@starci/hfs 4.7.9 → 4.7.11

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 4.7.11 - 2026-10-19
+- Changed: app release and Sonar adapters use native target binding, with local database migration and Docker transport preserving the declared stack target.
+
+## 4.7.10 - 2026-10-19
+- Changed: bundled canon pins follow the regenerated Stylelint vocabulary and the matching lint canon cohort; HFS command behavior is unchanged.
+
 ## 4.7.9 - 2026-10-19
 - Changed: the lite scaffold README explicitly starts the Docker engine before the Supabase CLI-managed local stack and keeps application startup in its declared development profile.
 

package/db/local-migrate.mjs

@@ -9,6 +9,7 @@ import { databasePush } from '../runtime/scripts/api/supabase/database-push.mjs'
 import { isMigrationName, migrationStamp } from '../runtime/scripts/hfs/rules/database-migrations.mjs';
 import { CONFIG_FILE, MIGRATIONS_DIR } from '../runtime/scripts/hfs/rules/database-constants.mjs';
 import { failure, refusal } from '../stack/errors.mjs';
+import { assertLocalDatabase, boundSupabaseLauncher, nativeDatabaseEnvironment } from '../stack/target-binding.mjs';
 
 const configError = (reason) => refusal('DB_CONFIG_INVALID', reason);
 const encrypted = (value) => typeof value === 'string' && value.includes('encrypted:');
@@ -96,7 +97,7 @@ function targetIdentity(config, env) {
 }
 
 /** Snapshot only in memory; no plaintext configuration, values or hashes reach the result. */
-function inputs(ctx) {
+function inputs(ctx, nativeTarget = null) {
   const root = path.resolve(ctx.cwd);
   requireDirectory(root);
   requireDirectory(path.join(root, 'supabase'));
@@ -111,6 +112,10 @@ function inputs(ctx) {
   requirePlainConfig(config);
   for (const value of Object.values(ctx.env)) if (encrypted(value)) throw configError('local migration does not decrypt encrypted environment values');
   const { values: env, files: envFiles } = projectEnvironment(root, ctx.env);
+  if (nativeTarget && (config.experimental?.stack === true
+    || env.SUPABASE_EXPERIMENTAL_STACK && !/^(?:0|false)$/i.test(env.SUPABASE_EXPERIMENTAL_STACK)
+    || env.SUPABASE_CLI_BINARY_OVERRIDE)) throw configError('the bound local target requires the declared legacy Supabase backend and installed launcher');
+  const launcher = nativeTarget ? boundSupabaseLauncher(root) : null;
   const target = targetIdentity(config, env);
   let names;
   try { names = fs.readdirSync(path.join(root, MIGRATIONS_DIR)).sort(byteOrder); } catch { throw configError('local migrations are not readable'); }
@@ -127,18 +132,25 @@ function inputs(ctx) {
     migrations.push([name, readFile(path.join(root, MIGRATIONS_DIR, name))]);
   }
   const digest = createHash('sha256').update(JSON.stringify({ root, appText, configText, envFiles, env, target, migrations })).digest('hex');
-  return { root, target, names: migrations.map(([name]) => name), digest };
+  return { root, target, names: migrations.map(([name]) => name), digest, nativeTarget, launcher };
 }
 
 function unchanged(ctx, snapshot) {
-  const current = inputs(ctx);
+  const current = inputs(ctx, snapshot.nativeTarget);
   if (current.digest !== snapshot.digest) throw failure('DB_FINAL_MISMATCH', 'local migration inputs changed during the operation');
   return current;
 }
 
 /** Only the specific Supabase owner can spawn; failures and malformed JSON never expose child output. */
 function push(ctx, snapshot, dryRun) {
-  const result = databasePush(snapshot.root, ['--local', '--skip-vault', '--workdir', snapshot.root, '--output-format', 'json', ...(dryRun ? ['--dry-run'] : ['--yes'])], { env: ctx.env, run: ctx.spawn });
+  const env = snapshot.nativeTarget ? nativeDatabaseEnvironment(ctx.env, snapshot.nativeTarget,
+    { 'SUPABASE_SERVICES_HOSTNAME': '127.0.0.1', 'SUPABASE_EXPERIMENTAL_STACK': '0' }) : ctx.env;
+  const run = snapshot.nativeTarget ? (file, args, options) => {
+    if (file !== process.execPath || args[0] !== snapshot.launcher) throw failure('DB_CLI_MISSING', 'the bound database launcher cannot fall back to a global tool');
+    return ctx.spawn(file, args, options);
+  } : ctx.spawn;
+  const result = databasePush(snapshot.root, ['--local', '--skip-vault', '--workdir', snapshot.root, '--output-format', 'json',
+    ...(snapshot.nativeTarget ? ['--profile', 'supabase'] : []), ...(dryRun ? ['--dry-run'] : ['--yes'])], { env, run });
   if (result?.error || result?.signal || result?.status !== 0) throw failure('DB_CLI_FAILED', 'the local Supabase migration command failed; database output was withheld');
   let payload;
   try { payload = JSON.parse(result.stdout); } catch { throw failure('DB_CLI_FAILED', 'the local migration command returned unreadable JSON'); }
@@ -156,8 +168,9 @@ function push(ctx, snapshot, dryRun) {
 }
 
 /** Preview by default; the caller admits execute only after the existing database arming check. No history repair, reset or linked fallback. */
-export function migrateLocalDatabase(ctx, { execute = false } = {}) {
-  const snapshot = inputs(ctx);
+export function migrateLocalDatabase(ctx, { execute = false, nativeTarget = null } = {}) {
+  const snapshot = inputs(ctx, nativeTarget);
+  assertLocalDatabase(nativeTarget, snapshot.target);
   const pending = push(ctx, snapshot, true);
   unchanged(ctx, snapshot);
   let applied = [];

package/db/migrate.mjs

@@ -18,6 +18,7 @@ import { firstLine, tool } from '../stack/context.mjs';
 import { approvalMissing, failure, refusal } from '../stack/errors.mjs';
 import { readDeclaration, runVerb } from '../release/index.mjs';
 import { migrateLocalDatabase } from './local-migrate.mjs';
+import { parseTargetBinding, assertUrlDatabase, assertBoundCustody, boundSupabaseLauncher, boundLinkedDatabaseUrl, nativeDatabaseEnvironment } from '../stack/target-binding.mjs';
 
 const DATABASE_CODE = 'DB_CONFIG_INVALID';
 
@@ -182,17 +183,20 @@ function parseConnection(value) {
   } catch { return null; }
 }
 
-function urlTarget(ctx, name) {
+function urlTarget(ctx, name, binding = null) {
   if (!KEY.test(name)) throw refusal('DB_USAGE', '--url-env must name an UPPER_CASE environment variable');
   const value = ctx.env[name];
   if (typeof value !== 'string' || value === '') throw refusal('DB_URL_ENV_MISSING', `${name} is not set`);
+  if (binding && (binding.mode !== 'url-env' || name !== binding.urlEnv)) throw refusal('DB_WRONG_PROJECT', 'the URL selector differs from the accepted native target');
+  assertUrlDatabase(binding, value);
   const parsed = parseConnection(value);
   if (!parsed) throw refusal('DB_URL_INVALID', `${name} is not a postgres connection URL`);
   const secrets = [value, parsed.password].filter(Boolean);
-  return { kind: 'url', how: `connection string from ${name}`, url: parsed.url, env: parsed.password ? { PGPASSWORD: parsed.password } : {}, secrets };
+  return { kind: 'url', how: `connection string from ${name}`, url: parsed.url, env: parsed.password ? { PGPASSWORD: parsed.password } : {}, secrets, nativeTarget: binding, privateInputEnv: name };
 }
 
-function sealedPassword(ctx, spec) {
+function sealedPassword(ctx, spec, binding = null) {
+  if (binding) assertBoundCustody(ctx.cwd, path.join(ctx.cwd, STACKS_DIR, spec.env, 'secrets', `${spec.member}.enc`));
   let map;
   try { map = readMap(path.join(ctx.cwd, STACKS_DIR, spec.env, 'secrets', `${spec.member}.enc`), ctx.sops); } catch { throw refusal('DB_PASSWORD_UNREADABLE', `the sealed member ${spec.member} cannot be opened`); }
   if (typeof map[spec.key] !== 'string' || map[spec.key] === '') throw refusal('DB_PASSWORD_UNREADABLE', `the sealed member ${spec.member} has no value for ${spec.key}`);
@@ -200,24 +204,45 @@ function sealedPassword(ctx, spec) {
 }
 
 /** The database password for the linked CLI: SUPABASE_DB_PASSWORD from the environment, else the declared sealed value, else none (the CLI mints a login). */
-function linkedPassword(ctx, decl) {
+function linkedPassword(ctx, decl, binding = null) {
+  if (binding) {
+    if (!decl.password || decl.password.env !== binding.environment || ctx.env.SUPABASE_DB_PASSWORD !== undefined)
+      throw refusal('DB_PASSWORD_UNREADABLE', 'the bound linked target requires its declared sealed password without an ambient override');
+    return sealedPassword(ctx, decl.password, binding);
+  }
   const given = ctx.env.SUPABASE_DB_PASSWORD;
   if (typeof given === 'string' && given !== '') return given;
   return decl.password === null ? null : sealedPassword(ctx, decl.password);
 }
 
-function linkedTarget(ctx, decl) {
+function linkedTarget(ctx, decl, binding = null) {
+  if (binding && (binding.mode !== 'linked' || decl.projectRef !== binding.projectRef || !decl.password || decl.password.env !== binding.environment))
+    throw refusal('DB_WRONG_PROJECT', 'the linked project and sealed password must match the accepted native target');
   let ref;
+  if (binding) assertBoundCustody(ctx.cwd, path.join(ctx.cwd, 'supabase', '.temp', 'project-ref'));
   try { ref = fs.readFileSync(path.join(ctx.cwd, 'supabase', '.temp', 'project-ref'), 'utf8').trim(); } catch { throw refusal('DB_NOT_LINKED', 'no linked project (supabase/.temp/project-ref): run supabase link first'); }
   if (decl.projectRef !== null && ref !== decl.projectRef) throw refusal('DB_WRONG_PROJECT', `the app is linked to ${ref}, not the declared project ${decl.projectRef}`);
-  const password = linkedPassword(ctx, decl);
-  return { kind: 'linked', how: `linked project ${ref}`, ref, url: null, env: password ? { SUPABASE_DB_PASSWORD: password } : {}, secrets: password ? [password] : [] };
+  if (binding && ref !== binding.projectRef) throw refusal('DB_WRONG_PROJECT', 'the linked project differs from the accepted native target');
+  let nativeUrl;
+  if (binding) {
+    const saved = path.join(ctx.cwd, 'supabase', '.temp', 'pooler-url');
+    const stat = fs.lstatSync(saved, { throwIfNoEntry: false });
+    if (stat) {
+      assertBoundCustody(ctx.cwd, saved);
+      if (stat.size > 8192) throw refusal('DB_WRONG_PROJECT', 'the saved native pooler endpoint exceeds its public bound');
+    }
+    nativeUrl = boundLinkedDatabaseUrl(binding, stat ? fs.readFileSync(saved, 'utf8') : null);
+  }
+  const password = linkedPassword(ctx, decl, binding);
+  if (binding) return { kind: 'url', logicalKind: 'linked', how: `linked project ${ref}`, ref, url: nativeUrl,
+    env: { PGPASSWORD: password }, secrets: [password], nativeTarget: binding };
+  return { kind: 'linked', how: `linked project ${ref}`, ref, url: null, env: password ? { SUPABASE_DB_PASSWORD: password } : {}, secrets: password ? [password] : [], nativeTarget: binding };
 }
 
 /** { kind, how, env, secrets, url }: the linked project of the app (default) or the connection string in the named environment variable. */
 export function resolveTarget(ctx, decl, options) {
   if (options.linked === true && options.urlEnv !== undefined) throw refusal('DB_USAGE', '--linked and --url-env exclude each other');
-  return options.urlEnv === undefined ? linkedTarget(ctx, decl) : urlTarget(ctx, options.urlEnv);
+  return options.urlEnv === undefined ? linkedTarget(ctx, decl, options.nativeTarget) : urlTarget(ctx, options.urlEnv, options.nativeTarget);
 }
 
 /** CLI arguments that select the database and the local supabase folder. */
@@ -228,7 +253,8 @@ export function requireArmed(ctx) {
   if (ctx.env.STARCI_DB_ARMED !== '1') throw approvalMissing('DB_NOT_ARMED', 'set STARCI_DB_ARMED=1 to apply database changes');
 }
 
-const supabaseCommand = (root) => {
+const supabaseCommand = (root, bound) => {
+  if (bound) return [process.execPath, boundSupabaseLauncher(root)];
   const script = path.join(root, 'node_modules', 'supabase', 'dist', 'supabase.js');
   return fs.existsSync(script) ? [process.execPath, script] : ['supabase'];
 };
@@ -236,15 +262,41 @@ const supabaseCommand = (root) => {
 /** Runs the Supabase CLI through the seam; a failure names the first stderr line with every secret scrubbed. Returns { stdout, text } (text = stdout plus stderr). */
 export function runCli(session, args) {
   const { ctx, target } = session;
-  const [command, ...lead] = supabaseCommand(ctx.cwd);
-  const run = tool(ctx, command, [...lead, ...args], { cwd: ctx.cwd, env: { ...ctx.env, ...target.env } });
+  const [command, ...lead] = supabaseCommand(ctx.cwd, target.nativeTarget);
+  const env = target.nativeTarget ? nativeDatabaseEnvironment(ctx.env, target.nativeTarget, target.env, [target.privateInputEnv]) : { ...ctx.env, ...target.env };
+  const workdir = target.nativeTarget ? args[args.indexOf('--workdir') + 1] : ctx.cwd;
+  if (target.nativeTarget && !session.nativeWorkdirs?.has(workdir)) throw refusal('DB_CONFIG_INVALID', 'the bound database command requires its clean public scratch project');
+  const run = tool(ctx, command, [...lead, ...args, ...(target.nativeTarget ? ['--profile', 'supabase', '--output-format', 'json', '--agent', 'no'] : [])], { cwd: workdir, env });
   if (run.error) throw failure('DB_CLI_MISSING', `cannot run the Supabase CLI (${scrub(run.error.message, target.secrets)})`);
   if (run.status !== 0) throw failure('DB_CLI_FAILED', `supabase ${args.slice(0, 2).join(' ')} failed: ${scrub(firstLine(run.stderr), target.secrets)}`);
   return { stdout: run.stdout ?? '', text: `${run.stdout ?? ''}${run.stderr ?? ''}` };
 }
 
-/** The remote history as a Set of versions (read-only). */
-export const listRemote = (session) => parseMigrationList(runCli(session, ['migration', 'list', ...targetArgs(session.target, session.ctx.cwd)]).text).remote;
+/** A bound consumer requires the native machine result; unreadable output cannot become an empty database history. */
+function boundRemoteVersions(stdout) {
+  let data;
+  try { data = JSON.parse(stdout); } catch { throw failure('DB_CLI_FAILED', 'the bound migration history is not readable JSON'); }
+  if (!Array.isArray(data?.migrations) || data.migrations.some(item => !plain(item)
+    || typeof item.local !== 'string' || typeof item.remote !== 'string'
+    || item.local !== '' && !STAMP.test(item.local) || item.remote !== '' && !STAMP.test(item.remote)
+    || !item.local && !item.remote))
+    throw failure('DB_CLI_FAILED', 'the bound migration history has an unexpected shape');
+  return new Set(data.migrations.map(item => item.remote).filter(Boolean));
+}
+
+/** The remote history as a Set of versions; bound callers require noninteractive structured output. */
+export function listRemote(session) {
+  if (!session.target.nativeTarget) return parseMigrationList(runCli(session, ['migration', 'list', ...targetArgs(session.target, session.ctx.cwd)]).text).remote;
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'starci-db-'));
+  try {
+    const { model } = session;
+    buildScratch(session, scratch, model.push.map(file => ({ from: path.join(model.root, model.decl.migrationsDir, file), name: file })));
+    return boundRemoteVersions(runCli(session, ['migration', 'list', ...targetArgs(session.target, scratch)]).stdout);
+  } finally {
+    session.nativeWorkdirs?.delete(scratch);
+    fs.rmSync(scratch, { recursive: true, force: true });
+  }
+}
 
 /* ---- the plan */
 
@@ -288,12 +340,13 @@ const dataOf = (model, plan, remote, extra) => ({
 
 /* ---- applying */
 
-/** A scratch supabase project holding exactly the given migration files; the link state of the app is copied so --linked works from it. */
+/** Public scratch SQL/config only for bound URLs; ordinary linked commands retain their native link state. */
 function buildScratch(session, dir, copies) {
   fs.mkdirSync(path.join(dir, 'supabase', 'migrations'), { recursive: true });
   fs.writeFileSync(path.join(dir, 'supabase', 'config.toml'), 'project_id = "starci-db-scratch"\n');
   for (const copy of copies) fs.copyFileSync(copy.from, path.join(dir, 'supabase', 'migrations', copy.name));
   if (session.target.kind === 'linked') fs.cpSync(path.join(session.ctx.cwd, 'supabase', '.temp'), path.join(dir, 'supabase', '.temp'), { recursive: true });
+  if (session.target.nativeTarget) (session.nativeWorkdirs ??= new Set()).add(dir);
 }
 
 const repair = (session, status, versions, dir) => runCli(session, ['migration', 'repair', '--status', status, ...versions, ...targetArgs(session.target, dir)]);
@@ -334,6 +387,7 @@ function applyPlan(session, plan) {
  * STARCI_DB_ARMED=1) applies it. Already baseline + forward: `nothing to do`, no mutating call, ok.
  */
 async function migrateDatabase(ctx, decl, options = {}) {
+  if (options.nativeTarget) boundSupabaseLauncher(ctx.cwd);
   const model = buildModel(ctx.cwd, decl);
   const session = { ctx, model, target: resolveTarget(ctx, decl, options) };
   const remote = listRemote(session);
@@ -354,19 +408,22 @@ async function migrateDatabase(ctx, decl, options = {}) {
   return { ok: true, lines: [...lines, `applied: ${pushed.length} forward migration(s) pushed; the remote history now holds ${final.size} version(s). Held back: ${model.held.join(', ') || 'nothing'}.`], data: dataOf(model, plan, remote, { executed: true, pushed, remoteCountAfter: final.size }) };
 }
 
-const SPEC = { boolean: ['--execute', '--json', '--linked', '--local'], value: ['--url-env'] };
+const SPEC = { boolean: ['--execute', '--json', '--linked', '--local'], value: ['--url-env', '--target-binding'] };
 
 /** Entry of the verb: explicit local applies active SQL; linked/url-env retains the declared cutover plan. Execute requires database arming. */
 export function dbMigrateMain(argv, io = {}) {
   return runVerb({
     label: 'starci app db migrate', name: 'db migrate', code: 'DB_USAGE', io, argv, spec: SPEC,
     run: (ctx, flags) => {
+      const nativeTarget = parseTargetBinding(flags['target-binding'], 'supabase-db');
+      if (nativeTarget && (nativeTarget.mode === 'local' ? !flags.local : nativeTarget.mode === 'linked' ? !flags.linked : flags['url-env'] !== nativeTarget.urlEnv))
+        throw refusal('DB_USAGE', 'the native database selector differs from its accepted binding');
       if (flags.local) {
         if (flags.linked || flags['url-env'] !== undefined) throw refusal('DB_USAGE', '--local excludes --linked and --url-env');
         if (flags.execute) requireArmed(ctx);
-        return migrateLocalDatabase(ctx, { execute: flags.execute === true });
+        return migrateLocalDatabase(ctx, { execute: flags.execute === true, nativeTarget });
       }
-      return migrateDatabase(ctx, loadDatabase(ctx.cwd), { execute: flags.execute === true, linked: flags.linked === true, urlEnv: flags['url-env'] });
+      return migrateDatabase(ctx, loadDatabase(ctx.cwd), { execute: flags.execute === true, linked: flags.linked === true, urlEnv: flags['url-env'], nativeTarget });
     },
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.9",
+  "version": "4.7.11",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/gate.mjs

@@ -71,7 +71,8 @@ function sonarGate(services, env) {
   const organization = sonar.organization ?? (sonar.organizationVar ? env[sonar.organizationVar] : null);
   if (organization) command.push(`-Dsonar.organization=${organization}`);
   if (!command.every((word) => TOKEN.test(word))) throw refusal('RELEASE_SONAR_UNAVAILABLE', 'Sonar host and organization must be plain command arguments');
-  return { name: 'sonar', command, summary: null, env: { SONAR_TOKEN: env[tokenName] }, provider: sonar };
+  return { name: 'sonar', command, summary: null, env: { SONAR_TOKEN: env[tokenName] }, provider: sonar,
+    credentialNames: [...new Set(['SONAR_TOKEN', tokenName])] };
 }
 
 function gateProblems(entry, at, seen) {
@@ -128,7 +129,7 @@ export function normalizeRelease(block, scripts = {}, services = {}, options = {
 
 /** Runs git in the app root; a missing git or (unless allowFail) a non-zero exit is a failure whose message names the first stderr line. */
 export function git(ctx, args, { allowFail = false } = {}) {
-  const run = tool(ctx, 'git', args, { cwd: ctx.cwd });
+  const run = tool(ctx, 'git', args, { cwd: ctx.cwd, env: ctx.env });
   if (run.error) throw failure('RELEASE_GIT_MISSING', `cannot run git (${run.error.message})`);
   if (run.status !== 0 && !allowFail) throw failure('RELEASE_GIT_FAILED', `git ${args.slice(0, 2).join(' ')}: ${firstLine(run.stderr)}`);
   return { code: run.status, stdout: String(run.stdout ?? '').trim(), stderr: String(run.stderr ?? '') };
@@ -236,11 +237,18 @@ async function runAvailableGate(ctx, gate, options) {
     summary: null, log: path.resolve(log), logSha256: sha256(log), env: Object.keys(gate.env) };
 }
 
-function runGate(ctx, gate, { dir, platform }) {
+const withoutCredentials = (values, credentialNames) => {
+  const selected = new Set(credentialNames);
+  return Object.fromEntries(Object.entries(values ?? {}).filter(([key]) => !selected.has(key.toUpperCase())));
+};
+
+function runGate(ctx, gate, { dir, platform, credentialNames }) {
   const log = path.join(dir, `${gate.name}.log`);
   const started = ctx.now();
   const [command, args] = launch(gate.command, platform);
-  const run = tool(ctx, command, args, { cwd: ctx.cwd, env: { ...ctx.env, ...gate.env } });
+  // The native scanner alone consumes Sonar credentials; ordinary gates cannot inherit or reintroduce them.
+  const env = { ...ctx.env, ...(gate.provider ? gate.env : withoutCredentials(gate.env, credentialNames)) };
+  const run = tool(ctx, command, args, { cwd: ctx.cwd, env });
   const output = `${run.stdout ?? ''}${run.stderr ?? ''}`;
   const text = gate.name === 'sonar' && gate.env.SONAR_TOKEN ? output.replaceAll(gate.env.SONAR_TOKEN, '[REDACTED]') : output;
   fs.writeFileSync(log, text);
@@ -345,6 +353,8 @@ function summaryOf(result) {
  */
 export async function releaseGate(ctx, config, options = {}) {
   if (options.sonar) config = { ...config, gates: [...config.gates.filter((gate) => gate.name !== 'sonar'), sonarGate(config.services, ctx.env)] };
+  const credentialNames = config.gates.find(gate => gate.provider)?.credentialNames ?? ['SONAR_TOKEN', config.services?.sonar?.token].filter(Boolean);
+  ctx = Object.create(ctx, {env: {value: withoutCredentials(ctx.env, credentialNames)}});
   // The CI verdict of a release is the candidate run of its own sha, judged by `starci app release push` (candidate-ci.mjs, OWNER RULING candidate-ci 2026-10-18):
   // the gate no longer refuses over the latest default-branch run.
   const facts = inspect(ctx, config, options);
@@ -355,7 +365,7 @@ export async function releaseGate(ctx, config, options = {}) {
   const base = { head: facts.head, tag: facts.chosen.tag, record: recordPath, gates: config.gates.map((gate) => gate.name) };
   if (facts.red.length > 0) return { ok: false, lines: [...plan, ...facts.red.map((item) => `RED: ${item}`), 'nothing was run.'], data: { ...base, red: facts.red, executed: false } };
   if (options.execute !== true) return { ok: true, lines: [...plan, '', 'dry run: no gate was run, nothing written. preconditions OK.'], data: { ...base, red: [], executed: false } };
-  const results = await runAll(ctx, config, { dir, platform: options.platform ?? process.platform });
+  const results = await runAll(ctx, config, { dir, platform: options.platform ?? process.platform, credentialNames });
   const report = results.map(summaryOf);
   const failed = results.filter((result) => !result.pass && !result.skipped);
   if (failed.length > 0) return { ok: false, lines: [...plan, ...report, `gate(s) red: ${failed.map((item) => item.name).join(', ')}. No L4 record, no tag.`], data: { ...base, executed: true, results } };

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,21 +29,21 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.15
+    version: 3.4.17
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.15
+    version: 8.4.17
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/stylelint-canon':
-    version: 2.0.9
+    version: 2.0.10
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.9
+    version: 1.7.11
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.9
+    version: 4.7.11
     group: starci
     install: registry
     side: both

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -105,6 +105,8 @@ properties:
       status: {enum: [deferred, supported]}
       reason: {type: string, minLength: 1}
   ci: {$ref: '#/$defs/ciDeclaration'}
+  operations:
+    $ref: provision-operation.schema.yaml
   services:
     description: >-
       The delivery, quality and platform services this repository's code and CI use - NOT Compose