@starci/eslint-canon-fe 9.2.0 → 9.4.0

package/dist/type-safety.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The rules that hold `type-safety.md`.
+ *
+ * FOUR RULES, ONE IDEA: the compiler is told the truth or it is not told at all. The double cast, the
+ * plain assertion, the non-null assertion and `any` are the four spellings of "trust me". They live
+ * here rather than in a repository's own `eslint.config.mjs` because a repository carries no rule of
+ * its own: a rule that exists only in one repository's config is a rule the next repository forgets.
+ * The array spelling is a formatting question and stays with the formatter.
+ *
+ * THE EXEMPTION IS A SPEC, and it has to be. Proving a closed API refuses bad input means building
+ * bad input, and there is no way to construct a value the types forbid without telling the compiler
+ * to forget them. A judgement-based exemption would be argued at every call site; a spec is decided
+ * once, by its name.
+ */
+import { type Rules, type Recommended } from "./lib/rule.js";
+/** A cast through `unknown` erases what the compiler knew, at the seam where it mattered. */
+export declare const noDoubleCast: import("./lib/rule.js").Rule<"double", []>;
+/**
+ * A type assertion is a claim the compiler cannot check, made at the place it was going to check.
+ *
+ * WHAT IS LEFT ALLOWED. `as const` (it narrows), `as unknown` (it widens, and everything is assignable
+ * to it), and `satisfies` (it checks). The cast through `unknown` to a real type is refused by
+ * `no-double-cast`, so this rule leaves the outer half of that pair to it and reports each once.
+ */
+export declare const noTypeAssertion: import("./lib/rule.js").Rule<"assertion", []>;
+/** `x!` says a value is present without proving it. */
+export declare const noNonNullAssertion: import("./lib/rule.js").Rule<"bang", []>;
+/** `any` switches checking off for everything it touches. */
+export declare const noExplicitAny: import("./lib/rule.js").Rule<"any", []>;
+/** The rules this law contributes to the plugin. */
+export declare const rules: Rules;
+/**
+ * The level this law asks for, as the plugin's own opinion.
+ *
+ * Exact - it matches one syntactic shape - but a repository adopting it with history should expect
+ * each report to be real work: a double cast is usually load-bearing by the time anybody notices,
+ * and removing one means giving the value a shape it did not have.
+ *
+ * `any` and the array spelling are NOT published here. They belong to the TypeScript plugin's own
+ * rules, which a consuming repository already has: `@typescript-eslint/no-explicit-any` and
+ * `@typescript-eslint/array-type` with the generic default.
+ */
+export declare const recommended: Recommended;

package/dist/type-safety.js

@@ -0,0 +1,139 @@
+/**
+ * The rules that hold `type-safety.md`.
+ *
+ * FOUR RULES, ONE IDEA: the compiler is told the truth or it is not told at all. The double cast, the
+ * plain assertion, the non-null assertion and `any` are the four spellings of "trust me". They live
+ * here rather than in a repository's own `eslint.config.mjs` because a repository carries no rule of
+ * its own: a rule that exists only in one repository's config is a rule the next repository forgets.
+ * The array spelling is a formatting question and stays with the formatter.
+ *
+ * THE EXEMPTION IS A SPEC, and it has to be. Proving a closed API refuses bad input means building
+ * bad input, and there is no way to construct a value the types forbid without telling the compiler
+ * to forget them. A judgement-based exemption would be argued at every call site; a spec is decided
+ * once, by its name.
+ */
+import { defineRule } from "./lib/rule.js";
+import { isProductSource } from "./lib/scope.js";
+/** True when a type node is the `unknown` keyword. */
+const isUnknown = (node) => Boolean(node) && node?.type === "TSUnknownKeyword";
+// -- TYPE-SAFETY-1 ---------------------------------------------------------------------------------
+/** A cast through `unknown` erases what the compiler knew, at the seam where it mattered. */
+export const noDoubleCast = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No cast through `unknown`; it turns checking off at the boundary." },
+        schema: [],
+        messages: {
+            double: "Casting through `unknown` tells the compiler to forget everything it knew about this value, because the two types have nothing in common. That is not a narrowing - a narrowing is a claim the compiler can still partly check - it is an erasure, and the seam it erases is the one worth checking: where a value crosses from outside the program to inside it. Narrow from `unknown` with a check the compiler can follow, or fix the shape.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        return {
+            TSAsExpression(node) {
+                // The outer cast of a `x as unknown as T` pair: its operand is itself a cast to `unknown`.
+                const inner = node.expression;
+                if (!inner || inner.type !== "TSAsExpression")
+                    return;
+                if (!isUnknown(inner.typeAnnotation))
+                    return;
+                context.report({ node, messageId: "double" });
+            },
+        };
+    },
+});
+// -- TYPE-SAFETY-2 ---------------------------------------------------------------------------------
+/** True for `as const`, the one assertion that narrows without claiming anything. */
+const isConstAssertion = (type) => type.type === "TSTypeReference" && type.typeName.type === "Identifier" && type.typeName.name === "const";
+/**
+ * A type assertion is a claim the compiler cannot check, made at the place it was going to check.
+ *
+ * WHAT IS LEFT ALLOWED. `as const` (it narrows), `as unknown` (it widens, and everything is assignable
+ * to it), and `satisfies` (it checks). The cast through `unknown` to a real type is refused by
+ * `no-double-cast`, so this rule leaves the outer half of that pair to it and reports each once.
+ */
+export const noTypeAssertion = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No `as T` or `<T>x`; narrow with a check, a guard or a parser." },
+        schema: [],
+        messages: {
+            assertion: "`as {{type}}` tells the compiler to believe something it could not verify. When the claim is wrong the type system keeps saying it is right and the failure moves to a reader. Narrow with a check the compiler can follow (a type guard, `in`, a discriminant), parse the value where it enters, or use `satisfies` when the goal is only to check a literal.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        const source = context.sourceCode ?? context.getSourceCode();
+        const report = (node) => context.report({ node, messageId: "assertion", data: { type: source.getText(node.typeAnnotation) } });
+        return {
+            TSAsExpression(node) {
+                if (isConstAssertion(node.typeAnnotation) || isUnknown(node.typeAnnotation))
+                    return;
+                const inner = node.expression;
+                if (inner && inner.type === "TSAsExpression" && isUnknown(inner.typeAnnotation))
+                    return;
+                report(node);
+            },
+            TSTypeAssertion(node) {
+                if (isConstAssertion(node.typeAnnotation))
+                    return;
+                report(node);
+            },
+        };
+    },
+});
+// -- TYPE-SAFETY-3 ---------------------------------------------------------------------------------
+/** `x!` says a value is present without proving it. */
+export const noNonNullAssertion = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No non-null assertion (`x!`); prove the value is there." },
+        schema: [],
+        messages: {
+            bang: "`!` asserts the value is not null or undefined and proves nothing: the day it is one, the failure is a TypeError in a reader's browser rather than a branch in the code. Handle the absent case (`if`, `??`, an early return) or make the type say it cannot be absent.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        return { TSNonNullExpression: (node) => context.report({ node, messageId: "bang" }) };
+    },
+});
+// -- TYPE-SAFETY-4 ---------------------------------------------------------------------------------
+/** `any` switches checking off for everything it touches. */
+export const noExplicitAny = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "No `any`; use a real type or `unknown` and narrow." },
+        schema: [],
+        messages: {
+            any: "`any` turns type checking off for this value and everything derived from it, silently. Use the real type, a generic, or `unknown` and narrow it where it is used.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        return { TSAnyKeyword: (node) => context.report({ node, messageId: "any" }) };
+    },
+});
+/** The rules this law contributes to the plugin. */
+export const rules = {
+    "no-double-cast": noDoubleCast,
+    "no-type-assertion": noTypeAssertion,
+    "no-non-null-assertion": noNonNullAssertion,
+    "no-explicit-any": noExplicitAny,
+};
+/**
+ * The level this law asks for, as the plugin's own opinion.
+ *
+ * Exact - it matches one syntactic shape - but a repository adopting it with history should expect
+ * each report to be real work: a double cast is usually load-bearing by the time anybody notices,
+ * and removing one means giving the value a shape it did not have.
+ *
+ * `any` and the array spelling are NOT published here. They belong to the TypeScript plugin's own
+ * rules, which a consuming repository already has: `@typescript-eslint/no-explicit-any` and
+ * `@typescript-eslint/array-type` with the generic default.
+ */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]));

package/dist/ui-rulings.d.ts

@@ -0,0 +1,11 @@
+import { type Recommended } from "./lib/rule.js";
+/** Navigation-like single selection uses the row fill instead of a second check indicator. */
+export declare const selectionFillNoCheck: import("./lib/rule.js").Rule<"indicator", []>;
+/** Grammar internal selectors belong to Grammar, including selectors in colocated class declarations. */
+export declare const noGrammarInternalSelector: import("./lib/rule.js").Rule<"internal", []>;
+export declare const rules: {
+    "selection-fill-no-check": import("./lib/rule.js").Rule<"indicator", []>;
+    "no-grammar-internal-selector": import("./lib/rule.js").Rule<"internal", []>;
+};
+/** Both owner rulings are universal errors in the frontend canon. */
+export declare const recommended: Recommended;

package/dist/ui-rulings.js

@@ -0,0 +1,121 @@
+import { attribute, attributeValue, staticText } from "./lib/ast.js";
+import { importOf } from "./lib/bindings.js";
+import { defineRule } from "./lib/rule.js";
+import { isProductSource } from "./lib/scope.js";
+import { typedClassStrings } from "./lib/typed-class-values.js";
+/** Resolve a named or namespace import at its use, preserving lexical shadowing. */
+const grammarComponent = (context, opening, expected) => {
+    const name = opening.name;
+    const root = name.type === "JSXMemberExpression" ? name.object : name;
+    if (root.type !== "JSXIdentifier")
+        return false;
+    const binding = importOf(context, root);
+    if (!binding ||
+        !/^@starci\/grammar(?:\/(?:common|core|offset-pop))?$/.test(binding.source))
+        return false;
+    return name.type === "JSXMemberExpression"
+        ? binding.imported === null && name.property.name === expected
+        : binding.imported === expected;
+};
+/** Only a final explicit attribute is proof when an opaque spread could override a value. */
+/** True when `text` is one of `values`; a missing text never is. */
+const oneOf = (values, text) => text !== null && values.includes(text);
+/** The plain tag name of a JSX element (`nav`), or null for a member or namespaced name. */
+const plainTag = (name) => (name.type === "JSXIdentifier" ? name.name : null);
+const propText = (opening, key) => {
+    let value = null;
+    for (const entry of opening.attributes) {
+        if (entry.type === "JSXSpreadAttribute")
+            value = null;
+        else if (entry.name.name === key)
+            value = staticText(entry.value);
+    }
+    return value;
+};
+/** Navigation and rail/list placement are structurally identifiable without guessing from product names. */
+const navigationList = (context, opening) => {
+    for (let node = opening.parent; node; node = node.parent) {
+        if (node.type !== "JSXElement")
+            continue;
+        const parent = node.openingElement;
+        if (oneOf(["nav", "ul", "ol"], plainTag(parent.name)) ||
+            oneOf(["navigation", "list"], propText(parent, "role")))
+            return true;
+        if (["Rail", "Sidebar"].some((role) => grammarComponent(context, parent, role)))
+            return true;
+    }
+    return false;
+};
+/** Navigation-like single selection uses the row fill instead of a second check indicator. */
+export const selectionFillNoCheck = defineRule({
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Navigation-like single-select ListBox rows use selectionIndicator=none.",
+        },
+        schema: [],
+        messages: {
+            indicator: 'Use selectionIndicator="none" on this navigation-like single-select ListBox; the row fill carries selection.',
+        },
+    },
+    create(context) {
+        return {
+            JSXOpeningElement(node) {
+                if (!grammarComponent(context, node, "ListBox") ||
+                    !navigationList(context, node))
+                    return;
+                if (oneOf(["none", "multiple"], propText(node, "selectionMode")))
+                    return;
+                if (propText(node, "selectionIndicator") !== "none")
+                    context.report({ node, messageId: "indicator" });
+            },
+        };
+    },
+});
+/** Grammar internal selectors belong to Grammar, including selectors in colocated class declarations. */
+export const noGrammarInternalSelector = defineRule({
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Application styles cannot target starci-core internals.",
+        },
+        schema: [],
+        messages: {
+            internal: "Remove this starci-core- selector. Compose the Grammar public API; message actions belong in the ChatBubble floating toolbar.",
+        },
+    },
+    create(context) {
+        if (!isProductSource(context))
+            return {};
+        const selector = /(?:\.|_|\[class[^\]]*)starci-core-/;
+        const report = (node, text) => {
+            if (text && selector.test(text))
+                context.report({ node, messageId: "internal" });
+        };
+        return {
+            Literal(node) {
+                if (typeof node.value === "string")
+                    report(node, node.value);
+            },
+            TemplateElement(node) {
+                report(node, node.value.cooked);
+            },
+            JSXAttribute(node) {
+                if (node.name.name !== "className")
+                    return;
+                const value = attributeValue(attribute(node.parent, "className"));
+                if (value?.type !== "Identifier" && value?.type !== "MemberExpression")
+                    return;
+                const strings = typedClassStrings(context, value, "classes");
+                if (strings.some((entry) => selector.test(entry.text)))
+                    context.report({ node, messageId: "internal" });
+            },
+        };
+    },
+});
+export const rules = {
+    "selection-fill-no-check": selectionFillNoCheck,
+    "no-grammar-internal-selector": noGrammarInternalSelector,
+};
+/** Both owner rulings are universal errors in the frontend canon. */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.2.0",
+  "version": "9.4.0",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",
@@ -16,18 +16,34 @@
   },
   "private": false,
   "exports": {
-    ".": "./index.mjs",
-    "./lib/*": "./lib/*"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./lib/*.mjs": {
+      "types": "./dist/lib/*.d.ts",
+      "default": "./dist/lib/*.js"
+    },
+    "./lib/*.js": {
+      "types": "./dist/lib/*.d.ts",
+      "default": "./dist/lib/*.js"
+    },
+    "./package.json": "./package.json"
   },
-  "main": "./index.mjs",
+  "imports": {
+    "#runtime/*": {
+      "types": "./src/types/runtime/*",
+      "default": "./runtime/*"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "files": [
     "LICENSE",
-    "*.mjs",
-    "lib/*.mjs",
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
     "runtime/**",
     "docs/*.md",
-    "*.ts",
-    "!*.spec.mjs",
     "CHANGELOG.md",
     "README.md"
   ],
@@ -43,7 +59,10 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node --test \"*.spec.mjs\""
+    "build": "node -e \"require('node:fs').rmSync('dist', {recursive: true, force: true})\" && tsc -p tsconfig.build.json && node -e \"const fs = require('node:fs'); for (const f of fs.readdirSync('dist', {recursive: true}).filter((n) => n.endsWith('.d.ts'))) fs.writeFileSync('dist/' + f, fs.readFileSync('dist/' + f, 'utf8').replace(/((?:from |import\\()['\\x22]\\.\\.?\\/[^'\\x22]+)\\.ts(['\\x22])/g, (all, head, quote) => head + '.js' + quote))\"",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test \"src/**/*.spec.ts\"",
+    "prepack": "npm run typecheck && npm run build && npm test"
   },
   "keywords": [
     "eslint",
@@ -54,10 +73,13 @@
   "dependencies": {
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
+    "@typescript-eslint/utils": "^8.72.1",
     "eslint-plugin-sonarjs": "4.2.1",
     "eslint-plugin-unicorn": "65.0.0"
   },
   "devDependencies": {
+    "@starci/tsconfig": "file:../tsconfig",
+    "@types/node": "^24.19.2",
     "eslint": "^9.18.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "typescript": "^6.0.3"

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,61 +30,61 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.13.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.57
+    version: 3.6.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.2.0
+    version: 9.4.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.13.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.13.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.1.0
+    version: 2.2.1
     group: starci
     install: registry
     side: fe
     source: packages/stylelint-canon/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.8
+    version: 2.1.0
     group: starci
     install: registry
     side: both
     source: packages/tsconfig/package.json
   '@starci/prettier-config':
-    version: 1.0.5
+    version: 1.1.0
     group: starci
     install: registry
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.3.7
+    version: 2.4.1
     group: starci
     install: registry
     side: be
@@ -97,19 +97,27 @@ pins:
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
-  '@starci/cli':
-    version: 1.7.47
+  '@starci/ai-router':
+    version: 0.2.1
+    group: starci
+    install: registry
+    side: be
+    source: packages/ai-router/package.json
+    why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
+  'starci-harness':
+    version: 1.1.0-alpha.1
     group: starci
     install: registry
     side: both
-    why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
+    source: cli/package.json
+    why: 'the one StarCi command line (bins starci and starci-harness): a product repository installs it for starci app, which it runs in-process through its exact @starci/hfs dependency, and its codegen loads starci-harness/input-bounds.'
   '@starci/hfs':
-    version: 4.8.0
+    version: 4.9.1
     group: starci
     install: registry
     side: both
     source: packages/hfs/package.json
-    why: 'the transitive app implementation used by @starci/cli; it carries the generated runtime slice read by starci app commands.'
+    why: 'the app implementation starci-harness runs for starci app; it carries the generated runtime slice read by starci app commands.'
   # --- tooling
   typescript:
     version: 5.9.3

package/runtime/scripts/lib/package-at.mjs

@@ -13,9 +13,9 @@ export const packageAt = (dir, name) => {
 /** This runtime's own `starci` bin (packages/cli is the only package that declares one). */
 const RUNTIME_STARCI_BIN = path.join(skillRoot, 'packages', 'cli', 'bin', 'starci.mjs');
 
-/** The `starci` bin of the @starci/cli that `dir` installs (a product runs its own pinned CLI), else this runtime's own. */
+/** The `starci` bin of the starci-harness that `dir` installs (a product runs its own pinned CLI), else this runtime's own. */
 function starciBin(dir) {
-  const packageFile = packageAt(dir, '@starci/cli');
+  const packageFile = packageAt(dir, 'starci-harness');
   if (packageFile) {
     try {
       const { bin } = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
@@ -50,13 +50,13 @@ export const loadTypescript = (...dirs) => {
 };
 
 /**
- * The app's command line and the app implementation behind it: `bin` the `starci` bin of the app's installed @starci/cli, else
+ * The app's command line and the app implementation behind it: `bin` the `starci` bin of the app's installed starci-harness, else
  * this runtime's packages/cli/bin/starci.mjs (starciBin); `dir` the @starci/hfs that answers
- * `starci app` - the app's own install, else the one beside its @starci/cli, else this runtime's packages/hfs - whose runtime
+ * `starci app` - the app's own install, else the one beside its starci-harness, else this runtime's packages/hfs - whose runtime
  * slice the gate's base lint (scripts/gates/gate.mjs) and the READ digest (scripts/gates/read-digest.mjs) load in-process.
  */
 export function hfsEntry(root) {
-  const cli = packageAt(root, '@starci/cli');
+  const cli = packageAt(root, 'starci-harness');
   const manifest = packageAt(root, '@starci/hfs') ?? (cli && packageAt(path.dirname(cli), '@starci/hfs'));
   return { dir: manifest ? path.dirname(manifest) : path.join(skillRoot, 'packages', 'hfs'), bin: starciBin(root) };
 }