[Whamp]

Summary

Adopt the shared TypeScript and structure standards on top of the current local main development state (a39d32f):

• upgrade to TypeScript 7, type-aware oxlint/tsgolint, oxfmt, and packaged Factory rules through oxlint jsPlugins
• ban real type assertions while preserving as const; validate opaque runtime data instead of casting
• apply strict indexing, naming, JSDoc, file-organization, and test-file requirements
• replace vendored Factory/Ultracite configuration with package-based rules
• restore knip at 6.25.0 as the TypeScript 7-compatible dead-code gate
• make e2e tests independent of global skills and current Pi startup wording
• document project opt-ins, framework exceptions, rule-by-rule evidence, and remaining upstream tooling risks

This PR also contains Will's three commits already present on local main but not origin/main when the isolated pilot worktree was created: a6a060b, 8b8bc4e, and a39d32f.

Resolved standards feedback

The pilot surfaced three standards defects, resolved in Whamp/coding-standards#18:

• TS-34: @factory/structured-logging is globally disabled; its unconfigurable Error → MetaError branch exceeds the portable standard
• TS-43: knip 6.25.0 replaces crashing 5.85.0 and passes under TypeScript 7.0.2
• TS-32: typed relative Vitest mocks are valid in this no-alias package; factories preserve actual exports with importOriginal

Verification

• pnpm run check: pass
  • type-aware oxlint: pass
  • TypeScript 7 strict typecheck: pass
  • oxfmt over 71 files: pass
  • knip 6.25.0: pass
  • duplicate detection: 0 clones
  • unit tests: 166 passed
• pnpm run test:e2e: 34 passed
• manual pi -e ./src/index.ts smoke test: /token-burden rendered the overlay
• frozen lockfile install: pass
• CodeGraph cycle/boundary checks: pass
• repeated Standards and Spec reviews: no remaining findings
• GitHub check and Socket checks: green

The final no-mistakes follow-up skipped duplicate agent review/test/docs/lint stages because this exact follow-up commit had already passed the commands and independent review above; no-mistakes still performed rebase, push, PR update, and CI verification.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​factory/​eslint-plugin@​0.1.0
	@​total-typescript/​shoehorn@​0.1.2
	oxlint-plugin-eslint@​1.73.0
	oxfmt@​0.58.0
	typescript@​5.9.3 ⏵ 7.0.2	-6		-1		+10
	oxlint@​1.73.0
	oxlint-tsgolint@​0.24.0
	knip@​6.25.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/knip@6.25.0 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm damerau-levenshtein is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@factory/eslint-plugin@0.1.0 → npm/damerau-levenshtein@1.0.8 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/damerau-levenshtein@1.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm es-abstract is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@factory/eslint-plugin@0.1.0 → npm/es-abstract@1.24.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm eslint-plugin-react is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@factory/eslint-plugin@0.1.0 → npm/eslint-plugin-react@7.37.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-react@7.37.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.