fix(cdk): restore exhaustiveness guard + correct knip ratchet keys (#282)

Addresses PR review (ayushtr-aws):

1. validation.ts: the `void (true as _AssertAttachmentExhaustive)` form
   silently defeated the AttachmentType exhaustiveness guard — a type
   assertion never errors, whereas the original ASSIGNMENT to a `never`
   type is the actual compile-time check. Restored the assignment and
   consume the binding with `void` so it survives noUnusedLocals and
   no-unused-vars without weakening the guard. Verified: tsc errors when
   a member is missing from ATTACHMENT_TYPE_LIST, compiles clean when
   exhaustive.

2. check-deadcode-ratchet.mjs: COUNTED_KEYS used non-existent knip 6.x
   keys (classMembers, nsExports, nsTypes) and counted unused files from
   a non-existent top-level report.files. Switched to the real keys
   (namespaceMembers, catalog) and count files from issues[].files[] so
   unused files actually move the ratchet. Count unchanged at 78.

Author: bgagent

cdk/src/handlers/shared/validation.ts

@@ -286,9 +286,14 @@ export const MAX_TOTAL_ATTACHMENT_SIZE_BYTES = MAX_TOTAL_ATTACHMENT_SIZE_MB * 10
 /** Compile-time exhaustiveness check for AttachmentType. */
 const ATTACHMENT_TYPE_LIST = ['image', 'file', 'url'] as const satisfies readonly AttachmentType[];
 type _AssertAttachmentExhaustive = Exclude<AttachmentType, (typeof ATTACHMENT_TYPE_LIST)[number]> extends never ? true : never;
-// `void` keeps the compile-time exhaustiveness assertion without an unused binding
-// (tsconfig noUnusedLocals does not honor eslint's ^_ ignore pattern).
-void (true as _AssertAttachmentExhaustive);
+// The ASSIGNMENT is the guard: if AttachmentType gains a member missing from
+// ATTACHMENT_TYPE_LIST, _AssertAttachmentExhaustive resolves to `never` and
+// assigning `true` is a hard compile error. (A `true as never` assertion would
+// NOT error — assertions are permitted whenever either side is assignable — so
+// it must stay an assignment.) `void` consumes the binding so noUnusedLocals
+// and @typescript-eslint/no-unused-vars stay satisfied without weakening it.
+const _attachmentExhaustiveCheck: _AssertAttachmentExhaustive = true;
+void _attachmentExhaustiveCheck;
 const VALID_ATTACHMENT_TYPES = new Set<string>(ATTACHMENT_TYPE_LIST);
 
 /** Allowed image MIME types (PNG and JPEG only — passed directly to Bedrock). */

scripts/check-deadcode-ratchet.mjs

@@ -28,8 +28,9 @@
  * (someone cleaned up), it prints the new lower number so the baseline can be
  * tightened in the same PR.
  *
- * Counted categories mirror what knip surfaces for this repo today (unused
- * files, dependencies, unlisted, binaries, exports, types, enum/class members).
+ * Counted categories are knip 6.x's array-valued issue keys (unused files,
+ * dependencies, unlisted/unresolved, binaries, exports, types, enum and
+ * namespace members, duplicates, catalog) — see COUNTED_KEYS below.
  * Per-category false positives are suppressed in `knip.json`, not here.
  */
 
@@ -41,7 +42,14 @@ import { dirname, join } from 'node:path';
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
 const baselinePath = join(repoRoot, 'knip-baseline.json');
 
+// knip 6.x emits one issues[] entry per file; each entry carries these
+// array-valued issue keys. `file` and `owners` are labels, not findings, so
+// they are excluded. `files` (unused files) is counted here — knip lists them
+// inside issues[].files[], NOT at the top level. `duplicates` is an
+// array-of-arrays (one inner array per duplicate group), so its `.length`
+// counts groups, which is the unit we ratchet on.
 const COUNTED_KEYS = [
+  'files',
   'dependencies',
   'devDependencies',
   'optionalPeerDependencies',
@@ -50,11 +58,10 @@ const COUNTED_KEYS = [
   'unresolved',
   'exports',
   'types',
-  'nsExports',
-  'nsTypes',
   'duplicates',
   'enumMembers',
-  'classMembers',
+  'namespaceMembers',
+  'catalog',
 ];
 
 function runKnip() {
@@ -80,7 +87,7 @@ function runKnip() {
 }
 
 function countIssues(report) {
-  let total = (report.files ?? []).length;
+  let total = 0;
   for (const issue of report.issues ?? []) {
     for (const key of COUNTED_KEYS) {
       if (Array.isArray(issue[key])) total += issue[key].length;