@afokapu/atdd-bun 0.6.2 → 0.7.1

package/conventions/tester.bun/tester.bun.telemetry-test-binding.convention.yaml

@@ -0,0 +1,52 @@
+schema_version: 1.1.0
+rule_id: tester.bun.telemetry-test-binding
+kind: rule
+status: active
+name: Telemetry tests bind the acceptance and the item they prove
+statement: >-
+  A `// Telemetry:` reference in a test file is well-formed, resolves to a tracking-plan item, and
+  the test carries an `Acceptance:` binding to a declared acceptance whose telemetry decision
+  requires that item (REQUIRED).
+terms:
+- term_id: telemetry_test
+  text: >-
+    a test file with a Telemetry: header, a TELEMETRY/EVENT/METRIC URN kind segment, or
+    *.telemetry.test.* colocation.
+- term_id: bound_acceptance
+  text: >-
+    the acceptance named by the test's Acceptance: header. Its telemetry decision must list the
+    bound item — a test proves a requirement, not an acquaintance.
+content:
+  summary: >-
+    The @covers edge of the telemetry graph: acceptance → item → test. A telemetry test that binds
+    an item but no acceptance proves something nobody required; one that binds an acceptance whose
+    decision does not list the item proves a relationship the plan never declared.
+  normative_text: |
+    Every Telemetry: header in a test file is judged on its own line: concrete-URN grammar,
+    registry resolution, presence of Acceptance: bindings, the bindings' existence in the plan,
+    and at least ONE bound acceptance's decision actually requiring the bound item. A spec file
+    legitimately covers many acceptances (the two-level @covers model); the requiring one may be
+    any of them, so the judgement is over the whole set — none requiring is the finding. A
+    header inside a string literal is not a header.
+  fix_hint: |
+    Bind both ends of the proof:
+
+      // URN: test:commons:ingress:E001-UNIT-001
+      // Acceptance: acc:commons:E001-UNIT-001
+      // Telemetry: telemetry:event:be:commons:response-invocation-accepted
+  exceptions:
+  - >-
+    Tests identified as telemetry tests by URN segment or colocation alone (no Telemetry: header)
+    are judged by the captured-sink and identity rules, not this one.
+  - >-
+    Inert until adoption, like every rule in this family.
+metadata:
+  aliases:
+  - TESTER-TELEMETRY-TEST-BINDING-001
+  severity: 2
+  # strict: atdd-bun fails on every finding; it has no advisory mode and no ratchet baseline.
+  disposition: strict
+  introduced_in: 0.7.0
+implementation:
+  type: validator
+  ref: bun_telemetry_test

package/conventions/tester.bun/tester.bun.telemetry-timing-semantics.convention.yaml

@@ -0,0 +1,53 @@
+schema_version: 1.1.0
+rule_id: tester.bun.telemetry-timing-semantics
+kind: rule
+status: active
+name: Declared timing semantics are exercised by a bound test
+statement: >-
+  Every timing semantic a tracking-plan item declares (post-commit, absent-after-rollback,
+  correlation-across-async) is exercised by at least one telemetry test bound to that item
+  (REQUIRED).
+terms:
+- term_id: timing_semantic
+  text: >-
+    a declared critical ordering property of an emission: post-commit (only after the transaction
+    commits), absent-after-rollback (never when it rolls back), correlation-across-async
+    (correlation context continues across an async handoff).
+- term_id: exercised
+  text: >-
+    the bound test references the behaviour — commit, rollback, correlation/context — in what it
+    asserts or names. The check is plan-driven and lexical by design: it requires the plan to say
+    when ordering matters and the test to speak to it.
+content:
+  summary: >-
+    Transaction-time telemetry bugs (the event that fires before the commit it describes, the
+    rollback that still emits, the context lost across an await) are exactly the ones return-value
+    tests never catch. The plan declares when ordering matters; the bound tests must speak to it.
+  normative_text: |
+    Timing semantics live on the tracking-plan item's timing list. For each declared semantic, at
+    least one test bound to the item by a Telemetry: header must reference the corresponding
+    behaviour — in code or in a test title; comments do not satisfy, and neither does prose in
+    the tracking plan. This deliberately does not prove ordering statically — it cannot, and
+    pretending otherwise would be false precision. Items that declare no timing are not judged,
+    which is how diagnostic logs and internal spans stay out of scope.
+  fix_hint: |
+    Declare on the item, exercise in the bound test:
+
+      "timing": ["post-commit"]                                // the plan says ordering matters
+      test("emits the planned event once the invocation commits", () => { ... });   // the test speaks to it
+  exceptions:
+  - >-
+    No declared timing, no obligation: a diagnostic log with an empty timing list never triggers
+    this rule.
+  - >-
+    Inert until adoption, like every rule in this family.
+metadata:
+  aliases:
+  - TESTER-TELEMETRY-TIMING-SEMANTICS-001
+  severity: 3
+  # strict: atdd-bun fails on every finding; it has no advisory mode and no ratchet baseline.
+  disposition: strict
+  introduced_in: 0.7.0
+implementation:
+  type: validator
+  ref: bun_telemetry_test

package/detectors/bun_telemetry_code/atdd.implementation.yaml

@@ -0,0 +1,24 @@
+schema_version: "1.0.0"
+kind: implementation
+subtype: validator
+implementation_id: coder.telemetry.impl
+targets_workspace: atdd.workspace.bun
+contract_version: "1.0.0"
+# The code-side half of the telemetry profile: source references into the tracking
+# plan, raw-string and forbidden-property emission, and the vendor-SDK boundary
+# around the neutral TelemetryPort. Inert until the repository adopts the
+# capability (telemetry root present, or any acceptance declaring a decision).
+emits_rule_ids:
+  - coder.bun.telemetry-source-binding
+  - coder.bun.telemetry-raw-string-emit
+  - coder.bun.telemetry-vendor-sdk
+  - coder.bun.telemetry-forbidden-properties
+  - coder.bun.telemetry-implementation-binding
+realizes_convention:
+  - coder.bun.telemetry-source-binding
+  - coder.bun.telemetry-raw-string-emit
+  - coder.bun.telemetry-vendor-sdk
+  - coder.bun.telemetry-forbidden-properties
+  - coder.bun.telemetry-implementation-binding
+entrypoint: detect.mjs
+report: detect.mjs

package/detectors/bun_telemetry_code/calls.mjs

@@ -0,0 +1,104 @@
+// calls.mjs — emit-call extraction shared by the raw-string and forbidden-property
+// checks. Never spawned as a check (the family runner only spawns checks/*.mjs).
+//
+// An emit-like call is `emit`, `emitted`, `track`, `capture`, `record`, `logEvent`,
+// `emitEvent` or `sendEvent` invoked as a function or method with a STRING LITERAL
+// as its first argument. The lookbehind rejects only word-character prefixes, so
+// `telemetry.emit(...)` matches while `resubmit(...)` does not. Calls whose first
+// argument is computed (a variable, a template literal, a contract constant) are
+// invisible to these checks by design: they are what the generated contracts use.
+
+// Comment masking (strings kept) lives in lib/scan.mjs; re-exported for the member checks.
+export { maskComments } from "../../lib/scan.mjs";
+
+const EMIT_CALLEE = /(?<![A-Za-z0-9_$])(?:emit|emitted|track|capture|record|logEvent|emitEvent|sendEvent)(?=\s*\()/g;
+
+/** Every emit-like call with a string-literal first argument: {index, value, argEnd}. */
+export function emitStringCalls(text) {
+  const calls = [];
+  for (const callee of text.matchAll(EMIT_CALLEE)) {
+    let i = callee.index + callee[0].length;
+    while (i < text.length && /\s/.test(text[i])) i++;
+    if (text[i] !== "(") continue;
+    i++;
+    while (i < text.length && /\s/.test(text[i])) i++;
+    const quote = text[i];
+    if (quote !== '"' && quote !== "'") continue;
+    let j = i + 1;
+    while (j < text.length && text[j] !== quote && text[j] !== "\n") {
+      if (text[j] === "\\") j++;
+      j++;
+    }
+    if (text[j] !== quote) continue;
+    calls.push({ index: callee.index, value: text.slice(i + 1, j), argEnd: j + 1 });
+  }
+  return calls;
+}
+
+/** Does a string look like a telemetry event NAME (as opposed to a log level or a key)? */
+export function looksLikeEventName(value) {
+  if (value.startsWith("telemetry:")) return true;
+  if (/^[a-z]+(?:_[a-z0-9]+)+$/.test(value)) return true;                                  // order_accepted
+  if (/^[a-z][a-zA-Z0-9]*$/.test(value) && /[a-z][A-Z]/.test(value)) return true;           // orderCreated
+  if (/^[A-Z][A-Za-z0-9]*(?: [A-Za-z0-9]+)+$/.test(value)) return true;                     // Order Created
+  return false;
+}
+
+/** The object literal starting at text[from] (already positioned at `{`), or null. */
+export function objectLiteralAt(text, from) {
+  if (text[from] !== "{") return null;
+  let depth = 0;
+  for (let i = from; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      let j = i + 1;
+      while (j < text.length && text[j] !== ch && text[j] !== "\n") {
+        if (text[j] === "\\") j++;
+        j++;
+      }
+      i = text[j] === ch ? j : j - 1;
+      continue;
+    }
+    if (ch === "{") depth++;
+    else if (ch === "}") {
+      depth--;
+      if (depth === 0) return text.slice(from, i + 1);
+    }
+  }
+  return null;
+}
+
+/** Top-level property names of an object-literal text (braces included). Shorthand
+ * properties carry no name of their own and are invisible to this scan. */
+export function topLevelKeys(objectText) {
+  const keys = [];
+  let depth = 0, i = 0, atKeyStart = true;
+  while (i < objectText.length) {
+    const ch = objectText[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      let j = i + 1;
+      while (j < objectText.length && objectText[j] !== ch && objectText[j] !== "\n") {
+        if (objectText[j] === "\\") j++;
+        j++;
+      }
+      i = j < objectText.length ? j + 1 : j;
+      atKeyStart = false;
+      continue;
+    }
+    if (ch === "{" || ch === "[" || ch === "(") { depth++; i++; atKeyStart = ch === "{" || ch === ","; continue; }
+    if (ch === "}" || ch === "]" || ch === ")") { depth--; i++; atKeyStart = false; continue; }
+    if (depth === 1 && atKeyStart) {
+      const match = /^([A-Za-z_$][\w$]*)\s*:/.exec(objectText.slice(i));
+      if (match) {
+        keys.push(match[1]);
+        i += match[0].length;
+        atKeyStart = false;
+        continue;
+      }
+    }
+    if (ch === ",") { atKeyStart = true; i++; continue; }
+    if (!/[\s:]/.test(ch)) atKeyStart = false;
+    i++;
+  }
+  return keys;
+}

package/detectors/bun_telemetry_code/checks/t_forbidden_properties.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.telemetry-forbidden-properties  (telemetry code family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { registry, normalizeName } from "../registry.mjs";
+import { maskComments, emitStringCalls, objectLiteralAt, topLevelKeys } from "../calls.mjs";
+
+// The tracking plan's forbidden_properties list (raw payloads, secrets, prompts) is a
+// promise about what NEVER leaves the process on that item. When an emit-like call
+// names a declared item, the object literal it passes is checked against that list —
+// snake_case in the plan meets camelCase in code through normalization.
+const RULE = "coder.bun.telemetry-forbidden-properties";
+
+const { adopted, forbidden } = await registry();
+const violations = [];
+if (adopted) {
+  const excludes = readExcludes();
+  for (const root of readRoots()) {
+    for (const file of walk(root, excludes, SOURCE_EXT)) {
+      const text = readText(file);
+      if (!text) continue;
+      const masked = maskComments(text);
+      for (const call of emitStringCalls(masked)) {
+        const banned = forbidden.get(call.value);
+        if (!banned) continue;
+        // From the end of the first argument, skip the separator and read the properties object.
+        let i = call.argEnd;
+        while (i < masked.length && /\s/.test(masked[i])) i++;
+        if (masked[i] !== ",") continue;
+        i++;
+        while (i < masked.length && /\s/.test(masked[i])) i++;
+        const objectText = objectLiteralAt(masked, i);
+        if (!objectText) continue;
+        for (const key of topLevelKeys(objectText)) {
+          if (!banned.has(normalizeName(key))) continue;
+          violations.push({ rule_id: RULE, file, ...locate(text, call.index),
+            evidence: `passes forbidden property '${key}' to ${call.value}; the tracking plan forbids it on this item` });
+        }
+      }
+    }
+  }
+}
+process.stderr.write(`bun-telemetry[forbidden-properties]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_telemetry_code/checks/t_implementation_binding.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.telemetry-implementation-binding  (telemetry code family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { registry } from "../registry.mjs";
+
+// The third edge of the traceability graph: every telemetry item an acceptance
+// REQUIRES must be bound to the implementation that emits it, by a Telemetry:
+// header in non-test source. A required item no source claims is planned telemetry
+// nobody emits — the plan and the code have diverged, and this is where it shows.
+const RULE = "coder.bun.telemetry-implementation-binding";
+const TELEMETRY_HEADER = /^[ \t]*\/\/[ \t]*Telemetry:[ \t]*(\S+)[ \t]*$/;
+const STRING_ON_LINE = /(["'`])(?:\\.|(?!\1)[^\n\\])*\1/g;
+
+const { adopted, ids, requiredIds, itemFileById } = await registry();
+const violations = [];
+if (adopted) {
+  const bound = new Set();
+  const excludes = readExcludes();
+  for (const root of readRoots()) {
+    for (const file of walk(root, excludes, SOURCE_EXT)) {
+      const text = readText(file);
+      if (!text) continue;
+      for (const raw of text.split("\n")) {
+        const match = TELEMETRY_HEADER.exec(raw.replace(STRING_ON_LINE, '""'));
+        if (match && ids.has(match[1])) bound.add(match[1]);
+      }
+    }
+  }
+  for (const id of [...requiredIds].sort()) {
+    // An unresolvable required URN is the acceptance-decision rule's finding; judge only declared items.
+    if (!ids.has(id) || bound.has(id)) continue;
+    violations.push({ rule_id: RULE, file: itemFileById.get(id) ?? "telemetry/", line: 1, col: 1,
+      evidence: `${id} is required by an acceptance but no implementation source binds it with a // Telemetry: header`,
+      source_line: "" });
+  }
+}
+process.stderr.write(`bun-telemetry[implementation-binding]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_telemetry_code/checks/t_raw_string_emit.mjs

@@ -0,0 +1,34 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.telemetry-raw-string-emit  (telemetry code family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { registry } from "../registry.mjs";
+import { maskComments, emitStringCalls, looksLikeEventName } from "../calls.mjs";
+
+// An emit-like call whose first argument is a raw string that names an event must name
+// a DECLARED event. Undeclared names are how tracking plans rot: the string compiles,
+// the dashboard never fills. A declared raw id passes for now; once generated contracts
+// exist, emitting even a declared id by string is drift the contract exists to prevent.
+const RULE = "coder.bun.telemetry-raw-string-emit";
+
+const { adopted, ids } = await registry();
+const violations = [];
+if (adopted) {
+  const excludes = readExcludes();
+  for (const root of readRoots()) {
+    for (const file of walk(root, excludes, SOURCE_EXT)) {
+      const text = readText(file);
+      if (!text) continue;
+      const masked = maskComments(text);
+      for (const call of emitStringCalls(masked)) {
+        if (!looksLikeEventName(call.value) || ids.has(call.value)) continue;
+        violations.push({ rule_id: RULE, file, ...locate(text, call.index),
+          evidence: `undeclared raw-string telemetry name '${call.value}'; declare it in the tracking plan (telemetry/<theme>/<artifact>/) and emit it through the generated contract` });
+      }
+    }
+  }
+}
+process.stderr.write(`bun-telemetry[raw-string-emit]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_telemetry_code/checks/t_source_binding.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.telemetry-source-binding  (telemetry code family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { registry } from "../registry.mjs";
+
+// A source file binds itself to the tracking plan with a Telemetry: header naming the
+// concrete item it emits. This is the source-to-telemetry traceability edge: every URN
+// so written must be a well-formed concrete URN that resolves to a registry entry.
+const RULE = "coder.bun.telemetry-source-binding";
+const TELEMETRY_HEADER = /^[ \t]*\/\/[ \t]*Telemetry:[ \t]*(\S+)[ \t]*$/;
+const STRING_ON_LINE = /(["'`])(?:\\.|(?!\1)[^\n\\])*\1/g;
+
+const { adopted, ids, concreteUrn } = await registry();
+const violations = [];
+if (adopted) {
+  const excludes = readExcludes();
+  for (const root of readRoots()) {
+    for (const file of walk(root, excludes, SOURCE_EXT)) {
+      const text = readText(file);
+      if (!text) continue;
+      let offset = 0, lineNo = 0;
+      for (const raw of text.split("\n")) {
+        lineNo += 1;
+        // A header inside a string literal is not a header: strip literals before judging the line.
+        const match = TELEMETRY_HEADER.exec(raw.replace(STRING_ON_LINE, '""'));
+        if (match) {
+          // Locate on the RAW line: literal stripping can shift columns, and the finding must not.
+          const column = Math.max(raw.indexOf(match[1]) + 1, 1);
+          if (!concreteUrn.test(match[1])) {
+            violations.push({ rule_id: RULE, file, line: lineNo, col: column,
+              evidence: `${match[1]} is not a concrete telemetry URN telemetry:{kind}:{plane}:{theme}:{artifact}[:{measure}]`,
+              source_line: raw.trim() });
+          } else if (!ids.has(match[1])) {
+            violations.push({ rule_id: RULE, file, line: lineNo, col: column,
+              evidence: `${match[1]} does not resolve to a tracking-plan item under telemetry/`,
+              source_line: raw.trim() });
+          }
+        }
+        offset += raw.length + 1;
+      }
+    }
+  }
+}
+process.stderr.write(`bun-telemetry[source-binding]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_telemetry_code/checks/t_vendor_sdk.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.telemetry-vendor-sdk  (telemetry code family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf } from "../../../lib/imports.mjs";
+import { registry } from "../registry.mjs";
+
+// Core depends only on a neutral TelemetryPort. Vendor SDKs and exporters belong in
+// the outer infrastructure adapters: the integration layer, or an infrastructure/
+// directory. A layered file that is neither has no business importing a vendor SDK —
+// type-only imports included, because the coupling is real even when erased.
+const RULE = "coder.bun.telemetry-vendor-sdk";
+const VENDOR_SDK = /^(?:@opentelemetry\/|@sentry\/|@datadog\/|@posthog\/|@statsig\/|@braze\/|@heap\/|@rudderstack\/|@segment\/|@amplitude\/|@mixpanel\/|dd-trace$|newrelic$|segment$|mixpanel$|amplitude$)/;
+const INFRASTRUCTURE = /[/\\]infrastructure[/\\]/;
+
+const { adopted } = await registry();
+const violations = [];
+if (adopted) {
+  const excludes = readExcludes();
+  for (const root of readRoots()) {
+    for (const file of walk(root, excludes, SOURCE_EXT)) {
+      const layer = layerOf(file);
+      if (!layer || layer === "integration" || INFRASTRUCTURE.test(file)) continue;
+      const text = readText(file);
+      if (!text) continue;
+      for (const specifier of allImportSpecifiers(text)) {
+        if (!VENDOR_SDK.test(specifier)) continue;
+        const at = text.indexOf(specifier);
+        violations.push({ rule_id: RULE, file, ...locate(text, at === -1 ? 0 : at),
+          evidence: `${layer} layer imports telemetry vendor SDK '${specifier}'; core depends only on the TelemetryPort — wire exporters in infrastructure adapters (integration layer)` });
+      }
+    }
+  }
+}
+process.stderr.write(`bun-telemetry[vendor-sdk]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_telemetry_code/detect.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env bun
+// FAMILY validator: bun_telemetry_code
+// Runs each member check (checks/*.mjs) VERBATIM as a subprocess and merges their
+// RAW v1.1 reports into one — one implementation realizing a family of rule_ids.
+// Files whose name begins with `_` are skipped: they are shared helpers.
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, mkdtempSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const reportPath = process.env.ATDD_VIOLATIONS_REPORT;
+if (!reportPath) {
+  process.stderr.write("family: ATDD_VIOLATIONS_REPORT is not set\n");
+  process.exit(2);
+}
+const checks = readdirSync(join(here, "checks"))
+  .filter((f) => (f.endsWith(".mjs") || f.endsWith(".ts")) && !f.startsWith("_"))
+  .sort();
+const td = mkdtempSync(join(tmpdir(), "atdd-bun-fam-"));
+const out = [];
+let crashed = false;
+for (const c of checks) {
+  const rep = join(td, c + ".json");
+  let exitedCleanly = true;
+  try {
+    execFileSync(process.execPath, [join(here, "checks", c)], {
+      env: { ...process.env, ATDD_VIOLATIONS_REPORT: rep },
+      stdio: ["ignore", "ignore", "inherit"],
+    });
+  } catch {
+    exitedCleanly = false; /* a member may exit non-zero after writing its report */
+  }
+  let read = false;
+  try {
+    out.push(...JSON.parse(readFileSync(rep, "utf8")).violations);
+    read = true;
+  } catch {}
+  // A member that crashed WITHOUT a report is a detector bug, and swallowing it here is a silent
+  // pass — the exact failure that once hid a broken regex behind zero findings. Fail loudly.
+  if (!exitedCleanly && !read) {
+    process.stderr.write(`family bun_telemetry_code: member ${c} crashed without a violation report\n`);
+    crashed = true;
+  }
+}
+if (crashed) process.exit(2); // a crashed member is a detector bug: fail loudly, not silently
+writeFileSync(reportPath, JSON.stringify({ violations: out }, null, 2), "utf8");
+process.stderr.write("family bun_telemetry_code: " + out.length + " violation(s)\n");
+process.exit(0);

package/detectors/bun_telemetry_code/fixtures/clean/plan/commons/E001.yaml

@@ -0,0 +1,10 @@
+urn: wmbt:commons:E001
+acceptances:
+  - identity:
+      urn: acc:commons:E001-UNIT-001
+    telemetry:
+      disposition: required
+      events:
+        - telemetry:event:be:commons:response-invocation-accepted
+      metrics:
+        - telemetry:metric:be:commons:response-invocation-accepted:duration

package/detectors/bun_telemetry_code/fixtures/clean/plan/commons/E002.yaml

@@ -0,0 +1,7 @@
+urn: wmbt:commons:E002
+acceptances:
+  - identity:
+      urn: acc:commons:E002-UNIT-001
+    telemetry:
+      disposition: not-applicable
+      rationale: No externally useful observable outcome beyond the tested return value.

package/detectors/bun_telemetry_code/fixtures/clean/plan/commons/_commons.yaml

@@ -0,0 +1,6 @@
+urn: wagon:commons
+wagon: commons
+produce:
+  - name: commons:response-invocation
+    contract: null
+    telemetry: telemetry:commons:response-invocation-accepted

package/detectors/bun_telemetry_code/fixtures/clean/src/wagons/commons/features/ingress/domain/accept-response.ts

@@ -0,0 +1,8 @@
+// Telemetry: telemetry:event:be:commons:response-invocation-accepted
+// Telemetry: telemetry:metric:be:commons:response-invocation-accepted:duration
+export type TelemetryPort = { emit(id: string, properties: Record<string, unknown>): void };
+
+export function acceptResponse(response: { id: string }, telemetry: TelemetryPort): void {
+  telemetry.emit("telemetry:event:be:commons:response-invocation-accepted", { response_id: response.id, outcome: "accepted" });
+  telemetry.emit("telemetry:metric:be:commons:response-invocation-accepted:duration", { outcome: "accepted" });
+}

package/detectors/bun_telemetry_code/fixtures/clean/src/wagons/commons/features/ingress/infrastructure/otel-adapter.ts

@@ -0,0 +1,8 @@
+// The one place a telemetry vendor SDK may appear: the outer adapter.
+import { metrics } from "@opentelemetry/api";
+
+export const otelTelemetry = {
+  emit(id: string, properties: Record<string, unknown>): void {
+    metrics.getMeter("commons").createCounter(id.replace(/^telemetry:/, "")).add(1, properties as Record<string, string>);
+  },
+};

package/detectors/bun_telemetry_code/fixtures/clean/telemetry/commons/response-invocation-accepted/event.be.json

@@ -0,0 +1,16 @@
+{
+  "id": "telemetry:event:be:commons:response-invocation-accepted",
+  "version": "1.0.0",
+  "logical_artifact": "telemetry:commons:response-invocation-accepted",
+  "kind": "event",
+  "plane": "be",
+  "owner": "commons",
+  "purpose": "Records that a response invocation passed acceptance so ingress health can be audited.",
+  "acceptances": ["acc:commons:E001-UNIT-001"],
+  "properties": {
+    "response_id": { "type": "string", "classification": "internal", "cardinality": "high" },
+    "outcome": { "type": "string", "allowed_values": ["accepted"] }
+  },
+  "required": ["response_id", "outcome"],
+  "forbidden_properties": ["raw_payload", "secret", "prompt"]
+}

package/detectors/bun_telemetry_code/fixtures/clean/telemetry/commons/response-invocation-accepted/metric.be.duration.json

@@ -0,0 +1,19 @@
+{
+  "id": "telemetry:metric:be:commons:response-invocation-accepted:duration",
+  "version": "1.0.0",
+  "logical_artifact": "telemetry:commons:response-invocation-accepted",
+  "kind": "metric",
+  "plane": "be",
+  "measure": "duration",
+  "instrument": "histogram",
+  "unit": "ms",
+  "owner": "commons",
+  "purpose": "Bounds how long an accepted response invocation takes to complete end to end.",
+  "acceptances": ["acc:commons:E001-UNIT-001"],
+  "properties": {
+    "outcome": { "type": "string", "classification": "internal", "cardinality": "low" }
+  },
+  "required": ["outcome"],
+  "dimensions": [{ "name": "outcome", "cardinality": "low" }],
+  "timing": ["post-commit"]
+}

package/detectors/bun_telemetry_code/fixtures/clean/tests/wagons/commons/features/ingress/unit/accept-response.telemetry.test.ts

@@ -0,0 +1,13 @@
+// URN: test:commons:ingress:E001-UNIT-001
+// Acceptance: acc:commons:E001-UNIT-001
+// Telemetry: telemetry:event:be:commons:response-invocation-accepted
+// Telemetry: telemetry:metric:be:commons:response-invocation-accepted:duration
+import { expect, mock, test } from "bun:test";
+import { acceptResponse } from "../../../../../src/wagons/commons/features/ingress/domain/accept-response";
+
+test("emits the planned event once the invocation commits", () => {
+  const emit = mock(() => {});
+  acceptResponse({ id: "r-1" }, { emit });
+  expect(emit).toHaveBeenCalledWith("telemetry:event:be:commons:response-invocation-accepted", { response_id: "r-1", outcome: "accepted" });
+  expect(emit).toHaveBeenCalledWith("telemetry:metric:be:commons:response-invocation-accepted:duration", { outcome: "accepted" });
+});

package/detectors/bun_telemetry_code/fixtures/clean/tests/wagons/commons/features/ingress/unit/accept-response.test.ts

@@ -0,0 +1,9 @@
+// Tests are not implementation source: the emit vocabulary is theirs to use freely.
+import { expect, test } from "bun:test";
+
+test("an accepted response emits the planned event", () => {
+  const emitted: Array<[string, Record<string, unknown>]> = [];
+  const sink = { emit: (id: string, properties: Record<string, unknown>) => emitted.push([id, properties]) };
+  sink.emit("fixture_only_probe_event", {});
+  expect(emitted).toContainEqual(["fixture_only_probe_event", {}]);
+});

package/detectors/bun_telemetry_code/fixtures/dirty/plan/commons/E001.yaml

@@ -0,0 +1,8 @@
+urn: wmbt:commons:E001
+acceptances:
+  - identity:
+      urn: acc:commons:E001-UNIT-001
+    telemetry:
+      disposition: required
+      events:
+        - telemetry:event:be:commons:response-invocation-accepted

package/detectors/bun_telemetry_code/fixtures/dirty/plan/commons/_commons.yaml

@@ -0,0 +1,6 @@
+urn: wagon:commons
+wagon: commons
+produce:
+  - name: commons:response-invocation
+    contract: null
+    telemetry: telemetry:commons:response-invocation-accepted

package/detectors/bun_telemetry_code/fixtures/dirty/src/wagons/commons/features/ingress/domain/accept-response.ts

@@ -0,0 +1,13 @@
+// Telemetry: telemetry:event:be:commons:unknown-item
+// Telemetry: order-created
+export function acceptResponse(
+  response: { id: string; raw: string },
+  telemetry: { emit(id: string, properties: Record<string, unknown>): void },
+): void {
+  telemetry.emit("order_accepted", { orderId: 7 });
+  telemetry.emit("telemetry:event:be:commons:response-invocation-accepted", {
+    response_id: response.id,
+    raw_payload: response.raw,
+    secret: "k",
+  });
+}

package/detectors/bun_telemetry_code/fixtures/dirty/src/wagons/commons/features/ingress/domain/tracing.ts

@@ -0,0 +1,3 @@
+import { trace } from "@opentelemetry/api";
+
+export const tracer = trace.getTracer("commons");