@starci/hfs 4.7.4 → 4.7.6

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 4.7.5 - 2026-10-18
+- Fixed: Codecov ignores the same slot-derived coverage complement as Sonar, including imported config, module and persistence files in shard reports. Project, patch and component targets remain at 100% on every measured logic file.
+
 ## 4.7.4 - 2026-10-18
 - Fixed: the managed Sonar configuration uses `sonar.javascript.node.maxspace`, the analyzer's supported Node heap property, with the existing 6144 MiB CI Node budget. This leaves memory for Java and the OS on an 8 GB runner; `sonar.nodejs.maxspace` did not apply the configured limit.
 

package/db/local-migrate.mjs

@@ -0,0 +1,181 @@
+// Explicit-local migration applies only the app's active SQL chain through the Supabase API owner.
+// Supabase CLI v2.119.0: db/push, migration-pending, migration-list and db-config.toml-read (read 2026-10-18).
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { parseEnv } from 'node:util';
+import { parse as parseToml } from 'smol-toml';
+import { databasePush } from '../runtime/scripts/api/supabase/database-push.mjs';
+import { isMigrationName, migrationStamp } from '../runtime/scripts/hfs/rules/database-migrations.mjs';
+import { CONFIG_FILE, MIGRATIONS_DIR } from '../runtime/scripts/hfs/rules/database-constants.mjs';
+import { failure, refusal } from '../stack/errors.mjs';
+
+const configError = (reason) => refusal('DB_CONFIG_INVALID', reason);
+const encrypted = (value) => typeof value === 'string' && value.includes('encrypted:');
+const byteOrder = (left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right));
+
+/** Never quote a parser/tool diagnostic: config, env and child streams can contain credentials. */
+function readFile(file, optional = false) {
+  try {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw configError('local migration inputs must be regular files');
+    return fs.readFileSync(file, 'utf8');
+  } catch (error) {
+    if (optional && error.code === 'ENOENT') return null;
+    throw configError('local migration inputs must be readable regular files');
+  }
+}
+
+function requireDirectory(directory) {
+  try {
+    const stat = fs.lstatSync(directory);
+    if (stat.isDirectory() && !stat.isSymbolicLink()) return;
+  } catch { /* The refusal below withholds filesystem diagnostics. */ }
+  throw configError('local migration requires the existing app directories, without links');
+}
+
+function requirePlainConfig(value) {
+  if (encrypted(value)) throw configError('local migration does not decrypt encrypted configuration');
+  if (value && typeof value === 'object') for (const item of Object.values(value)) requirePlainConfig(item);
+}
+
+/** The pinned CLI searches these exact files; interpolation/escapes are held rather than partially interpreted. */
+function projectEnvironment(root, ambient) {
+  const selected = ambient.SUPABASE_ENV || 'development';
+  if (!/^[A-Za-z0-9_-]+$/.test(selected)) throw configError('local migration requires an unambiguous Supabase environment selector');
+  const names = [`.env.${selected}.local`, ...(selected === 'test' ? [] : ['.env.local']), `.env.${selected}`, '.env'];
+  const values = {};
+  const files = [];
+  for (const dir of [path.join(root, 'supabase'), root]) {
+    for (const name of names) {
+      const file = path.join(dir, name);
+      const text = readFile(file, true);
+      files.push([file, text]);
+      if (text === null) continue;
+      // Pinned godotenv expansion and double-quote unescaping can synthesize the encryption prefix.
+      if (encrypted(text) || /[$\\]/.test(text)) throw configError('local migration requires literal unencrypted dotenv inputs');
+      // Keep only the common literal assignment grammar shared by Node and the pinned CLI.
+      for (const line of text.split(/\r?\n/)) {
+        if (/^\s*(?:#.*)?$/.test(line)) continue;
+        if (!/^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^'"#\r\n]*)(?:\s+#.*)?\s*$/.test(line)) {
+          throw configError('local migration requires literal single-line dotenv assignments');
+        }
+      }
+      let parsed;
+      try { parsed = parseEnv(text); } catch { throw configError('local migration dotenv inputs are not readable assignments'); }
+      for (const [key, value] of Object.entries(parsed)) {
+        if (!Object.hasOwn(ambient, key) && !Object.hasOwn(values, key)) values[key] = value;
+      }
+    }
+  }
+  return { values: { ...values, ...ambient }, files };
+}
+
+function expanded(value, env) {
+  if (typeof value !== 'string') return value;
+  const reference = /^env\(([A-Za-z_][A-Za-z0-9_]*)\)$/.exec(value);
+  const result = reference ? env[reference[1]] : value;
+  if (typeof result !== 'string' || result.startsWith('env(')) throw configError('local migration configuration has an unresolved environment reference');
+  return result;
+}
+
+const overridden = (name, value, env) => expanded(typeof env[name] === 'string' && env[name] !== '' ? env[name] : value, env);
+
+function targetIdentity(config, env) {
+  const project = overridden('SUPABASE_PROJECT_ID', config.project_id, env);
+  const portValue = overridden('SUPABASE_DB_PORT', config.db?.port, env);
+  const port = typeof portValue === 'string' && /^\d+$/.test(portValue) ? Number(portValue) : portValue;
+  const enabled = overridden('SUPABASE_DB_MIGRATIONS_ENABLED', config.db?.migrations?.enabled ?? true, env);
+  if (typeof project !== 'string' || !/^[A-Za-z0-9_-]+$/.test(project) || !Number.isInteger(port) || port < 1 || port > 65535) {
+    throw configError('local migration requires an explicit local project identity and database port');
+  }
+  if (enabled !== true && !(typeof enabled === 'string' && /^(?:1|t|T|true|TRUE|True)$/.test(enabled))) {
+    throw configError('local migration requires migrations to be explicitly enabled by the effective configuration');
+  }
+  return { project, port };
+}
+
+/** Snapshot only in memory; no plaintext configuration, values or hashes reach the result. */
+function inputs(ctx) {
+  const root = path.resolve(ctx.cwd);
+  requireDirectory(root);
+  requireDirectory(path.join(root, 'supabase'));
+  requireDirectory(path.join(root, MIGRATIONS_DIR));
+  const appText = readFile(path.join(root, 'hfs.json'));
+  let app;
+  try { app = JSON.parse(appText); } catch { throw configError('local migration requires a readable app declaration'); }
+  if (app?.kind !== 'app' || !['full', 'lite'].includes(app.edition ?? 'full')) throw configError('local migration requires a lite or full app');
+  const configText = readFile(path.join(root, CONFIG_FILE));
+  let config;
+  try { config = parseToml(configText); } catch { throw configError('local migration requires valid Supabase TOML'); }
+  requirePlainConfig(config);
+  for (const value of Object.values(ctx.env)) if (encrypted(value)) throw configError('local migration does not decrypt encrypted environment values');
+  const { values: env, files: envFiles } = projectEnvironment(root, ctx.env);
+  const target = targetIdentity(config, env);
+  let names;
+  try { names = fs.readdirSync(path.join(root, MIGRATIONS_DIR)).sort(byteOrder); } catch { throw configError('local migrations are not readable'); }
+  // Match the pinned CLI's unanchored first-entry legacy-init skip, including nested names.
+  const legacy = /([0-9]{14})_init\.sql/.exec(names[0] ?? '');
+  if (legacy && Number(legacy[1]) < 20211209000000) throw refusal('DB_STAMP_ORDER', 'the local chain contains a legacy init migration the installed CLI skips');
+  const migrations = [];
+  const stamps = new Set();
+  for (const name of names.filter((entry) => entry.endsWith('.sql'))) {
+    const stamp = name.slice(0, name.indexOf('_'));
+    if (!isMigrationName(name) || migrationStamp(stamp) === null) throw refusal('DB_MIGRATION_NAME', 'local migrations require valid UTC-stamped filenames');
+    if (stamps.has(stamp)) throw refusal('DB_STAMP_COLLISION', 'local migrations contain a duplicate timestamp');
+    stamps.add(stamp);
+    migrations.push([name, readFile(path.join(root, MIGRATIONS_DIR, name))]);
+  }
+  const digest = createHash('sha256').update(JSON.stringify({ root, appText, configText, envFiles, env, target, migrations })).digest('hex');
+  return { root, target, names: migrations.map(([name]) => name), digest };
+}
+
+function unchanged(ctx, snapshot) {
+  const current = inputs(ctx);
+  if (current.digest !== snapshot.digest) throw failure('DB_FINAL_MISMATCH', 'local migration inputs changed during the operation');
+  return current;
+}
+
+/** Only the specific Supabase owner can spawn; failures and malformed JSON never expose child output. */
+function push(ctx, snapshot, dryRun) {
+  const result = databasePush(snapshot.root, ['--local', '--skip-vault', '--workdir', snapshot.root, '--output-format', 'json', ...(dryRun ? ['--dry-run'] : ['--yes'])], { env: ctx.env, run: ctx.spawn });
+  if (result?.error || result?.signal || result?.status !== 0) throw failure('DB_CLI_FAILED', 'the local Supabase migration command failed; database output was withheld');
+  let payload;
+  try { payload = JSON.parse(result.stdout); } catch { throw failure('DB_CLI_FAILED', 'the local migration command returned unreadable JSON'); }
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload) || Object.hasOwn(payload, 'error') || payload._tag === 'Error' || payload.dryRun !== dryRun || typeof payload.upToDate !== 'boolean'
+    || !Array.isArray(payload.migrations) || !payload.migrations.every((name) => typeof name === 'string')
+    || !Array.isArray(payload.seeds) || payload.seeds.length !== 0 || !Array.isArray(payload.roles) || payload.roles.length !== 0) {
+    throw failure('DB_PUSH_STRAY', 'the local migration command returned an unexpected result');
+  }
+  const pending = payload.migrations;
+  const expected = snapshot.names.slice(snapshot.names.length - pending.length);
+  if (pending.length > snapshot.names.length || pending.some((name, index) => name !== expected[index]) || payload.upToDate !== (pending.length === 0)) {
+    throw failure('DB_PUSH_STRAY', 'the local migration result is not an ordered suffix of the authored chain');
+  }
+  return pending;
+}
+
+/** Preview by default; the caller admits execute only after the existing database arming check. No history repair, reset or linked fallback. */
+export function migrateLocalDatabase(ctx, { execute = false } = {}) {
+  const snapshot = inputs(ctx);
+  const pending = push(ctx, snapshot, true);
+  unchanged(ctx, snapshot);
+  let applied = [];
+  if (execute && pending.length > 0) {
+    const fresh = push(ctx, snapshot, true);
+    unchanged(ctx, snapshot);
+    if (fresh.some((name, index) => name !== pending[index]) || fresh.length !== pending.length) throw failure('DB_FINAL_MISMATCH', 'the local migration plan changed before apply');
+    applied = push(ctx, snapshot, false);
+    unchanged(ctx, snapshot);
+    if (applied.length !== fresh.length || applied.some((name, index) => name !== fresh[index])) {
+      throw failure('DB_FINAL_MISMATCH', 'the applied local migrations differ from the reviewed pending plan');
+    }
+    if (push(ctx, snapshot, true).length !== 0) throw failure('DB_FINAL_MISMATCH', 'the local migration version history is not fully applied');
+    unchanged(ctx, snapshot);
+  }
+  return {
+    ok: true,
+    lines: [`target         local project ${snapshot.target.project}`, `pending SQL    ${pending.join(', ') || 'none'}`, execute && applied.length ? `applied         ${applied.length} migration(s); local version history is current` : 'nothing applied'],
+    data: { target: 'local', pending, pushed: applied, executed: execute && applied.length > 0, done: pending.length === 0 || execute },
+  };
+}

package/db/migrate.mjs

@@ -17,6 +17,7 @@ import { STACKS_DIR } from '../stack/config.mjs';
 import { firstLine, tool } from '../stack/context.mjs';
 import { approvalMissing, failure, refusal } from '../stack/errors.mjs';
 import { readDeclaration, runVerb } from '../release/index.mjs';
+import { migrateLocalDatabase } from './local-migrate.mjs';
 
 const DATABASE_CODE = 'DB_CONFIG_INVALID';
 
@@ -353,12 +354,19 @@ async function migrateDatabase(ctx, decl, options = {}) {
   return { ok: true, lines: [...lines, `applied: ${pushed.length} forward migration(s) pushed; the remote history now holds ${final.size} version(s). Held back: ${model.held.join(', ') || 'nothing'}.`], data: dataOf(model, plan, remote, { executed: true, pushed, remoteCountAfter: final.size }) };
 }
 
-const SPEC = { boolean: ['--execute', '--json', '--linked'], value: ['--url-env'] };
+const SPEC = { boolean: ['--execute', '--json', '--linked', '--local'], value: ['--url-env'] };
 
-/** Entry of the verb: `starci app db migrate [--execute] [--linked | --url-env NAME] [--json]`. `io` is the app IO of src/main.mjs. */
+/** Entry of the verb: explicit local applies active SQL; linked/url-env retains the declared cutover plan. Execute requires database arming. */
 export function dbMigrateMain(argv, io = {}) {
   return runVerb({
     label: 'starci app db migrate', name: 'db migrate', code: 'DB_USAGE', io, argv, spec: SPEC,
-    run: (ctx, flags) => migrateDatabase(ctx, loadDatabase(ctx.cwd), { execute: flags.execute === true, linked: flags.linked === true, urlEnv: flags['url-env'] }),
+    run: (ctx, flags) => {
+      if (flags.local) {
+        if (flags.linked || flags['url-env'] !== undefined) throw refusal('DB_USAGE', '--local excludes --linked and --url-env');
+        if (flags.execute) requireArmed(ctx);
+        return migrateLocalDatabase(ctx, { execute: flags.execute === true });
+      }
+      return migrateDatabase(ctx, loadDatabase(ctx.cwd), { execute: flags.execute === true, linked: flags.linked === true, urlEnv: flags['url-env'] });
+    },
   });
 }

package/emit/db-types.mjs

@@ -185,7 +185,7 @@ function requireCurrentDatabase(root, run) {
   const applied = appliedVersions(result);
   if (applied.size !== expected.size || [...expected].some((version) => !applied.has(version))) {
     const head = (versions) => [...versions].sort().at(-1) ?? 'none';
-    throw new DbTypesError(`the local database is at ${head(applied)}, the migrations folder at ${head(expected)}; run "npm run db:reset" then emit again`, { file: dbTypesPath }, 'HFS_EMIT_DB_TYPES_STALE');
+    throw new DbTypesError(`the local database is at ${head(applied)}, the migrations folder at ${head(expected)}; inspect "starci app db plan --local", preview "starci app db migrate --local", apply the reviewed local plan with --execute and STARCI_DB_ARMED=1, then run "starci app emit"`, { file: dbTypesPath }, 'HFS_EMIT_DB_TYPES_STALE');
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.4",
+  "version": "4.7.6",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",
@@ -14,6 +14,9 @@
     "libpg-query": "18.1.5",
     "smol-toml": "1.9.0"
   },
+  "devDependencies": {
+    "typescript": "5.9.3"
+  },
   "files": [
     "LICENSE",
     "src/main.mjs",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -22,21 +22,21 @@ pins:
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-canon-fe (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
-    version: 0.9.14
+    version: 0.10.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.10
+    version: 3.4.12
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.10
+    version: 8.4.12
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.4
+    version: 1.7.6
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.4
+    version: 4.7.6
     group: starci
     install: registry
     side: both

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "1d8f6ce139e98259571df0aee8deccce139214f6aea6fc86ade937ca2dfb445d",
+  "hash": "27e8713cd03ca41190945705f7d4ae7a6fbd17a17d04c4c06ba7c8e2c4c520bc",
   "global": [
     {
       "name": "json",
@@ -403,7 +403,7 @@ export const CATALOG = {
             {
               "name": "local",
               "type": "boolean",
-              "summary": "inspect or repair the local Supabase database instead of the linked project"
+              "summary": "inspect local state; migrate applies only pending active SQL against the app's existing local stack"
             },
             {
               "name": "execute",
@@ -452,6 +452,8 @@ export const CATALOG = {
             "starci app db plan --json",
             "starci app db plan --local",
             "starci app db migrate --linked",
+            "starci app db migrate --local",
+            "starci app db migrate --local --execute",
             "starci app db migrate --execute",
             "starci app db post-cutover --green-at 2026-10-10T00:00:00Z"
           ],
@@ -474,8 +476,11 @@ export const CATALOG = {
             "reset keeps encrypted temporary recovery parts after a reset/restore failure and reports their directory; plaintext is always deleted",
             "baseline accepts --stamp; restamp requires --map; both preview without --apply",
             "plan is always read-only and supports --json; it compares migrations, cron, queues and Vault names",
-            "migrate and post-cutover read the optional database block of application-stacks.yaml; both are dry runs without --execute",
-            "migrate is idempotent: baseline plus forward on the remote prints nothing to do; held-back migrations are never applied by it",
+            "linked/url-env migrate and post-cutover read application-stacks.yaml's database block and preview without --execute",
+            "linked/url-env migrate skips an applied baseline and forward chain; held-back migrations belong to post-cutover",
+            "migrate --local uses the app workdir/config, previews pending active SQL and refuses history gaps or unknown versions",
+            "local migrate --execute needs STARCI_DB_ARMED=1; no history repair, baseline marking, reset, seed/role/Vault work or linked fallback",
+            "local migrate refuses encrypted config/env values and dotenv interpolation or escapes before any child; it never decrypts",
             "post-cutover applies held-back migrations after the read-only pg_proc preflight, an open time gate and STARCI_DB_ARMED=1"
           ],
           "runtimeSide": "host"

package/runtime/scripts/api/supabase/database-push.mjs

@@ -0,0 +1,5 @@
+// database-push.mjs - pending SQL migration push for an app's selected Supabase database.
+import { supabaseCall } from './lib.mjs';
+
+/** The spawn result of supabase db push; target, preview and runner options remain with the owning caller. */
+export function databasePush(...args) { return supabaseCall(['db', 'push'], ...args); }

package/runtime/scripts/api/supabase/lib.mjs

@@ -7,37 +7,48 @@ const candidateNames = (platform) => platform === 'win32'
   ? ['supabase.exe', 'supabase', 'supabase.cmd']
   : ['supabase'];
 
-/** Resolve the app-local Supabase CLI first, then PATH, retaining a PATH lookup fallback for useful spawn errors. */
+/** Resolve the app's installed npm launcher before executable discovery; npm command shims cannot run without a shell. */
 function resolveSupabase(appRoot, { env = process.env, platform = process.platform, exists = fs.existsSync } = {}) {
+  const launcher = path.join(appRoot, 'node_modules', 'supabase', 'dist', 'supabase.js');
+  if (exists(launcher)) return { file: process.execPath, args: [launcher] };
   const names = candidateNames(platform);
   const local = path.join(appRoot, 'node_modules', '.bin');
   for (const name of names) {
     const file = path.join(local, name);
-    if (exists(file)) return file;
+    if (exists(file)) return { file, args: [] };
   }
   const delimiter = platform === 'win32' ? ';' : ':';
   for (const directory of String(env.PATH ?? '').split(delimiter).filter(Boolean)) {
     for (const name of names) {
       const file = path.join(directory, name);
-      if (exists(file)) return file;
+      if (exists(file)) return { file, args: [] };
     }
   }
-  return 'supabase';
+  return { file: 'supabase', args: [] };
 }
 
-/** Run one Supabase call for an app root; options retain the injectable spawn seam used by focused specs. */
+/** Run one shell-free Supabase call at the app root; an unusable command shim returns an ENOEXEC spawn failure. */
 export const supabaseSpawn = (appRoot, args, {
   env = process.env,
   supabase,
   timeout = 60_000,
   run = spawnSync,
-} = {}) => run(supabase ?? resolveSupabase(appRoot, { env }), args, {
-  cwd: appRoot,
-  encoding: 'utf8',
-  env,
-  timeout,
-  windowsHide: true,
-});
+  platform = process.platform,
+  exists = fs.existsSync,
+} = {}) => {
+  const command = supabase === undefined || supabase === null ? resolveSupabase(appRoot, { env, platform, exists }) : { file: supabase, args: [] };
+  if (/\.(?:cmd|bat)$/iu.test(command.file)) return {
+    status: null, stdout: '', stderr: '', signal: null,
+    error: Object.assign(new Error('The Supabase command shim requires a shell; use an executable or the app-local npm launcher.'), { code: 'ENOEXEC' }),
+  };
+  return run(command.file, [...command.args, ...args], {
+    cwd: appRoot,
+    encoding: 'utf8',
+    env,
+    timeout,
+    windowsHide: true,
+  });
+};
 
 /** Invoke one Supabase command prefix with caller arguments and runner options. */
 export const supabaseCall = (prefix, appRoot, args = [], options = {}) =>

package/runtime/scripts/hfs/rules/unused-symbol-flow.mjs

@@ -6,14 +6,15 @@ import { unwrapCatalogExpression as unwrap } from '../../lib/ts-analysis.mjs';
 const ARRAY_CALLBACK = /^(?:map|flatMap|forEach|filter|find|some|every)$/u;
 
 export const symbolAt = (state, node) => {
-  const symbol = state.checker.getSymbolAtLocation(node);
+  const symbol = state.ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node
+    ? state.checker.getShorthandAssignmentValueSymbol(node.parent) : state.checker.getSymbolAtLocation(node);
   return symbol?.flags === state.ts.SymbolFlags.Alias ? state.checker.getAliasedSymbol(symbol) : symbol;
 };
 
 /** The expression bound to `name` in an object literal or a JSX attribute list. */
 function propertyValues(state, owner, name) {
   const { ts } = state;
-  if (ts.isObjectLiteralExpression(owner)) return owner.properties.filter(entry => ts.isPropertyAssignment(entry) && nameOf(ts, entry.name) === name).map(entry => entry.initializer);
+  if (ts.isObjectLiteralExpression(owner)) return owner.properties.filter(entry => (ts.isPropertyAssignment(entry) || ts.isShorthandPropertyAssignment(entry)) && nameOf(ts, entry.name) === name).map(entry => ts.isShorthandPropertyAssignment(entry) ? entry.name : entry.initializer);
   if (!ts.isJsxAttributes(owner)) return [];
   const attributes = owner.properties.filter(entry => ts.isJsxAttribute(entry) && entry.name.text === name && entry.initializer);
   return attributes.map(entry => ts.isJsxExpression(entry.initializer) ? entry.initializer.expression : entry.initializer).filter(Boolean);
@@ -72,6 +73,17 @@ function declarationValues(state, declaration, seen) {
   return declaration.initializer ? valuesOf(state, declaration.initializer, seen) : [];
 }
 
+/** Resolve local function and memo callback returns; an unknown call remains its own leaf. */
+function callValues(state, node, seen) {
+  const { ts } = state;
+  const declaration = symbolAt(state, node.expression)?.valueDeclaration;
+  const target = declaration && ts.isVariableDeclaration(declaration) ? unwrap(ts, declaration.initializer) : declaration;
+  const memo = ts.isIdentifier(node.expression) && node.expression.text === 'useMemo' ? unwrap(ts, node.arguments[0]) : null;
+  const fn = memo ?? target;
+  return fn && (ts.isArrowFunction(fn) || ts.isFunctionExpression(fn) || ts.isFunctionDeclaration(fn))
+    ? resolveAll(state, returnedExpressions(ts, fn), seen) : [node];
+}
+
 /** Leaf expressions `expression` may evaluate to. A translator variable and any unresolvable expression is its own leaf. */
 export function valuesOf(state, expression, visited = new Set()) {
   const { ts } = state;
@@ -79,6 +91,7 @@ export function valuesOf(state, expression, visited = new Set()) {
   if (!node || visited.has(node)) return [];
   const seen = new Set([...visited, node]);
   if (ts.isConditionalExpression(node)) return [...valuesOf(state, node.whenTrue, seen), ...valuesOf(state, node.whenFalse, seen)];
+  if (ts.isCallExpression(node)) return callValues(state, node, seen);
   if (ts.isPropertyAccessExpression(node)) return resolveAll(state, valuesOf(state, node.expression, seen).flatMap(owner => propertyValues(state, owner, node.name.text)), seen);
   if (ts.isElementAccessExpression(node)) return resolveAll(state, tableValues(state, node, seen), seen);
   if (!ts.isIdentifier(node)) return [node];

package/runtime/scripts/hfs/rules/unused-symbol-translators.mjs

@@ -112,13 +112,19 @@ export function translationBindings(state, sources) {
 /** Namespaces of the translators a receiver can be: declared here, or handed in through arguments and props. */
 function receiverNamespaces(state, receiver) {
   const { ts, checker } = state;
-  const direct = state.translators.get(checker.getSymbolAtLocation(receiver));
-  if (direct !== undefined) return direct;
-  return valuesOf(state, receiver).flatMap(leaf => {
-    // A translator factory called in place as an argument: f(useTranslations("admin")).
-    if (ts.isCallExpression(leaf)) return translatorNamespace(state, leaf, translationFactories(ts, leaf.getSourceFile())) ?? [];
-    return ts.isIdentifier(leaf) ? state.translators.get(checker.getSymbolAtLocation(leaf)) ?? [] : [];
-  });
+  const resolving = state.resolvingReceivers ??= new Set();
+  if (resolving.has(receiver)) return [];
+  resolving.add(receiver);
+  try {
+    const direct = state.translators.get(checker.getSymbolAtLocation(receiver));
+    if (direct !== undefined) return direct;
+    return valuesOf(state, receiver).flatMap(leaf => {
+      // A translator factory called in place as an argument: f(useTranslations("admin")).
+      if (ts.isCallExpression(leaf)) return translatorNamespace(state, leaf, translationFactories(ts, leaf.getSourceFile())) ?? [];
+      if (isFunction(ts, leaf)) return forwardedNamespaces(state, leaf);
+      return ts.isIdentifier(leaf) ? state.translators.get(symbolAt(state, leaf)) ?? [] : [];
+    });
+  } finally { resolving.delete(receiver); }
 }
 
 function handedIn(state, receiver) {

package/runtime/scripts/hfs/rules/unused-symbol.mjs

@@ -216,7 +216,7 @@ function indirectArguments(state, argument, prefix, seen) {
 
 function templateArguments(state, template, prefix) {
   // A literal head or tail makes the template a key pattern; a template of holes only proves nothing.
-  if (prefix !== null && hasLiteral(template)) state.templates.push([`${prefix}${template.head.text}`, ...template.templateSpans.map(span => span.literal.text)]);
+  if (hasLiteral(template)) state.templates.push({ prefix, parts: [`${prefix ?? ''}${template.head.text}`, ...template.templateSpans.map(span => span.literal.text)] });
 }
 
 function catalogArguments(state, node, prefix, seen = new Set()) {
@@ -280,16 +280,19 @@ function looseRead(state, name) {
 function catalogRead(state, candidate, liveCodes) {
   if (candidate.name.startsWith('errors.') && liveCodes.has(candidate.name.slice(7))) return true;
   if (state.catalogReads.has(candidate.name) || looseRead(state, candidate.name)) return true;
-  return state.templates.some(parts => parts.some(Boolean) && (() => {
-    const tail = candidate.name;
-    let offset = 0;
-    for (const [index, part] of parts.entries()) {
-      const next = tail.indexOf(part, offset);
-      if (next < 0 || index === 0 && next !== 0) return false;
-      offset = next + part.length;
-    }
-    return tail.endsWith(parts.at(-1));
-  })());
+  return state.templates.some(({ prefix, parts }) => {
+    const segments = candidate.name.split('.');
+    const tails = prefix === null ? segments.map((_, index) => segments.slice(index).join('.')) : [candidate.name];
+    return tails.some(tail => {
+      let offset = 0;
+      for (const [index, part] of parts.entries()) {
+        const next = tail.indexOf(part, offset);
+        if (next < 0 || index === 0 && next !== 0) return false;
+        offset = next + part.length;
+      }
+      return tail.endsWith(parts.at(-1));
+    });
+  });
 }
 
 /** The same rule applies to lite and full. Analyze all tracked consumers before filtering findings to a fast-check scope. */

package/src/main.mjs

@@ -103,7 +103,7 @@ starci app db restamp --map <restamp.yaml> [--local] [--apply] [--cwd <dir>]
 starci app db plan [--local] [--json] [--cwd <dir>]
 starci app db dump (--linked | --local | --url-env <NAME>) --out <dir> [--schema-only] [--json] [--cwd <dir>]
 starci app db reset --linked --auth keep|drop --storage keep|drop --backup <receipt.json> [--execute] [--json] [--cwd <dir>]
-starci app db migrate [--execute] [--linked | --url-env <NAME>] [--json] [--cwd <dir>]
+starci app db migrate [--execute] [--local | --linked | --url-env <NAME>] [--json] [--cwd <dir>]
 starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--linked | --url-env <NAME>] [--json] [--cwd <dir>]
 starci app release gate [--execute] [--source <ref>] [--tag-prefix <prefix>] [--json] [--cwd <dir>]
 starci app release push [--execute] [--remote <name>] [--json] [--cwd <dir>]

package/sync/index.mjs

@@ -10,7 +10,7 @@
 // and are listed in this module: the marked blocks of the root .gitignore and README.md, and .starciwork/.gitignore, which lives inside the
 // .starciwork directory slot. Every file is rendered with the app's hfs.json (both sides and their apps) and, for the Sonar
 // exclusions, the jest preset the app installs for its be side and the one coverage scope derived from the slot manifest
-// (scripts/hfs/coverage-scope.mjs: the be/jest.config.js scope, sonar.coverage.exclusions and the codecov.yml paths and components). `--check` compares the sha256 of the rendered content with the
+// (scripts/hfs/coverage-scope.mjs: the be/jest.config.js scope, sonar.coverage.exclusions and the codecov.yml paths, components and exclusions). `--check` compares the sha256 of the rendered content with the
 // file on disk and fails on any drift; `--write` rewrites the drifted files. `.gitignore` and README.md are shared files: only the marked
 // block is managed and the app's own lines around it are left alone. The root package.json is managed by its `scripts` block
 // only (mode scripts, compared as parsed JSON): the rest of the file (dependencies, the npm workspaces fe/apps/* and fe/packages/*,
@@ -328,6 +328,7 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     // The coverage scope is the same in both editions: lite measures exactly what full measures (ruling:R212/case-1, amended by ruling:R212/case-4).
     jestCoverage: scope === 'be' ? jestCoverageSource(jestCoverage(manifest, providers)) : '',
     coverageExclusions: scope === APP_SCOPE ? sonarCoverageExclusions(manifest, providers).join(',') : '',
+    codecovExclusions: scope === APP_SCOPE ? sonarCoverageExclusions(manifest, providers).map(glob => `  - ${JSON.stringify(glob)}`).join('\n') : '',
     codecovPaths: scope === APP_SCOPE ? codecovPaths(manifest, providers).map(glob => `          - ${JSON.stringify(glob)}`).join('\n') : '',
     codecovComponents: scope === APP_SCOPE ? componentsYaml(coverageComponents(manifest, { ...source, apps: app.sides.be.apps, providers })) : '',
     codecovTarget: quality.codecov.target,

package/templates/app/quality-config/codecov.yml

@@ -1,7 +1,7 @@
 {{header}}
 # The be unit run's lcov ({{lcovReport}}), uploaded by the managed CI workflow. Coverage is the logic of be/src/modules/**: the status
-# paths are the measured roots of the one coverage scope (derived from the slot manifest's `coverage` field; its complement is rendered into
-# sonar.coverage.exclusions and its roots into be/jest.config.js), held at {{codecovTarget}} on the project and on the patch, and each component (one per
+# paths are the measured roots of the one coverage scope (derived from the slot manifest's `coverage` field; its complement is shared by ignore and
+# sonar.coverage.exclusions and its roots by be/jest.config.js), held at {{codecovTarget}} on the project and on the patch, and each component (one per
 # service app, plus platform) is held at {{codecovTarget}} too. fe/ and be/src/features are outside coverage (features are thin by rule; a front end has no tests).
 codecov:
   require_ci_to_pass: true
@@ -31,4 +31,4 @@ component_management:
   individual_components:
 {{codecovComponents}}
 ignore:
-  - "fe/**"
+{{codecovExclusions}}