supercov 4.2.1 → 4.3.0

package/docs/assertions.md

@@ -86,6 +86,8 @@ npx supercov runs latest assertions
 Supercov renders what the test ran -- its code, its helpers, and the source it
 executed -- and asks [Jev](https://typesafe.ai) whether the test would fail for
 each statement's change. It prints an estimate first; `--dry-run` sends nothing.
+The estimate gives the first round and the most the pass can send, which is
+what it sends when no test is judged to catch anything.
 It needs a TypeSafe AI API key in `TYPESAFE_API_KEY`.
 
 `assertions` reads the saved result with no network and no key, a page at a

package/docs/cli.md

@@ -61,7 +61,8 @@ the score is arithmetic this command does over the answers. Text reports a band,
 `good`, `fair` or `weak`; `--json` carries the number and every check with what
 is known about it. `--all` includes test files, generated output and anything
 outside a source root, all of which are left out by default. `--dry-run` prints
-the exact requests and contacts nothing.
+the exact requests and contacts nothing; how many there are and what they cost
+is one line on stderr.
 
 `quality diff` reports what changed between two assessments: which files lost
 or gained health, each check that moved in them with its value before and after,
@@ -507,6 +508,11 @@ Merge creates a new run. The inputs must describe the same source,
 configuration, toolchain, schema, and coverage denominator. Supercov rejects an
 incompatible merge rather than publishing a misleading aggregate.
 
+`assertions assess` assesses a merged run across every suite merged into it,
+reusing the answers saved when its parts were assessed. `tests affected` is
+asked of the runs that were merged, which hold the record of what each test
+ran.
+
 ## Clean local data
 
 ```sh supercov

package/docs/quality.md

@@ -153,6 +153,12 @@ Source roots come from your package manifests and from what they declare, so a
 Test files, generated output, tool scripts, examples, benchmarks and
 documentation are left out, each with its reason. `--all` includes everything.
 
+A JavaScript or TypeScript file a coverage run would measure is always read,
+by `quality` and by `security`: the App Router handler at
+`app/api/wordpress/test/route.ts` is a route, not a test, and a root named in
+`SUPERCOV_SOURCE_ROOTS` is not second-guessed by its own name. Generated and
+vendored files stay out.
+
 If some of your code sits somewhere none of that recognises, Supercov asks Jev
 about those paths with your whole tree as context, and says how many it decided
 that way. To decide yourself:

package/docs/security.md

@@ -183,6 +183,12 @@ many of its measured lines no test reached. A handler that builds a query from
 request input is one thing; the same handler that no test ever executes is a
 stronger claim, and one that needs both halves of this product to make.
 
+When the run's assertions were assessed (`runs <run> assertions assess`), the
+report also says which flagged lines a test is judged to catch a change to, and
+which flagged files tests run without catching any line of. A run that was not
+assessed says so instead: nobody asked its tests, which is not the same as
+their catching nothing.
+
 ## What a change introduced
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.2.1",
+  "version": "4.3.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -119,14 +119,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.2.1",
-    "@supercov/cli-darwin-x64": "4.2.1",
-    "@supercov/cli-linux-arm64-gnu": "4.2.1",
-    "@supercov/cli-linux-arm64-musl": "4.2.1",
-    "@supercov/cli-linux-x64-gnu": "4.2.1",
-    "@supercov/cli-linux-x64-musl": "4.2.1",
-    "@supercov/cli-win32-arm64": "4.2.1",
-    "@supercov/cli-win32-x64": "4.2.1"
+    "@supercov/cli-darwin-arm64": "4.3.0",
+    "@supercov/cli-darwin-x64": "4.3.0",
+    "@supercov/cli-linux-arm64-gnu": "4.3.0",
+    "@supercov/cli-linux-arm64-musl": "4.3.0",
+    "@supercov/cli-linux-x64-gnu": "4.3.0",
+    "@supercov/cli-linux-x64-musl": "4.3.0",
+    "@supercov/cli-win32-arm64": "4.3.0",
+    "@supercov/cli-win32-x64": "4.3.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",