/// <reference types="node" />
/**
 * The gate checks every app runs, written once (docs/GATES.md §23).
 *
 * Until UIG-10 Peek and Ship each wrote them into their own
 * `scripts/gates-checks.mjs`. 65 different checks for finished tickets, counted
 * on 17 September: 28 were identical in both, 21 were the same check written two
 * ways, 2 read each app's real page, and 14 read code only one app has. This is
 * the first three groups as one list. The fourth stays in the app's own checks
 * file, beside this list.
 *
 * Where Peek and Ship wrote one check two ways, the check here runs both, so it
 * passes wherever either did: the raw-link probe with both of their texts, the
 * token probes against each token config the app has.
 *
 * `scripts/gates-compare.mjs` holds this list to Peek's and Ship's: every check
 * of theirs must be here, or be about code only that app has, or the comparison
 * fails and names it.
 *
 * A check for a ticket not built yet is a first guess at the evidence, taken
 * from the ticket's own text; the ticket that builds it changes it here.
 */
import type { CheckResult, GateCheck, GateHelpers, GateTicket } from './status'

export interface AppCheckOptions {
  /** Where the app is inside the repository: `.` unless it sits in a folder of its own. */
  app?: string
  /** A real page of the app, relative to the app, full of elements that are not controls. */
  page: string
  /** The ticket the gate chain is listed under, and whether this repo owns it: UIG-3 in Peek, UIG-4 in Ship. */
  chain?: { ref: string; owner: boolean }
  /** The token lint configs the app has, relative to the app. */
  tokenConfigs?: string[]
  /** The part a hand-made column header should name (UIG-22): `Panel` since 0.37.0, `ContainerHeader` before. */
  headers?: string[]
}

export const APP_TICKET_TITLES: Record<string, string> = {
  'UIG-2': 'The tracking rails — GATES.md, the status script, the guide committed',
  'UIG-3': 'Tracer bullet — one rule, end to end, blocking in Peek',
  'UIG-4': 'The same chain, blocking in Ship',
  'UIG-6': 'Branch protection — the backstop, all three repos',
  'UIG-7': 'Lint rule — every remaining raw element',
  'UIG-8': 'Lint rule — forbid the reach',
  'UIG-9': 'Lint rule — the className allow-list',
  'UIG-10': 'create-app — a command that makes a new Estiva app that runs',
  'UIG-13': "The registry widens to Peek's 115 and Ship's 74, with classification",
  'UIG-19': 'Lock the contract in CI',
  'UIG-20': 'The Claude skill, reading the registry',
  'UIG-21': 'CLAUDE.md becomes an index, not a lecture',
  'UIG-22': 'Fingerprint — a hand-made header row',
  'UIG-23': 'Fingerprint — a hand-made empty state',
  'UIG-24': 'Fingerprint — a browser tooltip where ours belongs',
  'UIG-25': 'Fingerprint — a component copied out by hand',
  'UIG-27': 'The components the apps had to build themselves — Link, ProgressBar, EmptyState padding',
  'UIG-28': 'Close the two holes in the token contract — arbitrary values, and inline style',
  'UIG-30': 'RichText — one component that draws a message\'s text, for both apps',
  'UIG-32': 'Peek and Ship take their gate pieces from the package',
  'UIG-33': 'Link — a whole row that is one link',
  'UIG-37': 'The gates refuse a TypeScript eslint-disable comment — know the rule names, rules off',
  'UIG-42': "What the gate can't see yet — a box around a part, a screen drawn by hand, two blind spots in the token check",
}

/** Run several checks as one: the first that does not pass is the answer. */
function all(h: GateHelpers, steps: (() => CheckResult | Promise<CheckResult>)[], label: string): () => Promise<CheckResult> {
  return async () => {
    for (const step of steps) {
      const r = await step()
      if (r.result !== 'pass') return r
    }
    return h.PASS(label)
  }
}

export function appChecks(h: GateHelpers, { app = '.', page, chain = { ref: 'UIG-3', owner: false }, tokenConfigs = ['eslint.tokens.config.js', 'eslint.config.js'], headers = ['Panel'] }: AppCheckOptions): GateTicket[] {
  const WEB = app === '.' ? '' : `${app.replace(/\/$/, '')}/`
  const cwd = app === '.' ? undefined : app
  const PROBE = 'src/components/__gates_probe__.tsx'
  const GATES = 'eslint.gates.config.js'
  const at = (rel: string) => `${WEB}${rel}`
  const probe = (code: string, expect: 'error' | 'warning' | 'none', mentions?: string, file = PROBE, config = GATES) => () =>
    h.lint({ ...(cwd ? { cwd } : {}), config, file, code, expect, mentions })
  const component = (body: string) => `export function Probe() {\n  return ${body}\n}\n`
  const installed = at('node_modules/@estiva-app/ui/dist/index.d.ts')
  const realPage = (): Promise<CheckResult> => h.lint({ ...(cwd ? { cwd } : {}), config: GATES, file: page, code: h.read(at(page)), expect: 'none' })
  const button = component('<button type="button">x</button>')
  /** A line TypeScript's own lint writes; ESLint refuses it where TypeScript's plugin is unknown (UIG-37). */
  const typescriptDirective = '// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport const probe: any = 1\n'
  const ticket = (ref: string, checks: GateCheck[], owner = false): GateTicket => ({ ref, title: APP_TICKET_TITLES[ref], owner, checks })

  const tokenProbe = (code: string, expect: 'error' | 'warning' | 'none', mentions?: string, file = PROBE) =>
    all(h, tokenConfigs.map((config) => probe(code, expect, mentions, file, config)), `${tokenConfigs.join(' and ')}: as expected`)

  return [
    ticket('UIG-2', [
      { what: 'npm run gates:status is wired', run: () => h.script('package.json', 'gates:status') },
    ]),
    ticket(chain.ref, [
      { what: 'the gate lint config loads', run: () => h.loads(at(GATES)) },
      { what: `${at('package.json')} has lint:rules`, run: () => h.script(at('package.json'), 'lint:rules') },
      { what: 'CI runs lint:rules', run: () => h.ci('lint:rules') },
      { what: 'the committed hook runs the gate lint', run: () => h.hook('.claude/settings.json', 'gates') },
      { what: '.gates-count.json is committed and parses', run: () => h.json(h.exists('.gates-count.json') ? '.gates-count.json' : at('.gates-count.json')) },
      { what: 'a raw <button> is an error naming Button', run: probe(button, 'error', 'Button') },
      { what: 'the same in a story', run: probe(button, 'error', 'Button', 'src/stories/__gates_probe__.stories.tsx') },
      { what: 'a test file is not checked, while source is', run: async () => {
        const source = await probe(button, 'error', 'Button')()
        if (source.result !== 'pass') return h.FAIL(`source is not checked yet, so this proves nothing: ${source.detail}`)
        return probe(button, 'none', undefined, 'src/components/__gates_probe__.test.tsx')()
      } },
      { what: 'the debt list exists', run: () => h.file('docs/GATES-DEBT.md') },
    ], chain.owner),
    ticket('UIG-6', [
      { what: 'GitHub requires the check gate to merge into main', run: () => h.protectedBranch(/^gate$/) },
      { what: "CI's job gate runs lint:rules", run: () => h.ciJob('gate', 'lint:rules') },
    ]),
    ticket('UIG-7', [
      { what: 'a raw <input> is an error naming TextInput', run: probe(component('<input />'), 'error', 'TextInput') },
      { what: 'a clickable <div> is an error naming Button (R5)', run: probe(component('<div onClick={() => history.back()}>Back</div>'), 'error', '`Button`') },
      { what: 'a raw <a> is an error naming Link', run: all(h, [probe(component('<a href="/topics">Topics</a>'), 'error', 'Link'), probe(component('<a href="/issues">Issues</a>'), 'error', 'Link')], 'a raw <a> is an error naming Link') },
      { what: 'a raw <form> is an error naming Form, and a file input one naming FilePicker', run: async () => {
        const form = await probe(component('<form />'), 'error', '`Form`')()
        if (form.result !== 'pass') return form
        return probe(component('<input type="file" />'), 'error', 'FilePicker')()
      } },
      { what: '<textarea>, <select>, <dialog> and <label> name Textarea, Select, DialogShell and Field', run: async () => {
        for (const [element, part] of [['textarea', 'Textarea'], ['select', 'Select'], ['dialog', 'DialogShell'], ['label', 'Field']]) {
          const one = await probe(component(`<${element} />`), 'error', `\`${part}\``)()
          if (one.result !== 'pass') return one
        }
        return h.PASS('all four are errors, each naming its part')
      } },
      { what: 'an element the package has no part for is an error that says to ask for one', run: probe(component('<iframe title="Map" />'), 'error', 'ask Katerina') },
      { what: 'an escaped element is not an error, while the same element is', run: async () => {
        const raw = await probe(component('<form />'), 'error')()
        if (raw.result !== 'pass') return h.FAIL(`a raw <form> is not caught yet, so this proves nothing: ${raw.detail}`)
        return probe('export function Probe() {\n  return (\n    // @estiva-escape(no-raw-element): a probe that keeps its element on purpose\n    <form />\n  )\n}\n', 'none')()
      } },
      { what: 'a real page, full of elements that are not controls, gets no error', run: realPage },
    ]),
    ticket('UIG-8', [
      { what: 'a Base UI import is an error naming the part built on it', run: probe("import { Popover } from '@base-ui/react/popover'\nexport const Probe = Popover\n", 'error', '`Popover`') },
      { what: 'createPortal is an error naming the floating parts', run: probe("import { createPortal } from 'react-dom'\nexport const Probe = (to: HTMLElement) => createPortal(<span />, to)\n", 'error', '`DialogShell`') },
      { what: 'a key listener on the whole page is an error, in a .ts file too', run: probe("export function listen() {\n  window.addEventListener('keydown', () => {})\n}\n", 'error', '`DialogShell`', 'src/lib/__gates_probe__.ts') },
      { what: 'arrow keys by hand are an error; Enter in a field is not', run: async () => {
        const arrows = await probe("export const onKeyDown = (e: KeyboardEvent) => e.key === 'ArrowDown'\n", 'error', '`Menu`', 'src/lib/__gates_probe__.ts')()
        if (arrows.result !== 'pass') return arrows
        return probe("export const onKeyDown = (e: KeyboardEvent) => e.key === 'Enter'\n", 'none', undefined, 'src/lib/__gates_probe__.ts')()
      } },
      { what: 'a hand-written role="option" is an error naming Select', run: probe(component('<div role="option" />'), 'error', '`Select`') },
      { what: 'tabIndex={0} on a div is an error; tabIndex={-1} is not', run: async () => {
        const zero = await probe(component('<div tabIndex={0} />'), 'error', '`Button`')()
        if (zero.result !== 'pass') return h.FAIL(`tabIndex={0} is not caught yet, so this proves nothing: ${zero.detail}`)
        return probe(component('<div tabIndex={-1} />'), 'none')()
      } },
      { what: 'overflow-y-auto is an error naming ScrollArea', run: probe(component('<div className="h-64 overflow-y-auto" />'), 'error', '`ScrollArea`') },
      { what: 'an escaped listener is not an error, while the same listener is', run: async () => {
        const raw = await probe("export function listen() {\n  document.addEventListener('mousedown', () => {})\n}\n", 'error', undefined, 'src/lib/__gates_probe__.ts')()
        if (raw.result !== 'pass') return h.FAIL(`a page listener is not caught yet, so this proves nothing: ${raw.detail}`)
        return probe("export function listen() {\n  // @estiva-escape(no-rebuilt-behaviour): a probe that keeps its listener on purpose\n  document.addEventListener('mousedown', () => {})\n}\n", 'none', undefined, 'src/lib/__gates_probe__.ts')()
      } },
      { what: 'a real page gets no error', run: realPage },
    ]),
    ticket('UIG-9', [
      { what: 'a border passed into Button is an error naming Button', run: probe(`import { Button } from '@estiva-app/ui'\n${component('<Button className="border">x</Button>')}`, 'error', 'on `Button` changes how it looks') },
      { what: 'placement passed into Button is not', run: probe(`import { Button } from '@estiva-app/ui'\n${component('<Button className="mt-2 w-full flex-1 relative">x</Button>')}`, 'none') },
      { what: 'an escaped look is not an error, while the same look is', run: async () => {
        const raw = await probe(`import { Link } from '@estiva-app/ui'\n${component('<Link href="/x" className="after:absolute after:inset-0">x</Link>')}`, 'error', '`Link`')()
        if (raw.result !== 'pass') return h.FAIL(`a restyled part is not caught yet, so this proves nothing: ${raw.detail}`)
        return probe(`import { Link } from '@estiva-app/ui'\nexport function Probe() {\n  return (\n    // @estiva-escape(no-restyled-part): a probe that keeps its row link on purpose\n    <Link href="/x" className="after:absolute after:inset-0">x</Link>\n  )\n}\n`, 'none')()
      } },
      { what: 'a real page gets no error', run: realPage },
    ]),
    // UIG-10, reopened 18 September: a tab holds one relay client, the way Peek and Ship hold
    // theirs and a made app is written to. Measured on both mains that day: one each, and no
    // socket opened any other way. A second holder, or a socket of the app's own, is a second
    // connection the relay signs in and budgets separately.
    ticket('UIG-10', [
      { what: 'the app holds one relay client, at module level, and opens no socket of its own', run: () => {
        const sources = h.listFiles(at('src'), (n) => /\.tsx?$/.test(n) && !/\.(test|stories)\.tsx?$/.test(n))
        const own = sources.filter((f) => /\bcreateLiveClient\(|\bcreateLiveRelay\(|\bnew WebSocket\(/.test(h.read(f)))
        if (own.length) return h.FAIL(`opens a socket of its own (${own.join(', ')}): hold one client from createLiveClientHolder()`)
        const holders = sources.filter((f) => /^\s*(?:export\s+)?const\s+\w+\s*=\s*createLiveClientHolder\(\)/m.test(h.read(f)))
        if (holders.length !== 1) return h.FAIL(holders.length ? `${holders.length} client holders (${holders.join(', ')}): a tab holds one` : 'no module-level createLiveClientHolder(): the app has no relay client')
        return h.PASS(`one client for the tab, held in ${holders[0]}`)
      } },
    ]),
    // Built by UIG-13, 18 September. An app's catalogue is built fresh from its code
    // and never committed: the package is public and the apps are private (Katerina).
    ticket('UIG-13', [
      { what: "npm run ui:find is the package's search, over the package and this app", run: () => h.contains(at('package.json'), /"ui:find":\s*"estiva-ui find\b/, "ui:find runs the package's estiva-ui find") },
      { what: "npm run registry:check is the package's check", run: () => h.contains(at('package.json'), /"registry:check":\s*"estiva-ui check\b/, 'registry:check runs estiva-ui check') },
      { what: "CI's job gate refuses a part with no description", run: () => h.ciJob('gate', 'registry:check') },
      // In the .gitignore of the app's own folder, where `estiva-ui build` would write it.
      { what: 'the catalogue is never committed: git ignores registry.json', run: () => h.contains(at('.gitignore'), /^\/?registry\.json\r?$/m, `${at('.gitignore')} ignores registry.json`) },
      { what: 'every part is described and sorted, and every file is accounted for', run: () => h.catalogue(at('.')) },
    ]),
    ticket('UIG-19', [
      // The contract runs inside `estiva-ui check`, which the gate job already runs
      // (UIG-13), so an app changes no script: it takes the package that has it.
      { what: 'the installed package checks the usage-page contract and the story links', run: () => h.contains(at('node_modules/@estiva-app/ui/dist/registry/cli.js'), 'the usage-page contract', "the installed estiva-ui check runs the contract") },
      { what: "CI's job gate runs it", run: () => h.ciJob('gate', 'registry:check') },
      { what: 'the app keeps no copy of it in its own gates-checks.mjs', run: () => h.exists(at('scripts/gates-checks.mjs')) ? h.lacks(at('scripts/gates-checks.mjs'), '"When not"', 'the app checks no page sections itself') : h.PASS('the app has no gates-checks.mjs') },
    ]),
    // The Claude skill (UIG-20): its text is the installed package's, read in by a
    // loader `estiva-ui skill` writes; the app commits the loader and the settings.
    ticket('UIG-20', [
      { what: "the skill's loader reads the installed package's text", run: () => h.contains('.claude/skills/estiva-ui/SKILL.md', `!\`cat "\${CLAUDE_PROJECT_DIR}/${at('node_modules/@estiva-app/ui/skill/estiva-ui.md')}"\``, 'the loader reads the package’s skill') },
      { what: 'the search runs without a prompt', run: () => h.contains('.claude/settings.json', 'Bash(npm run ui:find *)', '.claude/settings.json allows npm run ui:find') },
      { what: 'ui:find searches every app beside this one: it names none', run: () => h.lacks(at('package.json'), /"ui:find":[^\n]*--also/, 'ui:find names no neighbour, so it finds them all') },
      ...(WEB ? [{ what: 'ui:find runs from the top folder too', run: () => h.contains('package.json', /"ui:find":/, 'the top folder has ui:find') }] : []),
      { what: "CI's job gate refuses a loader that differs", run: () => (h.exists(at('node_modules/@estiva-app/ui/dist/registry/cli.js')) && /claude skill:/.test(h.read(at('node_modules/@estiva-app/ui/dist/registry/cli.js'))) ? h.ciJob('gate', 'registry:check') : h.FAIL('the installed package does not check the loader: take a version that does')) },
    ]),
    // What loads into every Claude session (UIG-21): CLAUDE.md is an index, the
    // rest loads where it applies, and a rule a check can hold is a check.
    ticket('UIG-21', [
      { what: 'CLAUDE.md with its imports is under 200 lines, and every rule file is scoped', run: () => h.instructions(200) },
      { what: "CI's job gate runs the token lint", run: () => {
        const tokens = h.ciJob('gate', 'lint:tokens')
        return tokens.result === 'pass' ? tokens : h.ciJob('gate', 'lint')
      } },
      { what: "a plain tailwind-merge is an error naming the package's cn()", run: tokenProbe("import { twMerge } from 'tailwind-merge'\nexport const merged = twMerge('p-2', 'p-3')\n", 'error', 'cn()', 'src/lib/__gates_probe__.ts') },
    ]),
    ticket('UIG-22', [
      // The Folders pane's own row, at the commit before peek 3dc663b.
      { what: `a hand-made column header is an error naming ${headers.join(' or ')}`, run: all(h, headers.map((name) => probe(component('<div className="flex h-full flex-col"><div className="flex items-center gap-2 px-3 py-2"><span>Folders</span></div><div /></div>'), 'error', name)), `a hand-made column header is an error naming ${headers.join(' or ')}`) },
      // 26 September: the package's header on its own is a panel made by hand, whose box forgot to scroll.
      { what: "the package's ContainerHeader on its own is an error naming Panel", run: probe(`import { ContainerHeader } from '@estiva-app/ui'\n${component('<div className="flex flex-col"><ContainerHeader title="Details" /><div className="px-4">x</div></div>')}`, 'error', '`Panel`') },
      { what: 'a group heading inside a list is left alone', run: probe(component('<section className="flex flex-col gap-px"><h3 className="flex h-8 items-center gap-2 px-3"><span>Todo</span></h3><div /></section>'), 'none') },
    ]),
    ticket('UIG-23', [
      { what: 'a hand-made empty line is an error naming EmptyState', run: probe("export function Probe({ items }: { items: string[] }) {\n  return <div>{items.length === 0 ? <p className=\"text-text-secondary\">Nothing here</p> : items.map((i) => <span key={i}>{i}</span>)}</div>\n}\n", 'error', 'EmptyState') },
    ]),
    ticket('UIG-24', [
      { what: 'a title= is an error naming WithTooltip', run: probe(`import { Button } from '@estiva-app/ui'\n${component('<Button title="Delete">x</Button>')}`, 'error', 'WithTooltip') },
    ]),
    ticket('UIG-25', [
      { what: "SectionLabel's class list, typed by hand, is a warning", run: probe(component('<span className="text-h5 leading-3 leaf:font-mono leaf:text-small leaf:uppercase leaf:tracking-widest text-text-secondary">Label</span>'), 'warning', 'SectionLabel') },
    ]),
    ticket('UIG-27', [
      { what: 'the installed package has Link', run: () => h.contains(installed, /\bLink\b/, 'the installed @estiva-app/ui exports Link') },
      { what: 'the installed package has ProgressBar', run: () => h.contains(installed, /\bProgressBar\b/, 'the installed @estiva-app/ui exports ProgressBar') },
    ]),
    ticket('UIG-28', [
      { what: 'text-[14px] is an error', run: tokenProbe(component('<div className="text-[14px]">x</div>'), 'error') },
      { what: 'a colour in an inline style is an error', run: tokenProbe(component("<div style={{ backgroundColor: '#ff0000' }}>x</div>"), 'error') },
      { what: 'h-[240px] is a warning', run: tokenProbe(component('<div className="h-[240px]">x</div>'), 'warning') },
      { what: 'h-[240px] is not an error', run: tokenProbe(component('<div className="h-[240px]">x</div>'), 'none') },
      { what: 'a hand-written line height behind an arbitrary variant is an error', run: tokenProbe(component('<div className="[&_p]:leading-[1.4]">x</div>'), 'error') },
      { what: 'a raw colour in a class is an error (the pattern that matched nothing, R1)', run: tokenProbe(component('<div className="bg-[#5c69dc]">x</div>'), 'error', 'raw colour') },
      { what: 'a width and height from a prop pass', run: tokenProbe("export function Probe({ size }: { size: number }) {\n  return <div style={{ width: size, height: size }}>x</div>\n}\n", 'none') },
      { what: 'a test file is not checked for hand-written values, while source is', run: all(h, tokenConfigs.map((config) => async () => {
        const code = component("<div className=\"text-[14px]\" style={{ color: 'red' }}>x</div>")
        const source = await probe(code, 'error', undefined, PROBE, config)()
        if (source.result !== 'pass') return h.FAIL(`source is not checked yet, so this proves nothing: ${source.detail}`)
        return probe(code, 'none', undefined, 'src/components/__gates_probe__.test.tsx', config)()
      }), 'a test file is not checked for hand-written values, while source is') },
    ]),
    // Built 28 September: the token check's two blind spots, and a box that places a page EmptyState.
    ticket('UIG-42', [
      { what: 'a class behind an arbitrary variant is an error', run: tokenProbe(component('<div className="group-hover/row:bg-gray-100">x</div>'), 'error') },
      { what: 'a class list joined by hand is read', run: tokenProbe(component("<div className={['text-sm', 'p-2'].join(' ')}>x</div>"), 'error') },
      { what: 'a box that centres a page EmptyState is an error naming it', run: probe(`import { EmptyState } from '@estiva-app/ui'\n${component('<div className="flex items-center justify-center"><EmptyState message="Nothing here" /></div>')}`, 'error', 'page-scope EmptyState') },
    ]),
    // Built 28 September: both apps drew the protocol's text tree by hand, and drifted apart.
    // A file that reads the protocol and draws a quote or a numbered list itself is a third copy.
    ticket('UIG-30', [
      { what: 'the installed package has RichText', run: () => h.contains(installed, /\bRichText\b/, 'the installed @estiva-app/ui exports RichText') },
      { what: "no file draws the protocol's text tree by hand", run: () => {
        const sources = h.listFiles(at('src'), (n) => /\.tsx$/.test(n) && !/\.(test|stories)\.tsx$/.test(n))
        // A file that takes the text tree from the protocol and draws a quote or a numbered list
        // itself, as Peek's MessageBody and Ship's RichText did before UIG-30. Any other import
        // from the protocol passes: Ship's Activity reads only `Imeta`, and its <ol> is a feed.
        const TREE = /\b(?:toRenderTree|RenderBlock|RenderInline|parseInlineMarks|parseBodySegments|markersToInlineNodes|InlineTextNode|InlineMarkSpan)\b/
        const readsTree = (text: string) => [...text.matchAll(/import\s+(?:type\s+)?\{([^}]*)\}\s*from\s*['"]@estiva-app\/protocol['"]/g)].some((m) => TREE.test(m[1]))
        const own = sources.filter((f) => { const text = h.read(f); return readsTree(text) && /<(?:blockquote|ol)\b/.test(text) })
        return own.length ? h.FAIL(`draws the text tree itself (${own.join(', ')}): pass the tree to RichText`) : h.PASS('formatted text is drawn by RichText only')
      } },
    ]),
    // UIG-33, Katerina's picks of 28 September: a row that is one link is `Link` with `cover`, and a
    // chip that is a link is `Chip` with `href`. Before, both apps stretched a link over its row by
    // hand (`after:absolute`) and rounded a Link round a chip, each under an escape.
    ticket('UIG-33', [
      { what: 'the installed package has Link cover and Chip href', run: all(h, [
        () => h.contains(at('node_modules/@estiva-app/ui/dist/Link.d.ts'), /\bcover\?: boolean/, 'the installed Link takes cover'),
        () => h.contains(at('node_modules/@estiva-app/ui/dist/Chip.d.ts'), /\bhref\?: string/, 'the installed Chip takes href'),
      ], 'the installed Link takes cover and Chip takes href') },
      { what: 'no link is stretched over its row by hand', run: () => {
        const sources = h.listFiles(at('src'), (n) => /\.tsx$/.test(n) && !/\.(test|stories)\.tsx$/.test(n))
        const own = sources.filter((f) => /<(?:Link|a)\b[^>]*\bafter:(?:absolute|inset-0)\b/.test(h.read(f)))
        return own.length ? h.FAIL(`stretches a link by hand (${own.join(', ')}): give the Link cover`) : h.PASS('every whole-row link is Link with cover')
      } },
    ]),
    // Katerina's ruling of 17 September (docs/GATES.md §23): one copy, in the package. An app made
    // by create-estiva-app passes this from its first commit; Peek and Ship do once UIG-32 lands.
    ticket('UIG-32', [
      { what: 'the gate pieces come from the package, and no repo keeps a copy', run: all(h, [
        () => h.contains(at('eslint.gates.config.js'), /from '@estiva-app\/ui\/gates'/, 'the gate config imports @estiva-app/ui/gates'),
        () => h.hook('.claude/settings.json', '@estiva-app/ui/dist/gates/cli.js'),
        // `estiva-gates status` where npm can find the command; by path where it cannot,
        // because the install is in the app's folder and the script is in the repo's top one (Ship).
        () => h.contains('package.json', /"gates:status":\s*"[^"]*(?:estiva-gates|@estiva-app\/ui\/dist\/gates\/cli\.js)[^"]*status/, "gates:status runs the package's engine"),
        () => (h.exists('scripts/gates-status.mjs') ? h.FAIL('scripts/gates-status.mjs is a copy of the status engine: run estiva-gates status instead') : h.PASS('no copy of the status engine')),
      ], 'the gate config, the hook and gates:status are the package\'s; no copy of the engine') },
    ]),
    ticket('UIG-37', [
      { what: 'a TypeScript eslint-disable comment breaks neither the gate nor the token lint', run: all(h, [
        probe(typescriptDirective, 'none'),
        tokenProbe(typescriptDirective, 'none'),
      ], `${[GATES, ...tokenConfigs].join(', ')}: a TypeScript directive is no error`) },
      { what: 'a token lint on its own is the package\'s tokenConfig, not built by hand', run: () =>
        (h.exists(at('eslint.tokens.config.js'))
          ? h.contains(at('eslint.tokens.config.js'), /\btokenConfig\(/, 'eslint.tokens.config.js runs tokenConfig from @estiva-app/ui/gates')
          : h.PASS('no token lint on its own')) },
    ]),
  ]
}