@starci/eslint-canon-fe 9.5.23 → 9.6.2

package/runtime/scripts/hfs/architecture/ast-walks.mjs

@@ -1,233 +1,250 @@
-// ast-walks.mjs - AST walks the architecture checkers share (moved out of typescript.mjs, which keeps the program loading and module resolution).
 import { canonical, isInside } from './config.mjs';
 import { hasAnyFlag, isConstVariable, sourceLocation } from '../../lib/ts-ast.mjs';
 import { UNPROVEN_FRAMEWORK, isUnshadowedCommonJsRequire, relativePath, unwrapExpression } from './typescript.mjs';
-
 /** `expression` unwrapped by the caller's own predicate set (a predicate absent on an older ts reads as never). */
-export function unwrapEach(ts, expression, predicates) {
-  let current = expression;
-  while (current && predicates.some((predicate) => predicate?.(current))) current = current.expression;
-  return current;
+export function unwrapEach(_ts, expression, predicates) {
+    let current = expression;
+    // The predicates the caller passes select wrapper nodes, which all carry an `expression` child.
+    while (current && predicates.some((predicate) => predicate?.(current)))
+        current = current.expression;
+    return current;
 }
-
 /** `value` with every TS alias hop resolved (a re-exported import reads as its target symbol). */
 export function normalizedSymbolValue(ts, checker, value = null) {
-  let symbol = value;
-  const seen = new Set();
-  while (symbol && hasAnyFlag(symbol.flags, ts.SymbolFlags.Alias) && !seen.has(symbol)) {
-    seen.add(symbol);
-    const target = checker.getAliasedSymbol(symbol);
-    if (!target || target === symbol) break;
-    symbol = target;
-  }
-  return symbol;
+    let symbol = value;
+    const seen = new Set();
+    while (symbol && hasAnyFlag(symbol.flags, ts.SymbolFlags.Alias) && !seen.has(symbol)) {
+        seen.add(symbol);
+        const target = checker.getAliasedSymbol(symbol);
+        if (!target || target === symbol)
+            break;
+        symbol = target;
+    }
+    return symbol;
 }
-
 /** The symbol `node` names, aliases resolved. */
 export function normalizedSymbol(ts, checker, node) {
-  return normalizedSymbolValue(ts, checker, checker?.getSymbolAtLocation(node) ?? null);
+    return normalizedSymbolValue(ts, checker, checker?.getSymbolAtLocation(node) ?? null);
 }
-
 /** The identifier or member-name node an expression selects through unwrapExpression, or null. */
 export function selectedNode(ts, expression) {
-  expression = unwrapExpression(ts, expression);
-  if (ts.isIdentifier(expression)) return expression;
-  if (ts.isPropertyAccessExpression(expression)) return expression.name;
-  if (ts.isElementAccessExpression(expression) && ts.isStringLiteralLike(expression.argumentExpression)) return expression.argumentExpression;
-  return null;
+    const unwrapped = unwrapExpression(ts, expression);
+    if (ts.isIdentifier(unwrapped))
+        return unwrapped;
+    if (ts.isPropertyAccessExpression(unwrapped))
+        return unwrapped.name;
+    if (ts.isElementAccessExpression(unwrapped) && ts.isStringLiteralLike(unwrapped.argumentExpression))
+        return unwrapped.argumentExpression;
+    return null;
 }
-
 /**
  * The symbol `node` ultimately evaluates to: its own symbol, followed through a single `const` variable
  * initializer (and so on). `unselected: 'null'` answers null when `node` selects no name at all.
  */
 export function valueSymbol(ts, checker, node, seen = new Set(), { unselected = 'node' } = {}) {
-  const selected = selectedNode(ts, node);
-  if (!selected && unselected === 'null') return null;
-  const symbol = normalizedSymbol(ts, checker, selected ?? node);
-  if (!symbol || seen.has(symbol)) return symbol;
-  seen.add(symbol);
-  const declarations = symbol.getDeclarations?.() ?? [];
-  if (declarations.length === 1 && ts.isVariableDeclaration(declarations[0]) && declarations[0].initializer
-    && isConstVariable(ts, declarations[0])) {
-    return valueSymbol(ts, checker, declarations[0].initializer, seen, { unselected });
-  }
-  return symbol;
-}
-
+    const selected = selectedNode(ts, node);
+    if (!selected && unselected === 'null')
+        return null;
+    const symbol = normalizedSymbol(ts, checker, selected ?? node);
+    if (!symbol || seen.has(symbol))
+        return symbol;
+    seen.add(symbol);
+    const declarations = symbol.getDeclarations?.() ?? [];
+    const [only] = declarations;
+    if (declarations.length === 1 && only && ts.isVariableDeclaration(only) && only.initializer
+        && isConstVariable(ts, only)) {
+        return valueSymbol(ts, checker, only.initializer, seen, { unselected });
+    }
+    return symbol;
+}
 /**
  * The expressions `declaration` returns: its body when it is an expression-bodied arrow/function, else every
  * `return`'s argument without descending into nested functions. `functionLike` overrides which node kinds bound
  * that descent (default the four callable declaration kinds; pass `ts.isFunctionLike` for the wider set).
  */
 export function returnedExpressions(ts, declaration, { functionLike = null } = {}) {
-  const boundary = functionLike ?? ((node) => ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)
-    || ts.isArrowFunction(node) || ts.isFunctionExpression(node));
-  if ((ts.isArrowFunction(declaration) || ts.isFunctionExpression(declaration)) && !ts.isBlock(declaration.body)) return [declaration.body];
-  const body = boundary(declaration) ? declaration.body : null;
-  if (!body || !ts.isBlock(body)) return [];
-  const returned = [];
-  const visit = (node) => {
-    if (node !== body && boundary(node)) return;
-    if (ts.isReturnStatement(node) && node.expression) returned.push(node.expression);
-    else ts.forEachChild(node, visit);
-  };
-  visit(body);
-  return returned;
-}
-
+    const boundary = functionLike ?? ((node) => ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)
+        || ts.isArrowFunction(node) || ts.isFunctionExpression(node));
+    if ((ts.isArrowFunction(declaration) || ts.isFunctionExpression(declaration)) && !ts.isBlock(declaration.body))
+        return [declaration.body];
+    // A node the boundary predicate accepts is a function-like, which carries a `body`.
+    const body = boundary(declaration) ? declaration.body : null;
+    if (!body || !ts.isBlock(body))
+        return [];
+    const returned = [];
+    const visit = (node) => {
+        if (node !== body && boundary(node))
+            return;
+        if (ts.isReturnStatement(node) && node.expression)
+            returned.push(node.expression);
+        else
+            ts.forEachChild(node, visit);
+    };
+    visit(body);
+    return returned;
+}
 /** A node's decorators across TS versions (ts.getDecorators, else the legacy `decorators` property). */
 export function nodeDecorators(ts, node) {
-  return ts.canHaveDecorators(node) ? ts.getDecorators(node) ?? [] : node.decorators ?? [];
+    return ts.canHaveDecorators(node) ? ts.getDecorators(node) ?? [] : node.decorators ?? [];
 }
-
 /** One finding row: rule id, root-relative path, node position and message, plus rule extras. */
 export function violation(config, sourceFile, node, ruleId, message, extra = {}) {
-  return { ruleId, path: relativePath(config.root, sourceFile.fileName), ...sourceLocation(sourceFile, node), message, ...extra };
+    return { ruleId, path: relativePath(config.root, sourceFile.fileName), ...sourceLocation(sourceFile, node), message, ...extra };
 }
-
 /** Whether `match` holds for `node` or a descendant (the walk stops at the first match). */
 export function anyDescendant(ts, node, match) {
-  let found = false;
-  const visit = (current) => {
-    if (found) return;
-    if (match(current)) { found = true; return; }
-    ts.forEachChild(current, visit);
-  };
-  visit(node);
-  return found;
-}
-
+    let found = false;
+    const visit = (current) => {
+        if (found)
+            return;
+        if (match(current)) {
+            found = true;
+            return;
+        }
+        ts.forEachChild(current, visit);
+    };
+    visit(node);
+    return found;
+}
 /**
  * The framework kinds `expression` can produce: `directOf(ts, checker, {symbol, selected, targets})` maps a
  * selected node's symbols to a kind (default `targets.get(symbol)`); `shorthandOf` (when set) also resolves
  * shorthand-property declarations and descends property assignments; `newExpression` descends `new X()` callees.
  */
-const addKinds = (target, source) => { for (const kind of source) target.add(kind); };
-
+const addKinds = (target, source) => { for (const kind of source)
+    target.add(kind); };
 const kindsFromReturns = (ts, checker, declaration, targets, options) => {
-  const kinds = new Set();
-  for (const returned of returnedExpressions(ts, declaration)) addKinds(kinds, tracedFrameworkKinds(ts, checker, returned, targets, options));
-  return kinds;
+    const kinds = new Set();
+    for (const returned of returnedExpressions(ts, declaration))
+        addKinds(kinds, tracedFrameworkKinds(ts, checker, returned, targets, options));
+    return kinds;
 };
-
 const kindsFromDeclaration = (ts, checker, declaration, targets, options, shorthandOf) => {
-  const kinds = new Set();
-  if (ts.isVariableDeclaration(declaration) && declaration.initializer)
-    addKinds(kinds, tracedFrameworkKinds(ts, checker, declaration.initializer, targets, options));
-  if (shorthandOf && ts.isShorthandPropertyAssignment(declaration)) {
-    const target = normalizedSymbolValue(ts, checker, checker.getShorthandAssignmentValueSymbol?.(declaration));
-    const kind = shorthandOf(ts, checker, target, targets);
-    if (kind) kinds.add(kind);
-  }
-  if (shorthandOf && ts.isPropertyAssignment(declaration))
-    addKinds(kinds, tracedFrameworkKinds(ts, checker, declaration.initializer, targets, options));
-  addKinds(kinds, kindsFromReturns(ts, checker, declaration, targets, options));
-  return kinds;
+    const kinds = new Set();
+    if (ts.isVariableDeclaration(declaration) && declaration.initializer)
+        addKinds(kinds, tracedFrameworkKinds(ts, checker, declaration.initializer, targets, options));
+    if (shorthandOf && ts.isShorthandPropertyAssignment(declaration)) {
+        const target = normalizedSymbolValue(ts, checker, checker.getShorthandAssignmentValueSymbol?.(declaration));
+        const kind = shorthandOf(ts, checker, target, targets);
+        if (kind)
+            kinds.add(kind);
+    }
+    if (shorthandOf && ts.isPropertyAssignment(declaration))
+        addKinds(kinds, tracedFrameworkKinds(ts, checker, declaration.initializer, targets, options));
+    addKinds(kinds, kindsFromReturns(ts, checker, declaration, targets, options));
+    return kinds;
 };
-
 const kindsFromSymbol = (ts, checker, symbol, targets, seen, options) => {
-  const nextSeen = new Set(seen).add(symbol);
-  const declarationOptions = { ...options, seen: nextSeen };
-  const kinds = new Set();
-  for (const declaration of symbol.getDeclarations?.() ?? [])
-    addKinds(kinds, kindsFromDeclaration(ts, checker, declaration, targets, declarationOptions, options.shorthandOf));
-  return kinds;
+    const nextSeen = new Set(seen).add(symbol);
+    const declarationOptions = { ...options, seen: nextSeen };
+    const kinds = new Set();
+    for (const declaration of symbol.getDeclarations?.() ?? [])
+        addKinds(kinds, kindsFromDeclaration(ts, checker, declaration, targets, declarationOptions, options.shorthandOf));
+    return kinds;
 };
-
-const defaultDirectOf = (ts, checker, { symbol, targets }) => targets.get(symbol) ?? null;
-
-export function tracedFrameworkKinds(ts, checker, expression, targets,
-  { seen = new Set(), depth = 0, directOf = null, shorthandOf = null, newExpression = false } = {}) {
-  if (!expression) return new Set();
-  if (depth > 10) return new Set([UNPROVEN_FRAMEWORK]);
-  const unwrapped = unwrapExpression(ts, expression);
-  const selected = selectedNode(ts, unwrapped);
-  const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
-  const direct = symbol ? (directOf ?? defaultDirectOf)(ts, checker, { symbol, selected, targets }) : null;
-  if (direct) return new Set([direct]);
-  const options = { depth: depth + 1, directOf, shorthandOf, newExpression };
-  if (ts.isArrowFunction(unwrapped) || ts.isFunctionExpression(unwrapped)) return kindsFromReturns(ts, checker, unwrapped, targets, { ...options, seen });
-  if (ts.isCallExpression(unwrapped)) {
-    const kinds = tracedFrameworkKinds(ts, checker, unwrapped.expression, targets, { ...options, seen });
-    if (kinds.size) return kinds;
-  }
-  if (newExpression && ts.isNewExpression(unwrapped))
-    return tracedFrameworkKinds(ts, checker, unwrapped.expression, targets, { ...options, seen });
-  if (!symbol || seen.has(symbol)) return new Set();
-  return kindsFromSymbol(ts, checker, symbol, targets, seen, options);
-}
-
+const defaultDirectOf = (_ts, _checker, { symbol, targets }) => targets.get(symbol) ?? null;
+export function tracedFrameworkKinds(ts, checker, expression, targets, { seen = new Set(), depth = 0, directOf = null, shorthandOf = null, newExpression = false } = {}) {
+    if (!expression)
+        return new Set();
+    if (depth > 10)
+        return new Set([UNPROVEN_FRAMEWORK]);
+    const unwrapped = unwrapExpression(ts, expression);
+    const selected = selectedNode(ts, unwrapped);
+    const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
+    const direct = symbol && selected ? (directOf ?? defaultDirectOf)(ts, checker, { symbol, selected, targets }) : null;
+    if (direct)
+        return new Set([direct]);
+    const options = { depth: depth + 1, directOf, shorthandOf, newExpression };
+    if (ts.isArrowFunction(unwrapped) || ts.isFunctionExpression(unwrapped))
+        return kindsFromReturns(ts, checker, unwrapped, targets, { ...options, seen });
+    if (ts.isCallExpression(unwrapped)) {
+        const kinds = tracedFrameworkKinds(ts, checker, unwrapped.expression, targets, { ...options, seen });
+        if (kinds.size)
+            return kinds;
+    }
+    if (newExpression && ts.isNewExpression(unwrapped))
+        return tracedFrameworkKinds(ts, checker, unwrapped.expression, targets, { ...options, seen });
+    if (!symbol || seen.has(symbol))
+        return new Set();
+    return kindsFromSymbol(ts, checker, symbol, targets, seen, options);
+}
 /** 'unproven framework' | 'multiple framework' | the one kind | null, for a decorator whose expression constructs. */
 export function constructedDecoratorKind(ts, checker, decorator, targets, traceOpts = {}) {
-  const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
-  const kinds = tracedFrameworkKinds(ts, checker, callee, targets, traceOpts);
-  if (kinds.has(UNPROVEN_FRAMEWORK)) return 'unproven framework';
-  if (kinds.size === 1) return [...kinds][0];
-  return kinds.size ? 'multiple framework' : null;
+    const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
+    const kinds = tracedFrameworkKinds(ts, checker, callee, targets, traceOpts);
+    if (kinds.has(UNPROVEN_FRAMEWORK))
+        return 'unproven framework';
+    if (kinds.size === 1)
+        return [...kinds][0] ?? null;
+    return kinds.size ? 'multiple framework' : null;
 }
-
 /** The target a decorator resolves to through a `let`/`var` alias's single initializer, or null. */
 export function mutableDecoratorKind(ts, checker, decorator, targets) {
-  const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
-  const selected = selectedNode(ts, callee);
-  const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
-  const declarations = symbol?.getDeclarations?.() ?? [];
-  if (declarations.length !== 1 || !ts.isVariableDeclaration(declarations[0]) || !declarations[0].initializer
-    || isConstVariable(ts, declarations[0])) return null;
-  return targets.get(valueSymbol(ts, checker, declarations[0].initializer)) ?? null;
-}
-
+    const callee = ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
+    const selected = selectedNode(ts, callee);
+    const symbol = selected ? normalizedSymbol(ts, checker, selected) : null;
+    const declarations = symbol?.getDeclarations?.() ?? [];
+    const [only] = declarations;
+    if (declarations.length !== 1 || !only || !ts.isVariableDeclaration(only) || !only.initializer
+        || isConstVariable(ts, only))
+        return null;
+    const resolved = valueSymbol(ts, checker, only.initializer);
+    return (resolved ? targets.get(resolved) : undefined) ?? null;
+}
 /** The callee expression of a decorator (the called expression of `@x(...)`, else the expression itself). */
 export function decoratorCallee(ts, decorator) {
-  return ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
+    return ts.isCallExpression(decorator.expression) ? decorator.expression.expression : decorator.expression;
 }
-
 /**
  * The module `statement` (import, export-from or import-equals) statically binds: its specifier text, the
  * module's symbol and its exported symbols by name (aliases resolved); `symbol` is null when the module does
  * not resolve. Null when the statement names no static specifier.
  */
 export function moduleExportsOf(ts, checker, statement) {
-  let moduleSpecifier = null;
-  if ((ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement))
-    && statement.moduleSpecifier && ts.isStringLiteralLike(statement.moduleSpecifier)) moduleSpecifier = statement.moduleSpecifier;
-  let importEquals = null;
-  if (ts.isImportEqualsDeclaration(statement) && ts.isExternalModuleReference(statement.moduleReference)
-    && statement.moduleReference.expression && ts.isStringLiteralLike(statement.moduleReference.expression)) importEquals = statement.moduleReference.expression;
-  const specifierNode = moduleSpecifier ?? importEquals;
-  const specifier = specifierNode?.text;
-  if (specifier == null) return null;
-  const symbol = checker.getSymbolAtLocation(specifierNode) ?? null;
-  const exports = new Map((symbol ? checker.getExportsOfModule(symbol) : []).map(item => [item.getName(), normalizedSymbolValue(ts, checker, item)]));
-  return { specifierNode, specifier, symbol, exports };
-}
-
+    let moduleSpecifier = null;
+    if ((ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement))
+        && statement.moduleSpecifier && ts.isStringLiteralLike(statement.moduleSpecifier))
+        moduleSpecifier = statement.moduleSpecifier;
+    let importEquals = null;
+    if (ts.isImportEqualsDeclaration(statement) && ts.isExternalModuleReference(statement.moduleReference)
+        && statement.moduleReference.expression && ts.isStringLiteralLike(statement.moduleReference.expression))
+        importEquals = statement.moduleReference.expression;
+    const specifierNode = moduleSpecifier ?? importEquals;
+    if (!specifierNode)
+        return null;
+    const specifier = specifierNode.text;
+    const symbol = checker.getSymbolAtLocation(specifierNode) ?? null;
+    const exports = new Map((symbol ? checker.getExportsOfModule(symbol) : [])
+        .map((item) => [item.getName(), normalizedSymbolValue(ts, checker, item) ?? null]));
+    return { specifierNode, specifier, symbol, exports };
+}
 /**
  * The program source files a framework-target scan of `checker` judges: every file in `localFiles`, plus (when
  * `root` is given) declaration files inside the root but outside node_modules. Null when no program of the
  * context owns the checker.
  */
 export function programSourcesOf(context, checker, localFiles, { root = null } = {}) {
-  const program = context.programs.find(candidate => candidate.getTypeChecker() === checker) ?? null;
-  if (!program) return null;
-  return program.getSourceFiles().filter(sourceFile => localFiles.has(canonical(sourceFile.fileName))
-    || (root && sourceFile.isDeclarationFile && isInside(root, sourceFile.fileName)
-      && !sourceFile.fileName.replaceAll('\\', '/').includes('/node_modules/')));
+    const program = context.programs.find(candidate => candidate.getTypeChecker() === checker) ?? null;
+    if (!program)
+        return null;
+    return program.getSourceFiles().filter(sourceFile => localFiles.has(canonical(sourceFile.fileName))
+        || (root && sourceFile.isDeclarationFile && isInside(root, sourceFile.fileName)
+            && !sourceFile.fileName.replaceAll('\\', '/').includes('/node_modules/')));
 }
-
 /**
  * The CommonJS require() caveat every framework scan reports: each `require('<specifier>')` `accepted` pushes
  * `${filePath} uses a CommonJS <label ?? specifier> <detail>` (the import-shape reasoning cannot prove that binding).
  */
-export function commonJsRequireReasons(ts, checker, sourceFile, accepted, reasons, filePath, detail) {
-  const label = arguments[7] ?? null;
-  const visit = node => {
-    if (ts.isCallExpression(node) && isUnshadowedCommonJsRequire(ts, checker, node.expression)
-      && node.arguments.length === 1 && ts.isStringLiteralLike(node.arguments[0]) && accepted(node.arguments[0].text)) {
-      reasons.push(`${filePath} uses a CommonJS ${label ?? node.arguments[0].text} ${detail}`);
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
+export function commonJsRequireReasons(ts, checker, sourceFile, accepted, reasons, filePath, detail, labelArgument) {
+    const label = labelArgument ?? null;
+    const visit = (node) => {
+        if (ts.isCallExpression(node) && isUnshadowedCommonJsRequire(ts, checker, node.expression) && node.arguments.length === 1) {
+            const [argument] = node.arguments;
+            if (argument && ts.isStringLiteralLike(argument) && accepted(argument.text)) {
+                reasons.push(`${filePath} uses a CommonJS ${label ?? argument.text} ${detail}`);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
 }

package/runtime/scripts/hfs/architecture/automatic-gates.mjs

@@ -1,96 +1,103 @@
 import { readTextFile } from '../../lib/read-text.mjs';
-
 // Owner ruling 2026-09-29 (layout 2026-09-30): integration, e2e and contract run MANUALLY only. No hook, default typecheck,
 // coverage run or automatic CI trigger may include those trees or run those projects. Linting the e2e files is not running them: ESLint reads them
 // as syntax in the one repository-wide lint run (the factory's e2e block), so no `lint:e2e` command exists to judge.
 const E2E_COMMAND = new RegExp([
-  String.raw`\btest:(?:e2e|integration|contract)\b|`,
-  String.raw`\btypecheck:tests\b|`,
-  String.raw`--selectProjects\s+(?:e2e|integration|contract)\b|`,
-  String.raw`src\/tests\/(?:world|integration|e2e|contract)\b|`,
-  String.raw`jest[^\n|&;]*(?:e2e|integration|contract)`,
+    String.raw `\btest:(?:e2e|integration|contract)\b|`,
+    String.raw `\btypecheck:tests\b|`,
+    String.raw `--selectProjects\s+(?:e2e|integration|contract)\b|`,
+    String.raw `src\/tests\/(?:world|integration|e2e|contract)\b|`,
+    String.raw `jest[^\n|&;]*(?:e2e|integration|contract)`,
 ].join(''), 'u');
 const UNIT_RUN_SCRIPTS = ['test', 'test:unit', 'test:ci', 'test:coverage', 'test:cov'];
-
-const runsE2e = text => E2E_COMMAND.test(String(text).replace(/--ignore-pattern[= ]+(?:"[^"]*"|'[^']*'|\S+)/gu, ''));
-const withoutComments = text => text.split('\n').filter(line => !/^\s*#/u.test(line)).join('\n');
-
+const runsE2e = (text) => E2E_COMMAND.test(String(text).replace(/--ignore-pattern[= ]+(?:"[^"]*"|'[^']*'|\S+)/gu, ''));
+const withoutComments = (text) => text.split('\n').filter(line => !/^\s*#/u.test(line)).join('\n');
 function inspectHooks(state) {
-  for (const hook of ['.husky/pre-commit', '.husky/pre-push']) {
-    const text = readTextFile(state.root, hook);
-    if (text === null) continue;
-    const body = withoutComments(text);
-    if (runsE2e(body)) state.finding(state.rule, hook, `${hook} runs integration, e2e or contract. They are manual only; hooks run unit, lint and typecheck.`);
-    for (const match of body.matchAll(/npm\s+run\s+([\w:.-]+)/gu)) state.pending.push(match[1]);
-  }
+    for (const hook of ['.husky/pre-commit', '.husky/pre-push']) {
+        const text = readTextFile(state.root, hook);
+        if (text === null)
+            continue;
+        const body = withoutComments(text);
+        if (runsE2e(body))
+            state.finding(state.rule, hook, `${hook} runs integration, e2e or contract. They are manual only; hooks run unit, lint and typecheck.`);
+        for (const match of body.matchAll(/npm\s+run\s+([\w:.-]+)/gu))
+            state.pending.push(match[1]);
+    }
 }
-
 function inspectLintStaged(state) {
-  const lintStaged = state.pkg?.['lint-staged'];
-  if (lintStaged && runsE2e(Object.values(lintStaged).flat().join('\n')))
-    state.finding(state.rule, 'package.json', 'lint-staged runs an integration, e2e or contract command. They are manual only.');
+    const lintStaged = state.pkg?.['lint-staged'];
+    if (lintStaged && runsE2e(Object.values(lintStaged).flat().join('\n')))
+        state.finding(state.rule, 'package.json', 'lint-staged runs an integration, e2e or contract command. They are manual only.');
 }
-
 function inspectHookScripts(state) {
-  for (const name of state.pending) {
-    if (state.called.has(name)) continue;
-    state.called.add(name);
-    const command = state.scripts[name];
-    if (typeof command !== 'string') continue;
-    if (runsE2e(command)) state.finding(state.rule, 'package.json', `Script ${name} is run by a husky hook and touches integration, e2e or contract. They are manual only.`);
-    for (const match of command.matchAll(/npm\s+run\s+([\w:.-]+)/gu)) state.pending.push(match[1]);
-  }
+    for (const name of state.pending) {
+        if (state.called.has(name))
+            continue;
+        state.called.add(name);
+        const command = state.scripts[name];
+        if (typeof command !== 'string')
+            continue;
+        if (runsE2e(command))
+            state.finding(state.rule, 'package.json', `Script ${name} is run by a husky hook and touches integration, e2e or contract. They are manual only.`);
+        for (const match of command.matchAll(/npm\s+run\s+([\w:.-]+)/gu))
+            state.pending.push(match[1]);
+    }
 }
-
 function inspectUnitGates(state) {
-  if (!state.tree.hasFile(state.jestConfig)) return;
-  for (const name of UNIT_RUN_SCRIPTS) {
-    const command = state.scripts[name];
-    if (typeof command === 'string' && /\bjest\b/u.test(command) && !/--selectProjects\s+unit\b/u.test(command))
-      state.finding(state.rule, 'package.json', `Script ${name} runs jest without --selectProjects unit and would run the integration, e2e or contract project.`);
-  }
-  const jestText = readTextFile(state.root, state.jestConfig) ?? '';
-  if (/collectCoverageFrom/u.test(jestText) && !/!src\/tests\/(?:\*\*|e2e)/u.test(jestText))
-    state.finding(state.rule, state.jestConfig, 'collectCoverageFrom must exclude src/tests/** so no integration, e2e or contract file counts toward coverage.');
+    if (state.jestConfig === null || !state.tree.hasFile(state.jestConfig))
+        return;
+    for (const name of UNIT_RUN_SCRIPTS) {
+        const command = state.scripts[name];
+        if (typeof command === 'string' && /\bjest\b/u.test(command) && !/--selectProjects\s+unit\b/u.test(command))
+            state.finding(state.rule, 'package.json', `Script ${name} runs jest without --selectProjects unit and would run the integration, e2e or contract project.`);
+    }
+    const jestText = readTextFile(state.root, state.jestConfig) ?? '';
+    if (/collectCoverageFrom/u.test(jestText) && !/!src\/tests\/(?:\*\*|e2e)/u.test(jestText))
+        state.finding(state.rule, state.jestConfig, 'collectCoverageFrom must exclude src/tests/** so no integration, e2e or contract file counts toward coverage.');
 }
-
 function inspectWorkflows(state) {
-  for (const file of state.tree.files().filter(entry => /^\.github\/workflows\/[^/]+\.ya?ml$/u.test(entry))) {
-    const text = readTextFile(state.root, file);
-    if (text === null) continue;
-    const trigger = /^on:.*(?:\n(?:[ \t].*)?$)*/mu.exec(text)?.[0] ?? '';
-    if (!/\b(?:push|pull_request)\b/u.test(trigger)) continue;
-    if (runsE2e(withoutComments(text)))
-      state.finding(state.rule, file, `${file} runs e2e on push or pull_request. Move the e2e job to its own workflow with on: workflow_dispatch only.`);
-  }
+    for (const file of state.tree.files().filter((entry) => /^\.github\/workflows\/[^/]+\.ya?ml$/u.test(entry))) {
+        const text = readTextFile(state.root, file);
+        if (text === null)
+            continue;
+        const trigger = /^on:.*(?:\n(?:[ \t].*)?$)*/mu.exec(text)?.[0] ?? '';
+        if (!/\b(?:push|pull_request)\b/u.test(trigger))
+            continue;
+        if (runsE2e(withoutComments(text)))
+            state.finding(state.rule, file, `${file} runs e2e on push or pull_request. Move the e2e job to its own workflow with on: workflow_dispatch only.`);
+    }
 }
-
 /** Check hooks, transitive hook scripts, unit scripts, coverage and automatic workflows. */
 export function e2eInAutomaticGate({ root, tree, jestConfig, finding }) {
-  const rule = 'HFS_E2E_IN_AUTOMATIC_GATE';
-  let pkg = null;
-  try { pkg = JSON.parse(readTextFile(root, 'package.json') ?? ''); } catch { /* the package checks own invalid JSON */ }
-  const state = { root, tree, jestConfig, finding, rule, pkg, scripts: pkg?.scripts ?? {}, pending: [], called: new Set() };
-  inspectHooks(state);
-  inspectLintStaged(state);
-  inspectHookScripts(state);
-  inspectUnitGates(state);
-  inspectWorkflows(state);
+    const rule = 'HFS_E2E_IN_AUTOMATIC_GATE';
+    let pkg = null;
+    try {
+        pkg = JSON.parse(readTextFile(root, 'package.json') ?? '');
+    }
+    catch { /* the package checks own invalid JSON */ }
+    const state = { root, tree, jestConfig, finding, rule, pkg, scripts: pkg?.scripts ?? {}, pending: [], called: new Set() };
+    inspectHooks(state);
+    inspectLintStaged(state);
+    inspectHookScripts(state);
+    inspectUnitGates(state);
+    inspectWorkflows(state);
 }
-
 /** The be side's default tsconfig excludes the world, integration, e2e and contract trees (they are checked by src/tests/tsconfig.json). */
 export function testTreesOutOfDefaultProgram({ root, tree, finding }) {
-  const rule = 'HFS_E2E_IN_AUTOMATIC_GATE';
-  const tsconfigText = readTextFile(root, 'tsconfig.json');
-  let tsconfig = null;
-  try { tsconfig = tsconfigText === null ? null : JSON.parse(tsconfigText); } catch { /* the typecheck itself owns parsing */ }
-  if (tsconfig) {
-    const excludedText = JSON.stringify(tsconfig.exclude ?? []);
-    const excludesTestTrees = ['world', 'integration', 'e2e', 'contract'].every(tree => excludedText.includes(`src/tests/${tree}`));
-    const defaultAll = tsconfig.include === undefined && tsconfig.files === undefined;
-    const files = tree.files();
-    if (files.some(file => /^src\/tests\/(?:world|integration|e2e|contract)\/.+\.[cm]?tsx?$/u.test(file)) && !excludesTestTrees &&
-        (defaultAll || JSON.stringify(tsconfig.include ?? []).includes('src')))
-      finding(rule, 'tsconfig.json', 'The default tsconfig includes src/tests/{world,integration,e2e,contract}/**. Exclude those trees and check them with src/tests/tsconfig.json (typecheck:tests).');
-  }
+    const rule = 'HFS_E2E_IN_AUTOMATIC_GATE';
+    const tsconfigText = readTextFile(root, 'tsconfig.json');
+    let tsconfig = null;
+    try {
+        tsconfig = tsconfigText === null ? null : JSON.parse(tsconfigText);
+    }
+    catch { /* the typecheck itself owns parsing */ }
+    if (tsconfig) {
+        const excludedText = JSON.stringify(tsconfig.exclude ?? []);
+        const excludesTestTrees = ['world', 'integration', 'e2e', 'contract'].every(tree => excludedText.includes(`src/tests/${tree}`));
+        const defaultAll = tsconfig.include === undefined && tsconfig.files === undefined;
+        const files = tree.files();
+        if (files.some((file) => /^src\/tests\/(?:world|integration|e2e|contract)\/.+\.[cm]?tsx?$/u.test(file)) && !excludesTestTrees &&
+            (defaultAll || JSON.stringify(tsconfig.include ?? []).includes('src')))
+            finding(rule, 'tsconfig.json', 'The default tsconfig includes src/tests/{world,integration,e2e,contract}/**. Exclude those trees and check them with src/tests/tsconfig.json (typecheck:tests).');
+    }
 }