@cosmicdrift/kumiko-guards 0.387.0 → 0.388.0

package/src/guard-app-feature-structure.ts

@@ -116,6 +116,8 @@ function checkCustomScreens(sf: SourceFile, violations: GuardViolation[]): void
 const DIRECTIVE_HEAD_CHARS = 600;
 const FEATURE_RELATIVE_PATH = /(?:src\/features|packages\/bundled-features\/src)\/[^/]+\/(.+)$/;
 
+const PATH_IMPLIED_RUNTIME_DIRS = ["dev/", "scripts/"];
+
 // 4. runtime-client marker instead of the path
 function clientMarkerViolation(sf: SourceFile): GuardViolation | undefined {
   const filePath = sf.getFilePath();
@@ -125,13 +127,13 @@ function clientMarkerViolation(sf: SourceFile): GuardViolation | undefined {
     directiveInHead(sf.getFullText().slice(0, DIRECTIVE_HEAD_CHARS)) === "client";
   if (!hasClientMarker || isIgnoredFile(sf)) return undefined;
   const underWeb = featureRelative.startsWith("web/") || /^web\.tsx?$/.test(featureRelative);
-  return {
-    file: filePath,
-    line: 1,
-    message: underWeb
-      ? "redundant @runtime client marker — files under web/ are client by path"
-      : "client code outside web/ — move it under web/ (bun kumiko codemod feature-layout . --write)",
-  };
+  const runtimeFromPath = PATH_IMPLIED_RUNTIME_DIRS.some((dir) => featureRelative.startsWith(dir));
+  const message = underWeb
+    ? "redundant @runtime client marker — files under web/ are client by path"
+    : runtimeFromPath
+      ? "@runtime client marker under dev/ or scripts/ — the path already sets the runtime; remove the marker (bun kumiko codemod feature-layout . --write)"
+      : "client code outside web/ — move it under web/ (bun kumiko codemod feature-layout . --write)";
+  return { file: filePath, line: 1, message };
 }
 
 export const guard: AstGuard = {

package/src/guard-comment-issue-ref-only.ts

@@ -42,11 +42,13 @@ const EXCLUDE = /(\.d\.(ts|tsx)$|\/dist\/)/;
 
 // `fw#12`, `#1234`, `kumiko-framework#3`, `oven-sh/bun#5`; `'` is an HTML entity.
 const REFERENCE_RE = /(?<!&)[\w./-]*#\d+(?![\w])/g;
+// Not preceded by a path/word character and not followed by `/`, `-` or `.ext`, so file names such
+// as `round2.ts` or `phase1.sql` are not planning labels, while a sentence-final "Phase 2." is.
 const PLANNING_WORD_RE =
-  /\b(?:phase|round|welle|wave|sprint)[- ]?\d+(?:\.\d+)*[a-z]?\b|\bbug-bash(?:[- ]\d+)?\b/gi;
+  /(?<![\w./-])(?:phase|round|welle|wave|sprint)[- ]?\d+(?:\.\d+)*[a-z]?(?![\w/-]|\.\w)|(?<![\w./-])bug-bash(?:[- ]\d+)?(?![\w/-]|\.\w)/gi;
 // Dotted plan labels such as S2.H1, T1.5c, B1.5. Case-sensitive and without V so
 // that version numbers (v1.2, V20.1) never count.
-const DOTTED_LABEL_RE = /\b[A-UW-Z]\d{1,2}(?:\.(?:\d+[a-z]?|[A-Z]\d+))+\b/g;
+const DOTTED_LABEL_RE = /(?<![\w./-])[A-UW-Z]\d{1,2}(?:\.(?:\d+[a-z]?|[A-Z]\d+))+\b/g;
 const WORD_RE = /[\p{L}_$][\p{L}\p{N}_$'-]*/gu;
 const MIN_EXPLANATORY_WORD_LENGTH = 3;
 

package/src/guard-comment-lang.ts

@@ -1,3 +1,9 @@
+// Comment-language ratchet: no new German comments in product code. No NLP —
+// German markers are common function words or umlaut characters in the comment text.
+// Baseline mode compares per-file counts against a frozen file (more than the
+// baseline fails, fewer is allowed but does not rewrite it); `--touched` fails
+// on any German comment that overlaps a line added since `--base`.
+
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
 import { scanCommentTrivia } from "./_lib/comment-trivia";
@@ -8,12 +14,6 @@ import { resolvePushRepoRoot } from "./_lib/push-root";
 import { resolveRepoRoots } from "./_lib/roots";
 import { type ScanSpec, scanFiles } from "./_lib/scan-scope";
 
-// Comment-language ratchet: no new German comments in product code. No NLP —
-// German markers are common function words or umlaut characters in the comment text.
-// Baseline mode compares per-file counts against a frozen file (more than the
-// baseline fails, fewer is allowed but does not rewrite it); `--touched` fails
-// on any German comment that overlaps a line added since `--base`.
-
 export const COMMENT_LANG_FLAGS: readonly string[] = [
   "--touched",
   "--list",

package/src/guard-direct-entity-writes.ts

@@ -206,10 +206,7 @@ function entityRegistrationOf(call: CallExpression): EntityRegistration | undefi
     return undefined;
   }
   const definition = call.getArguments()[0]?.asKind(SyntaxKind.ObjectLiteralExpression);
-  const nameProp = definition?.getProperty("name");
-  if (!definition || nameProp?.getKind() !== SyntaxKind.PropertyAssignment) return undefined;
-  const nameValue = nameProp.asKindOrThrow(SyntaxKind.PropertyAssignment).getInitializer();
-  if (nameValue?.getKind() !== SyntaxKind.StringLiteral) return undefined;
+  if (!definition?.getProperty("name")) return undefined;
   return {
     entityDid: spreadEntityDefinitionId(definition),
     overrideTableDid: entityTableOverrideId(definition),
@@ -601,7 +598,7 @@ function deriveCatalogs(
 }
 
 const REWRITE_CATALOGS_COMMAND =
-  'bun packages/guards/src/run-guards.ts --write-baseline --guard="Direct-Entity-Writes Guard"';
+  'bunx kumiko-guards guards --write-baseline --guard="Direct-Entity-Writes Guard"';
 
 // Published packages whose catalog exists on disk although they define no ES table any more.
 function publishedRootsWithCatalog(files: readonly SourceFile[]): Set<string> {
@@ -670,6 +667,13 @@ function writeCatalogs(files: readonly SourceFile[], esTables: ReadonlySet<Table
   }
 }
 
+const MAX_RECEIVER_TEXT_LENGTH = 60;
+
+// Function-form receivers are arbitrary expressions; keep the message on one greppable line.
+function compactReceiverText(node: Node): string {
+  return node.getText().replace(/\s+/g, "").slice(0, MAX_RECEIVER_TEXT_LENGTH);
+}
+
 export function scanDirectWrites(
   sf: SourceFile,
   esTables: ReadonlySet<TableId>,
@@ -706,7 +710,7 @@ export function scanDirectWrites(
       if (isInsideProjectionApply(call)) continue;
       out.push({
         line: call.getStartLineNumber(),
-        receiver: w.receiver.getText(),
+        receiver: compactReceiverText(w.receiver),
         op: w.op,
         table: w.tableArg.getText(),
         snippet: call.getText().slice(0, 120),
@@ -717,7 +721,7 @@ export function scanDirectWrites(
 
     out.push({
       line: call.getStartLineNumber(),
-      receiver: w.receiver.getText(),
+      receiver: compactReceiverText(w.receiver),
       op: w.op,
       table: w.tableArg.getText(),
       snippet: call.getText().slice(0, 120),
@@ -727,6 +731,13 @@ export function scanDirectWrites(
   return out;
 }
 
+type DirectWriteViolation = {
+  file: string;
+  line: number;
+  message: string;
+  neverFrozen?: boolean;
+};
+
 export const guard: AstGuard = {
   name: "Direct-Entity-Writes Guard",
   scan: SCAN,
@@ -738,40 +749,18 @@ export const guard: AstGuard = {
     // Merge all collections BEFORE the empty-set check — otherwise a repo that only uses r.entity
     // would skip every scan: the canary fires falsely and writes on entity tables go undetected.
     const esTables = collectScopeEsTables(files);
-    if (esTables.size === 0) {
-      // An empty set means either the repo has no event store at all, or the
-      // scan lost the ES definitions while table writes are still present.
-      if (!hasAnyTableWriteOrDeclaration(files)) return { violations: [] };
-      return {
-        violations: [
-          {
-            file: "<scan>",
-            line: 0,
-            message:
-              "BLOCKED: guard found table writes or table declarations but no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
-          },
-        ],
-      };
-    }
-
-    const violations: Array<{
-      file: string;
-      line: number;
-      message: string;
-      neverFrozen?: boolean;
-    }> = catalogViolations(files, esTables);
-
     const firstFile = files[0];
     const externalEsTables = firstFile
       ? createExternalEsTables(firstFile.getProject())
       : { has: () => false };
 
+    const writeViolations: DirectWriteViolation[] = [];
     for (const sf of files) {
       const file = sf.getFilePath();
       if (EXCLUDE.test(file)) continue;
 
       for (const hit of scanDirectWrites(sf, esTables, externalEsTables)) {
-        violations.push({
+        writeViolations.push({
           file: path.relative(ROOT, file),
           line: hit.line,
           message: `[${hit.kind}] ${hit.receiver}.${hit.op}(${hit.table}) — ${hit.snippet}`,
@@ -779,6 +768,29 @@ export const guard: AstGuard = {
       }
     }
 
+    if (esTables.size === 0) {
+      // Writes on catalog tables of installed packages are real findings even without own ES tables.
+      if (writeViolations.length > 0) return { violations: writeViolations };
+      // An empty set means either the repo has no event store at all, or the
+      // scan lost the ES definitions while table writes are still present.
+      if (!hasAnyTableWriteOrDeclaration(files)) return { violations: [] };
+      return {
+        violations: [
+          {
+            file: "<scan>",
+            line: 0,
+            message:
+              "BLOCKED: guard found table writes or table declarations but no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
+          },
+        ],
+      };
+    }
+
+    const violations: DirectWriteViolation[] = [
+      ...catalogViolations(files, esTables),
+      ...writeViolations,
+    ];
+
     return { violations };
   },
   writeBaseline(files) {

package/src/guard-file-size.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 /**
- * File Size Guard — production files above 2000 lines are frozen in
+ * File Size Guard — production files above 1200 lines are frozen in
  * `.kumiko-file-size-baseline.json` (key = file, value = line count) and may
  * not grow; a new file above the threshold is a violation. Without a baseline
  * file (consumer repos) it only warns.
@@ -31,7 +31,7 @@ const SCAN: ScanSpec = {
   frameworkWithin: ["packages/*/src/**"],
 };
 
-export const MAX_FILE_LINES = 2000;
+export const MAX_FILE_LINES = 1200;
 
 const EXCLUDE =
   /(__tests__|\.test\.(ts|tsx)$|\.integration\.(ts|tsx)$|\.d\.(ts|tsx)$|\.generated\.(ts|tsx)$|\/generated\/|\/locale-[^/]+\/src\/strings\.ts$)/;

package/src/guard-import-extensions.ts

@@ -14,7 +14,8 @@
  * Exit 1 on violations, 0 when clean.
  */
 
-import { type Node, type SourceFile, SyntaxKind } from "ts-morph";
+import { dirname, resolve } from "node:path";
+import { Node, type SourceFile, SyntaxKind } from "ts-morph";
 import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 
 const SCAN: ScanSpec = {
@@ -23,7 +24,7 @@ const SCAN: ScanSpec = {
 };
 
 const EXCLUDE = /(\.d\.ts$|\/fixtures\/)/;
-const RELATIVE_JS_SPECIFIER = /^\.{1,2}\/.*\.jsx?$/;
+const RELATIVE_JS_SPECIFIER = /^(\.{1,2}\/.*)\.(jsx?)$/;
 // A published bin that imports its own build output (`../dist/cli.js`) has no
 // `.ts` sibling to name; the `.js` there is the only file that exists.
 const BUILD_OUTPUT_SEGMENT = /(^|\/)dist\//;
@@ -33,17 +34,34 @@ interface Finding {
   readonly specifier: string;
 }
 
-function relativeJsSpecifier(node: Node | undefined): string | undefined {
-  const literal = node?.asKind(SyntaxKind.StringLiteral);
-  const value = literal?.getLiteralValue();
-  if (value === undefined || !RELATIVE_JS_SPECIFIER.test(value)) return undefined;
-  return BUILD_OUTPUT_SEGMENT.test(value) ? undefined : value;
+// Mirrors the import-extensions codemod: only a specifier with a `.ts`/`.tsx` sibling is fixable.
+// A genuine `.js` file (generated or vendored) has nothing to rename to and must not fail the guard.
+function hasSourceSibling(sf: SourceFile, base: string, extension: string): boolean {
+  const candidates = extension === "jsx" ? ["tsx"] : ["ts", "tsx"];
+  const project = sf.getProject();
+  return candidates.some((candidate) => {
+    const path = resolve(dirname(sf.getFilePath()), `${base}.${candidate}`);
+    return (
+      project.getSourceFile(path) !== undefined || project.getFileSystem().fileExistsSync(path)
+    );
+  });
+}
+
+function relativeJsSpecifier(sf: SourceFile, node: Node | undefined): string | undefined {
+  const value =
+    node !== undefined && (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node))
+      ? node.getLiteralValue()
+      : undefined;
+  if (value === undefined || BUILD_OUTPUT_SEGMENT.test(value)) return undefined;
+  const [, base = "", extension = ""] = RELATIVE_JS_SPECIFIER.exec(value) ?? [];
+  if (base === "" || !hasSourceSibling(sf, base, extension)) return undefined;
+  return value;
 }
 
 function findJsSpecifiers(sf: SourceFile): Finding[] {
   const findings: Finding[] = [];
   const add = (node: Node | undefined): void => {
-    const specifier = relativeJsSpecifier(node);
+    const specifier = relativeJsSpecifier(sf, node);
     if (node !== undefined && specifier !== undefined) {
       findings.push({ line: node.getStartLineNumber(), specifier });
     }
@@ -51,8 +69,15 @@ function findJsSpecifiers(sf: SourceFile): Finding[] {
   for (const declaration of [...sf.getImportDeclarations(), ...sf.getExportDeclarations()]) {
     add(declaration.getModuleSpecifier());
   }
+  for (const importType of sf.getDescendantsOfKind(SyntaxKind.ImportType)) {
+    const argument = importType.getArgument();
+    if (Node.isLiteralTypeNode(argument)) add(argument.getLiteral());
+  }
   for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-    if (call.getExpression().getKind() === SyntaxKind.ImportKeyword) add(call.getArguments()[0]);
+    const callee = call.getExpression();
+    if (callee.getKind() === SyntaxKind.ImportKeyword || callee.getText() === "mock.module") {
+      add(call.getArguments()[0]);
+    }
   }
   return findings;
 }

package/src/guard-no-direct-fs.ts

@@ -90,7 +90,7 @@ const ALLOWLIST: readonly AllowEntry[] = [
   // Framework: migrations/schema tooling, DB codegen, boot validator —
   // CLI/build time, no request input.
   { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/migrations\/kumiko-drift\.ts$/ },
-  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/schema-cli\.ts$/ },
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/schema-cli(\.ts|\/[^/]+\.ts)$/ },
   // same CLI-tooling pattern as schema-cli.ts — repo-tree/node_modules walking for the upgrade command, not app-level file storage
   { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/upgrade-cli\.ts$/ },
   { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/es-ops\/runner\.ts$/ },

package/src/guard-public-exports-changelog.ts

@@ -1,11 +1,3 @@
-import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { Project } from "ts-morph";
-import { cliFlagsError, type GuardViolation, reportResults } from "./_lib/guard-kit";
-import { frameworkTsConfigPath, resolveRepoRoots } from "./_lib/roots";
-
 // Public exports of packages/framework and packages/bundled-features must not
 // disappear (rename/removal) without a breaking changelog entry.
 //
@@ -30,6 +22,14 @@ import { frameworkTsConfigPath, resolveRepoRoots } from "./_lib/roots";
 // has ONE changelog (src/changes.json); packages/bundled-features has one PER
 // FEATURE (src/<feature>/changes.json, feature = first export-key segment).
 
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { Project } from "ts-morph";
+import { cliFlagsError, type GuardViolation, reportResults } from "./_lib/guard-kit";
+import { frameworkTsConfigPath, resolveRepoRoots } from "./_lib/roots";
+
 export const PUBLIC_EXPORTS_CHANGELOG_FLAGS: readonly string[] = [
   "--write-baseline",
   "--no-baseline",

package/src/guard-renderer-boundaries.ts

@@ -11,6 +11,9 @@
  * emits SVG strings and the live dispatcher is a fetch client, so the symbol and JSX-tag rules would be noise there. They stay free
  * of react-dom, jsdom and any import of `src/web`.
  *
+ * `headless` additionally may not import react, the renderer root or anything outside its own
+ * folder (server/mail bundles import it); the shared layer may not import `live`.
+ *
  * Deliberately simple: a regex scan over the source text. False positives
  * (e.g. "window" in a string literal) are possible but rare — the guard is a
  * maintenance alarm, not a semantic proof.
@@ -41,6 +44,24 @@ const FORBIDDEN_IMPORTS = [
   /from ["']@cosmicdrift\/kumiko-dispatcher-live["']/,
 ];
 
+// `headless` is consumed server-side (prod bundle, mail HTML): it must stay free of React and of
+// the shared layer, so it may only import itself and third-party packages other than react.
+const HEADLESS_FORBIDDEN_IMPORTS = [
+  /from ["']react(?:\/.*)?["']/,
+  /from ["']@cosmicdrift\/kumiko-renderer(?:\/(?!headless(?:["'/]))[^"']*)?["']/,
+];
+
+// The fetch/document.cookie dispatcher client belongs to consumers of `live`, not the shared layer.
+const SHARED_FORBIDDEN_IMPORTS = [
+  /from ["'](?:\.\.?\/)+live(?:\/.*)?["']/,
+  /from ["']@cosmicdrift\/kumiko-renderer\/live(?:\/.*)?["']/,
+];
+
+// dev-console.ts is a dependency-free console wrapper, safe in server bundles.
+const HEADLESS_ALLOWED_LEAF = /(?:^|\/)dev-console(?:\.ts)?$/;
+
+const RELATIVE_SPECIFIER = /from ["'](\.\.?\/[^"']*)["']/;
+
 // Runtime symbols that mean DOM/browser. `\b` prevents substring matches
 // (e.g. "origin" not matched as "origin.foo"). This is a coarse guard — a
 // ts-morph-based check would be more precise, but not worth the effort here.
@@ -82,6 +103,34 @@ type Violation = {
   readonly excerpt: string;
 };
 
+const RENDERER_SRC = `${path.sep}packages${path.sep}renderer${path.sep}src${path.sep}`;
+
+// Absolute path of `packages/renderer/src/<dir>` containing `file`, or "" when it is elsewhere.
+function rendererSrcSubdir(file: string, dir: string): string {
+  const marker = `${RENDERER_SRC}${dir}${path.sep}`;
+  const index = file.indexOf(marker);
+  return index === -1 ? "" : file.slice(0, index + marker.length - 1);
+}
+
+function isInside(dir: string, target: string): boolean {
+  return target === dir || target.startsWith(dir + path.sep);
+}
+
+function escapesHeadless(file: string, line: string): boolean {
+  const headlessDir = rendererSrcSubdir(file, "headless");
+  const specifier = RELATIVE_SPECIFIER.exec(line)?.[1];
+  if (headlessDir === "" || specifier === undefined) return false;
+  if (HEADLESS_ALLOWED_LEAF.test(specifier)) return false;
+  return !isInside(headlessDir, path.resolve(path.dirname(file), specifier));
+}
+
+function isSharedLayer(file: string): boolean {
+  return (
+    file.includes(RENDERER_SRC) &&
+    ["headless", "live", "web"].every((dir) => rendererSrcSubdir(file, dir) === "")
+  );
+}
+
 function walk(dir: string, skippedDirs: readonly string[] = []): string[] {
   const out: string[] = [];
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
@@ -111,15 +160,18 @@ export function findViolations(file: string, root: string, importRulesOnly = fal
     const trimmed = line.trim();
     if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
 
-    for (const pattern of FORBIDDEN_IMPORTS) {
-      if (pattern.test(line)) {
-        violations.push({
-          file: path.relative(root, file),
-          line: i + 1,
-          rule: "forbidden-import",
-          excerpt: trimmed,
-        });
-      }
+    const importPatterns = [
+      ...FORBIDDEN_IMPORTS,
+      ...(rendererSrcSubdir(file, "headless") !== "" ? HEADLESS_FORBIDDEN_IMPORTS : []),
+      ...(isSharedLayer(file) ? SHARED_FORBIDDEN_IMPORTS : []),
+    ];
+    if (importPatterns.some((pattern) => pattern.test(line)) || escapesHeadless(file, line)) {
+      violations.push({
+        file: path.relative(root, file),
+        line: i + 1,
+        rule: "forbidden-import",
+        excerpt: trimmed,
+      });
     }
     if (importRulesOnly) continue;
     for (const pattern of FORBIDDEN_SYMBOLS) {

package/src/guard-test-timeouts.ts

@@ -32,7 +32,7 @@
  * Consumer (via the published `kumiko-guards` CLI):
  *   kumiko-guards guards --guard=test-timeouts
  */
-import { type CallExpression, Node, type SourceFile, SyntaxKind } from "ts-morph";
+import { type CallExpression, Node, type SourceFile, SyntaxKind, type Type } from "ts-morph";
 import {
   type AstGuard,
   type GuardOutcome,
@@ -182,12 +182,20 @@ function declarationBaseCallee(callee: Node): Node {
 }
 
 // An identifier can be the Playwright test body (`test(title, details, body)`) or an options
-// variable like `{ retry: 2 }`, so it only counts when its type is a number or carries `timeout`.
+// variable like `{ retry: 2 }`, so only its type decides. Every other non-function expression
+// (conditional, member access, call) is treated as a timeout so a union or untyped value cannot hide one.
 function isTimeoutArgument(arg: Node): boolean {
   if (Node.isObjectLiteralExpression(arg)) return hasTimeoutProperty(arg);
   if (Node.isArrowFunction(arg) || Node.isFunctionExpression(arg)) return false;
+  if (!Node.isIdentifier(arg)) return true;
   const type = arg.getType();
-  return type.isNumber() || type.isNumberLiteral() || type.getProperty("timeout") !== undefined;
+  if (type.isAny() || type.isUnknown()) return true;
+  const carriesNumber = (t: Type): boolean => t.isNumber() || t.isNumberLiteral();
+  return (
+    carriesNumber(type) ||
+    (type.isUnion() && type.getUnionTypes().some(carriesNumber)) ||
+    type.getProperty("timeout") !== undefined
+  );
 }
 
 function declarationTimeoutReason(

package/src/guard-thin-wrappers.ts

@@ -335,16 +335,51 @@ function extractMarkerReason(node: FnNode): string | null {
   return null;
 }
 
+// A typed lookup table (`const T: Record<K, Fn> = {…}` or `{…} satisfies …`) fixes one
+// signature per slot; a one-call entry adapts that signature, so inlining it would mean
+// dropping the table, not the wrapper.
+function isTypedTableLiteral(literal: Node): boolean {
+  let parent = literal.getParent();
+  while (parent?.isKind(SyntaxKind.AsExpression)) parent = parent.getParent();
+  if (parent?.isKind(SyntaxKind.SatisfiesExpression)) return true;
+  return parent?.isKind(SyntaxKind.VariableDeclaration) === true && !!parent.getTypeNode();
+}
+
+function collectTypedTableValueNames(sf: SourceFile): Set<string> {
+  const names = new Set<string>();
+  for (const literal of sf.getDescendantsOfKind(SyntaxKind.ObjectLiteralExpression)) {
+    if (!isTypedTableLiteral(literal)) continue;
+    for (const property of literal.getProperties()) {
+      if (property.isKind(SyntaxKind.ShorthandPropertyAssignment)) names.add(property.getName());
+      if (!property.isKind(SyntaxKind.PropertyAssignment)) continue;
+      const value = property.getInitializer();
+      if (value?.isKind(SyntaxKind.Identifier)) names.add(value.getText());
+    }
+  }
+  return names;
+}
+
+function isInlineTypedTableValue(node: FnNode): boolean {
+  const property = node.getParent();
+  const literal = property?.isKind(SyntaxKind.PropertyAssignment)
+    ? property.getParent()
+    : undefined;
+  return literal !== undefined && isTypedTableLiteral(literal);
+}
+
 // ── Scan ──────────────────────────────────────────────────────────────────
 
 export function collectFindings(sf: SourceFile): Finding[] {
   const file = path.relative(ROOT, sf.getFilePath());
   const findings: Finding[] = [];
+  const typedTableValueNames = collectTypedTableValueNames(sf);
 
   const check = (node: FnNode) => {
     const fnName = getFnName(node);
     // skip: anonymous functions cannot be reported by name
     if (!fnName) return;
+    // skip: a typed table slot, see isTypedTableLiteral
+    if (typedTableValueNames.has(fnName) || isInlineTypedTableValue(node)) return;
 
     const callee = getSingleDirectCallee(node);
     // skip: not a single-callee wrapper

package/src/pre-push.sh

@@ -18,8 +18,8 @@
 #      sub-repo's own package.json `test` script — refuses the push if that
 #      script is missing.
 #
-# Before the checks below, the hook runs a gitleaks scan of origin/main..HEAD
-# when the binary is installed.
+# Before the checks below, the hook runs a gitleaks scan of origin/main..<pushed sha>
+# for every pushed ref when the binary is installed.
 #
 # Extension point: a tracked, executable scripts/pre-push-extra.sh runs
 # before the main check in every branch above, with KUMIKO_PUSH_REPO_ROOT
@@ -123,11 +123,27 @@ if ! command -v gitleaks >/dev/null 2>&1; then
 elif ! git -C "$REPO_ROOT" rev-parse --verify --quiet origin/main >/dev/null 2>&1; then
   echo "[pre-push] origin/main not found — secret scan skipped" >&2
 else
-  echo "[pre-push] gitleaks git origin/main..HEAD"
-  if ! (cd "$REPO_ROOT" && gitleaks git --no-banner --redact --log-opts="origin/main..HEAD" .); then
-    echo "[pre-push] gitleaks found secrets — refusing push" >&2
-    exit 1
+  # git passes "<local ref> <local sha> <remote ref> <remote sha>" per pushed ref on stdin;
+  # scan those tips (not HEAD), skip deletes. Without stdin (direct call) fall back to HEAD.
+  SCAN_TIPS=""
+  PUSH_LINES=0
+  if [ ! -t 0 ]; then
+    while read -r _local_ref LOCAL_SHA _remote_ref _remote_sha; do
+      [ -n "$LOCAL_SHA" ] || continue
+      PUSH_LINES=$((PUSH_LINES + 1))
+      case "$LOCAL_SHA" in *[!0]*) SCAN_TIPS="$SCAN_TIPS $LOCAL_SHA" ;; esac
+    done
+  fi
+  if [ "$PUSH_LINES" -eq 0 ]; then
+    SCAN_TIPS=" HEAD"
   fi
+  for SCAN_TIP in $SCAN_TIPS; do
+    echo "[pre-push] gitleaks git origin/main..$SCAN_TIP"
+    if ! (cd "$REPO_ROOT" && gitleaks git --no-banner --redact --log-opts="origin/main..$SCAN_TIP" .); then
+      echo "[pre-push] gitleaks found secrets — refusing push" >&2
+      exit 1
+    fi
+  done
 fi
 
 # infra#559/#569: from a worktree, `--git-common-dir` resolves to the main

package/src/repo-manifest/app-ports/static-app-config.ts

@@ -39,20 +39,24 @@ function propertyName(node: Node): string | undefined {
 }
 
 function objectProperty(object: ObjectLiteralExpression, name: string): Node | undefined {
+  let found: Node | undefined;
+  let opaqueAfterFound = false;
   for (const property of object.getProperties()) {
-    if (
-      property.isKind(SyntaxKind.SpreadAssignment) ||
-      property.isKind(SyntaxKind.ShorthandPropertyAssignment)
-    ) {
-      throw new StaticConfigError(
-        `${name}: spread and shorthand properties cannot be read statically`,
-      );
-    }
-    if (propertyName(property) === name && property.isKind(SyntaxKind.PropertyAssignment)) {
-      return property.getInitializerOrThrow();
+    if (property.isKind(SyntaxKind.SpreadAssignment)) {
+      opaqueAfterFound = true;
+    } else if (property.isKind(SyntaxKind.ShorthandPropertyAssignment)) {
+      if (property.getName() === name) opaqueAfterFound = true;
+    } else if (propertyName(property) === name && property.isKind(SyntaxKind.PropertyAssignment)) {
+      found = property.getInitializerOrThrow();
+      opaqueAfterFound = false;
     }
   }
-  return undefined;
+  if (opaqueAfterFound) {
+    throw new StaticConfigError(
+      `${name}: spread and shorthand properties cannot be read statically`,
+    );
+  }
+  return found;
 }
 
 function numericLiteral(node: Node | undefined, path: string): number {

package/src/run-guards.ts

@@ -97,6 +97,8 @@ const GUARD_NAME_PREFIX = "--guard=";
 
 export type RunGuardsCliDeps = {
   readonly writeBaselineRoots?: readonly RepoRoot[];
+  readonly acquireSlot?: () => () => void;
+  readonly buildProject?: typeof buildSharedProject;
 };
 
 // Shared by the direct `bun run-guards.ts` invocation below and by the
@@ -115,7 +117,7 @@ export function runGuardsCli(argv: readonly string[], deps: RunGuardsCliDeps = {
     return 1;
   }
   if (flags.includes("--explain")) {
-    for (const line of explainGuards(GUARDS, buildSharedProject(GUARDS))) {
+    for (const line of explainGuards(GUARDS, (deps.buildProject ?? buildSharedProject)(GUARDS))) {
       console.log(line);
     }
     return 0;
@@ -155,12 +157,15 @@ export function runGuardsCli(argv: readonly string[], deps: RunGuardsCliDeps = {
     );
     return 0;
   }
-  const strictSecurityBaseline = flags.includes("--strict-security-baseline");
+  return runAllGuards(flags.includes("--strict-security-baseline"), deps);
+}
+
+function runAllGuards(strictSecurityBaseline: boolean, deps: RunGuardsCliDeps): number {
   const guards = strictSecurityBaseline ? GUARDS.filter(isSecurityGuard) : GUARDS;
   // Taken before the ts-morph project is built: that is where the memory goes.
-  const releaseSlot = acquireGuardRunSlot();
+  const releaseSlot = (deps.acquireSlot ?? acquireGuardRunSlot)();
   try {
-    const project = buildSharedProject(guards);
+    const project = (deps.buildProject ?? buildSharedProject)(guards);
     printGuardKitBanner(guards.length, project);
     return reportResults(runGuards(guards, project, { strictSecurityBaseline }));
   } finally {