@starci/hfs 5.0.5 → 5.0.6

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.21.9
+    version: 0.21.10
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.11.16
+    version: 3.11.17
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.9.9
+    version: 9.9.10
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.9
+    version: 0.21.10
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.9
+    version: 0.21.10
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 5.0.5
+    version: 5.0.6
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -5107,7 +5107,7 @@ rules:
       - {path: packages/eslint/be/module-shape.spec.mjs, editions: [lite, full], codes: [BE_MODULE_DEFINITION_MISSING]}
   - id: R296
     code: "CI_SECRET_SEALED"
-    law: "A name declared in ci.secrets or ci.dependabot.secrets never names a key stored inside an app sealed .starcistacks/<env>/secrets/<member>.enc member. App runtime and CI custody are separate; checks inspect key names without decrypting or printing values."
+    law: "A sealed CI credential copy names an explicit service credential bound to the selected product project, environment, member and key; required product Sonar analysis uses sonar.enc.yaml and an app runtime key never becomes a CI credential. Checks inspect names without decrypting or printing values."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["CI_SECRET_SEALED"]
@@ -5129,7 +5129,7 @@ rules:
       - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [CI_SECRET_SEALED]}
   - id: R297
     code: "APP_SECRET_IN_CI"
-    law: "A sealed member key granted to an app container by a deploy grant never appears in ci.secrets or ci.vars. The grant environment, member and selected key determine app custody; online GitHub custody is verified by starci app ci verify."
+    law: "A sealed member key selected by an app runtime secret declaration or deploy grant never appears in ci.secrets or ci.vars. The consumer environment, member and selected key determine app custody; online GitHub custody is verified by starci app ci verify."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["APP_SECRET_IN_CI"]

package/runtime/modules/kernel/failure-codes.yaml

@@ -1742,12 +1742,12 @@ CI_DECLARATION_DRIFT:
   kind: check-finding
 
 CI_SECRET_SEALED:
-  title: "CI name overlaps sealed app custody"
+  title: "CI credential lacks exact project service custody"
   title_vi: "Tên CI trùng khóa bí mật đã niêm phong"
-  meaning_vi: "Tên CI hoặc Dependabot cũng là khóa trong thành viên .enc của ứng dụng."
+  meaning_vi: "Bản sao khóa CI không trỏ đúng dịch vụ, dự án, môi trường, thành viên và khóa đã niêm phong; khóa chạy ứng dụng không thuộc CI."
   causes_vi:
-    - "Tên CI hoặc Dependabot cũng là khóa trong thành viên .enc của ứng dụng."
-  nextStep_vi: "Bỏ khóa ứng dụng khỏi khai báo CI; đưa bí mật CI vào kho GitHub tương ứng."
+    - "Thiếu liên kết credential của dịch vụ, sai dự án hoặc dùng khóa được cấp cho container ứng dụng."
+  nextStep_vi: "Giữ khóa runtime ngoài CI; khai báo đúng credential.project và liên kết services.<id>.ci.secrets cho bản sao khóa công cụ."
   owner: op-retry
   kind: check-finding
 

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -196,7 +196,7 @@ $defs:
           local: {type: string, pattern: '^https?://[^\s]+$'}
           public: {type: string, pattern: '^https://[^\s]+$'}
           fromCredential:
-            description: A hosted endpoint carried inside a credential (a Sentry DSN) - the credential id, never the value.
+            description: A private connection URL carried inside a sealed credential - its credential id, never the value. Public local or hosted URLs use local or public.
             type: string
             pattern: '^[a-z][a-z0-9-]*$'
       stack: {$ref: '#/$defs/serviceStack'}
@@ -432,17 +432,19 @@ $defs:
       publishedBy: {type: string, minLength: 1}
   serviceCredential:
     description: >-
-      A custody reference, never a value - the repository whose stack holds it and the plaintext
-      member's path from that repository's root; the tracked <path>.enc twin must exist. The field env is the
-      variable the consuming tool reads; `key` is the field inside a structured custody file (app.yaml)
-      when the application reads the file itself. At least one of env and key is named. Sonar
-      convention (scripts/gates/sonar-local.mjs reads it): id `admin` creates projects and mints
-      tokens; a credential whose id is a project key is that project's analysis token.
+      A name-only connection or credential reference: its repository, actual sealed member path and key.
+      env names the consuming tool's variable. project references projects[].key for project-scoped tooling;
+      ids identify references independently of provider project-key syntax. Username, password and private
+      endpoint keys use separate references; operator/admin login lives in a separate authority member and
+      is never an implicit scanner or CI credential. Product Sonar analysis names exactly
+      .starcistacks/<declared-env>/secrets/sonar.enc.yaml; ci-declaration.mjs enforces that service-specific member.
+      Legacy plaintext paths with .enc twins require migration.
     type: object
     additionalProperties: false
     required: [id, custody]
     properties:
       id: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+      project: {type: string, minLength: 1, description: "The exact projects[].key this credential serves; execution selects the entry by the actual consumer repository."}
       purpose: {type: string, minLength: 1}
       env: {type: string, pattern: '^[A-Z][A-Z0-9_]*$'}
       key: {type: string, minLength: 1}
@@ -469,6 +471,7 @@ $defs:
       workflow: {type: string, minLength: 1}
       permissions: {type: array, items: {type: string, minLength: 1}}
       secrets:
+        description: Explicit credential-to-CI execution-copy links; names are declared in the top-level ci block. ci.token selects the analysis copy.
         type: array
         items:
           type: object

package/runtime/scripts/gates/starcistacks-ci.mjs

@@ -22,7 +22,7 @@ export const catalogOf = (id) => {
 export const checkServiceForm = (service, id, entry, at, kind, add, ambiguous) => {
     if (service.provider && !catalogOf(id).providers.includes(service.provider))
         add('refuse', 'STACKS_PROVIDER_UNKNOWN', `${at}.provider`, `${service.provider} is not a ${id} provider (${catalogOf(id).providers.join(', ')})`);
-    if (Object.hasOwn(entry?.ci ?? {}, 'secrets') || Object.hasOwn(entry?.ci ?? {}, 'vars'))
+    if (Object.hasOwn(entry?.ci ?? {}, 'vars') || service.ci.secrets.some((item) => !item.credential))
         add('suspect', 'STACKS_CI_LEGACY_FORM', `${at}.ci`, 'move the names to the top-level ci block and name them by services.<id>.ci.token / hostVar');
     if (id === 'sonar' && service.provider === 'sonarcloud' && !service.organization
         && !(kind === 'example' && service.runtimeSecrets.length && !service.credentials.length && service.ci.organizationVar))
@@ -56,6 +56,8 @@ export function checkQualityService(service, id, at, context, checkServiceCi) {
             ambiguous('codecov auth must be oidc or token');
         if (id === 'codecov' && service.auth === 'token' && !service.ci.token)
             ambiguous('codecov auth token requires ci.token');
+        if (id === 'codecov' && service.auth === 'oidc' && (service.ci.token || service.credentials.length || service.ci.secrets.length))
+            ambiguous('codecov OIDC has no token, credential or sealed member');
         checkServiceCi(service, id, at, context);
         return true;
     }

package/runtime/scripts/gates/starcistacks-form.d.mts

@@ -6,6 +6,7 @@ export interface ServiceCredential {
     env: string | null;
     key: string | null;
     purpose: string | null;
+    project?: string | null;
     custody: {
         repository: string | null;
         path: string | null;

package/runtime/scripts/gates/starcistacks.d.mts

@@ -119,6 +119,7 @@ declare function summary(service: ServiceLike): {
         id: string | null;
         env: string | null;
         key: string | null;
+        project: string | null | undefined;
         custody: string;
         present: boolean | null;
     }[];

package/runtime/scripts/gates/starcistacks.mjs

@@ -42,6 +42,8 @@ import { readProperties } from '../lib/properties.mjs';
 import { escapeRegExp } from '../lib/regex.mjs';
 import { isInfrastructureValueFile } from './starcistacks-value-file.mjs';
 import { STACK_DECLARATION_TEMPLATE } from '../lib/example-refs.mjs';
+import { isSealedName } from '../lib/sealed-member.mjs';
+import { serviceBindings } from '../hfs/ci-declaration.mjs';
 import { checkSecretForm, kindOf } from './starcistacks-form.mjs';
 import { SERVICE_CATALOG, catalogOf, checkServiceForm, checkCiDeclaration, checkQualityService } from './starcistacks-ci.mjs';
 import { applicationStackFindings } from './starcistacks-runtime.mjs';
@@ -165,9 +167,10 @@ const normalizeCredential = (credential, declaringRepo) => {
     const repo = resolveDeclaredRepository(custody.repository, { fromRepo: declaringRepo });
     const rel = text(custody.path);
     const abs = resolveCustodyFile(repo, rel);
-    return { id: text(credential.id), env: text(credential.env), key: text(credential.key), purpose: text(credential.purpose),
+    const sealed = rel && isSealedName(rel) ? abs : abs ? `${abs}.enc` : null;
+    return { id: text(credential.id), env: text(credential.env), key: text(credential.key), purpose: text(credential.purpose), project: text(credential.project),
         custody: { repository: text(custody.repository), path: rel, resolved: Boolean(repo), file: abs,
-            encPresent: abs ? isFile(`${abs}.enc`) : null, plainPresent: abs ? isFile(abs) : null } };
+            encPresent: sealed ? isFile(sealed) : null, plainPresent: abs && !isSealedName(abs) ? isFile(abs) : false } };
 };
 const ownerActionOf = (s) => {
     const noAction = s.ownerAction === 'none' ? 'none' : null;
@@ -239,12 +242,9 @@ export function resolveStackService(repoRoot, serviceId) {
         const listed = service.projects.some((project) => project.repository === name);
         if (declaration.sourceHost && !listed)
             continue;
-        // Through the source host a product gets the shared server, its shared credentials and its own project
-        // token (a credential whose id is a project key); other projects' tokens and the host's CI wiring are not its.
-        const ownKey = service.projects.find((project) => project.repository === name)?.key;
-        const projectKeys = new Set(service.projects.map((project) => project.key));
+        // A source host lends public server settings only; analysis credentials stay in the selected product's custody.
         if (declaration.sourceHost)
-            service = { ...service, credentials: service.credentials.filter((credential) => !projectKeys.has(credential.id) || credential.id === ownKey),
+            service = { ...service, credentials: [],
                 ci: { wiring: null, workflow: null, permissions: [], secrets: [], vars: [], provisioning: null } };
         return { declaration: declaration.file, declaringRepo: declaration.repo, sourceHost: Boolean(declaration.sourceHost),
             repository: name, projectKey: service.projects.find((project) => project.repository === name)?.key ?? null, ...service };
@@ -304,7 +304,7 @@ const checkServiceCredentials = (service, at, add, ambiguous) => {
         if (!credential.custody.resolved)
             add('suspect', 'STACKS_CUSTODY_UNVERIFIED', where, `custody repository ${credential.custody.repository} is not checked out on this machine`);
         else if (!credential.custody.encPresent)
-            add('refuse', 'STACKS_CUSTODY_MISSING', where, `${credential.custody.repository}/${credential.custody.path}.enc is not in custody; repair the stack custody (secret:gen / stack-secret) - never ask the owner for a value the declaration says the runtime holds`);
+            add('refuse', 'STACKS_CUSTODY_MISSING', where, `${credential.custody.repository}/${credential.custody.path} is not sealed in custody; repair the declared member through starci app secret`);
     }
     return ids;
 };
@@ -371,6 +371,18 @@ const checkService = (id, entry, { schema, declFile, declaration, governing, nam
     checkServiceForm(service, id, entry, at, kind, add, ambiguous);
     if (checkDisabledService(service, id, at, ciUses, ambiguous, add))
         return;
+    let product = false;
+    try {
+        product = JSON.parse(fs.readFileSync(path.join(declaration?.repo ?? '', 'hfs.json'), 'utf8')).kind === 'app';
+    }
+    catch { /* other checks own a missing app declaration */ }
+    if (id === 'sonar' && product) {
+        const selected = serviceBindings(declaration?.doc, name);
+        for (const problem of selected.problems.filter((problem) => problem.at.startsWith('services.sonar')))
+            ambiguous(problem.message);
+        if (service.ci.wiring === 'required' && !selected.bindings.some((binding) => binding.service === 'sonar' && binding.name === service.ci.token))
+            ambiguous('required Sonar analysis needs this product project credential in its declared environment sonar.enc.yaml member');
+    }
     if (checkQualityService(service, id, at, { governing, name, ciUses, ciText, add, ambiguous }, checkServiceCi))
         return;
     checkEnabledService(service, id, at, { governing, name, ciUses, ciText, add, kind }, ambiguous);
@@ -546,7 +558,7 @@ export function checkStarciStacks(repoRoot, { newRepo = false, examplesRoot = pa
 function summary(service) {
     return { provider: service.provider, mode: service.mode, auth: service.auth, host: service.host,
         stack: service.stack ? { owner: service.stack.owner ?? null, repository: service.stack.repository, root: service.stack.root, environment: service.stack.environment, compose: service.stack.compose, container: service.stack.container } : null,
-        projects: service.projects, credentials: service.credentials.map((credential) => ({ id: credential.id, env: credential.env, key: credential.key,
+        projects: service.projects, credentials: service.credentials.map((credential) => ({ id: credential.id, env: credential.env, key: credential.key, project: credential.project,
             custody: `${credential.custody.repository}/${credential.custody.path}`, present: credential.custody.encPresent ?? null })),
         ci: service.ci, ownerAction: service.ownerAction };
 }
@@ -575,7 +587,7 @@ export function ownerAskConflict({ repo, question } = {}) {
             continue;
         const custody = service.credentials.map((credential) => `${credential.custody.repository}/${credential.custody.path}`);
         const custodyNote = custody.length ? ` and its credentials in custody (${custody.join(', ')})` : ` and auth ${service.auth}`;
-        const sonarNote = id === 'sonar' ? 'Run starci gate sonar (status, ensure-project, scan) - it reads host, project and token from the declaration and custody. ' : '';
+        const sonarNote = id === 'sonar' ? 'The native app release gate selects this product project credential; analysis never provisions projects or rotates credentials. ' : '';
         const provisioningNote = service.ci.provisioning ? ` (${service.ci.provisioning})` : '';
         return { service: id, provider: service.provider, declaration: slash(service.declaration), matched: byName ?? byWord,
             message: `${id} (${service.provider}, ${service.mode}) is declared in ${slash(service.declaration)} with ownerAction none${custodyNote}; the owner is never asked for it. ${sonarNote}CI wiring is ${service.ci.wiring ?? 'undeclared'}${provisioningNote}.` };

package/runtime/scripts/hfs/architecture/contract-bounds.d.mts

@@ -0,0 +1,3 @@
+import type { TypeScriptApi } from './config.mjs';
+/** True only for an unambiguous named export proven through actual declarations to a generated contract declaration. */
+export declare function isBoundsExport(ts: TypeScriptApi, target: string, name: string, ownsGenerated: (file: string) => boolean, seen?: Set<string>): boolean;

package/runtime/scripts/hfs/architecture/contract-bounds.mjs

@@ -0,0 +1,72 @@
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+/** The generated input-bounds owner is contract data, not an operation. */
+const BOUNDS_MODULE = /(?:^|\/)__generated__\/input-bounds\.ts$/;
+/** Directly exported declarations with the requested name; multiple declarations are ambiguous. */
+function declaredExports(ts, source, name) {
+    let count = 0;
+    for (const statement of source.statements) {
+        if (!ts.canHaveModifiers(statement) || !ts.getModifiers(statement)?.some(modifier => modifier.kind === ts.SyntaxKind.ExportKeyword))
+            continue;
+        if (ts.isVariableStatement(statement)) {
+            count += statement.declarationList.declarations.filter(declaration => ts.isIdentifier(declaration.name) && declaration.name.text === name).length;
+        }
+        else if ((ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) || ts.isInterfaceDeclaration(statement) ||
+            ts.isTypeAliasDeclaration(statement) || ts.isEnumDeclaration(statement)) && statement.name?.text === name)
+            count += 1;
+    }
+    return count;
+}
+/** The concrete file a relative module specifier resolves to, in the same order as the rule's owner resolver. */
+function readSource(ts, target) {
+    for (const file of [`${target}.ts`, `${target}/index.ts`, target]) {
+        let text;
+        try {
+            text = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+        if (source.parseDiagnostics.length)
+            return null;
+        return { file, source };
+    }
+    return null;
+}
+/** True only for an unambiguous named export proven through actual declarations to a generated contract declaration. */
+export function isBoundsExport(ts, target, name, ownsGenerated, seen = new Set()) {
+    const found = readSource(ts, target);
+    if (!found)
+        return false;
+    const { file, source } = found;
+    const key = `${file}#${name}`;
+    if (seen.has(key) || seen.size >= 32)
+        return false;
+    const direct = declaredExports(ts, source, name);
+    const matches = [];
+    let wildcard = false;
+    for (const statement of source.statements) {
+        if (!ts.isExportDeclaration(statement))
+            continue;
+        const module = statement.moduleSpecifier && ts.isStringLiteralLike(statement.moduleSpecifier) ? statement.moduleSpecifier.text : null;
+        if (!statement.exportClause) {
+            wildcard = true;
+            continue;
+        }
+        if (!ts.isNamedExports(statement.exportClause))
+            continue;
+        for (const item of statement.exportClause.elements)
+            if (item.name.text === name) {
+                matches.push({ origin: (item.propertyName ?? item.name).text, module });
+            }
+    }
+    if (wildcard || direct + matches.length !== 1)
+        return false;
+    if (BOUNDS_MODULE.test(file.replaceAll('\\', '/')))
+        return ownsGenerated(file) && direct === 1 && matches.length === 0;
+    const match = matches[0];
+    if (direct || !match || !match.module?.startsWith('.'))
+        return false;
+    return isBoundsExport(ts, resolve(dirname(file), match.module), match.origin, ownsGenerated, new Set([...seen, key]));
+}

package/runtime/scripts/hfs/architecture/index.mjs

@@ -243,7 +243,7 @@ function runHfsMachine(config, context, paths, injectedTypeScript, base, fast, v
         return hfsChecks;
     const graph = buildHfsGraph(config, hfsContext);
     const input = { config, context: hfsContext, graph, base };
-    const runs = { tiers: () => checkTiers(graph), reachability: () => checkReachability(input), deadExports: () => checkDeadExports(input),
+    const runs = { tiers: () => checkTiers(graph, hfsContext.ts), reachability: () => checkReachability(input), deadExports: () => checkDeadExports(input),
         requiredFiles: () => checkRequiredFiles(input), clones: () => checkClones(input), symbols: () => checkSymbols(input), docLanguage: () => checkDocLanguage(input) };
     if (graph.profile === 'be')
         for (const [name, [check]] of Object.entries(BACKEND_MACHINE))

package/runtime/scripts/hfs/architecture/tiers.d.mts

@@ -1,3 +1,4 @@
+import type { TypeScriptApi } from './config.mjs';
 import type { ArchitectureViolation, HfsGraph } from './hfs-graph.mjs';
 /**
  * HFS checks 1 and 2 (knowledge/hfs/slots.yaml `tiers`):
@@ -14,7 +15,7 @@ import type { ArchitectureViolation, HfsGraph } from './hfs-graph.mjs';
  * Importing inside one owner is always allowed; the public-entry rule stays with owners.mjs (ARCH_OWNER_EXPORT_BYPASS).
  */
 export declare const TIER_RULE_IDS: string[];
-export declare function checkTiers(graph: HfsGraph): {
+export declare function checkTiers(graph: HfsGraph, ts: TypeScriptApi): {
     violations: ArchitectureViolation[];
     coverage: {
         tierDirection: number;

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -1,4 +1,6 @@
 import { byCodeUnit } from '../../lib/list.mjs';
+import { dirname, relative } from 'node:path';
+import { isBoundsExport } from './contract-bounds.mjs';
 import { registryListImport, registrySlot } from './entity-registry.mjs';
 /**
  * HFS checks 1 and 2 (knowledge/hfs/slots.yaml `tiers`):
@@ -139,14 +141,53 @@ function reportReasonedTierViolation(graph, edge, answer, tierRule, counts, viol
         message,
     });
 }
-function inspectTierEdge(graph, edge, tierRule, counts, violations, coverage) {
+/** A public API entry may expose generated contract data without exposing operations to a hook. */
+function contractMetadataEdge(graph, ts, edge, verdict) {
+    if (graph.profile !== 'fe' || verdict.reason !== 'tierDirection')
+        return false;
+    const from = graph.files.get(edge.from);
+    const to = graph.files.get(edge.to);
+    if (from?.tier !== 'hooks' || to?.tier !== 'transport' || to.slot !== 'fe.modules.api' || !to.owner || to.owner.slot !== 'fe.modules' || to.owner.bindings.capability !== 'api')
+        return false;
+    // The tier verdict precedes private-entry checks, so prove both app isolation and the owner entry here.
+    const fromApp = graph.resolver.classifyPath(edge.from).bindings?.app;
+    const toApp = graph.resolver.classifyPath(edge.to).bindings?.app;
+    if (!fromApp || fromApp !== toApp || edge.to !== `${to.owner.root}/index.ts`)
+        return false;
+    const declaration = edge.edge.declaration;
+    let names;
+    if (ts.isImportDeclaration(declaration)) {
+        const clause = declaration.importClause;
+        if (!clause || clause.name || !clause.namedBindings || !ts.isNamedImports(clause.namedBindings))
+            return false;
+        names = clause.namedBindings.elements.map(item => (item.propertyName ?? item.name).text);
+    }
+    else if (ts.isExportDeclaration(declaration)) {
+        if (!declaration.exportClause || !ts.isNamedExports(declaration.exportClause))
+            return false;
+        names = declaration.exportClause.elements.map(item => (item.propertyName ?? item.name).text);
+    }
+    else
+        return false;
+    const apiOwner = to.owner;
+    const dirnameOfEntry = dirname(to.abs);
+    const ownsGenerated = (file) => {
+        const rel = `${apiOwner.root}/${relative(dirnameOfEntry, file).replaceAll('\\', '/')}`;
+        const classified = graph.resolver.classifyPath(rel);
+        const owner = graph.resolver.ownerOf(rel);
+        return classified.status === 'owned' && classified.slot === 'fe.transport.generated' &&
+            owner?.slot === apiOwner.slot && owner.root === apiOwner.root;
+    };
+    return names.length > 0 && names.every(name => isBoundsExport(ts, to.abs, name, ownsGenerated));
+}
+function inspectTierEdge(graph, ts, edge, tierRule, counts, violations, coverage) {
     const verdict = graph.resolver.importAllowed(edge.from, edge.to);
     if (verdict.reason === 'unowned' || verdict.reason?.startsWith('slot')) {
         coverage.unclassifiedEdges += 1;
         return;
     }
     coverage.edgesChecked += 1;
-    if (verdict.reason === 'tierDirection' && registryListImport(graph.resolver, edge))
+    if (verdict.reason === 'tierDirection' && (registryListImport(graph.resolver, edge) || contractMetadataEdge(graph, ts, edge, verdict)))
         return;
     reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, violations);
 }
@@ -197,14 +238,14 @@ function addOwnerCycleViolations(adjacency, witness, violations) {
     }
     return components.length;
 }
-export function checkTiers(graph) {
+export function checkTiers(graph, ts) {
     const { resolver, profile } = graph;
     const violations = [];
     const tierRule = profile === 'be' ? 'BE_TIER_DIRECTION' : 'FE_TIER_DIRECTION';
     const coverage = { edgesChecked: 0, unclassifiedEdges: 0 };
     const counts = { tierDirection: 0, layerOrder: 0, crossApp: 0 };
     for (const edge of graph.edges)
-        inspectTierEdge(graph, edge, tierRule, counts, violations, coverage);
+        inspectTierEdge(graph, ts, edge, tierRule, counts, violations, coverage);
     // Owner cycles: nodes are owner units, edges the imports between two distinct units.
     const { adjacency, witness } = ownerAdjacency(graph, resolver);
     const cycles = addOwnerCycleViolations(adjacency, witness, violations);

package/runtime/scripts/hfs/ci-declaration.d.mts

@@ -45,11 +45,57 @@ export interface ValidCiDeclaration extends CiDeclaration {
 }
 /** True when readCiDeclaration found no problem in `declaration`. */
 export declare const isValidCiDeclaration: (declaration: CiDeclaration) => declaration is ValidCiDeclaration;
+/** A private endpoint uses an explicitly linked secret copy; public endpoints use the existing CI variable selector. */
+export declare function serviceHostSecret(service: ParsedDoc): string | null;
+/** Public credential selectors that ordinary child processes have no authority to inherit. */
+export declare function serviceCredentialNames(doc: ParsedDoc): string[];
+/** A project service's retrievable credential, and the explicitly linked CI execution copy. No value is held here. */
+export interface ServiceBinding {
+    service: string;
+    credential: string;
+    name: string;
+    repository: string;
+    projectKey: string;
+    environment: string;
+    member: string;
+    key: string;
+    path: string;
+}
+export interface BindingProblem {
+    at: string;
+    message: string;
+}
+/** An application runtime declaration or deploy grant selects runtime authority regardless of its CI name. */
+export declare function runtimeGranted(doc: ParsedDoc, environment: string, member: string, key: string): boolean;
+/** Read an actual member path, retaining the legacy dotenv suffix without guessing a plaintext twin. */
+export declare function serviceMemberPath(value: unknown): {
+    environment: string;
+    member: string;
+    path: string;
+} | null;
+/** The selected project's public credential reference, independent of CI: used for a sealed private endpoint too. */
+export declare function projectServiceCredential(doc: ParsedDoc, serviceId: string, credentialId: string, repository: string): ServiceBinding | null;
+/**
+ * Positive tooling classification: the selected product project, one explicit CI link, its own declared environment and exact
+ * member/key. Names alone, a sealed key alone, or credentials of a host or another project confer no tooling authority.
+ */
+export declare function serviceBindings(doc: ParsedDoc, repository: string): {
+    bindings: ServiceBinding[];
+    problems: BindingProblem[];
+};
+/** A sealed row belongs to this exact positive binding; a same-named key elsewhere remains unrelated custody. */
+export declare function boundSealedKey(binding: ServiceBinding, sealed: {
+    env?: string;
+    member?: string;
+    key: string;
+    file?: string;
+}): boolean;
 /** Each CI name belongs to one class and scope; declarations contain names and public configuration only. */
 export declare function readCiDeclaration(doc: ParsedDoc): CiDeclaration;
 /** Missing quality blocks preserve the existing rendered defaults; disabled services remain explicitly disabled. */
-export declare function qualityServices(doc: ParsedDoc, { example }?: {
+export declare function qualityServices(doc: ParsedDoc, { example, repository }?: {
     example?: boolean;
+    repository?: string | undefined;
 }): ParsedDoc;
 /** Read only encrypted envelope key names, never decrypting or returning any sealed value. */
 export declare function sealedKeyNames(root: string, { fs }: {