@cosmicdrift/kumiko-guards 0.386.0 → 0.388.0

package/src/guard-comment-lang.ts

@@ -1,6 +1,12 @@
+// Comment-language ratchet: no new German comments in product code. No NLP —
+// German markers are common function words or umlaut characters in the comment text.
+// Baseline mode compares per-file counts against a frozen file (more than the
+// baseline fails, fewer is allowed but does not rewrite it); `--touched` fails
+// on any German comment that overlaps a line added since `--base`.
+
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
-import { ts } from "ts-morph";
+import { scanCommentTrivia } from "./_lib/comment-trivia";
 import { gitEnv } from "./_lib/git-env";
 import { ALL_REPO_KINDS, cliFlagsError, isLocalFinding } from "./_lib/guard-kit";
 import { lineHasIgnoreTag } from "./_lib/ignore-tag";
@@ -8,12 +14,6 @@ import { resolvePushRepoRoot } from "./_lib/push-root";
 import { resolveRepoRoots } from "./_lib/roots";
 import { type ScanSpec, scanFiles } from "./_lib/scan-scope";
 
-// Comment-language ratchet: no new German comments in product code. No NLP —
-// German markers are common function words or umlaut characters in the comment text.
-// Baseline mode compares per-file counts against a frozen file (more than the
-// baseline fails, fewer is allowed but does not rewrite it); `--touched` fails
-// on any German comment that overlaps a line added since `--base`.
-
 export const COMMENT_LANG_FLAGS: readonly string[] = [
   "--touched",
   "--list",
@@ -72,142 +72,11 @@ function germanCommentSite(
   };
 }
 
-// Tokens that end an operand without being identifiers or keywords.
-const OPERAND_END_PUNCTUATION_KINDS: ReadonlySet<ts.SyntaxKind> = new Set([
-  ts.SyntaxKind.NumericLiteral,
-  ts.SyntaxKind.BigIntLiteral,
-  ts.SyntaxKind.StringLiteral,
-  ts.SyntaxKind.NoSubstitutionTemplateLiteral,
-  ts.SyntaxKind.TemplateTail,
-  ts.SyntaxKind.RegularExpressionLiteral,
-  ts.SyntaxKind.CloseParenToken,
-  ts.SyntaxKind.CloseBracketToken,
-  ts.SyntaxKind.CloseBraceToken,
-  ts.SyntaxKind.PlusPlusToken,
-  ts.SyntaxKind.MinusMinusToken,
-]);
-
-// Reserved words after which an expression (so possibly a regex) starts.
-const EXPRESSION_INTRODUCING_KEYWORDS: ReadonlySet<ts.SyntaxKind> = new Set([
-  ts.SyntaxKind.ReturnKeyword,
-  ts.SyntaxKind.TypeOfKeyword,
-  ts.SyntaxKind.InstanceOfKeyword,
-  ts.SyntaxKind.InKeyword,
-  ts.SyntaxKind.CaseKeyword,
-  ts.SyntaxKind.VoidKeyword,
-  ts.SyntaxKind.DeleteKeyword,
-  ts.SyntaxKind.ThrowKeyword,
-  ts.SyntaxKind.NewKeyword,
-  ts.SyntaxKind.YieldKeyword,
-  ts.SyntaxKind.AwaitKeyword,
-  ts.SyntaxKind.ElseKeyword,
-  ts.SyntaxKind.DoKeyword,
-  ts.SyntaxKind.ExtendsKeyword,
-  ts.SyntaxKind.DefaultKeyword,
-]);
-
-function isIdentifierOrKeyword(kind: ts.SyntaxKind): boolean {
-  return (
-    kind === ts.SyntaxKind.Identifier ||
-    (kind >= ts.SyntaxKind.FirstKeyword && kind <= ts.SyntaxKind.LastKeyword)
-  );
-}
-
-// After an operand end a `/` is division, not the start of a regex literal.
-// Contextual keywords (`from`, `type`, `of`, ...) scan as keyword kinds but are
-// valid member and variable names, so every non-introducing keyword counts. A `!`
-// is the non-null postfix only when the token before it ended an operand.
-function isOperandEnd(kind: ts.SyntaxKind, previousEndedOperand: boolean): boolean {
-  if (kind === ts.SyntaxKind.ExclamationToken) return previousEndedOperand;
-  if (OPERAND_END_PUNCTUATION_KINDS.has(kind)) return true;
-  return isIdentifierOrKeyword(kind) && !EXPRESSION_INTRODUCING_KEYWORDS.has(kind);
-}
-
-const TRIVIA_KINDS: ReadonlySet<ts.SyntaxKind> = new Set([
-  ts.SyntaxKind.SingleLineCommentTrivia,
-  ts.SyntaxKind.MultiLineCommentTrivia,
-  ts.SyntaxKind.WhitespaceTrivia,
-  ts.SyntaxKind.NewLineTrivia,
-]);
-
-// The raw scanner always yields SlashToken for `/`; without the rescan a regex
-// body like /\{/ would shift braceDepth and end a template early. After an
-// operand the rescan would instead swallow `/ 2; // {` as a regex and hide the comment.
-function rescanSlashAsRegex(
-  scanner: ts.Scanner,
-  kind: ts.SyntaxKind,
-  previousEndedOperand: boolean,
-): ts.SyntaxKind {
-  if (previousEndedOperand) return kind;
-  const reScanned = scanner.reScanSlashToken();
-  return reScanned === ts.SyntaxKind.RegularExpressionLiteral ? reScanned : kind;
-}
-
-function closesTemplateSubstitution(
-  templateBraceDepths: readonly number[],
-  braceDepth: number,
-): boolean {
-  return (
-    templateBraceDepths.length > 0 &&
-    braceDepth === templateBraceDepths[templateBraceDepths.length - 1]
-  );
-}
-
-// Template substitutions can nest braces (object literals, arrow bodies, other
-// templates). The raw scanner tokenizes a `}` as a plain CloseBraceToken and
-// never resumes template mode, so reScanTemplateToken() must run once brace
-// depth returns to the level the substitution opened at.
 export function scanGermanComments(fullText: string, file: string): Site[] {
   const sites: Site[] = [];
-  const scanner = ts.createScanner(
-    ts.ScriptTarget.Latest,
-    /* skipTrivia */ false,
-    ts.LanguageVariant.Standard,
-    fullText,
-  );
-
-  const templateBraceDepths: number[] = [];
-  let braceDepth = 0;
-  let previousEndedOperand = false;
-
-  let kind = scanner.scan();
-  while (kind !== ts.SyntaxKind.EndOfFileToken) {
-    switch (kind) {
-      case ts.SyntaxKind.SingleLineCommentTrivia:
-      case ts.SyntaxKind.MultiLineCommentTrivia: {
-        const site = germanCommentSite(
-          fullText,
-          file,
-          scanner.getTokenStart(),
-          scanner.getTokenText(),
-        );
-        if (site) sites.push(site);
-        break;
-      }
-      case ts.SyntaxKind.SlashToken:
-      case ts.SyntaxKind.SlashEqualsToken:
-        kind = rescanSlashAsRegex(scanner, kind, previousEndedOperand);
-        break;
-      case ts.SyntaxKind.TemplateHead:
-      case ts.SyntaxKind.TemplateMiddle:
-        templateBraceDepths.push(braceDepth);
-        break;
-      case ts.SyntaxKind.OpenBraceToken:
-        braceDepth++;
-        break;
-      case ts.SyntaxKind.CloseBraceToken:
-        if (closesTemplateSubstitution(templateBraceDepths, braceDepth)) {
-          templateBraceDepths.pop();
-          kind = scanner.reScanTemplateToken(false);
-          continue;
-        }
-        if (braceDepth > 0) braceDepth--;
-        break;
-      default:
-        break;
-    }
-    if (!TRIVIA_KINDS.has(kind)) previousEndedOperand = isOperandEnd(kind, previousEndedOperand);
-    kind = scanner.scan();
+  for (const comment of scanCommentTrivia(fullText)) {
+    const site = germanCommentSite(fullText, file, comment.start, comment.text);
+    if (site) sites.push(site);
   }
   return sites;
 }

package/src/guard-direct-entity-writes.ts

@@ -206,10 +206,7 @@ function entityRegistrationOf(call: CallExpression): EntityRegistration | undefi
     return undefined;
   }
   const definition = call.getArguments()[0]?.asKind(SyntaxKind.ObjectLiteralExpression);
-  const nameProp = definition?.getProperty("name");
-  if (!definition || nameProp?.getKind() !== SyntaxKind.PropertyAssignment) return undefined;
-  const nameValue = nameProp.asKindOrThrow(SyntaxKind.PropertyAssignment).getInitializer();
-  if (nameValue?.getKind() !== SyntaxKind.StringLiteral) return undefined;
+  if (!definition?.getProperty("name")) return undefined;
   return {
     entityDid: spreadEntityDefinitionId(definition),
     overrideTableDid: entityTableOverrideId(definition),
@@ -601,7 +598,7 @@ function deriveCatalogs(
 }
 
 const REWRITE_CATALOGS_COMMAND =
-  'bun packages/guards/src/run-guards.ts --write-baseline --guard="Direct-Entity-Writes Guard"';
+  'bunx kumiko-guards guards --write-baseline --guard="Direct-Entity-Writes Guard"';
 
 // Published packages whose catalog exists on disk although they define no ES table any more.
 function publishedRootsWithCatalog(files: readonly SourceFile[]): Set<string> {
@@ -670,6 +667,13 @@ function writeCatalogs(files: readonly SourceFile[], esTables: ReadonlySet<Table
   }
 }
 
+const MAX_RECEIVER_TEXT_LENGTH = 60;
+
+// Function-form receivers are arbitrary expressions; keep the message on one greppable line.
+function compactReceiverText(node: Node): string {
+  return node.getText().replace(/\s+/g, "").slice(0, MAX_RECEIVER_TEXT_LENGTH);
+}
+
 export function scanDirectWrites(
   sf: SourceFile,
   esTables: ReadonlySet<TableId>,
@@ -706,7 +710,7 @@ export function scanDirectWrites(
       if (isInsideProjectionApply(call)) continue;
       out.push({
         line: call.getStartLineNumber(),
-        receiver: w.receiver.getText(),
+        receiver: compactReceiverText(w.receiver),
         op: w.op,
         table: w.tableArg.getText(),
         snippet: call.getText().slice(0, 120),
@@ -717,7 +721,7 @@ export function scanDirectWrites(
 
     out.push({
       line: call.getStartLineNumber(),
-      receiver: w.receiver.getText(),
+      receiver: compactReceiverText(w.receiver),
       op: w.op,
       table: w.tableArg.getText(),
       snippet: call.getText().slice(0, 120),
@@ -727,6 +731,13 @@ export function scanDirectWrites(
   return out;
 }
 
+type DirectWriteViolation = {
+  file: string;
+  line: number;
+  message: string;
+  neverFrozen?: boolean;
+};
+
 export const guard: AstGuard = {
   name: "Direct-Entity-Writes Guard",
   scan: SCAN,
@@ -738,40 +749,18 @@ export const guard: AstGuard = {
     // Merge all collections BEFORE the empty-set check — otherwise a repo that only uses r.entity
     // would skip every scan: the canary fires falsely and writes on entity tables go undetected.
     const esTables = collectScopeEsTables(files);
-    if (esTables.size === 0) {
-      // An empty set means either the repo has no event store at all, or the
-      // scan lost the ES definitions while table writes are still present.
-      if (!hasAnyTableWriteOrDeclaration(files)) return { violations: [] };
-      return {
-        violations: [
-          {
-            file: "<scan>",
-            line: 0,
-            message:
-              "BLOCKED: guard found table writes or table declarations but no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
-          },
-        ],
-      };
-    }
-
-    const violations: Array<{
-      file: string;
-      line: number;
-      message: string;
-      neverFrozen?: boolean;
-    }> = catalogViolations(files, esTables);
-
     const firstFile = files[0];
     const externalEsTables = firstFile
       ? createExternalEsTables(firstFile.getProject())
       : { has: () => false };
 
+    const writeViolations: DirectWriteViolation[] = [];
     for (const sf of files) {
       const file = sf.getFilePath();
       if (EXCLUDE.test(file)) continue;
 
       for (const hit of scanDirectWrites(sf, esTables, externalEsTables)) {
-        violations.push({
+        writeViolations.push({
           file: path.relative(ROOT, file),
           line: hit.line,
           message: `[${hit.kind}] ${hit.receiver}.${hit.op}(${hit.table}) — ${hit.snippet}`,
@@ -779,6 +768,29 @@ export const guard: AstGuard = {
       }
     }
 
+    if (esTables.size === 0) {
+      // Writes on catalog tables of installed packages are real findings even without own ES tables.
+      if (writeViolations.length > 0) return { violations: writeViolations };
+      // An empty set means either the repo has no event store at all, or the
+      // scan lost the ES definitions while table writes are still present.
+      if (!hasAnyTableWriteOrDeclaration(files)) return { violations: [] };
+      return {
+        violations: [
+          {
+            file: "<scan>",
+            line: 0,
+            message:
+              "BLOCKED: guard found table writes or table declarations but no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
+          },
+        ],
+      };
+    }
+
+    const violations: DirectWriteViolation[] = [
+      ...catalogViolations(files, esTables),
+      ...writeViolations,
+    ];
+
     return { violations };
   },
   writeBaseline(files) {

package/src/guard-direct-fetch.ts

@@ -3,7 +3,7 @@
  * Guard: finds raw `fetch(` calls in server code outside the client-scoped
  * exceptions.
  *
- * `egress(policy)` (@cosmicdrift/kumiko-framework/http, framework#2147) is
+ * `egress(policy)` (@cosmicdrift/kumiko-framework/http) is
  * the single exported way for server code to speak outward — it enforces an
  * SSRF policy (external/internal/tenant-supplied) at the call site instead
  * of leaving that to convention. This guard fails on raw `fetch(` in server
@@ -45,7 +45,7 @@ const EXCLUDE =
   /(__tests__|\.test\.ts$|\.integration\.ts$|\.d\.ts$|(?:^|\/)web\/|(?:^|\/)public\/)/;
 
 // Prefixed by RepoRoot.name (not kind): kind "app" is shared across
-// unregistered repos (infra#560).
+// unregistered repos.
 
 // packages/framework/src/http/egress.ts IS the egress() implementation.
 const ALLOWLIST = [/^kumiko-framework\/packages\/framework\/src\/http\/egress\.ts$/];
@@ -59,7 +59,7 @@ interface Violation {
 }
 
 // `self` omitted: Worker globals live under web/public (excluded); a local
-// `const self = this` binding was a systematic FP (infra#582).
+// `const self = this` binding was a systematic FP.
 const GLOBAL_FETCH_RECEIVERS = new Set(["globalThis", "window"]);
 
 // The marker is a per-line skip for a security guard, so it only counts with a

package/src/guard-feature-integration-tests.ts

@@ -115,7 +115,7 @@ function collectImportedFeatureIds(project: Project, roots: readonly RepoRoot[])
 }
 
 /**
- * Baseline from the infra#436 measurement: features with no integration
+ * Baseline from the measurement: features with no integration
  * test reaching their directory at all — only covered (if at all) by unit
  * tests (`feature.test.ts`). Pre-existing at the first sharp run, not
  * introduced by this change. Backfilling is its own scope per feature, not

package/src/guard-file-size.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 /**
- * File Size Guard — production files above 2000 lines are frozen in
+ * File Size Guard — production files above 1200 lines are frozen in
  * `.kumiko-file-size-baseline.json` (key = file, value = line count) and may
  * not grow; a new file above the threshold is a violation. Without a baseline
  * file (consumer repos) it only warns.
@@ -31,7 +31,7 @@ const SCAN: ScanSpec = {
   frameworkWithin: ["packages/*/src/**"],
 };
 
-export const MAX_FILE_LINES = 2000;
+export const MAX_FILE_LINES = 1200;
 
 const EXCLUDE =
   /(__tests__|\.test\.(ts|tsx)$|\.integration\.(ts|tsx)$|\.d\.(ts|tsx)$|\.generated\.(ts|tsx)$|\/generated\/|\/locale-[^/]+\/src\/strings\.ts$)/;

package/src/guard-i18n-locale-mount.ts

@@ -6,7 +6,7 @@
  * guard-i18n-keys.ts only checks whether a used t() key is defined —
  * and has no concept of a "mount point". A mount that never calls
  * localeDeClient() (client) or localeDe() (server) slips through there
- * completely (kumiko-studio#191, publicstatus#365, infra#533).
+ * completely.
  *
  * Scope gate: the package.json closest to the file must point at
  * kumiko-locale-de (currently kumiko-studio, publicstatus, solon,
@@ -83,9 +83,9 @@ function gateFor(sf: SourceFile, cache: Map<string, Gate>): Gate | undefined {
   return gate;
 }
 
-// localeDeClient() (clientFeatures) matcht per Call-Text; `{ de: ... }` deckt
-// die rohe <LocaleProvider fallbackBundles={[{ de: bundle }, ...]}>-Komposition
-// ab, die keinen localeDeClient()-Call verwendet.
+// localeDeClient() in clientFeatures is matched by call text; `{ de: ... }` also
+// covers a raw <LocaleProvider fallbackBundles={[{ de: bundle }, ...]}> composition
+// that does not use a localeDeClient() call.
 function localeDeClientRef(node: Node): boolean {
   if (node.isKind(SyntaxKind.Identifier) && node.getText() === "localeDeClient") return true;
   if (node.isKind(SyntaxKind.CallExpression)) return localeDeClientRef(node.getExpression());

package/src/guard-i18n-locale-terminology.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 /**
- * Guard: locale bundle values must follow Mandant/Organización terminology (#2200, fw#2355).
+ * Guard: locale bundle values must follow Mandant/Organización terminology.
  *
  * German UI copy always says "Mandant" (never "Tenant"/"Organisation"); Spanish, French
  * and Italian always say "Organización"/"organisation"/"organizzazione" (never the
@@ -50,8 +50,8 @@ const RULES: Record<TerminologyLocale, LocaleRule> = {
   de: {
     preferred: "Mandant",
     // Tenants? covers plural; Organisation(en|s)? without trailing \b so
-    // compounds like Organisations-ID / Organisationsstruktur still match
-    // (infra#603). TenantAdmin stays safe: \b after Tenant fails on 'A'.
+    // compounds like Organisations-ID / Organisationsstruktur still match.
+    // TenantAdmin stays safe: \b after Tenant fails on 'A'.
     forbidden: [/\bTenants?\b/i, /\bOrganisation(en|s)?/i],
   },
   es: {

package/src/guard-i18n-ui-strings.ts

@@ -4,7 +4,7 @@
 // that the keys are defined — this guard closes the gap before that:
 // strings that never became keys, e.g. "Loading tenants…").
 //
-// Part of App-Mounting 2.0 (infra#208).
+// Part of App-Mounting 2.0.
 
 import { type CallExpression, type Node, type SourceFile, SyntaxKind } from "ts-morph";
 import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
@@ -13,7 +13,7 @@ import { hasIgnoreTag } from "./_lib/ignore-tag";
 // Web/public code only — server code (handler error texts) goes through the
 // error i18n pipeline and has its own guards.
 //
-// samples/ deliberately NOT scanned (tried in infra#478, rolled back): the
+// samples/ deliberately NOT scanned (tried and rolled back): the
 // showcase/gallery pages are dev docs about the framework API itself
 // ("Form.title / toolbarTitle", "children — auto from schema.navs"), not
 // app UI text a real user sees. 354 hits in the trial run, almost all such
@@ -21,7 +21,7 @@ import { hasIgnoreTag } from "./_lib/ignore-tag";
 // r.translations definitions); this guard stays scoped to app repos.
 //
 // src/features/**/feature.ts covers feature.ts registrar calls (r.nav/r.screen
-// object-literal arguments) — infra#504: those sit outside JSX and were a
+// object-literal arguments) — those sit outside JSX and were a
 // blind spot. Other server code (handlers/, lib/) has its own i18n pipeline
 // and is filtered out below by requiring an r.*-call ancestor.
 const SCAN: ScanSpec = {
@@ -131,7 +131,7 @@ function collectTernaryLogicText(node: Node): TextPiece[] {
   return textPieces(node);
 }
 
-// infra#711: a hop out of a helper is only taken while that helper call is
+// A hop out of a helper is only taken while that helper call is
 // itself an argument of the next call — a call nested deeper (inside an object
 // or array, e.g. `createTextField({ label })` under `createEntity({ fields })`)
 // builds a value instead of forwarding the registrar's argument. The full chain
@@ -220,7 +220,7 @@ function checkRegistrarLabelProperties(sf: SourceFile, violations: GuardViolatio
     if (!HUMAN_TEXT.test(value) || I18N_KEY_SHAPE.test(value)) continue;
     const callChain = registrarCallChain(prop);
     if (callChain === undefined) continue;
-    // The agent-doc slot (kumiko-framework#2615) is LLM metadata for the
+    // The agent-doc slot is LLM metadata for the
     // AI tool catalog: English by design, never rendered as UI text. The
     // slot is the options object handed to a call on the registrar
     // argument chain, so forwarding it through a `defineEntity*Handler`

package/src/guard-import-extensions.ts

@@ -14,7 +14,8 @@
  * Exit 1 on violations, 0 when clean.
  */
 
-import { type Node, type SourceFile, SyntaxKind } from "ts-morph";
+import { dirname, resolve } from "node:path";
+import { Node, type SourceFile, SyntaxKind } from "ts-morph";
 import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 
 const SCAN: ScanSpec = {
@@ -23,7 +24,7 @@ const SCAN: ScanSpec = {
 };
 
 const EXCLUDE = /(\.d\.ts$|\/fixtures\/)/;
-const RELATIVE_JS_SPECIFIER = /^\.{1,2}\/.*\.jsx?$/;
+const RELATIVE_JS_SPECIFIER = /^(\.{1,2}\/.*)\.(jsx?)$/;
 // A published bin that imports its own build output (`../dist/cli.js`) has no
 // `.ts` sibling to name; the `.js` there is the only file that exists.
 const BUILD_OUTPUT_SEGMENT = /(^|\/)dist\//;
@@ -33,17 +34,34 @@ interface Finding {
   readonly specifier: string;
 }
 
-function relativeJsSpecifier(node: Node | undefined): string | undefined {
-  const literal = node?.asKind(SyntaxKind.StringLiteral);
-  const value = literal?.getLiteralValue();
-  if (value === undefined || !RELATIVE_JS_SPECIFIER.test(value)) return undefined;
-  return BUILD_OUTPUT_SEGMENT.test(value) ? undefined : value;
+// Mirrors the import-extensions codemod: only a specifier with a `.ts`/`.tsx` sibling is fixable.
+// A genuine `.js` file (generated or vendored) has nothing to rename to and must not fail the guard.
+function hasSourceSibling(sf: SourceFile, base: string, extension: string): boolean {
+  const candidates = extension === "jsx" ? ["tsx"] : ["ts", "tsx"];
+  const project = sf.getProject();
+  return candidates.some((candidate) => {
+    const path = resolve(dirname(sf.getFilePath()), `${base}.${candidate}`);
+    return (
+      project.getSourceFile(path) !== undefined || project.getFileSystem().fileExistsSync(path)
+    );
+  });
+}
+
+function relativeJsSpecifier(sf: SourceFile, node: Node | undefined): string | undefined {
+  const value =
+    node !== undefined && (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node))
+      ? node.getLiteralValue()
+      : undefined;
+  if (value === undefined || BUILD_OUTPUT_SEGMENT.test(value)) return undefined;
+  const [, base = "", extension = ""] = RELATIVE_JS_SPECIFIER.exec(value) ?? [];
+  if (base === "" || !hasSourceSibling(sf, base, extension)) return undefined;
+  return value;
 }
 
 function findJsSpecifiers(sf: SourceFile): Finding[] {
   const findings: Finding[] = [];
   const add = (node: Node | undefined): void => {
-    const specifier = relativeJsSpecifier(node);
+    const specifier = relativeJsSpecifier(sf, node);
     if (node !== undefined && specifier !== undefined) {
       findings.push({ line: node.getStartLineNumber(), specifier });
     }
@@ -51,8 +69,15 @@ function findJsSpecifiers(sf: SourceFile): Finding[] {
   for (const declaration of [...sf.getImportDeclarations(), ...sf.getExportDeclarations()]) {
     add(declaration.getModuleSpecifier());
   }
+  for (const importType of sf.getDescendantsOfKind(SyntaxKind.ImportType)) {
+    const argument = importType.getArgument();
+    if (Node.isLiteralTypeNode(argument)) add(argument.getLiteral());
+  }
   for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    if (call.getExpression().getKind() === SyntaxKind.ImportKeyword) add(call.getArguments()[0]);
+    const callee = call.getExpression();
+    if (callee.getKind() === SyntaxKind.ImportKeyword || callee.getText() === "mock.module") {
+      add(call.getArguments()[0]);
+    }
   }
   return findings;
 }

package/src/guard-no-custom-primitives.ts

@@ -4,7 +4,7 @@
 // exist in the framework (usePrimitives() resp. widgets/) — app rebuilds
 // drift visually and cost every migration twice.
 //
-// Second rule (infra#748): raw form HTML (<input>/<select>/<textarea>/
+// Second rule: raw form HTML (<input>/<select>/<textarea>/
 // <label>) in app/feature web code, regardless of what the file imports —
 // an import gate here previously let the designer's raw <input>s pass just
 // by importing from @cosmicdrift/kumiko-renderer (types only) instead of
@@ -15,8 +15,6 @@
 // closed against an empty baseline while no baseline file exists —
 // otherwise the rule would stay silent in every app repo until someone
 // manually runs --write-baseline there.
-//
-// Part of App-Mounting 2.0 (infra#208).
 
 import { existsSync } from "node:fs";
 import * as path from "node:path";
@@ -93,7 +91,7 @@ const RAW_FORM_HTML_REMEDIATION =
   `or usePrimitives(). Real exception: // ${IGNORE_TAG} <reason>`;
 
 // The rule is new: measured backlog is 0 in every locally checked repo
-// (infra#748). Without a baseline file, check fail-closed against an empty
+// . Without a baseline file, check fail-closed against an empty
 // baseline instead of (as usual) warn-only until the first
 // `--write-baseline` — otherwise the rule would stay silent in every app
 // repo until it separately commits its own baseline file (every baseline

package/src/guard-no-direct-fs.ts

@@ -90,7 +90,7 @@ const ALLOWLIST: readonly AllowEntry[] = [
   // Framework: migrations/schema tooling, DB codegen, boot validator —
   // CLI/build time, no request input.
   { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/migrations\/kumiko-drift\.ts$/ },
-  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/schema-cli\.ts$/ },
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/schema-cli(\.ts|\/[^/]+\.ts)$/ },
   // same CLI-tooling pattern as schema-cli.ts — repo-tree/node_modules walking for the upgrade command, not app-level file storage
   { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/upgrade-cli\.ts$/ },
   { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/es-ops\/runner\.ts$/ },

package/src/guard-no-direct-process-env.ts

@@ -59,7 +59,7 @@ export function isScannableBinFile(rel: string): boolean {
 // convention at all — "solon" is deliberately not on it) and intersected
 // with the resolved roots, so a restricted scope actually narrows what this
 // guard scans instead of always walking every repo regardless of scope
-// (infra#721 follow-up — a money-horse-scoped push must not fail on a
+// (follow-up — a money-horse-scoped push must not fail on a
 // finding in publicstatus).
 const CANDIDATE_ENV_TS_REPOS: ReadonlySet<string> = new Set([
   "kumiko-studio",
@@ -81,7 +81,7 @@ export function findDirectProcessEnv(roots?: ReadonlyArray<RepoRoot>): ProcessEn
 /**
  * Like findDirectProcessEnv, additionally reports the number of files read
  * and repos with bin/env.ts — without that an empty scan can't be told apart
- * from a clean one (infra#433).
+ * from a clean one.
  */
 export function scanDirectProcessEnv(roots: ReadonlyArray<RepoRoot> = resolveRepoRoots()): {
   readonly findings: ProcessEnvFinding[];

package/src/guard-no-inline-styles.ts

@@ -2,7 +2,7 @@
 // No inline CSS in app code: `style={...}` props and `React.CSSProperties`
 // style objects bypass theme tokens and dark mode. Use widgets/tokens.
 //
-// Part of App-Mounting 2.0 (infra#208).
+// Part of App-Mounting 2.0.
 
 import { type SourceFile, SyntaxKind } from "ts-morph";
 import {

package/src/guard-no-raw-hooks.ts

@@ -7,8 +7,6 @@
 // pattern that produces them.
 //
 // Local UI state via useState stays allowed.
-//
-// Part of App-Mounting 2.0 (infra#208).
 
 import { Node, type SourceFile, SyntaxKind } from "ts-morph";
 import {

package/src/guard-primitives-discipline.ts

@@ -96,7 +96,7 @@ type ScanScope = {
 
 // Framework checkout enforces bundled-features + samples. App-repo checkout
 // scans the app's web/ screens — primitives-discipline as a ratchet per app
-// repo (infra#224). Every other resolved repo (enterprise, platform, ...)
+// repo. Every other resolved repo (enterprise, platform, ...)
 // scans alongside the others in one run — flatMap all of them instead of
 // cascading, which would silently skip every root after the first, exactly
 // the silent-skip this guard fixes.

package/src/guard-public-exports-changelog.ts

@@ -1,11 +1,3 @@
-import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { Project } from "ts-morph";
-import { cliFlagsError, type GuardViolation, reportResults } from "./_lib/guard-kit";
-import { frameworkTsConfigPath, resolveRepoRoots } from "./_lib/roots";
-
 // Public exports of packages/framework and packages/bundled-features must not
 // disappear (rename/removal) without a breaking changelog entry.
 //
@@ -30,6 +22,14 @@ import { frameworkTsConfigPath, resolveRepoRoots } from "./_lib/roots";
 // has ONE changelog (src/changes.json); packages/bundled-features has one PER
 // FEATURE (src/<feature>/changes.json, feature = first export-key segment).
 
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { Project } from "ts-morph";
+import { cliFlagsError, type GuardViolation, reportResults } from "./_lib/guard-kit";
+import { frameworkTsConfigPath, resolveRepoRoots } from "./_lib/roots";
+
 export const PUBLIC_EXPORTS_CHANGELOG_FLAGS: readonly string[] = [
   "--write-baseline",
   "--no-baseline",

package/src/guard-raw-classname.ts

@@ -5,7 +5,7 @@
 // Layout utilities (flex/grid/gap/p-/m-/w-) and token classes
 // (bg-primary, text-status-ok, …) stay allowed.
 //
-// Part of App-Mounting 2.0 (infra#208). Enabled per app repo in the
+// Part of App-Mounting 2.0. Enabled per app repo in the
 // respective migration PR (ui-guards input in _app-test.yml).
 
 import { type JsxAttribute, type SourceFile, SyntaxKind } from "ts-morph";