@starci/hfs 4.17.3 → 5.0.2

package/CHANGELOG.md

@@ -1,7 +1,21 @@
 # Changelog
 
+## 5.0.2
+
+- Changed: Align bundled canon pins and exact sibling requirements with Grammar and its lint families at 0.21.6. Runtime behavior and rule severity are unchanged.
+
 ## Unreleased
 
+## 5.0.1 - 2026-11-02
+
+- Fixed: function-subject provenance follows callable re-exports to the canonical declaration, so unit provider checks recognize the real subject through barrel exports while retaining invocation and dependency checks.
+
+## 5.0.0 - 2026-11-02
+
+- Changed: repeatable `app check --gate` selectors dispatch to the existing check families. Sonar and Codecov selectors reuse the combined quality-baseline engine and retain its prediction labels.
+- Changed: `--no-cache` invokes the existing recompute-and-refresh mode; ordinary `app check` retains content-keyed cache reuse.
+- Breaking: replaced individual family flags and `app check --full` with `--gate <name>` and `--no-cache`.
+
 ## 4.17.3 - 2026-11-02
 
 - Changed: bundled canonical pins follow the consolidated Grammar 0.21.3 preservation API cohort; runtime rules are unchanged.

package/README.md

@@ -18,7 +18,7 @@ starci app add spec <file>.service.ts [--cwd <dir>]
 starci app add image [--cwd <dir>]
 starci app lint [--cwd <dir>] [--changed <file>...] [--workspace <dir>] [--fix] [--json] [--out <sonar file>]
 starci app sync [--execute] [--cwd <dir>]
-starci app check [--cwd <dir>] [--json] [--full] [--hfs] [--format] [--db] [--secrets] [--wiring] [--types] [--lint] [--test] [--sonar] [--coverage-from <lcov>] [--quiet]
+starci app check [--cwd <dir>] [--gate <hfs|format|db|secrets|wiring|types|lint|test|sonar|codecov> ...] [--no-cache] [--json] [--coverage-from <lcov>] [--quiet]
 starci app check --staged [--cwd <dir>]
 starci app upgrade [--execute]
 starci app world <up|down|status> [--stack <dir>] [--services <list>] [--k3d] [--force] [--json] [--cwd <dir>]
@@ -193,7 +193,7 @@ Its own checks (`scripts/hfs/check.mjs`, `scripts/hfs/rules/`; the rendered-file
 | `FE_NO_TESTS` | error | a front end holds a `*.spec.*`, `*.test.*` or `*-spec.*` file, an `e2e/`, `__tests__/`, `__mocks__/` or `test-support/` directory, a vitest, Playwright, jest or Cypress file, a test script, or a test dependency in a `package.json`; no exception (R97; `scripts/hfs/rules/fe-no-tests.mjs`) |
 | `HFS_GITIGNORE_BLOCK_DRIFT` | error | the managed `.gitignore` block differs from its render (R04; `sync/managed.mjs`) |
 | `HFS_SONAR_CONFIG` | error | `sonar-project.properties` differs from its render: no `sonar.host.url`, the `sonar.exclusions` of the installed jest preset, the be lcov import with the coverage scope the slot manifest derives as the only coverage scope (R11; `sync/managed.mjs`) |
-| `HFS_FORMAT` | error | a tracked file the repository's own prettier would change (R19; `sync/format.mjs`, run in batches by `--format`) |
+| `HFS_FORMAT` | error | a tracked file the repository's own prettier would change (R19; `sync/format.mjs`, run in batches by the format family) |
 | `HFS_FORMAT_TOOL_MISSING` | refusal (exit 2) | prettier is not installed in the repository; the format check is never skipped |
 
 The managed files are judged by `sync/managed.mjs` and `sync/ts-strict.mjs` (the package renders the templates; the runtime copy does not). The list of managed
@@ -209,8 +209,11 @@ finding under the machine's own rule id (`BE_TIER_DIRECTION`, `HFS_UNUSED_EXPORT
 repository without `typescript` installed fails with `ARCH_TYPESCRIPT_MISSING`; the check never passes because it could not run.
 
 With no selector `starci app check` runs every family diff-only against the committed cache `.starcistacks/cache/` (contexts/project/check-cache.md) and
-writes what it judged back; the result equals a full run's. `--full` runs the selected families in full. A selector (`--hfs`, `--format`, `--db`, `--secrets`,
-`--wiring`, `--types`, `--lint`, `--test`, `--sonar`) runs one family; selectors combine. Each family prints `<family>: <full|diff> (<reason>), checked n, reused n;
+writes what it judged back; the result equals a full run's. `--no-cache` runs selected work fresh and writes the refreshed cache records.
+Repeat `--gate <name>` to combine `hfs`, `format`, `db`, `secrets`, `wiring`, `types`, `lint`, `test`, `sonar` and `codecov`.
+The last two names dispatch to the same existing combined prediction family and execute it once, so ten public choices retain nine core families.
+Predictions remain diagnostics; actual Sonar CI/release checks and Codecov CI uploads keep their existing ownership and verdicts.
+`app check --staged` remains the separate pre-commit guard. Each family prints `<family>: <full|diff> (<reason>), checked n, reused n;
 findings n new, n known, n fixed`. Progress goes to stderr (`--quiet` silences it). `STARCI_APP_CHECK_CACHE=verify` runs diff then full and exits 2 on any difference;
 `STARCI_APP_CHECK_CACHE=full` never reads the cache (the release gate).
 

package/coverage/cli.mjs

@@ -68,10 +68,10 @@ function recordFilesUnder(dir) {
 function mergeRecords(cwd, dir, out, merge) {
     const absolute = path.resolve(cwd, dir);
     if (!fs.existsSync(absolute) || !fs.statSync(absolute).isDirectory())
-        throw new Error(`no ${dir} folder: the check cache holds no unit coverage yet (run starci app check --test)`);
+        throw new Error(`no ${dir} folder: the check cache holds no unit coverage yet (run starci app check --gate test)`);
     const records = recordFilesUnder(absolute).flatMap((file) => parseRecords(fs.readFileSync(file, 'utf8')).records).filter((record) => record.step === SPEC_STEP);
     if (records.length === 0)
-        throw new Error(`no unit-spec record under ${dir}: the check cache holds no unit coverage yet (run starci app check --test)`);
+        throw new Error(`no unit-spec record under ${dir}: the check cache holds no unit coverage yet (run starci app check --gate test)`);
     const outDir = path.dirname(path.resolve(cwd, out));
     merge(records.map(sourcesOf), { outDir, reportRoot: path.dirname(outDir), recordRoot: cwd });
     return { specs: records.length };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.17.3",
+  "version": "5.0.2",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.21.3
+    version: 0.21.6
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.11.10
+    version: 3.11.13
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.9.3
+    version: 9.9.6
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.3
+    version: 0.21.6
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.3
+    version: 0.21.6
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.17.3
+    version: 5.0.2
     group: starci
     install: registry
     side: both

package/runtime/modules/kernel/failure-codes.yaml

@@ -294,7 +294,7 @@ BE_APP_BOOT_PROOF_MISSING:
     - "Thiếu provider, thiếu export của module hoặc có phụ thuộc vòng"
     - "Thiếu AppModule, dữ liệu mẫu cho đăng ký động hoặc đối tượng thay thế hạ tầng"
     - "Tiến trình chứng minh ghép nối thất bại hoặc hết thời gian"
-  nextStep_vi: "Sửa đăng ký và phạm vi provider trong AppModule thật, cung cấp dữ liệu mẫu cùng đối tượng thay thế hạ tầng rồi chạy lại starci app check --wiring."
+  nextStep_vi: "Sửa đăng ký và phạm vi provider trong AppModule thật, cung cấp dữ liệu mẫu cùng đối tượng thay thế hạ tầng rồi chạy lại starci app check --gate wiring."
   owner: op-retry
   kind: check-finding
 
@@ -1727,7 +1727,7 @@ BOOT_PROOF_TIMEOUT:
   meaning_vi: "Tiến trình chứng minh ghép nối Nest chạy quá ngân sách thời gian riêng của nó (STARCI_BOOT_PROOF_TIMEOUT_MS, lấy từ heavy.bootProofTimeoutSeconds của ops/liveness.yaml) cả lần đầu lẫn lần thử lại. Đây không phải lỗi ghép nối: máy đang quá tải nên chưa phán được."
   causes_vi:
     - "Máy chủ đang chạy nhiều lệnh nặng cùng lúc nên trình biên dịch TypeScript của bằng chứng chạy quá chậm"
-  nextStep_vi: "Chạy lại starci app check --wiring khi máy rảnh hơn; nếu vẫn hết thời gian khi máy rảnh, nâng heavy.bootProofTimeoutSeconds trong ops/liveness.yaml."
+  nextStep_vi: "Chạy lại starci app check --gate wiring khi máy rảnh hơn; nếu vẫn hết thời gian khi máy rảnh, nâng heavy.bootProofTimeoutSeconds trong ops/liveness.yaml."
   owner: op-retry
   kind: check-finding
 

package/runtime/scripts/hfs/app-wiring.d.mts

@@ -63,7 +63,7 @@ export interface AppWiringInput {
     run?: WorkerRun;
 }
 export declare function appWiring({ repoRoot, repo, files, fixtures, timeout, run }: AppWiringInput): WiringResult;
-/** Optional standalone entry; coordinator connects the same seam to app check --wiring. */
+/** Optional standalone entry; coordinator connects the same seam to app check --gate wiring. */
 export interface AppWiringMainIo {
     cwd?: string;
     stdout?: (text: string) => unknown;

package/runtime/scripts/hfs/app-wiring.mjs

@@ -30,9 +30,9 @@ const SAFE_REASONS = new Set([...DI_FAILURES.values(), COMPILATION_FAILURE]);
 const modulePath = (app) => `apps/${app}/src/app.module.ts`;
 export const wiringFixturePath = (app) => `src/tests/fixtures/builders/${app}.builder.ts`;
 const refusal = (file, reason) => ({ code: BOOT_PROOF_CODE, level: 'error', path: file,
-    message: `${file}: lite boot proof failed (${reason}); compile the real AppModule with explicit fixture options and infrastructure doubles using starci app check --wiring`, reason });
+    message: `${file}: lite boot proof failed (${reason}); compile the real AppModule with explicit fixture options and infrastructure doubles using starci app check --gate wiring`, reason });
 const timedOut = (file, budget) => ({ code: BOOT_PROOF_TIMEOUT, level: 'warning', path: file, reason: 'proof worker timed out',
-    message: `${file}: the lite boot proof reached no verdict: its worker ran out of its ${Math.round(budget / 1000)} s budget twice (the host is loaded); this is no failure of the proof, rerun starci app check --wiring when the host is quieter` });
+    message: `${file}: the lite boot proof reached no verdict: its worker ran out of its ${Math.round(budget / 1000)} s budget twice (the host is loaded); this is no failure of the proof, rerun starci app check --gate wiring when the host is quieter` });
 /** The worker's budget in ms, from its spawn: the CLI's STARCI_BOOT_PROOF_TIMEOUT_MS, else four compile deadlines (at least a minute). */
 export function workerBudget(timeout, env = process.env) {
     const configured = Number(env[BOOT_PROOF_TIMEOUT_ENV]);
@@ -217,12 +217,20 @@ export function appWiring({ repoRoot, repo = readJson(repoRoot, 'hfs.json'), fil
 export function appWiringMain(argv, { cwd = invocationDir(), stdout = (text) => process.stdout.write(text), stderr = (text) => process.stderr.write(text) } = {}) {
     let directory = cwd, json = false;
     for (let at = 0; at < argv.length; at += 1) {
-        if (argv[at] === '--cwd' && argv[at + 1])
-            directory = path.resolve(cwd, argv[++at]);
-        else if (argv[at] === '--json')
+        const argument = argv[at];
+        const next = argv[at + 1];
+        if (argument === '--cwd' && next && !next.startsWith('--')) {
+            directory = path.resolve(cwd, next);
+            at += 1;
+        }
+        else if (argument?.startsWith('--cwd=') && argument.length > '--cwd='.length)
+            directory = path.resolve(cwd, argument.slice('--cwd='.length));
+        else if (argument === '--json')
             json = true;
-        else if (argv[at] !== '--wiring') {
-            stderr('usage: starci app check --wiring [--cwd <dir>] [--json]\n');
+        else if (argument === '--gate' && next === 'wiring')
+            at += 1;
+        else if (argument !== '--gate=wiring') {
+            stderr('usage: starci app check --gate wiring [--cwd <dir>] [--json]\n');
             return 2;
         }
     }

package/runtime/scripts/hfs/architecture/canon-jsx-clones.mjs

@@ -17,7 +17,7 @@ function importBindings(ts, scope, statement) {
         return;
     const module = statement.moduleSpecifier.text;
     if (clause.name)
-        scope.bindings.set(clause.name.text, { kind: 'component' });
+        scope.bindings.set(clause.name.text, { kind: 'component', module, name: 'default' });
     const named = clause.namedBindings;
     if (!named)
         return;
@@ -28,8 +28,9 @@ function importBindings(ts, scope, statement) {
             if (element.isTypeOnly)
                 continue;
             const imported = element.propertyName?.text ?? element.name.text;
-            const kind = TRANSLATION_MODULES.has(module) && TRANSLATION_FACTORIES.has(imported) ? 'translation-factory' : 'component';
-            scope.bindings.set(element.name.text, { kind });
+            const binding = TRANSLATION_MODULES.has(module) && TRANSLATION_FACTORIES.has(imported)
+                ? { kind: 'translation-factory' } : { kind: 'component', module, name: imported };
+            scope.bindings.set(element.name.text, binding);
         }
 }
 function lexicalBindings(ts, sourceFile) {
@@ -151,12 +152,55 @@ function nestedDataObjects(ts, expression, bindingOf, excluded) {
                 nestedDataObjects(ts, element, bindingOf, excluded);
     }
 }
+/** Resolve the canonical status owner through its import binding, including aliases and namespaces. */
+function statusOwner(ts, tag, bindingOf) {
+    const binding = ts.isIdentifier(tag) ? bindingOf(tag) : ts.isPropertyAccessExpression(tag) && ts.isIdentifier(tag.expression) ? bindingOf(tag.expression) : null;
+    const module = binding?.kind === 'component' || binding?.kind === 'namespace' ? binding.module : null;
+    const name = binding?.kind === 'component' ? binding.name : ts.isPropertyAccessExpression(tag) ? tag.name.text : null;
+    return name === 'SlotView' && module !== null && /(?:^|\/)components\/composites\/SlotView(?:\/index)?(?:\.[cm]?tsx?)?$/.test(module);
+}
+/** The mandated status wiring breaks clone windows; its render body remains ordinary compared code. */
+function statusRecipe(ts, opening, bindingOf, excluded) {
+    if (!statusOwner(ts, opening.tagName, bindingOf))
+        return;
+    const attributes = opening.attributes.properties;
+    const render = attributes.find(attribute => ts.isJsxAttribute(attribute) && ts.isIdentifier(attribute.name) && attribute.name.text === 'render');
+    const value = render && ts.isJsxAttribute(render) && render.initializer && ts.isJsxExpression(render.initializer) ? unwrap(ts, render.initializer.expression) : undefined;
+    if (!value || !ts.isArrowFunction(value) || value.parameters.length !== 2 || ts.isBlock(value.body))
+        return;
+    const waiting = value.parameters[1];
+    if (!waiting || !ts.isIdentifier(waiting.name) || waiting.initializer || waiting.dotDotDotToken)
+        return;
+    const waitingBinding = bindingOf(waiting.name);
+    let forwardsLoading = false;
+    const visit = (node) => {
+        if (ts.isJsxAttribute(node) && ts.isIdentifier(node.name) && node.name.text === 'isLoading'
+            && node.initializer && ts.isJsxExpression(node.initializer)) {
+            const flag = unwrap(ts, node.initializer.expression);
+            if (flag && ts.isIdentifier(flag) && waitingBinding && bindingOf(flag) === waitingBinding)
+                forwardsLoading = true;
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(value.body);
+    if (!forwardsLoading)
+        return;
+    const wiring = attributes.filter(attribute => ts.isJsxSpreadAttribute(attribute) ? dataMapping(ts, attribute.expression, bindingOf)
+        : ts.isIdentifier(attribute.name) && ['slot', 'placeholder', 'labels', 'onRetry'].includes(attribute.name.text)
+            && !!attribute.initializer && ts.isJsxExpression(attribute.initializer) && dataMapping(ts, attribute.initializer.expression, bindingOf));
+    const hasSlot = wiring.some(attribute => ts.isJsxSpreadAttribute(attribute) || ts.isJsxAttribute(attribute) && ts.isIdentifier(attribute.name) && attribute.name.text === 'slot');
+    if (!hasSlot)
+        return;
+    for (const attribute of wiring)
+        excluded.add(attribute);
+}
 /** Canon data prop objects qualify through an imported component binding, never its chosen name or file path. */
 export function canonJsxCloneNodes(ts, sourceFile) {
     const bindingOf = lexicalBindings(ts, sourceFile);
     const excluded = new Set();
     const visit = (node) => {
         if ((ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) && importedComponent(ts, node.tagName, bindingOf)) {
+            statusRecipe(ts, node, bindingOf, excluded);
             for (const attribute of node.attributes.properties) {
                 if (!ts.isJsxAttribute(attribute) || !attribute.initializer || !ts.isJsxExpression(attribute.initializer))
                     continue;

package/runtime/scripts/hfs/architecture/contracts.mjs

@@ -203,6 +203,9 @@ function signatureParameterStatus(ts, checker, signature, location, parameter, s
     const actual = parameterSymbol ? checker.getTypeOfSymbolAtLocation(parameterSymbol, location) : null;
     if (actual && parameter.questionToken && !ts.isUnionTypeNode(parameter.type) && hasAnyFlag(actual.flags, ts.TypeFlags.Union)) {
         const selected = actual.types.filter((type) => !hasAnyFlag(type.flags, ts.TypeFlags.Undefined));
+        // An optional boolean is represented as true | false | undefined, not one Boolean member.
+        if (selected.length > 0 && selected.every((type) => hasAnyFlag(type.flags, ts.TypeFlags.BooleanLike)))
+            return 'scalar';
         return selected.length === 1 ? contractTypeStatusFromType(ts, checker, selected[0]) : 'inline';
     }
     return actual ? contractTypeStatusFromType(ts, checker, actual) : contractTypeStatus(ts, checker, parameter.type);

package/runtime/scripts/hfs/architecture/function-spec-providers.d.mts

@@ -1,13 +1,13 @@
-import type { ArrayLiteralExpression, CallExpression, Expression, Node, ObjectLiteralExpression, SourceFile } from 'typescript';
+import type { ArrayLiteralExpression, CallExpression, Expression, Node, ObjectLiteralExpression, SourceFile, TypeChecker } from 'typescript';
 import type { TypeScriptApi } from './config.mjs';
 import type { ImportBinding } from './machine-ast.mjs';
 export declare const keyOf: (ts: TypeScriptApi, property: Node) => string | null;
 /**
- * The callable subset of a function subject's exports. Constants, enums, objects, types, `export ... from` re-exports and overload
- * signatures do not change which functions the spec must provide; a class or a default-export assignment keeps the class-provider
- * check (null), as does a module with no callable export.
+ * The callable subset of a function subject's exports, including named re-exports resolved to real implementations. Constants,
+ * enums, objects, type-only exports and bodyless declarations do not count; a class or a default-export assignment keeps the
+ * class-provider check (null), as does a module with no callable export.
  */
-export declare function functionSubjectExports(ts: TypeScriptApi, sourceFile: SourceFile): string[] | null;
+export declare function functionSubjectExports(ts: TypeScriptApi, sourceFile: SourceFile, checker: TypeChecker): string[] | null;
 /** The names of the value-object classes a module exports, or null when it exports a class that is not one (or none). */
 export declare function valueObjectSubjects(ts: TypeScriptApi, sourceFile: SourceFile): string[] | null;
 /** The value of one literal object property. */

package/runtime/scripts/hfs/architecture/function-spec-providers.mjs

@@ -1,4 +1,5 @@
 import path from 'node:path';
+import { normalizedSymbol } from './ast-walks.mjs';
 export const keyOf = (ts, property) => (ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property)) && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)) ? property.name.text : null;
 const exported = (ts, statement) => statement.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.ExportKeyword) ?? false;
 /** The directly defined functions among the declarations of an exported variable statement; other values are not callable. */
@@ -19,17 +20,30 @@ function callableExports(ts, statement) {
         return statement.name && statement.body ? [statement.name.text] : [];
     return ts.isVariableStatement(statement) ? callableVariables(ts, statement) : [];
 }
+/** Named value re-exports count only when the checker resolves an actual function implementation. */
+function callableReexports(ts, checker, statement) {
+    if (!ts.isExportDeclaration(statement) || statement.isTypeOnly || !statement.exportClause || !ts.isNamedExports(statement.exportClause))
+        return [];
+    return statement.exportClause.elements.filter(element => !element.isTypeOnly && (normalizedSymbol(ts, checker, element.name)?.declarations ?? []).some(declaration => {
+        if (declaration.getSourceFile().isDeclarationFile)
+            return false;
+        if (ts.isFunctionDeclaration(declaration))
+            return Boolean(declaration.body);
+        return ts.isVariableDeclaration(declaration) && Boolean(declaration.initializer
+            && (ts.isArrowFunction(declaration.initializer) || ts.isFunctionExpression(declaration.initializer)));
+    })).map(element => element.name.text);
+}
 /**
- * The callable subset of a function subject's exports. Constants, enums, objects, types, `export ... from` re-exports and overload
- * signatures do not change which functions the spec must provide; a class or a default-export assignment keeps the class-provider
- * check (null), as does a module with no callable export.
+ * The callable subset of a function subject's exports, including named re-exports resolved to real implementations. Constants,
+ * enums, objects, type-only exports and bodyless declarations do not count; a class or a default-export assignment keeps the
+ * class-provider check (null), as does a module with no callable export.
  */
-export function functionSubjectExports(ts, sourceFile) {
+export function functionSubjectExports(ts, sourceFile, checker) {
     const names = [];
     for (const statement of sourceFile.statements) {
         if (ts.isClassDeclaration(statement) || ts.isExportAssignment(statement))
             return null;
-        for (const name of callableExports(ts, statement))
+        for (const name of [...callableExports(ts, statement), ...callableReexports(ts, checker, statement)])
             if (!names.includes(name))
                 names.push(name);
     }

package/runtime/scripts/hfs/architecture/unit-spec-providers.d.mts

@@ -13,7 +13,7 @@ import type { MachineContext } from './machine-ast.mjs';
  * constructor-deps.mjs). Providers are matched by the exported name of the imported binding (`import { CACHE as C }` is
  * CACHE), never by text. A provider is a class, or `{ provide: TOKEN, useValue: double }` and nothing else. A sibling
  * containing only exported functions instead provides its complete real function object and exercises it through module.get;
- * the constants, enums, re-exports and overload signatures beside those functions do not count. A value-object subject (an
+ * callable named re-exports count, while constants, enums, type-only exports and overload signatures do not. A value-object subject (an
  * undecorated class whose constructor parameters carry no injection token) is built with `new`, Nest never constructs it.
  *
  * Findings: an extra provider, a missing provider, a service that is not the first provider, a dependency whose token cannot

package/runtime/scripts/hfs/architecture/unit-spec-providers.mjs

@@ -18,7 +18,7 @@ import { checkFunctionSubject, functionSubjectExports, keyOf as literalKey, valu
  * constructor-deps.mjs). Providers are matched by the exported name of the imported binding (`import { CACHE as C }` is
  * CACHE), never by text. A provider is a class, or `{ provide: TOKEN, useValue: double }` and nothing else. A sibling
  * containing only exported functions instead provides its complete real function object and exercises it through module.get;
- * the constants, enums, re-exports and overload signatures beside those functions do not count. A value-object subject (an
+ * callable named re-exports count, while constants, enums, type-only exports and overload signatures do not. A value-object subject (an
  * undecorated class whose constructor parameters carry no injection token) is built with `new`, Nest never constructs it.
  *
  * Findings: an extra provider, a missing provider, a service that is not the first provider, a dependency whose token cannot
@@ -111,7 +111,7 @@ function checkTestingModule({ ts, kit, rel, serviceRel, serviceFile, imports, ca
     const list = providerList(ts, call, rel, report);
     if (!list)
         return;
-    const names = functionSubjectExports(ts, serviceFile.sourceFile);
+    const names = functionSubjectExports(ts, serviceFile.sourceFile, kit.checkerOf(serviceFile.sourceFile));
     if (names) {
         checkFunctionSubject({ ts, rel, serviceRel, imports, call, list, names, report });
         return;

package/src/main.mjs

@@ -8,7 +8,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 // The @starci/hfs implementation behind `starci app`: one repository, `<app>/`, with one package.json, lockfile and node_modules
 // at its root and two sides, be/ and fe/, declared by the one hfs.json of kind app. Every verb runs at the app root.
-//   starci app check [--cwd <dir>] [--json] [--full] [--hfs] [--format] [--db] [--secrets] [--wiring] [--types] [--lint] [--test] [--sonar] [--coverage-from <lcov>] | check --staged
+//   starci app check [--cwd <dir>] [--json] [--gate <hfs|format|db|secrets|wiring|types|lint|test|sonar|codecov>]... [--no-cache] [--coverage-from <lcov>] [--shard <i>/<n>] | check --staged
 //                                            every tracked path has a slot; required files exist; nothing forbidden or
 //                                            tracked-that-must-be-ignored; pins match; every managed file equals its render
 //                                            (sync/managed.mjs, the .gitignore block and sonar-project.properties included); no empty or ghost
@@ -21,10 +21,12 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 //                                            ESLint executes once per side through the installed managed config; the FE config composes
 //                                            the universal canon and the explicitly selected Grammar-family canon.
 //                                            The results are committed in .starcistacks/cache/ (cache/, contexts/project/check-cache.md): with no selector every
-//                                            family runs diff-only against it and writes what it judged back; --full runs the selected families in full; a
-//                                            selector (--hfs, --format, --db, --secrets, --wiring, --types, --lint, --test, --sonar) runs only that family, and
-//                                            selectors combine. Each family prints one diagnosis line (full or diff and why, checked, reused, findings new, known,
-//                                            fixed); progress goes to stderr (--quiet silences it). STARCI_APP_CHECK_CACHE=verify runs diff then full and fails (exit 2)
+//                                            local family reuses valid cache records and writes what it judged back; a missing cache, fingerprint change or
+//                                            release selects full automatically. Repeat --gate to select gates; no selector runs every existing family.
+//                                            sonar and codecov select the same combined baseline predictions, not server verdicts. --no-cache recomputes the
+//                                            selected families and writes the refreshed cache; it does not bypass writes.
+//                                            Each family prints one diagnosis line (full or diff and why, checked, reused, findings new, known, fixed);
+//                                            progress goes to stderr (--quiet silences it). STARCI_APP_CHECK_CACHE=verify runs diff then full and fails (exit 2)
 //                                            on any difference; =full never reads the cache (the release gate).
 //                                            --coverage-from <lcov> judges a coverage report produced elsewhere (the merge of a sharded unit run) and records nothing.
 //                                            --staged: the pre-commit guard alone (sync/hygiene.mjs: staged .starciwork and .starcistacks paths, the secrets
@@ -145,8 +147,10 @@ const DATABASE_VERBS = new Map([['baseline', dbBaselineMain], ['restamp', dbRest
  */
 /** The flags of the add nouns that generate a file tree from a pattern (service, spec and image take none of them, and --inject is only theirs). */
 const ADD_FLAGS = { value: ['--event', '--from', '--service', '--connection', '--owner', '--failed', '--done', '--shapes', '--read', '--app', '--kind', '--blocks', '--tabs'], boolean: ['--fe', '--form'] };
-/** The family selectors of `app check`, one flag per family of the cache (contexts/project/check-cache.md). */
-const FAMILY_FLAGS = FAMILIES.map((family) => `--${family}`);
+/** The repeatable selector of `app check`; its values are the canonical family vocabulary. */
+const GATE_FLAGS = ['--gate'];
+/** Both quality selectors dispatch to the existing combined Sonar/Codecov baseline family. */
+const CHECK_GATES = [...FAMILIES, 'codecov'];
 const PARSED = {
     scaffold: { run: scaffoldMain, value: ['--registry-visibility'], edition: true, forms: [{ operands: '<name>' }] },
     add: {
@@ -158,7 +162,7 @@ const PARSED = {
             { operands: 'image', flags: [] },
         ],
     },
-    check: { run: checkMain, value: ['--coverage-from', '--shard'], boolean: ['--json', '--staged', '--full', ...FAMILY_FLAGS], edition: true, forms: [{ only: { boolean: ['--json', '--full', ...FAMILY_FLAGS], value: ['--coverage-from', '--shard'] } }, { only: { boolean: ['--staged'] }, edition: false }] },
+    check: { run: checkMain, value: ['--coverage-from', '--shard'], list: GATE_FLAGS, boolean: ['--json', '--staged', '--no-cache'], edition: true, forms: [{ only: { boolean: ['--json', '--no-cache'], list: GATE_FLAGS, value: ['--coverage-from', '--shard'] } }, { only: { boolean: ['--staged'] }, edition: false }] },
     slot: { run: slotMain, boolean: ['--json'], forms: [{ operands: '<path>' }] },
     emit: { run: emitMain, forms: [{}] },
 };
@@ -168,6 +172,7 @@ const ADD_FLAGS_ALL = flagsOf(ADD_FLAGS);
 const PARSED_FLAGS = new Set([...Object.values(PARSED).flatMap(flagsOf), '--edition']);
 /** The placeholder of a value flag in the usage; any other prints as <name>. */
 const PLACEHOLDERS = {
+    '--gate': `<${CHECK_GATES.join('|')}>`,
     '--registry-visibility': 'public|private', '--edition': 'full|lite', '--base': '<ref>', '--coverage-from': '<lcov>', '--shard': '<i>/<n>', '--inject': '<binding>',
     '--event': '<event>', '--from': '<service>', '--service': '<Class>=<module>', '--owner': '<service>', '--failed': '<event>', '--done': '<event>',
     '--shapes': '<a,b,c>', '--blocks': '<a,b>', '--tabs': '<a,b>', '--kind': 'modal|drawer', '--image': '<service>=<ref>', '--sha': '<sha>',
@@ -331,7 +336,14 @@ function printExplain(e, out) {
 }
 /** The family selectors given, as families; none given selects `fallback`. */
 function selectedFamilies(opts, fallback) {
-    const given = FAMILIES.filter((family) => opts[family] === true);
+    const given = (listFlag(opts, 'gate') ?? []).map((value) => {
+        if (value === 'codecov')
+            return 'sonar';
+        const family = FAMILIES.find((candidate) => candidate === value);
+        if (family === undefined)
+            throw new Error(`--gate accepts ${CHECK_GATES.join('|')}; got ${JSON.stringify(value)}`);
+        return family;
+    });
     return new Set(given.length > 0 ? given : fallback);
 }
 /** Opens the session of a verb over the tracked files of the app: progress on stderr, `--quiet` silent, a terminal rewriting running lines in place. */
@@ -483,7 +495,7 @@ function printCheckProofs(result, out) {
         out(formatCoverageReport(result.coverage));
 }
 /** The flags `check --staged` refuses: it is the pre-commit guard alone, so none of the whole-app pass's options means anything with it. */
-const STAGED_REFUSES = ['--json', '--full', '--coverage-from', '--shard', ...FAMILY_FLAGS];
+const STAGED_REFUSES = ['--json', '--no-cache', '--coverage-from', '--shard', ...GATE_FLAGS];
 /** The family a finding belongs to, for naming it when a verified run disagrees with the cache. */
 function familyOf(finding) {
     const code = finding.code ?? '';
@@ -567,17 +579,21 @@ async function checkMain(opts, io) {
     }
     const coverageFrom = valueFlag(opts, 'coverage-from');
     const shard = valueFlag(opts, 'shard');
+    const explicit = selectedFamilies(opts, []);
     if (shard !== undefined) {
-        // The sharded full unit run of CI (--test --full --shard <i>/<n>): the shard's Jest run in the shape the shard merge reads; nothing is recorded.
+        // A selected test shard is always a whole-unit shard, in the shape the coverage merge reads; nothing is recorded.
         const match = /^(\d+)\/(\d+)$/.exec(shard);
-        if (match === null || opts.test !== true || opts.full !== true)
-            throw new Error('--shard <i>/<n> belongs to `starci app check --test --full`');
-        return runTestShard(repoRoot, Number(match[1]), Number(match[2]));
+        if (explicit.size !== 1 || !explicit.has('test') || coverageFrom !== undefined)
+            throw new Error('--shard <i>/<n> requires --gate test alone and takes no --coverage-from');
+        const index = Number(match?.[1]);
+        const total = Number(match?.[2]);
+        if (match === null || !Number.isSafeInteger(index) || !Number.isSafeInteger(total) || index < 1 || total < index)
+            throw new Error('--shard needs <i>/<n> with 1 <= i <= n');
+        return runTestShard(repoRoot, index, total);
     }
-    const explicit = selectedFamilies(opts, []);
     // A coverage report judged on its own (the merge job of a sharded run) runs no family; with selectors it comes on top of them.
     const selected = explicit.size > 0 ? explicit : coverageFrom === undefined ? new Set(DEFAULT_FAMILIES) : new Set();
-    const full = opts.full === true ? new Set(selected) : undefined;
+    const full = opts['no-cache'] === true ? new Set(selected) : undefined;
     if (io.env[CACHE_ENV] === 'verify')
         return verifyCache(io, selected, coverageFrom);
     const { result, seconds } = await checkRun({ io, selected, full, use: coverageFrom !== undefined && explicit.size === 0 ? 'bypass' : 'normal', coverageFrom });
@@ -590,7 +606,7 @@ async function checkMain(opts, io) {
             out(`${result.gate.line}\n`);
     }
     const exit = result.eslint?.errors.length ? 2 : result.ok ? 0 : 1;
-    writeRunLog(repoRoot, { command: `check${[...selected].map((family) => ` --${family}`).join('')}${opts.full === true ? ' --full' : ''}`, seconds, exit, families: result.families.map((report) => ({ ...report, seconds: 0 })) }, io.env);
+    writeRunLog(repoRoot, { command: `check${[...new Set(listFlag(opts, 'gate') ?? [])].map((gate) => ` --gate ${gate}`).join('')}${opts['no-cache'] === true ? ' --no-cache' : ''}${coverageFrom === undefined ? '' : ` --coverage-from ${JSON.stringify(coverageFrom)}`}`, seconds, exit, families: result.families.map((report) => ({ ...report, seconds: 0 })) }, io.env);
     return exit;
 }
 function emitMain(opts, { cwd: repoRoot, stdout: out }) {

package/templates/app/ci-workflows/github/workflows/ci.yml

@@ -87,7 +87,7 @@ jobs:
       - name: production dependency audit
         run: {{auditCommand}}
       - name: format
-        run: npx --no-install starci app check --format
+        run: npx --no-install starci app check --gate format
       - name: typecheck
         run: npm run typecheck
         env:

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -87,7 +87,7 @@ jobs:
       - name: production dependency audit
         run: {{auditCommand}}
       - name: format
-        run: npx --no-install starci app check --format
+        run: npx --no-install starci app check --gate format
       - name: typecheck
         run: npm run typecheck
         env:

package/templates/app/package-scripts/db.json

@@ -7,4 +7,4 @@
     "db:push": "{{appBinary}} db migrate --db-url-env DATABASE_URL --execute",
     "db:plan": "{{appBinary}} db migrate --db-url-env DATABASE_URL",
     "db:dump": "{{appBinary}} db dump --db-url-env DATABASE_URL --out ../{{project}}-db-backups",
-    "db:lint": "{{appBinary}} check --db",
+    "db:lint": "{{appBinary}} check --gate db",