@starci/hfs 4.7.16 → 4.7.18

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 4.7.18 - 2026-10-21
+- Changed: supersedes 4.7.17, published from a lane whose history the owner refused (an unapproved allowlist entry) and therefore a superseded orphan that is not used; this version carries the same work plus the standalone scaffold fix.
+- Fixed: the managed CI's coverage job runs `starci app coverage verify <lcov>`, the coverage judgement alone over the merged report, instead of `npm run codegen && starci app check --coverage-from` (the whole app check the fast and lint jobs already ran); its default timeout is 15 minutes (`knowledge/hfs/ci-standard.yaml`). NIVO v0.3.0's coverage job took 18m43s of 20 and the tag run was cancelled.
+- Fixed: the sonar row of `starci app release gate --sonar` no longer passes on the scanner's exit code alone: it reads `.scannerwork/report-task.txt`, polls `api/ce/task` until the analysis ends and reads `api/qualitygates/project_status` with the same token; ERROR is red as `RELEASE_SONAR_GATE_FAILED` naming each failed condition, a 600-second wait is `RELEASE_SONAR_GATE_TIMEOUT` and an unreadable answer `RELEASE_SONAR_GATE_UNREADABLE`; canon pins follow the matching package cohort.
+
+- Fixed: `npx @starci/cli app scaffold` works from the published packages alone: the Sonar exclusions come from the jest preset copy @starci/hfs ships (`runtime/packages/jest-preset/sonar-exclusions.cjs`, `bundledPresets`), not from a @starci/jest-preset installed beside the CLI (it was `HFS_SYNC_PRESET_MISSING`); `starci app upgrade` reads the same copy instead of a hand-kept list.
+- Fixed: a new scaffold path is git-initialised with an unborn main before any file is written (`HFS_SCAFFOLD_GIT_INIT_FAILED` when git cannot), as the verb promised, so `starci npm ci` can install the hooks; an existing empty unborn main repository is still accepted.
+
+- Fixed: `BE_UNIT_SPEC_NOT_STAGED` exempts a measured file with nothing to execute (constants and types only), which has nothing a spec could call and whose spec the spec rules refuse; every measured file with a function, method, constructor or accessor still needs its spec staged beside it. It refused the scaffold's own first commit on the constant-only `http-status.policy.ts`; the scaffold now also ships `migrate-connections.client.spec.ts`.
+
 ## 4.7.16 - 2026-10-21
 - Fixed: `DB_MIGRATION_DESTRUCTIVE` counts a be/src source as a reference of a dropped or altered column only when the source names the column's table too, so a same-named column of another table (`public.brain_lessons.origin` beside a drop of `transactions.origin`) no longer blocks a contract migration; table and other object drops keep the leaf match; canon pins follow the matching package cohort.
 

package/coverage/cli.mjs

@@ -3,14 +3,18 @@
 // coverage proof, the Codecov upload and the Sonar import read. The merge is the app's installed @starci/jest-preset (`@starci/jest-preset/merge`):
 // istanbul-lib-coverage merges the shard maps by source location, and the preset's own lcov reporter writes the result exactly as an unsharded run
 // would. A path is a coverage-final.json or a directory searched for every one below it; no report found refuses (exit 2), never an empty report.
+// `starci app coverage verify <lcov>`: the coverage proof alone (scripts/hfs/coverage-from.mjs, the judgement `starci app check --coverage-from`
+// adds to the whole check): every measured logic file is in the merged lcov at 100 per file. The managed CI's coverage job runs it after the merge,
+// so the job re-runs none of the rules the fast and lint jobs already judged. Exit 0 proved, 1 refused (the report lists every finding), 2 bad usage.
 import path from 'node:path';
 import { createRequire } from 'node:module';
+import { coverageFrom, formatCoverageReport } from '../runtime/scripts/hfs/coverage-from.mjs';
 
-const USAGE = 'usage: starci app coverage merge --out <lcov> <coverage-final.json-or-dir>... [--cwd <dir>]';
+const USAGE = 'usage: starci app coverage merge --out <lcov> <coverage-final.json-or-dir>... [--cwd <dir>] | starci app coverage verify <lcov> [--cwd <dir>]';
 
 function parse(argv) {
   const [action, ...rest] = argv;
-  if (action !== 'merge') throw new Error(USAGE);
+  if (action !== 'merge' && action !== 'verify') throw new Error(USAGE);
   const opts = { inputs: [] };
   for (let index = 0; index < rest.length; index += 1) {
     const arg = rest[index];
@@ -22,6 +26,11 @@ function parse(argv) {
     } else if (arg.startsWith('--')) throw new Error(`unknown flag ${arg}; ${USAGE}`);
     else opts.inputs.push(arg);
   }
+  opts.action = action;
+  if (action === 'verify') {
+    if (opts.out !== undefined || opts.inputs.length !== 1) throw new Error(USAGE);
+    return opts;
+  }
   if (!opts.out || !opts.inputs.length) throw new Error(USAGE);
   if (path.basename(opts.out) !== 'lcov.info') throw new Error(`--out names the lcov.info the coverage proof reads; ${USAGE}`);
   return opts;
@@ -34,11 +43,27 @@ function installedMerge(cwd) {
   }
 }
 
-/** Exit 0 merged, 2 bad usage, no preset or no report found. `merge` replaces the installed preset merge in a spec. */
-export async function coverageMain(argv, { cwd: baseCwd = process.cwd(), stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), merge } = {}) {
+/** The coverage proof of the app at `cwd` over the lcov `report`: exit 0 proved, 1 refused, 2 when the proof cannot run. */
+function verifyCoverage(cwd, report, { stdout, stderr, prove }) {
+  try {
+    const result = prove({ repoRoot: cwd, coverageFrom: report });
+    stdout(formatCoverageReport(result));
+    return result.ok ? 0 : 1;
+  } catch (error) {
+    stderr(`starci app coverage verify: ${String(error?.message ?? error).split('\n')[0]}\n`);
+    return 2;
+  }
+}
+
+/**
+ * Exit 0 merged or proved, 1 a refused proof, 2 bad usage, no preset or no report found. `merge` replaces the installed preset merge and
+ * `prove` the coverage proof in a spec.
+ */
+export async function coverageMain(argv, { cwd: baseCwd = process.cwd(), stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), merge, prove = coverageFrom } = {}) {
   let opts;
   try { opts = parse(argv); } catch (error) { stderr(`starci app coverage: ${error.message}\n`); return 2; }
   const cwd = path.resolve(baseCwd, opts.cwd ?? '.');
+  if (opts.action === 'verify') return verifyCoverage(cwd, opts.inputs[0], { stdout, stderr, prove });
   try {
     const run = merge ?? installedMerge(cwd);
     const outDir = path.dirname(path.resolve(cwd, opts.out));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.16",
+  "version": "4.7.18",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",