@starci/eslint-canon-fe 9.2.0 → 9.3.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 9.3.0 - 2026-10-28
+
+- Changed (breaking for apps): owner ruling fe-shape-not-state. A pure half takes `{ shape?, props, on? }`; `base-props-atom` refuses the retired `state` key with a message naming the rename, and `no-data-status-shape` reads `XShape` unions (and still the old `XState` names, so a status word is caught during the rename).
+- Changed: the bundled runtime copies follow the retirement of `@starci/cli`: the bundled canon pins replace the retired `@starci/cli` with `starci-harness` 1.1.0-alpha.1 (`source: cli/package.json`), the one command line a product installs for `starci app`, and follow the harness packages (Grammar family 0.14.0, hfs 4.9.0, canon-fe 9.3.0, canon-be 3.5.0); the runtime finds an app's `starci` bin in its installed `starci-harness`.
+
 ## 9.2.0 - 2026-10-27
 
 - Changed: owner ruling two-grammars: the bundled Grammar catalog declares exactly two families, `core` (`@starci/eslint-grammar-core`, `coreGrammarConfig`) and `offset-pop`; `starci`, `starci-core` and `heritage` are refused. The Grammar entry checks (button intent, control height, surface rules, UI rulings) accept `@starci/grammar/<common|core|offset-pop>`. The bundled canon pins follow the harness packages (Grammar family 0.13.0, hfs 4.8.0, canon-fe 9.2.0, canon-be 3.4.57, stylelint-canon 2.1.0).

package/drawing.mjs

@@ -75,7 +75,7 @@ const keyOf = (member) => (member.key?.type === "Identifier" ? member.key.name :
 export const basePropsAtom = {
   meta: {
     type: "problem",
-    docs: { description: "A pure `XBase` takes `state`, atom `props` and `on` actions; feature composition may receive named render callbacks in `props`." },
+    docs: { description: "A pure `XBase` takes `shape`, atom `props` and `on` actions; feature composition may receive named render callbacks in `props`." },
     schema: [],
     messages: {
       tree:
@@ -85,7 +85,9 @@ export const basePropsAtom = {
       onData:
         "`on.{{key}}` is not an action. `on` holds functions only; data belongs in `props`.",
       member:
-        "`{{key}}` is not part of the pure contract. A pure half takes `state`, `props` and `on`{{children}}.",
+        "`{{key}}` is not part of the pure contract. A pure half takes `shape`, `props` and `on`{{children}}.",
+      renamed:
+        "`state` is the retired name of the drawn shape: rename it `shape` (owner ruling fe-shape-not-state).",
     },
   },
   create(context) {
@@ -197,7 +199,11 @@ export const basePropsAtom = {
         for (const member of membersOf(annotation, types)) {
           const key = keyOf(member)
           const type = member.typeAnnotation?.typeAnnotation
-          if (key === "state") continue
+          if (key === "shape") continue
+          if (key === "state") {
+            context.report({ node: member, messageId: "renamed" })
+            continue
+          }
           if (key === "props") checkData(type, "props", new Set())
           else if (key === "on") checkActions(type)
           else if (key === "children" && tier === "layouts") continue
@@ -274,11 +280,11 @@ const DATA_STATUS = new Set([
   "skeleton", "closed", "idle", "refreshing", "retrying",
 ])
 
-/** A surface's `XState` names shapes only. */
+/** A surface's `XShape` names shapes only. */
 export const noDataStatusShape = {
   meta: {
     type: "problem",
-    docs: { description: "`XState` of a pure half names drawn shapes, never a data status or open/closed." },
+    docs: { description: "`XShape` of a pure half names drawn shapes, never a data status or open/closed." },
     schema: [],
     messages: {
       status:
@@ -298,7 +304,7 @@ export const noDataStatusShape = {
     }
     return {
       TSTypeAliasDeclaration(node) {
-        if (/^[A-Z][A-Za-z0-9]*State$/.test(node.id.name)) check(node.id.name, node.typeAnnotation)
+        if (/^[A-Z][A-Za-z0-9]*(?:Shape|State)$/.test(node.id.name)) check(node.id.name, node.typeAnnotation)
       },
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.2.0",
+  "version": "9.3.0",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,35 +30,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.13.0
+    version: 0.14.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.57
+    version: 3.5.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.2.0
+    version: 9.3.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.13.0
+    version: 0.14.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.13.0
+    version: 0.14.0
     group: starci
     install: registry
     side: fe
@@ -97,19 +97,20 @@ pins:
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
-  '@starci/cli':
-    version: 1.7.47
+  'starci-harness':
+    version: 1.1.0-alpha.1
     group: starci
     install: registry
     side: both
-    why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
+    source: cli/package.json
+    why: 'the one StarCi command line (bins starci and starci-harness): a product repository installs it for starci app, which it runs in-process through its exact @starci/hfs dependency, and its codegen loads starci-harness/input-bounds.'
   '@starci/hfs':
-    version: 4.8.0
+    version: 4.9.0
     group: starci
     install: registry
     side: both
     source: packages/hfs/package.json
-    why: 'the transitive app implementation used by @starci/cli; it carries the generated runtime slice read by starci app commands.'
+    why: 'the app implementation starci-harness runs for starci app; it carries the generated runtime slice read by starci app commands.'
   # --- tooling
   typescript:
     version: 5.9.3

package/runtime/scripts/lib/package-at.mjs

@@ -13,9 +13,9 @@ export const packageAt = (dir, name) => {
 /** This runtime's own `starci` bin (packages/cli is the only package that declares one). */
 const RUNTIME_STARCI_BIN = path.join(skillRoot, 'packages', 'cli', 'bin', 'starci.mjs');
 
-/** The `starci` bin of the @starci/cli that `dir` installs (a product runs its own pinned CLI), else this runtime's own. */
+/** The `starci` bin of the starci-harness that `dir` installs (a product runs its own pinned CLI), else this runtime's own. */
 function starciBin(dir) {
-  const packageFile = packageAt(dir, '@starci/cli');
+  const packageFile = packageAt(dir, 'starci-harness');
   if (packageFile) {
     try {
       const { bin } = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
@@ -50,13 +50,13 @@ export const loadTypescript = (...dirs) => {
 };
 
 /**
- * The app's command line and the app implementation behind it: `bin` the `starci` bin of the app's installed @starci/cli, else
+ * The app's command line and the app implementation behind it: `bin` the `starci` bin of the app's installed starci-harness, else
  * this runtime's packages/cli/bin/starci.mjs (starciBin); `dir` the @starci/hfs that answers
- * `starci app` - the app's own install, else the one beside its @starci/cli, else this runtime's packages/hfs - whose runtime
+ * `starci app` - the app's own install, else the one beside its starci-harness, else this runtime's packages/hfs - whose runtime
  * slice the gate's base lint (scripts/gates/gate.mjs) and the READ digest (scripts/gates/read-digest.mjs) load in-process.
  */
 export function hfsEntry(root) {
-  const cli = packageAt(root, '@starci/cli');
+  const cli = packageAt(root, 'starci-harness');
   const manifest = packageAt(root, '@starci/hfs') ?? (cli && packageAt(path.dirname(cli), '@starci/hfs'));
   return { dir: manifest ? path.dirname(manifest) : path.join(skillRoot, 'packages', 'hfs'), bin: starciBin(root) };
 }