@starci/hfs 4.7.2 → 4.7.3

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 4.7.3 - 2026-10-18
+- Fixed: the managed CI typecheck step declares the CI standard's raised Node heap, preventing the NIVO release candidate's typecheck from exhausting Node's default heap; the CI standard checks typecheck steps too.
+- Fixed: the fresh coverage job runs codegen before the whole-app coverage proof, preparing ignored GraphQL wire types before the app check or its isolated example copy starts; a failed generator stops the proof.
+
 ## 4.7.2 - 2026-10-18
 - Fixed: `app coverage merge` merges the shard istanbul maps through the installed @starci/jest-preset/merge (4.7.1 merged lcov text and reported phantom gaps on real data); the managed unit step sets STARCI_COVERAGE_SHARD and uploads coverage-final.json; `app lint` accepts a canon inside the app's linked node_modules.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.2",
+  "version": "4.7.3",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.7
+    version: 3.4.9
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.7
+    version: 8.4.9
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.2
+    version: 1.7.3
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.2
+    version: 4.7.3
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/ci-standard.yaml

@@ -27,7 +27,7 @@ defaults:
 # The steps that need a raised Node heap on the GitHub runner, matched on their `run` text, and the least heap they must declare in NODE_OPTIONS.
 heap:
   minMiB: 6144
-  steps: ['npm run lint', 'app lint', 'app check --coverage-from']
+  steps: ['npm run typecheck', 'npm run lint', 'app lint', 'app check --coverage-from']
 
 items:
   - id: candidate-trigger

package/sync/ci-commands.mjs

@@ -210,11 +210,12 @@ function sonarMergeSteps(condition) {
 const STANDARD = new URL('../runtime/knowledge/hfs/ci-standard.yaml', import.meta.url);
 /** The per-job settings of the managed CI: ci.jobs.<job>.timeoutMinutes and ci.jobs.test.shards of the manifest over the defaults of the CI standard. */
 function ciJobSettings(declaration) {
-  const defaults = parseYaml(fs.readFileSync(STANDARD, 'utf8')).defaults;
+  const { defaults, heap } = parseYaml(fs.readFileSync(STANDARD, 'utf8'));
   const jobs = declaration?.ci?.jobs ?? {};
   const timeout = (job) => String(jobs[job]?.timeoutMinutes ?? defaults.timeoutMinutes[job]);
   const shards = Number(jobs.test?.shards ?? defaults.shards);
   return {
+    nodeOptions: `--max-old-space-size=${heap.minMiB}`,
     timeoutFast: timeout('fast'), timeoutLint: timeout('lint'), timeoutTest: timeout('test'), timeoutCoverage: timeout('coverage'),
     timeoutBuild: timeout('build'), timeoutSonar: timeout('sonar'), timeoutDbTypes: timeout('db-types'),
     testShards: `[${Array.from({ length: shards }, (_, index) => index + 1).join(', ')}]`, testShardTotal: String(shards),
@@ -240,7 +241,7 @@ export function ciWorkflowCommands(source, lcovReport = 'be/coverage/lcov.info',
     ciBuildSteps: build.steps,
     ciLint: exampleCommand(source, 'npm run lint'),
     ciLintSonar: exampleCommand(source, 'npm run lint -- --sonar reports/lint.sonar.json'),
-    ciCoverageProof: exampleCommand(source, 'npx starci app check --coverage-from ' + lcovReport),
+    ciCoverageProof: 'npm run codegen --silent && ' + exampleCommand(source, 'npx starci app check --coverage-from ' + lcovReport),
     ciDatabaseLint: exampleCommand(source, 'npm run db:lint'),
     auditCommand: `npm audit${audit.omitDev ? ' --omit=dev' : ''} --audit-level=${audit.level}`,
     sonarTokenSecret: sonar?.token ?? 'SONAR_TOKEN',
@@ -252,13 +253,13 @@ export function ciWorkflowCommands(source, lcovReport = 'be/coverage/lcov.info',
       ...(sonar ? ["        if: env.SONAR_TOKEN == ''"] : []),
       `        run: ${exampleCommand(source, 'npm run lint -- --side ' + side)}`,
       '        env:',
-      '          NODE_OPTIONS: --max-old-space-size=6144',
+      `          NODE_OPTIONS: ${settings.nodeOptions}`,
       ...(sonar ? [
         '      - name: lint with Sonar import',
         "        if: env.SONAR_TOKEN != ''",
         `        run: ${exampleCommand(source, 'npm run lint -- --side ' + side + ' --sonar reports/lint.' + side + '.sonar.json')}`,
         '        env:',
-        '          NODE_OPTIONS: --max-old-space-size=6144',
+        `          NODE_OPTIONS: ${settings.nodeOptions}`,
         `      - uses: ${UPLOAD_ARTIFACT}`,
         // Inside an if: expression the matrix value is an argument of format(), never a nested ${{ }} (actionlint: a nested expression makes the condition always true).
         "        if: always() && env.SONAR_TOKEN != '' && hashFiles(format('reports/lint.{0}.sonar.json', matrix.side)) != ''",

package/templates/app/ci-workflows/github/workflows/ci.yml

@@ -30,6 +30,8 @@ jobs:
         run: npm run format:check
       - name: typecheck
         run: npm run typecheck
+        env:
+          NODE_OPTIONS: {{nodeOptions}}
 
   lint:
     timeout-minutes: {{timeoutLint}}
@@ -86,7 +88,7 @@ jobs:
       - name: coverage proof
         run: {{ciCoverageProof}}
         env:
-          NODE_OPTIONS: --max-old-space-size=6144
+          NODE_OPTIONS: {{nodeOptions}}
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always() && hashFiles('{{lcovReport}}') != ''
         with:

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -30,6 +30,8 @@ jobs:
         run: npm run format:check
       - name: typecheck
         run: npm run typecheck
+        env:
+          NODE_OPTIONS: {{nodeOptions}}
 
   lint:
     timeout-minutes: {{timeoutLint}}
@@ -86,7 +88,7 @@ jobs:
       - name: coverage proof
         run: {{ciCoverageProof}}
         env:
-          NODE_OPTIONS: --max-old-space-size=6144
+          NODE_OPTIONS: {{nodeOptions}}
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always() && hashFiles('{{lcovReport}}') != ''
         with: