.test.ts
@@ -64,7 +64,12 @@ function runDoctorWithChecks(checks: readonly DiagnosticCheck[]): {
 describe('SW-001: Doctor output snapshot conformance tests', () => {
   it('matches output snapshot and contract for all-pass diagnostics', () => {
     const checks: readonly DiagnosticCheck[] = [
-      mockCheck('node', 'Node.js', 'pass', 'Supported version 22.13.0 detected.'),
+      mockCheck(
+        'node',
+        'Node.js',
+        'pass',
+        'Supported version 22.13.0 detected.',
+      ),
       mockCheck('npm', 'npm', 'pass', 'Supported version 10.9.2 detected.'),
       mockCheck('git', 'Git', 'pass', 'git version 2.45.0 detected.'),
       mockCheck('rust', 'Rust', 'pass', 'rustc 1.84.0 detected.'),
@@ -94,7 +99,12 @@ describe('SW-001: Doctor output snapshot conformance tests', () => {
 
   it('matches output snapshot and contract for warning diagnostics (usable with warnings)', () => {
     const checks: readonly DiagnosticCheck[] = [
-      mockCheck('node', 'Node.js', 'pass', 'Supported version 22.13.0 detected.'),
+      mockCheck(
+        'node',
+        'Node.js',
+        'pass',
+        'Supported version 22.13.0 detected.',
+      ),
       mockCheck('npm', 'npm', 'pass', 'Supported version 10.9.2 detected.'),
       mockCheck(
         'docker',
@@ -123,7 +133,12 @@ describe('SW-001: Doctor output snapshot conformance tests', () => {
 
   it('matches output snapshot and contract for failure diagnostics (action required)', () => {
     const checks: readonly DiagnosticCheck[] = [
-      mockCheck('node', 'Node.js', 'pass', 'Supported version 22.13.0 detected.'),
+      mockCheck(
+        'node',
+        'Node.js',
+        'pass',
+        'Supported version 22.13.0 detected.',
+      ),
       mockCheck(
         'stellar',
         'Stellar CLI',
diff --git a/tests/generator-destination-containment.test.ts b/tests/generator-destination-containment.test.ts
index 7caeec6..edaf024 100644
--- a/tests/generator-destination-containment.test.ts
+++ b/tests/generator-destination-containment.test.ts
@@ -131,10 +131,7 @@ describe('generator destination containment', () => {
     });
 
     expect(() =>
-      planProjectDestination(
-        { ...input, projectName: '.' },
-        emptyFileSystem,
-      ),
+      planProjectDestination({ ...input, projectName: '.' }, emptyFileSystem),
     ).toThrow(ValidationCliError);
   });
 });
diff --git a/tests/helpers/mock-child-process.ts b/tests/helpers/mock-child-process.ts
index cef1231..2dd3cb8 100644
--- a/tests/helpers/mock-child-process.ts
+++ b/tests/helpers/mock-child-process.ts
@@ -12,8 +12,7 @@ export class MockChildProcess implements ManagedChildProcess {
   readonly stdout = new PassThrough();
   readonly stderr = new PassThrough();
   #exitListener:
-    | ((code: number | null, signal: NodeJS.Signals | null) => void)
-    | undefined;
+    ((code: number | null, signal: NodeJS.Signals | null) => void) | undefined;
   #errorListener: ((error: Error) => void) | undefined;
 
   once(event: 'error', listener: (error: Error) => void): this;
diff --git a/tests/helpers/package-metadata.ts b/tests/helpers/package-metadata.ts
index 4691ad2..24b3c6c 100644
--- a/tests/helpers/package-metadata.ts
+++ b/tests/helpers/package-metadata.ts
@@ -119,9 +119,10 @@ export function assertPackageMetadata(
   );
 
   // 2. Scripts — exact values
-  expect(pkg['scripts'], `package.json 'scripts' at ${packageJsonPath}`).toEqual(
-    options.scripts,
-  );
+  expect(
+    pkg['scripts'],
+    `package.json 'scripts' at ${packageJsonPath}`,
+  ).toEqual(options.scripts);
 
   // 2b. Scripts — no extra keys beyond what is expected
   const actualScriptKeys = Object.keys(
diff --git a/tests/npm-invocation-metacharacters.test.ts b/tests/npm-invocation-metacharacters.test.ts
index 1f3a73b..8a13c5e 100644
--- a/tests/npm-invocation-metacharacters.test.ts
+++ b/tests/npm-invocation-metacharacters.test.ts
@@ -40,72 +40,69 @@ afterEach(() => {
 describe.each([
   { platform: 'win32', label: 'Windows' },
   { platform: 'linux', label: 'POSIX' },
-] as const)(
-  'npm invocation on $label',
-  ({ platform }) => {
-    it('runs a safe fixed command successfully', () => {
-      onPlatform(platform);
-
-      const invocation = createNpmInvocation(['run', 'test']);
-
-      expect(Array.isArray(invocation.args)).toBe(true);
-      expect(invocation.args.slice(-2)).toEqual(['run', 'test']);
-      if (platform === 'win32') {
-        // `/d /s /c` is the documented safe wrapper: it disables AutoRun
-        // autorestart and treats the remainder as a single command.
-        expect(invocation.command).toBe('cmd.exe');
-        expect(invocation.args.slice(0, 3)).toEqual(['/d', '/s', '/c']);
-      } else {
-        expect(invocation.command).toBe('npm');
-      }
-    });
-
-    it.each([
-      'value & calc.exe',
-      'value | more',
-      'value; del important.txt',
-      '$(whoami)',
-      '`id`',
-      'value > C:/Windows/System32/out.txt',
-      'value && echo pwned',
-      'a"b',
-      "a'b",
-      'value\nsecond',
-    ])('keeps %j a single, inert argv element', (hostile) => {
-      onPlatform(platform);
-
-      const invocation = createNpmInvocation(['run', 'test', '--', hostile]);
-      const forwarded = invocation.args[invocation.args.length - 1];
-
-      // Present exactly once, byte-for-byte: never split, quoted or concatenated
-      // into the command line.
-      expect(forwarded).toBe(hostile);
-      expect(invocation.args.filter((arg) => arg === hostile)).toHaveLength(1);
-
-      // The fixed npm prefix is untouched, so nothing can be prepended to it.
-      if (platform === 'win32') {
-        expect(invocation.args.slice(0, 4)).toEqual(['/d', '/s', '/c', 'npm']);
-      } else {
-        expect(invocation.command).toBe('npm');
-      }
-    });
-
-    it('never produces a single joined command string', () => {
-      onPlatform(platform);
-
-      const invocation = createNpmInvocation(['run', 'test', '--', 'a && b']);
-
-      // The whole defence is that `command` and `args` stay separate so the
-      // spawner can pass `shell: false`.
-      expect(typeof invocation.command).toBe('string');
-      expect(Array.isArray(invocation.args)).toBe(true);
-      for (const arg of invocation.args) {
-        expect(typeof arg).toBe('string');
-      }
-      expect(invocation.args.join(' ')).toContain('a && b');
-    });
-  },
-);
+] as const)('npm invocation on $label', ({ platform }) => {
+  it('runs a safe fixed command successfully', () => {
+    onPlatform(platform);
+
+    const invocation = createNpmInvocation(['run', 'test']);
+
+    expect(Array.isArray(invocation.args)).toBe(true);
+    expect(invocation.args.slice(-2)).toEqual(['run', 'test']);
+    if (platform === 'win32') {
+      // `/d /s /c` is the documented safe wrapper: it disables AutoRun
+      // autorestart and treats the remainder as a single command.
+      expect(invocation.command).toBe('cmd.exe');
+      expect(invocation.args.slice(0, 3)).toEqual(['/d', '/s', '/c']);
+    } else {
+      expect(invocation.command).toBe('npm');
+    }
+  });
+
+  it.each([
+    'value & calc.exe',
+    'value | more',
+    'value; del important.txt',
+    '$(whoami)',
+    '`id`',
+    'value > C:/Windows/System32/out.txt',
+    'value && echo pwned',
+    'a"b',
+    "a'b",
+    'value\nsecond',
+  ])('keeps %j a single, inert argv element', (hostile) => {
+    onPlatform(platform);
+
+    const invocation = createNpmInvocation(['run', 'test', '--', hostile]);
+    const forwarded = invocation.args[invocation.args.length - 1];
+
+    // Present exactly once, byte-for-byte: never split, quoted or concatenated
+    // into the command line.
+    expect(forwarded).toBe(hostile);
+    expect(invocation.args.filter((arg) => arg === hostile)).toHaveLength(1);
+
+    // The fixed npm prefix is untouched, so nothing can be prepended to it.
+    if (platform === 'win32') {
+      expect(invocation.args.slice(0, 4)).toEqual(['/d', '/s', '/c', 'npm']);
+    } else {
+      expect(invocation.command).toBe('npm');
+    }
+  });
+
+  it('never produces a single joined command string', () => {
+    onPlatform(platform);
+
+    const invocation = createNpmInvocation(['run', 'test', '--', 'a && b']);
+
+    // The whole defence is that `command` and `args` stay separate so the
+    // spawner can pass `shell: false`.
+    expect(typeof invocation.command).toBe('string');
+    expect(Array.isArray(invocation.args)).toBe(true);
+    for (const arg of invocation.args) {
+      expect(typeof arg).toBe('string');
+    }
+    expect(invocation.args.join(' ')).toContain('a && b');
+  });
+});
 
 describe('npm invocation argument handling', () => {
   it('keeps the fixed prefix when no arguments are supplied', () => {
@@ -125,4 +122,4 @@ describe('npm invocation argument handling', () => {
     expect(invocation.command).toBe('npm');
     expect(invocation.args).toEqual([]);
   });
-});
\ No newline at end of file
+});
diff --git a/tests/release-pack-snapshot.test.ts b/tests/release-pack-snapshot.test.ts
index 1ecdc99..b87b3d3 100644
--- a/tests/release-pack-snapshot.test.ts
+++ b/tests/release-pack-snapshot.test.ts
@@ -10,12 +10,18 @@ const packageJson = JSON.parse(
 ) as { name: string; version: string };
 
 function runPackDryRun(command?: string, args?: readonly string[]) {
-  const invocation = createNpmInvocation(args ?? ['pack', '--dry-run', '--json']);
-  const result = spawnSync(command ?? invocation.command, command ? (args ?? []) : invocation.args, {
-    cwd: root,
-    encoding: 'utf8',
-    shell: false,
-  });
+  const invocation = createNpmInvocation(
+    args ?? ['pack', '--dry-run', '--json'],
+  );
+  const result = spawnSync(
+    command ?? invocation.command,
+    command ? (args ?? []) : invocation.args,
+    {
+      cwd: root,
+      encoding: 'utf8',
+      shell: false,
+    },
+  );
   if (result.error || result.status !== 0) {
     throw new Error(
       `npm pack --dry-run failed: ${result.error?.message || result.stderr || result.stdout || 'unknown spawn failure'}`,
@@ -44,7 +50,9 @@ describe('npm pack content snapshot', () => {
       expect(path.startsWith('tests/')).toBe(false);
       expect(path.startsWith('.github/')).toBe(false);
       const basename = path.split('/').at(-1) ?? '';
-      expect(basename === '.env.example' || !/^\.env(?:\..*)?$/.test(basename)).toBe(true);
+      expect(
+        basename === '.env.example' || !/^\.env(?:\..*)?$/.test(basename),
+      ).toBe(true);
       expect(path).not.toBe('.npmrc');
     }
   });
@@ -69,8 +77,8 @@ describe('release dry-run artifact assertions', () => {
   });
 
   it('fails actionably when the dry-run command itself is misconfigured', () => {
-    expect(() => runPackDryRun('stellarforge-command-that-does-not-exist')).toThrow(
-      /npm pack --dry-run failed: .*ENOENT/i,
-    );
+    expect(() =>
+      runPackDryRun('stellarforge-command-that-does-not-exist'),
+    ).toThrow(/npm pack --dry-run failed: .*ENOENT/i);
   });
 });
diff --git a/tests/test-orchestration-regression.test.ts b/tests/test-orchestration-regression.test.ts
index ff0cdb6..5b6020a 100644
--- a/tests/test-orchestration-regression.test.ts
+++ b/tests/test-orchestration-regression.test.ts
@@ -16,8 +16,7 @@ class TestChild implements ManagedChildProcess {
   readonly stdout = new PassThrough();
   readonly stderr = new PassThrough();
   #exitListener:
-    | ((code: number | null, signal: NodeJS.Signals | null) => void)
-    | undefined;
+    ((code: number | null, signal: NodeJS.Signals | null) => void) | undefined;
 
   once(event: 'error', listener: (error: Error) => void): this;
   once(
diff --git a/tests/test-workflow-platform-and-exit.test.ts b/tests/test-workflow-platform-and-exit.test.ts
index d3ac2c5..8b3cd70 100644
--- a/tests/test-workflow-platform-and-exit.test.ts
+++ b/tests/test-workflow-platform-and-exit.test.ts
@@ -52,8 +52,7 @@ class FakeChild implements ManagedChildProcess {
   readonly stderr = new PassThrough();
   readonly killedSignals: NodeJS.Signals[] = [];
   #exitListener:
-    | ((code: number | null, signal: NodeJS.Signals | null) => void)
-    | undefined;
+    ((code: number | null, signal: NodeJS.Signals | null) => void) | undefined;
 
   once(event: 'error', listener: (error: Error) => void): this;
   once(
@@ -134,29 +133,30 @@ describe('Cargo test exit-code propagation (#168)', () => {
     { code: 1, reason: 'test assertion failed' },
     { code: 101, reason: 'cargo test harness panic' },
     { code: 127, reason: 'cargo not executable' },
-  ])('maps a non-zero Cargo exit ($code) to a subprocess failure', async ({
-    code,
-  }) => {
-    const child = new FakeChild();
+  ])(
+    'maps a non-zero Cargo exit ($code) to a subprocess failure',
+    async ({ code }) => {
+      const child = new FakeChild();
 
-    const running = superviseDevProcesses([cargoSpec()], {
-      spawnProcess: () => child,
-      signalSource: new FakeSignalSource(),
-    });
+      const running = superviseDevProcesses([cargoSpec()], {
+        spawnProcess: () => child,
+        signalSource: new FakeSignalSource(),
+      });
 
-    child.emitExit(code, null);
+      child.emitExit(code, null);
 
-    const error = await running.then(
-      () => undefined,
-      (reason: unknown) => reason,
-    );
+      const error = await running.then(
+        () => undefined,
+        (reason: unknown) => reason,
+      );
 
-    expect(error).toBeInstanceOf(SubprocessCliError);
-    expect((error as SubprocessCliError).userMessage).toContain(
-      `with code ${code}`,
-    );
-    expect((error as SubprocessCliError).userMessage).toContain('cargo:test');
-  });
+      expect(error).toBeInstanceOf(SubprocessCliError);
+      expect((error as SubprocessCliError).userMessage).toContain(
+        `with code ${code}`,
+      );
+      expect((error as SubprocessCliError).userMessage).toContain('cargo:test');
+    },
+  );
 
   it('invokes Cargo with an argument array, never a joined shell string', () => {
     const spec = cargoSpec();
@@ -181,12 +181,7 @@ describe('resolved plan matches the platform (#170)', () => {
 
       expect(plan?.command).toBe('cmd.exe');
       // Fixed wrapper flags first, then `npm run test` as separate argv entries.
-      expect(plan?.args.slice(0, 4)).toEqual([
-        '/d',
-        '/s',
-        '/c',
-        'npm',
-      ]);
+      expect(plan?.args.slice(0, 4)).toEqual(['/d', '/s', '/c', 'npm']);
       expect(plan?.args.slice(-2)).toEqual(['run', 'test']);
     });
   });
@@ -242,7 +237,9 @@ describe('resolved plan matches the platform (#170)', () => {
         const [plan] = resolveTestProcessPlan(root);
 
         expect(plan?.label).toBe('cargo:test');
-        expect(plan?.command).toBe(platform === 'win32' ? 'cargo.exe' : 'cargo');
+        expect(plan?.command).toBe(
+          platform === 'win32' ? 'cargo.exe' : 'cargo',
+        );
         expect(plan?.args).toEqual(['test']);
       }
     });
@@ -255,4 +252,4 @@ describe('resolved plan matches the platform (#170)', () => {
       expect(() => resolveTestProcessPlan(root)).toThrow(/No supported/);
     });
   });
-});
\ No newline at end of file
+});
diff --git a/tests/workflow-permissions.test.ts b/tests/workflow-permissions.test.ts
index 6a5817c..fb42769 100644
--- a/tests/workflow-permissions.test.ts
+++ b/tests/workflow-permissions.test.ts
@@ -20,7 +20,8 @@ describe('GHA least-privilege permissions audit (SW-105)', () => {
     const all = auditWorkflowDirectory(fixtures);
     expect(
       all.some(
-        (v) => v.file === 'pr-ci-bad-write-all.yml' && /write-all/.test(v.message),
+        (v) =>
+          v.file === 'pr-ci-bad-write-all.yml' && /write-all/.test(v.message),
       ),
     ).toBe(true);
   });

From f9a635f0411194db5dba9808ecd92ae08cc70073 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:14:53 +0100
Subject: [PATCH 38/44] chore(recovery): remove temporary formatter runner

---
 .github/workflows/recovery-format.yml | 45 ---------------------------
 1 file changed, 45 deletions(-)
 delete mode 100644 .github/workflows/recovery-format.yml

diff --git a/.github/workflows/recovery-format.yml b/.github/workflows/recovery-format.yml
deleted file mode 100644
index 2ad5f0d..0000000
--- a/.github/workflows/recovery-format.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: Temporary Recovery Formatter
-
-on:
-  push:
-    branches:
-      - maint/recovery-production-build
-
-permissions: {}
-
-jobs:
-  format:
-    if: github.ref == 'refs/heads/maint/recovery-production-build'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout recovery branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: maint/recovery-production-build
-
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: '22.13.0'
-          package-manager-cache: false
-
-      - name: Install locked tools without lifecycle scripts
-        run: npm ci --ignore-scripts --no-audit --no-fund
-
-      - name: Apply the repository's declared Prettier formatting
-        run: npm run format
-
-      - name: Commit formatter-only changes to this recovery branch
-        run: |
-          git config user.name 'github-actions[bot]'
-          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git add src tests eslint.config.js vitest.config.ts package.json tsconfig*.json .prettierrc
-          if git diff --cached --quiet; then
-            echo 'No formatting changes were necessary.'
-            exit 0
-          fi
-          git commit -m 'style: apply repository Prettier baseline'
-          git push origin HEAD:maint/recovery-production-build

From e9b0f01b05e40e273e4b906e3655b8413c9dfd7a Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:16:29 +0100
Subject: [PATCH 39/44] chore(release): add patch changeset for recovery fixes

---
 .changeset/recovery-production-fixes.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/recovery-production-fixes.md

diff --git a/.changeset/recovery-production-fixes.md b/.changeset/recovery-production-fixes.md
new file mode 100644
index 0000000..a370109
--- /dev/null
+++ b/.changeset/recovery-production-fixes.md
@@ -0,0 +1,5 @@
+---
+"@diginodes/stellarforge-cli": patch
+---
+
+Restore reliable command timeout diagnostics, secret redaction, generator type resolution, and cross-platform regression validation.

From e39ee49823c2e8c0b24fff08f9109a2cc18c7d97 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:17:11 +0100
Subject: [PATCH 40/44] chore(release): clarify recovery patch summary

---
 .changeset/recovery-production-fixes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changeset/recovery-production-fixes.md b/.changeset/recovery-production-fixes.md
index a370109..ec351d5 100644
--- a/.changeset/recovery-production-fixes.md
+++ b/.changeset/recovery-production-fixes.md
@@ -2,4 +2,4 @@
 "@diginodes/stellarforge-cli": patch
 ---
 
-Restore reliable command timeout diagnostics, secret redaction, generator type resolution, and cross-platform regression validation.
+Restore reliable timeout diagnostics, secret redaction, generator type resolution, and cross-platform CLI validation.

From 944ed3fc4928f5649fa528813e1a3e12e5e57e8d Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:17:43 +0100
Subject: [PATCH 41/44] chore(recovery): sync latest least-privilege automation
 policy

---
 .github/workflows/wave-stale-prs.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/wave-stale-prs.yml b/.github/workflows/wave-stale-prs.yml
index b3ae1f4..3778a38 100644
--- a/.github/workflows/wave-stale-prs.yml
+++ b/.github/workflows/wave-stale-prs.yml
@@ -19,7 +19,7 @@ jobs:
     permissions:
       contents: read
       issues: write
-      pull-requests: read
+      pull-requests: write
     steps:
       - name: Warn and escalate stale Wave PRs
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9

From 9131b4f6fb410ad5145b11c80c70574fd2beedce Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:17:46 +0100
Subject: [PATCH 42/44] chore(recovery): sync latest least-privilege automation
 policy

---
 scripts/audit-workflow-permissions.mjs | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/scripts/audit-workflow-permissions.mjs b/scripts/audit-workflow-permissions.mjs
index 7b491be..fc45ff0 100644
--- a/scripts/audit-workflow-permissions.mjs
+++ b/scripts/audit-workflow-permissions.mjs
@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-/* global process, console */
 /**
  * SW-105 — GitHub Actions least-privilege permissions conformance audit.
  * Static check only. Does not modify workflow permissions.
@@ -20,7 +19,7 @@ const JOB_PERMISSION_ALLOWLIST = {
     publish: new Set(['contents:write', 'id-token:write']),
   },
   'wave-stale-prs.yml': {
-    stale: new Set(['issues:write']),
+    stale: new Set(['issues:write', 'pull-requests:write']),
   },
   'codeql.yml': {
     analyze: new Set(['security-events:write']),
@@ -64,13 +63,13 @@ function extractPermissionBlocks(text) {
       continue;
     }
 
-    const jobMatch = line.match(/^[ ]{2}([A-Za-z0-9_-]+):\s*$/);
+    const jobMatch = line.match(/^  ([A-Za-z0-9_-]+):\s*$/);
     if (jobMatch && currentJob !== null || jobMatch && lines.slice(0, i).some((v) => /^jobs:\s*$/.test(v))) {
       currentJob = jobMatch[1];
     }
 
     const topPerm = line.match(/^permissions:\s*(.*)$/);
-    const jobPerm = line.match(/^[ ]{4}permissions:\s*(.*)$/);
+    const jobPerm = line.match(/^    permissions:\s*(.*)$/);
     const match = topPerm || jobPerm;
     if (!match) continue;
 
@@ -83,7 +82,7 @@ function extractPermissionBlocks(text) {
     } else if (rest.length === 0) {
       let j = i + 1;
       while (j < lines.length) {
-        const entry = lines[j].match(/^[ ]{2,6}([A-Za-z0-9_-]+):\s*(\S+)\s*$/);
+        const entry = lines[j].match(/^ {2,6}([A-Za-z0-9_-]+):\s*(\S+)\s*$/);
         if (!entry) break;
         entries.push({ key: entry[1], value: entry[2] });
         j++;

From 4a43b40c3b99dc28f1dd5c845d8e4c4224886e2b Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:18:23 +0100
Subject: [PATCH 43/44] ci: validate workflow syntax and expressions with
 actionlint

---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1f467e3..3ccf7e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,6 +34,9 @@ jobs:
       - name: Install from committed lockfile
         run: npm ci --ignore-scripts --no-audit --no-fund
 
+      - name: Validate GitHub Actions workflows with actionlint
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
+
       - name: Audit workflow least-privilege permissions
         run: npm run audit:workflow-permissions
 

From 38b91fd00e300efc74ae20e210fdd42fc2c835d8 Mon Sep 17 00:00:00 2001
From: Ahmed Mahmud <ahmedmahmud1994@hotmail.com>
Date: Fri, 13 Nov 2026 03:19:26 +0100
Subject: [PATCH 44/44] fix(ci): keep permissions audit lint-clean with latest
 allowlist

---
 scripts/audit-workflow-permissions.mjs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/scripts/audit-workflow-permissions.mjs b/scripts/audit-workflow-permissions.mjs
index fc45ff0..f5dd415 100644
--- a/scripts/audit-workflow-permissions.mjs
+++ b/scripts/audit-workflow-permissions.mjs
@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+/* global process, console */
 /**
  * SW-105 — GitHub Actions least-privilege permissions conformance audit.
  * Static check only. Does not modify workflow permissions.
@@ -63,13 +64,13 @@ function extractPermissionBlocks(text) {
       continue;
     }
 
-    const jobMatch = line.match(/^  ([A-Za-z0-9_-]+):\s*$/);
+    const jobMatch = line.match(/^[ ]{2}([A-Za-z0-9_-]+):\s*$/);
     if (jobMatch && currentJob !== null || jobMatch && lines.slice(0, i).some((v) => /^jobs:\s*$/.test(v))) {
       currentJob = jobMatch[1];
     }
 
     const topPerm = line.match(/^permissions:\s*(.*)$/);
-    const jobPerm = line.match(/^    permissions:\s*(.*)$/);
+    const jobPerm = line.match(/^[ ]{4}permissions:\s*(.*)$/);
     const match = topPerm || jobPerm;
     if (!match) continue;
 
@@ -82,7 +83,7 @@ function extractPermissionBlocks(text) {
     } else if (rest.length === 0) {
       let j = i + 1;
       while (j < lines.length) {
-        const entry = lines[j].match(/^ {2,6}([A-Za-z0-9_-]+):\s*(\S+)\s*$/);
+        const entry = lines[j].match(/^[ ]{2,6}([A-Za-z0-9_-]+):\s*(\S+)\s*$/);
         if (!entry) break;
         entries.push({ key: entry[1], value: entry[2] });
         j++;