@cosmicdrift/kumiko-guards 0.381.0 → 0.383.0

package/src/guard-section-fields-raw.ts

@@ -1,300 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Guard: raw iteration over a section's `fields` instead of `sectionFieldSpecs`.
- *
- * The boot-validator enforces `fields` XOR `groups` on edit sections
- * (packages/framework/src/engine/boot-validator/screens.ts), so a section that
- * carries `groups` has `fields: []`. A reader that iterates `section.fields`
- * walks an empty list there and silently sees no field at all — no crash, no
- * empty screen, just a check that checks nothing. The same cause hit three
- * independent readers (kumiko-framework#2986, then the boot-guard and the E2E
- * generator in #3042). `sectionFieldSpecs` (engine/screen-helpers.ts) is the
- * one reader that unions both sources.
- *
- * Flagged: for-of, spread, array reads, indexing, call arguments and
- * destructuring over the `fields` of a section (by name or by a `groups`
- * property on its type), also behind `!`, parentheses, `as` and `??`.
- * Known gap: `section.fields.length` is not flagged — the fields-XOR-groups
- * validator itself needs it, and an emptiness check is not the silent-
- * iteration bug.
- *
- * Scoped to the framework repo (`kinds`) and to the layer where a section is
- * a *spec*: renderer components iterate the already-flattened view model,
- * where the same expression is correct. Widening to the consumer repos needs
- * all nine measured against one pinned version first.
- *
- * Deliberate raw readers carry `// kumiko-lint-ignore section-fields-raw
- * <reason>` on the line itself or the line above — the reason is required, a
- * bare tag stays a finding.
- *
- * `.kumiko-section-fields-raw-baseline.json` in the repo root pins the frozen
- * count per file; over baseline fails, at or under passes. Without the file
- * the guard is warning-only (bootstrap: `--write-baseline` once).
- *
- * Usage:
- *   bun guards/guard-section-fields-raw.ts                  # compare to baseline
- *   bun guards/guard-section-fields-raw.ts --write-baseline # freeze current
- *   bun guards/guard-section-fields-raw.ts --no-baseline    # skip comparison
- */
-import * as path from "node:path";
-import {
-  type Node,
-  type PropertyAccessExpression,
-  type SourceFile,
-  SyntaxKind,
-  type VariableDeclaration,
-} from "ts-morph";
-import {
-  type AstGuard,
-  baselineRatchet,
-  buildSharedProject,
-  filesForGuard,
-  type GuardOutcome,
-  type GuardViolation,
-  isLocalFinding,
-  relFromRepoRoot,
-  runStandalone,
-  type ScanSpec,
-} from "./_lib/guard-kit";
-import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
-
-const ROOT = process.cwd();
-
-const SCAN: ScanSpec = {
-  scope: "source",
-  extensions: ["ts", "tsx"],
-  kinds: ["framework"],
-  frameworkWithin: [
-    "packages/framework/src/engine/**",
-    "packages/framework/src/i18n/**",
-    "packages/testing/src/helpers/**",
-    "packages/renderer/src/headless/**",
-    "packages/renderer/src/app/**",
-  ],
-};
-
-const EXCLUDE = /(__tests__|\.test\.tsx?$|\.integration\.tsx?$|\.d\.ts$)/;
-
-const IGNORE_TAG = "kumiko-lint-ignore section-fields-raw";
-// hasIgnoreTag() from _lib accepts a bare tag; a visible reason is required, so
-// the reason must start with a real character: the `*` of a closing `*/` (block
-// and JSX comments) must not count as one.
-const REASONED_TAG = new RegExp(`${IGNORE_TAG}\\s+(?!\\*/)[^\\s*]`);
-
-const SECTION_RECEIVER = /section/i;
-
-const ARRAY_READS = new Set([
-  "at",
-  "concat",
-  "entries",
-  "every",
-  "filter",
-  "find",
-  "findIndex",
-  "findLast",
-  "findLastIndex",
-  "flat",
-  "flatMap",
-  "forEach",
-  "includes",
-  "indexOf",
-  "join",
-  "keys",
-  "lastIndexOf",
-  "map",
-  "reduce",
-  "reduceRight",
-  "reverse",
-  "slice",
-  "some",
-  "sort",
-  "toReversed",
-  "toSorted",
-  "toSpliced",
-  "values",
-  "with",
-]);
-
-function relFile(sf: SourceFile, roots: readonly RepoRoot[]): string {
-  return relFromRepoRoot(sf.getFilePath(), roots);
-}
-
-function hasReasonedIgnoreTag(node: Node): boolean {
-  const lines = node.getSourceFile().getFullText().split("\n");
-  const line = node.getStartLineNumber();
-  return REASONED_TAG.test(lines[line - 1] ?? "") || REASONED_TAG.test(lines[line - 2] ?? "");
-}
-
-// A section is recognised by its name or, when types resolve, by carrying a
-// `groups` property — so `sec.fields` and `layout.sections.map((s) => s.fields)`
-// are caught too. The name regex stays as the fallback for untyped receivers.
-function isSectionReceiver(receiver: Node): boolean {
-  if (SECTION_RECEIVER.test(receiver.getText())) return true;
-  return receiver.getType().getProperty("groups") !== undefined;
-}
-
-// Climbs `x!`, `(x)`, `x as T` and `x ?? y` so a wrapped read is judged by the
-// context it ends up in.
-function unwrapReadContext(access: Node): Node {
-  let current = access;
-  for (;;) {
-    const parent = current.getParent();
-    if (
-      parent !== undefined &&
-      (parent.isKind(SyntaxKind.NonNullExpression) ||
-        parent.isKind(SyntaxKind.ParenthesizedExpression) ||
-        parent.isKind(SyntaxKind.AsExpression) ||
-        (parent.isKind(SyntaxKind.BinaryExpression) &&
-          parent.getOperatorToken().getKind() === SyntaxKind.QuestionQuestionToken &&
-          parent.getLeft() === current))
-    ) {
-      current = parent;
-      continue;
-    }
-    return current;
-  }
-}
-
-function isSequenceRead(access: PropertyAccessExpression): boolean {
-  const read = unwrapReadContext(access);
-  const parent = read.getParent();
-  if (parent === undefined) return false;
-  if (parent.isKind(SyntaxKind.ForOfStatement)) return parent.getExpression() === read;
-  if (parent.isKind(SyntaxKind.SpreadElement) || parent.isKind(SyntaxKind.SpreadAssignment)) {
-    return true;
-  }
-  if (parent.isKind(SyntaxKind.ElementAccessExpression)) return parent.getExpression() === read;
-  if (parent.isKind(SyntaxKind.CallExpression)) return parent.getArguments().includes(read);
-  if (
-    parent.isKind(SyntaxKind.PropertyAccessExpression) &&
-    parent.getExpression() === read &&
-    ARRAY_READS.has(parent.getName())
-  ) {
-    return parent.getParent()?.isKind(SyntaxKind.CallExpression) === true;
-  }
-  return false;
-}
-
-function isDestructuredFieldsRead(declaration: VariableDeclaration): boolean {
-  const pattern = declaration.getNameNode();
-  const initializer = declaration.getInitializer();
-  if (!pattern.isKind(SyntaxKind.ObjectBindingPattern) || initializer === undefined) return false;
-  if (!isSectionReceiver(initializer)) return false;
-  return pattern
-    .getElements()
-    .some(
-      (element) => (element.getPropertyNameNode() ?? element.getNameNode()).getText() === "fields",
-    );
-}
-
-export interface Finding {
-  file: string;
-  line: number;
-  snippet: string;
-}
-
-export function scanRawSectionFieldReads(
-  sf: SourceFile,
-  roots: readonly RepoRoot[] = resolveRepoRoots(),
-): Finding[] {
-  const findings: Finding[] = [];
-  for (const access of sf.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
-    if (access.getName() !== "fields") continue;
-    if (!isSectionReceiver(access.getExpression())) continue;
-    if (!isSequenceRead(access)) continue;
-    if (hasReasonedIgnoreTag(access)) continue;
-    const line = access.getStartLineNumber();
-    const file = relFile(sf, roots);
-    findings.push({ file, line, snippet: access.getText().slice(0, 80) });
-    console.warn(
-      `  [section-fields-raw WARN] ${file}:${line}  raw read of ${access.getText().slice(0, 80)} — use sectionFieldSpecs(section)`,
-    );
-  }
-  for (const declaration of sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
-    if (!isDestructuredFieldsRead(declaration)) continue;
-    if (hasReasonedIgnoreTag(declaration)) continue;
-    const line = declaration.getStartLineNumber();
-    const file = relFile(sf, roots);
-    findings.push({ file, line, snippet: declaration.getText().slice(0, 80) });
-    console.warn(
-      `  [section-fields-raw WARN] ${file}:${line}  destructured fields of ${declaration.getText().slice(0, 80)} — use sectionFieldSpecs(section)`,
-    );
-  }
-  return findings;
-}
-
-function scan(
-  files: readonly SourceFile[],
-  roots: readonly RepoRoot[] = resolveRepoRoots(),
-): Finding[] {
-  const findings: Finding[] = [];
-  for (const sf of files) {
-    if (EXCLUDE.test(sf.getFilePath())) continue;
-    findings.push(...scanRawSectionFieldReads(sf, roots));
-  }
-  return findings;
-}
-
-const BASELINE_FILE = ".kumiko-section-fields-raw-baseline.json";
-const sectionFieldsRawBaseline = baselineRatchet({
-  file: path.join(ROOT, BASELINE_FILE),
-  formatVersion: 1,
-  unit: "raw section.fields read(s)",
-});
-
-const REMEDIATION = `Use sectionFieldSpecs(section) from @cosmicdrift/kumiko-framework/ui-types, or mark the line with \`// ${IGNORE_TAG} <reason>\`.`;
-
-export function baselineCounts(findings: readonly Finding[]): Record<string, number> {
-  const counts: Record<string, number> = {};
-  for (const f of findings.filter(isLocalFinding)) counts[f.file] = (counts[f.file] ?? 0) + 1;
-  return counts;
-}
-
-function analyse(
-  files: readonly SourceFile[],
-  roots: readonly RepoRoot[],
-  compareBaseline: boolean,
-): GuardOutcome {
-  const findings = scan(files, roots);
-  if (!compareBaseline) {
-    console.log("  Baseline comparison skipped (--no-baseline).");
-    return { violations: [] };
-  }
-  const local = findings.filter(isLocalFinding);
-  const violations: GuardViolation[] = sectionFieldsRawBaseline.check(
-    baselineCounts(findings),
-    REMEDIATION,
-    {
-      formatDriftRemediation:
-        'Run `kumiko-guards guards --write-baseline --guard="Raw section.fields Guard"` once.',
-      resolveLine: (file) => local.find((f) => f.file === file)?.line ?? 1,
-    },
-  );
-  return { violations };
-}
-
-export const guard: AstGuard = {
-  name: "Raw section.fields Guard",
-  scan: SCAN,
-  hint: `${REMEDIATION} Known gap: \`section.fields.length\` is not flagged. After a deliberate change: \`kumiko-guards guards --write-baseline --guard="Raw section.fields Guard"\`.`,
-  run: (files, roots = resolveRepoRoots()) => analyse(files, roots, true),
-  writeBaseline: (files) => sectionFieldsRawBaseline.write(baselineCounts(scan(files))),
-};
-
-// Flags are read only here, never in run() — the shared runner drives every
-// guard with the same argv, and a --write-baseline meant for another guard
-// must not silently refreeze this one.
-if (import.meta.main) {
-  const args = process.argv.slice(2);
-  if (args.includes("--write-baseline")) {
-    const project = buildSharedProject([guard]);
-    sectionFieldsRawBaseline.write(baselineCounts(scan(filesForGuard(project, guard))));
-    process.exit(0);
-  }
-  if (args.includes("--no-baseline")) {
-    const project = buildSharedProject([guard]);
-    analyse(filesForGuard(project, guard), resolveRepoRoots(), false);
-    process.exit(0);
-  }
-  runStandalone(guard);
-}

package/src/guard-table-ddl.ts

@@ -1,155 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Table-DDL Guard (WARNING, no fail).
- *
- * Finds calls of `unsafePushTables` / `unsafeCreateEntityTable` /
- * `unsafeEnsureEntityTable` outside the allowed paths. Apps
- * declare tables via `r.entity()` (event-sourced) or
- * `r.rawTable()` (declarative bypass with audit marker) — direct
- * `unsafe*` calls bypass the event-sourcing system entirely.
- *
- * Plan: kumiko-platform/docs/plans/architecture/table-ddl-guard.md
- * (stage 2). Stage 1 renamed the symbols so every call is
- * greppable; stage 3 introduced `r.rawTable()` as the clean alternative;
- * stage 2 (this check) enforces consistency.
- *
- * Allowlist (path regexes, OR-combined):
- *   - packages/framework/src/event-store/**          ES meta tables
- *   - packages/framework/src/pipeline/event-consumer-state.ts
- *   - packages/framework/src/pipeline/projection-state.ts
- *   - packages/framework/src/db/table-push.ts       the DDL helpers themselves
- *   - packages/testing/src/stack/**                  test-stack helpers, pushEntityProjectionTables, helper definitions
- *   - **\/__tests__/**                               test setup
- *   - **\/drizzle/**                                 drizzle-kit configuration
- *   - **\/bin/migrate.ts                             app-owned migrate CLI
- *   - packages/guards/src/guard-table-ddl.ts          the guard itself
- *   - kumiko-framework/scripts/migrate-rename-table-ddl.ts  ts-morph rename
- *
- * Output: warning + file:line + code snippet. Never blocks.
- */
-
-import path from "node:path";
-import { type Identifier, type Node, type SourceFile, SyntaxKind } from "ts-morph";
-import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
-
-const ROOT = process.cwd();
-
-const SCAN: ScanSpec = { scope: "source", extensions: ["ts"] };
-
-export const UNSAFE_NAMES: ReadonlySet<string> = new Set([
-  "unsafePushTables",
-  "unsafeCreateEntityTable",
-  "unsafeEnsureEntityTable",
-]);
-
-export const ALLOWLIST_PATTERNS: ReadonlyArray<RegExp> = [
-  /\/packages\/framework\/src\/event-store\//,
-  /\/packages\/framework\/src\/pipeline\/event-consumer-state\.ts$/,
-  /\/packages\/framework\/src\/pipeline\/projection-state\.ts$/,
-  /\/packages\/framework\/src\/db\/table-push\.ts$/,
-  /\/packages\/testing\/src\/stack\//,
-  /\/__tests__\//,
-  /\/drizzle\//,
-  /\/bin\/migrate\.ts$/,
-  // Guards + the rename script may name the symbols in code — both are
-  // tooling, not a runtime path.
-  /\/packages\/guards\/src\/guard-table-ddl\.ts$/,
-  /\/scripts\/migrate-rename-table-ddl\.ts$/,
-];
-
-export function isAllowed(absPath: string): boolean {
-  return ALLOWLIST_PATTERNS.some((re) => re.test(absPath));
-}
-
-export interface Finding {
-  readonly file: string;
-  readonly line: number;
-  readonly symbol: string;
-  readonly snippet: string;
-}
-
-const NEVER_CALL_SITE_PARENT_KINDS: ReadonlySet<SyntaxKind> = new Set([
-  SyntaxKind.ImportSpecifier,
-  SyntaxKind.ExportSpecifier,
-  SyntaxKind.PropertyAssignment,
-  SyntaxKind.ShorthandPropertyAssignment,
-]);
-
-// The identifier names something other than a runtime call of the symbol: an
-// import/export specifier (the violation is the call-site, not "having the
-// name in scope"; the `as` alias case still flags the call), an object key,
-// the right-hand side of a property access (`obj.unsafePushTables` — a method
-// on an unrelated type), or a type-level member (`interface { unsafePushTables(): void }`).
-function isNotRuntimeCallSite(id: Identifier, parent: Node): boolean {
-  if (NEVER_CALL_SITE_PARENT_KINDS.has(parent.getKind())) return true;
-  if (parent.isKind(SyntaxKind.PropertyAccessExpression)) return parent.getNameNode() === id;
-  if (parent.isKind(SyntaxKind.PropertySignature)) return parent.getNameNode() === id;
-  if (parent.isKind(SyntaxKind.MethodSignature)) return parent.getNameNode() === id;
-  return false;
-}
-
-export function collectFindings(sf: SourceFile, repoRoot: string): Finding[] {
-  const absPath = sf.getFilePath();
-  if (isAllowed(absPath)) return [];
-
-  const findings: Finding[] = [];
-  const lines = sf.getFullText().split("\n");
-
-  for (const id of sf.getDescendantsOfKind(SyntaxKind.Identifier)) {
-    const name = id.getText();
-    if (!UNSAFE_NAMES.has(name)) continue;
-
-    const parent = id.getParent();
-    if (!parent) continue;
-    if (isNotRuntimeCallSite(id, parent)) continue;
-
-    const line = id.getStartLineNumber();
-    const raw = (lines[line - 1] ?? "").trim();
-    const snippet = raw.length > 100 ? `${raw.slice(0, 97)}...` : raw;
-    findings.push({
-      file: path.relative(repoRoot, absPath),
-      line,
-      symbol: name,
-      snippet,
-    });
-  }
-  return findings;
-}
-
-function report(findings: readonly Finding[], scanned: number): void {
-  console.log(`Table-DDL Guard: ${scanned} files checked.`);
-  if (findings.length === 0) {
-    console.log("  No bypass calls outside the allowlist.");
-  } else {
-    console.log(`  ${findings.length} bypass call(s) outside the allowlist:`);
-    for (const f of findings) {
-      console.log(`    ${f.file}:${f.line}  ${f.symbol}`);
-      console.log(`      ${f.snippet}`);
-    }
-    console.log("");
-    console.log("  Rule: unsafe* calls are reserved for framework-internal code (event-store,");
-    console.log("  pipeline-state, stack), test setup (__tests__, drizzle/), app migrate CLIs");
-    console.log("  (bin/migrate.ts). Apps declare tables via r.entity() or r.rawTable().");
-    console.log("  Plan: kumiko-platform/docs/plans/architecture/table-ddl-guard.md");
-    console.log("  Warning, no fail.");
-  }
-}
-
-export const guard: AstGuard = {
-  name: "Table-DDL Guard",
-  scan: SCAN,
-  run(files) {
-    const findings: Finding[] = [];
-    let scanned = 0;
-    for (const sf of files) {
-      scanned++;
-      findings.push(...collectFindings(sf, ROOT));
-    }
-    report(findings, scanned);
-    // Warning, no fail (see module header): bypass calls are reported but
-    // never block the guard run.
-    return { violations: [] };
-  },
-};
-
-if (import.meta.main) runStandalone(guard);

package/src/guard-text-field-stance.ts

@@ -1,248 +0,0 @@
-#!/usr/bin/env bun
-/**
- * Guard: `createTextField`/`createLongTextField` calls without a `personal`
- * stance, with a baseline regression guard like guard-pii-annotations.ts.
- *
- * kumiko-framework#2810: `createTextField`/`createLongTextField` should
- * throw fail-closed when no `personal` (pattern #2558) is declared.
- * Workspace-wide `personal` is missing at hundreds of call sites — a throw would
- * break the build immediately. This guard covers the full set (every call),
- * `guard-pii-annotations.ts` only the name heuristic (PII-suspicious
- * field names) — the two baselines are deliberately separate.
- *
- * `.kumiko-text-field-stance-baseline.json` in the repo root pins the frozen
- * finding count per file:
- *   - current <= baseline per file: PASS
- *   - current >  baseline per file: FAIL (new call without a personal stance)
- * Reductions do NOT update the baseline automatically — run `--write-baseline`
- * after annotation commits. Without a baseline file the guard stays
- * warning-only (bootstrap: run `--write-baseline` once).
- *
- * Usage:
- *   bun guards/guard-text-field-stance.ts                  # compare against baseline
- *   bun guards/guard-text-field-stance.ts --write-baseline # rewrite baseline
- *   bun guards/guard-text-field-stance.ts --no-baseline    # skip comparison
- */
-import * as path from "node:path";
-import {
-  type CallExpression,
-  type Node,
-  type ObjectLiteralExpression,
-  type SourceFile,
-  SyntaxKind,
-} from "ts-morph";
-import {
-  type AstGuard,
-  baselineRatchet,
-  buildSharedProject,
-  filesForGuard,
-  type GuardOutcome,
-  type GuardViolation,
-  isLocalFinding,
-  relFromRepoRoot,
-  runStandalone,
-  type ScanSpec,
-} from "./_lib/guard-kit";
-import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
-
-const ROOT = process.cwd();
-
-const SCAN: ScanSpec = {
-  scope: "source",
-  extensions: ["ts"],
-  frameworkWithin: ["packages/*/src/**", "samples/**", "demo/**"],
-  // `demo/` isn't a declared sourceRoot (kumiko.json) — extraGlobs pulls its
-  // files in on top of the scope's own hits; frameworkWithin above still
-  // gates them the same as every other hit.
-  extraGlobs: ["demo/**/*.ts"],
-};
-// Unlike guard-pii-annotations.ts, tests are IN scope: kumiko-framework#2810's
-// fail-closed throw fires at call time regardless of test vs. production code —
-// a test fixture calling createTextField() without `personal` breaks the same
-// way prod code would once the throw lands.
-const EXCLUDE = /\.d\.ts$/;
-
-const FIELD_FACTORY_CALLEES = new Set(["createTextField", "createLongTextField"]);
-
-// These two files deliberately call the factories without a stance to prove
-// the fail-closed throw (kumiko-framework#2921) — exact repo-relative match,
-// not basename, so a consumer file sharing a name stays flagged.
-const STANCE_THROW_TEST_ALLOWLIST = new Set<string>([
-  "packages/framework/src/engine/__tests__/factories-long-text.test.ts",
-  "packages/framework/src/engine/__tests__/factories-personal.test.ts",
-]);
-
-const VALID_PERSONAL_HINT =
-  '{ personal: "self" | "tenant" | "ref" | { of: "<ownerField>" } | false } ("false" additionally needs { reason: "..." })';
-
-function relFile(sf: SourceFile, roots: readonly RepoRoot[]): string {
-  return relFromRepoRoot(sf.getFilePath(), roots);
-}
-
-function fieldFactoryOptions(call: CallExpression): ObjectLiteralExpression | undefined {
-  const first = call.getArguments()[0];
-  return first?.isKind(SyntaxKind.ObjectLiteralExpression) ? first : undefined;
-}
-
-// A spread's source (e.g. `{ ...base, maxLength: 5 }`) may supply `personal`
-// without a literal property here — statically undecidable like a non-object
-// argument, so treat it the same way (not countable).
-function hasSpreadProperty(obj: ObjectLiteralExpression): boolean {
-  return obj.getProperties().some((prop) => prop.isKind(SyntaxKind.SpreadAssignment));
-}
-
-// Mirrors guard-pii-annotations.ts's `personal` branch: every value counts as
-// answered, including `personal: false` (the framework requires a `reason`
-// for it) — except `undefined`/`null`, which never answered the question.
-function hasPersonalStance(obj: ObjectLiteralExpression): boolean {
-  const prop = obj.getProperty("personal");
-  if (!prop?.isKind(SyntaxKind.PropertyAssignment)) return false;
-  const init: Node | undefined = prop.getInitializer();
-  return (
-    init !== undefined &&
-    init.getKind() !== SyntaxKind.UndefinedKeyword &&
-    !(init.isKind(SyntaxKind.Identifier) && init.getText() === "undefined") &&
-    init.getKind() !== SyntaxKind.NullKeyword
-  );
-}
-
-function enclosingFieldName(call: CallExpression): string | null {
-  let node = call.getParent();
-  while (node) {
-    if (node.isKind(SyntaxKind.PropertyAssignment)) {
-      return node.getName();
-    }
-    node = node.getParent();
-  }
-  return null;
-}
-
-export interface Finding {
-  file: string;
-  line: number;
-  place: string;
-  callee: string;
-}
-
-function scanFieldFactories(sf: SourceFile, roots: readonly RepoRoot[]): Finding[] {
-  const findings: Finding[] = [];
-  const file = relFile(sf, roots);
-  if (STANCE_THROW_TEST_ALLOWLIST.has(file)) return findings;
-
-  for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    const callee = call.getExpression().getText();
-    if (!FIELD_FACTORY_CALLEES.has(callee)) continue;
-
-    const args = call.getArguments();
-    if (args.length > 0) {
-      const options = fieldFactoryOptions(call);
-      if (!options) continue; // non-literal argument (variable/spread) — not statically decidable
-      if (hasSpreadProperty(options)) continue;
-      if (hasPersonalStance(options)) continue;
-    }
-
-    const place = enclosingFieldName(call) ?? `${callee}(...)`;
-    const line = call.getStartLineNumber();
-    findings.push({ file, line, place, callee });
-  }
-  return findings;
-}
-
-export function scan(
-  files: readonly SourceFile[],
-  roots: readonly RepoRoot[] = resolveRepoRoots(),
-): {
-  findings: Finding[];
-  scanned: number;
-} {
-  const findings: Finding[] = [];
-  let scanned = 0;
-  for (const sf of files) {
-    if (EXCLUDE.test(sf.getFilePath())) continue;
-    scanned++;
-    findings.push(...scanFieldFactories(sf, roots));
-  }
-  return { findings, scanned };
-}
-
-function localFindings(findings: readonly Finding[]): readonly Finding[] {
-  return findings.filter(isLocalFinding);
-}
-
-function countByFile(findings: readonly Finding[]): Record<string, number> {
-  const counts: Record<string, number> = {};
-  for (const f of findings) counts[f.file] = (counts[f.file] ?? 0) + 1;
-  return counts;
-}
-
-const BASELINE_FILE = ".kumiko-text-field-stance-baseline.json";
-const textFieldStanceBaseline = baselineRatchet({
-  file: path.join(ROOT, BASELINE_FILE),
-  formatVersion: 1,
-  unit: "finding(s) without personal stance",
-});
-
-// One place for "what goes into the baseline", used by both the compare and
-// the write path — a sibling finding leaking into the written file would turn
-// a foreign checkout's code into a local, unfixable red.
-export function baselineCounts(findings: readonly Finding[]): Record<string, number> {
-  return countByFile(localFindings(findings));
-}
-
-function checkBaseline(findings: readonly Finding[]): GuardViolation[] {
-  const local = localFindings(findings);
-  const resolveLine = (file: string): number => local.find((f) => f.file === file)?.line ?? 1;
-  return textFieldStanceBaseline.check(
-    baselineCounts(findings),
-    `Annotate the call (${VALID_PERSONAL_HINT}).`,
-    {
-      formatDriftRemediation: `Run \`kumiko-guards guards --write-baseline --guard="Text-Field Personal-Stance Guard"\` once.`,
-      resolveLine,
-    },
-  );
-}
-
-function analyse(
-  files: readonly SourceFile[],
-  roots: readonly RepoRoot[],
-  compareBaseline: boolean,
-): GuardOutcome {
-  const { findings } = scan(files, roots);
-  if (!compareBaseline) {
-    for (const f of findings)
-      console.warn(
-        `  [text-field-stance WARN] ${f.file}:${f.line}  ${f.callee}(...) at "${f.place}" has no personal stance — mark ${VALID_PERSONAL_HINT}`,
-      );
-    console.log("  Baseline comparison skipped (--no-baseline).");
-    return { violations: [] };
-  }
-  return { violations: checkBaseline(findings) };
-}
-
-export const guard: AstGuard = {
-  name: "Text-Field Personal-Stance Guard",
-  scan: SCAN,
-  hint: 'after a deliberate annotation: `kumiko-guards guards --write-baseline --guard="Text-Field Personal-Stance Guard"`',
-  run: (files, roots = resolveRepoRoots()) => analyse(files, roots, true),
-  writeBaseline: (files) => textFieldStanceBaseline.write(baselineCounts(scan(files).findings)),
-};
-
-// Flags are read ONLY here, not in run() — the shared runner
-// (run-guards.ts) drives all guards with the same argv, and a
-// --write-baseline there must not silently rewrite the
-// baseline.
-if (import.meta.main) {
-  const args = process.argv.slice(2);
-  if (args.includes("--write-baseline")) {
-    const project = buildSharedProject([guard]);
-    const { findings } = scan(filesForGuard(project, guard));
-    textFieldStanceBaseline.write(baselineCounts(findings));
-    process.exit(0);
-  }
-  if (args.includes("--no-baseline")) {
-    const project = buildSharedProject([guard]);
-    analyse(filesForGuard(project, guard), resolveRepoRoots(), false);
-    process.exit(0);
-  }
-  runStandalone(guard);
-}