@celilo/cli 0.21.0 → 0.23.0

package/src/cli/commands/module-remove.ts

@@ -24,6 +24,11 @@ import {
 } from '../../services/celilo-events';
 import { getContainerService, getServiceCredentials } from '../../services/container-service';
 import { completeOperation, failOperation, startOperation } from '../../services/module-operations';
+import {
+  type DependentCandidate,
+  describeRemovalRefusal,
+  findRemovalBlockers,
+} from '../../services/remove-guard';
 import { cleanupWebRoutesForModule } from '../../services/web-route-cleanup';
 import { getArg, hasFlag, validateRequiredArgs } from '../parser';
 import { log } from '../prompts';
@@ -81,23 +86,26 @@ export async function handleModuleRemove(
     .all();
 
   if (providedCapabilities.length > 0) {
-    const providedNames = new Set(providedCapabilities.map((c) => c.capabilityName));
+    const providedNames = providedCapabilities.map((c) => c.capabilityName);
     const otherModules = db.select().from(modules).where(ne(modules.id, moduleId)).all();
 
-    const dependents = otherModules
-      .filter((m) => {
-        const parsed = ModuleManifestSchema.safeParse(m.manifestData);
-        if (!parsed.success) return false;
-        return (parsed.data.requires?.capabilities ?? []).some((req) =>
-          providedNames.has(req.name),
-        );
-      })
-      .map((m) => m.id);
-
-    if (dependents.length > 0) {
+    const candidates: DependentCandidate[] = [];
+    for (const m of otherModules) {
+      const parsed = ModuleManifestSchema.safeParse(m.manifestData);
+      if (!parsed.success) continue;
+      candidates.push({
+        id: m.id,
+        manifest: parsed.data,
+        paused: m.state === 'PAUSED',
+        deployed: !(['IMPORTED', 'VALIDATED', 'CONFIGURED'] as string[]).includes(m.state),
+      });
+    }
+
+    const blockers = findRemovalBlockers(providedNames, candidates);
+    if (blockers.length > 0) {
       return {
         success: false,
-        error: `Cannot remove '${moduleId}': the following installed modules depend on its capabilities: ${dependents.join(', ')}`,
+        error: describeRemovalRefusal(moduleId, blockers),
       };
     }
   }
@@ -163,9 +171,9 @@ async function performModuleRemove(
   // prompt on hook failure.
   const manifestForHook = module.manifestData as { hooks?: { on_uninstall?: unknown } } | undefined;
   if (manifestForHook?.hooks?.on_uninstall) {
-    // Match build-stream's TTY detection: in non-TTY contexts (tests,
-    // pipes, CI) skipAnimation prevents the gauge's setInterval and
-    // raw-stdin handlers from blocking process exit.
+    // Match build-stream's TTY detection: in non-TTY contexts (tests, pipes,
+    // CI) skipAnimation prevents the gauge's setInterval and raw-stdin
+    // handlers from blocking process exit.
     const isInteractive = process.stdout.isTTY && process.stdin.isTTY;
     const gauge = new FuelGauge(`${moduleId}: on_uninstall`, {
       skipAnimation: !isInteractive,
@@ -173,35 +181,65 @@ async function performModuleRemove(
     gauge.start();
     const logger = createGaugeLogger(gauge, moduleId, 'on_uninstall');
     const hookResult = await runNamedHook(moduleId, 'on_uninstall', db, logger, {});
+
     if (hookResult.success) {
       gauge.stop(true);
     } else {
       gauge.stop(false);
-      log.warn(`on_uninstall failed: ${hookResult.error ?? 'unknown error'}`);
-      if (force) {
-        log.info('--force set, continuing removal despite hook failure');
-      } else if (!isInteractive) {
-        // Non-TTY (tests, scripts, piped input). Don't try to prompt —
-        // @clack/prompts hangs on stdin in that context. Default
-        // behaviour: continue with removal so a hook crash doesn't
-        // wedge automation. Operators who want strict failure can
-        // re-run `celilo module run-hook <id> on_uninstall` manually.
-        log.warn('Non-interactive context detected; continuing removal despite hook failure');
-      } else {
-        const proceed = await withInterviewSession(() =>
-          askConfirm({
-            scope: `module-remove:${moduleId}`,
-            key: 'continue_after_hook_failure',
-            message:
-              'on_uninstall hook failed. Continue removing the module anyway? ' +
-              '(some external state may not be cleaned up)',
-            defaultValue: false,
-          }),
-        );
-        if (!proceed) {
-          return { success: false, error: 'Removal cancelled after on_uninstall failure' };
-        }
+      const reason = hookResult.error ?? 'unknown error';
+
+      if (!force) {
+        // STOP, and leave the module ERRORED. Do not ask.
+        //
+        // `on_uninstall` is what withdraws a module's cross-module state —
+        // caddy unexposes its ports and clears its Caddyfile, a firewall
+        // provider withdraws its forwards. If it failed, that state is still
+        // out there and we do not know how much of it the hook managed before
+        // dying. Deleting the module now orphans whatever is left, with no
+        // record of what to go clean up.
+        //
+        // This previously asked "continue removing anyway?" in a TTY and
+        // silently continued when not one. Both were wrong. The prompt offers
+        // the orphaning decision at the least informed possible moment — inside
+        // a Y/N, before anyone has looked at the machine — and the non-TTY
+        // default made orphaning the norm for every scripted removal.
+        //
+        // The module is marked ERROR rather than left reading INSTALLED,
+        // because the previous behaviour recorded the failure only in a
+        // `module_operations` row: `module list` and `system doctor` both
+        // showed the module as perfectly healthy while its teardown had failed.
+        //
+        // The way forward is deliberate: go look, clean up by hand, then
+        // re-run with --force, which means "I have remediated; drop the
+        // record."
+        db.update(modules)
+          .set({
+            state: 'ERROR',
+            errorMessage: `on_uninstall failed: ${reason}`,
+            updatedAt: new Date(),
+          })
+          .where(eq(modules.id, moduleId))
+          .run();
+
+        return {
+          success: false,
+          error: [
+            `Cannot remove '${moduleId}': its on_uninstall hook failed, so cross-module state it registered (port forwards, DNS records, web routes) may still exist.`,
+            '',
+            `  ${reason}`,
+            '',
+            `'${moduleId}' is now marked ERROR and has NOT been removed. Inspect what the hook left behind, clean it up, then re-run:`,
+            `  celilo module remove ${moduleId} --force`,
+            '',
+            '--force means "I have remediated this by hand; delete the record anyway".',
+          ].join('\n'),
+        };
       }
+
+      log.warn(`on_uninstall failed: ${reason}`);
+      log.info(
+        '--force set: continuing removal. Any state the hook left behind is yours to clean up.',
+      );
     }
   }
 

package/src/cli/commands/module-status.ts

@@ -62,10 +62,9 @@ export async function handleModuleStatus(args: string[]): Promise<CommandResult>
     .where(eq(capabilities.moduleId, moduleId))
     .all();
 
-  // Build sections as multi-line blocks joined by \n\n.
-  // The display code in index.ts splits on \n\n and passes each section
-  // as a single multi-line string to p.log.message(), avoiding clack's
-  // per-line extra spacing.
+  // Build sections as multi-line blocks joined by \n\n. index.ts writes the
+  // whole message to stdout verbatim, so the blank line between sections is
+  // exactly what the operator sees.
   const sections: string[] = [];
 
   // Section 1: Module metadata

package/src/cli/commands/module-update.test.ts

@@ -143,7 +143,7 @@ description: fixture
   });
 
   test('quiet=true suppresses the per-call log lines (caller renders its own)', async () => {
-    // We can't easily intercept @clack's log output without adding test
+    // We can't easily intercept the log helpers' output without adding test
     // hooks, so instead we exercise that the call simply succeeds and
     // returns the structured outcome — the sweep relies on this to
     // render its own output without duplicates. A non-quiet call

package/src/cli/commands/proxmox-template-selection.ts

@@ -60,7 +60,7 @@ function compareDescending(a: ParsedUbuntu, b: ParsedUbuntu): number {
 
 /**
  * Build the option list used by the select prompt and tests.
- * Exported so tests can assert on filtering/sorting without mocking @clack.
+ * Exported so tests can assert on filtering/sorting without driving a prompt.
  */
 export function buildUbuntuOptions(appliances: ProxmoxAppliance[]): ParsedUbuntu[] {
   return appliances

package/src/cli/commands/status.ts

@@ -10,6 +10,7 @@ import { eq } from 'drizzle-orm';
 import { getDb } from '../../db/client';
 import { capabilities, moduleConfigs, modules, systemConfig, systemSecrets } from '../../db/schema';
 import { type ModuleManifest, getSingularSystemSpec } from '../../manifest/schema';
+import { formatPausedDuration } from '../../services/module-pause';
 import type { CommandResult } from '../types';
 
 /**
@@ -26,10 +27,21 @@ async function determineModuleStatus(
   generatedPath: string,
   dbState: string,
 ): Promise<{
-  status: 'IMPORTED' | 'CONFIGURED' | 'GENERATED' | 'DEPLOYED' | 'VERIFIED' | 'NEEDS_UPDATE';
+  status:
+    | 'IMPORTED'
+    | 'CONFIGURED'
+    | 'GENERATED'
+    | 'DEPLOYED'
+    | 'VERIFIED'
+    | 'NEEDS_UPDATE'
+    | 'PAUSED';
   missingCount?: number;
 }> {
-  // Deployed states come directly from the DB — don't infer from filesystem
+  // Deployed states come directly from the DB — don't infer from filesystem.
+  // PAUSED is checked FIRST: a paused module still has a generated/ directory
+  // and a full config, so every derivation below it would report it as an
+  // ordinary deployed module and the pause would be invisible here.
+  if (dbState === 'PAUSED') return { status: 'PAUSED' };
   if (dbState === 'VERIFIED') return { status: 'VERIFIED' };
   if (dbState === 'INSTALLED') return { status: 'DEPLOYED' };
 
@@ -120,6 +132,9 @@ export async function handleStatus(): Promise<CommandResult> {
         );
 
         // Status icon
+        // A paused module is deliberately out of service, so it must never
+        // carry the same ✓ as a healthy one — that is exactly how a pause turns
+        // into an outage nobody notices.
         const icon =
           statusInfo.status === 'VERIFIED' ||
           statusInfo.status === 'DEPLOYED' ||
@@ -128,7 +143,14 @@ export async function handleStatus(): Promise<CommandResult> {
             : '⚠';
 
         lines.push(`  ${icon} ${module.id} (v${module.version})`);
-        lines.push(`    Status: ${statusInfo.status}`);
+        if (statusInfo.status === 'PAUSED') {
+          // State plus AGE — a pause with alerting suppressed is only safe if
+          // how long it has run is impossible to miss (design D7).
+          lines.push(`    Status: PAUSED (${formatPausedDuration(module.pausedAt)})`);
+          if (module.pauseReason) lines.push(`    Paused: ${module.pauseReason}`);
+        } else {
+          lines.push(`    Status: ${statusInfo.status}`);
+        }
 
         // Type: VPS or Container
         const zone = getSingularSystemSpec(manifest)?.zone;

package/src/cli/completion.ts

@@ -113,6 +113,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'list-subscribers',
       'resync-subscriptions',
       'list-pending',
+      'list-failed',
       'list-unanswered',
       'drain',
       'run',
@@ -193,6 +194,8 @@ export async function getCompletions(words: string[], current: number): Promise<
       'terraform-unlock',
       'types',
       'validate',
+      'pause',
+      'unpause',
     ];
     return filterSuggestions(subcommands, args[1] || '');
   }
@@ -436,6 +439,8 @@ export async function getCompletions(words: string[], current: number): Promise<
       'terraform-unlock',
       'verify',
       'audit', // deprecation alias for `verify`
+      'pause',
+      'unpause',
     ];
     if (moduleCommands.includes(args[1] || '')) {
       const db = getDb();

package/src/cli/fuel-gauge.ts

@@ -10,7 +10,7 @@
  */
 
 import { stdout } from 'node:process';
-import * as p from '@clack/prompts';
+import { log } from '@celilo/cli-display';
 import { getActiveDisplay } from './prompts';
 
 /**
@@ -173,7 +173,7 @@ export class FuelGauge {
     if (!this.running) return;
 
     this.cleanup();
-    p.log.info(`${this.title} (backgrounded)`);
+    log.info(`${this.title} (backgrounded)`);
 
     if (this.onBackground) {
       this.onBackground();
@@ -208,9 +208,9 @@ export class FuelGauge {
     this.cleanup();
 
     if (success) {
-      p.log.success(this.title);
+      log.success(this.title);
     } else {
-      p.log.error(this.title);
+      log.error(this.title);
       console.log('');
       console.log(colors.dim('Last output:'));
       const errorLines = this.outputLines.slice(-this.errorDisplayLines);

package/src/cli/index.ts

@@ -4,6 +4,7 @@
  * Orchestration function (Rule 10.1) - routes commands to handlers
  */
 
+import { log as uiLog } from '@celilo/cli-display';
 import {
   COMMANDS,
   type CommandDef,
@@ -11,7 +12,6 @@ import {
   resolveRemote,
   runRemoteClient,
 } from '@celilo/core';
-import * as p from '@clack/prompts';
 import { CLIServerRequestSchema, parseJsonWithValidation } from '../validation/schemas';
 import {
   handleApiAuthorizedKeys,
@@ -32,6 +32,7 @@ import {
   handleEventsEmit,
   handleEventsFail,
   handleEventsInstallDaemon,
+  handleEventsListFailed,
   handleEventsListPending,
   handleEventsListSubscribers,
   handleEventsListUnanswered,
@@ -76,6 +77,7 @@ import { handleModuleJournal } from './commands/module-journal';
 import { handleModuleList } from './commands/module-list';
 import { handleModuleLogs } from './commands/module-logs';
 import { handleModuleOperations } from './commands/module-operations';
+import { handleModulePause, handleModuleUnpause } from './commands/module-pause';
 import { handleModulePublish } from './commands/module-publish';
 import { handleModuleRemove } from './commands/module-remove';
 import { handleModuleSearch } from './commands/module-search';
@@ -300,6 +302,7 @@ Subcommands:
   list-subscribers             List persistent bus subscribers
   resync-subscriptions         Rebuild subscribers from deployed modules' manifests (after a restore/migration)
   list-pending [--subscriber]  List pending deliveries
+  list-failed [--subscriber]   List failed/abandoned deliveries with a true total
   drain [--concurrency N]      Process pending deliveries once and return
   run [--poll-ms N]            Run the long-running dispatcher (foreground)
   emit <type> [<payload>]      Emit an event (operator/test path)
@@ -576,6 +579,20 @@ Subcommands:
 
   remove <id>                          Remove a module and all its data
 
+  pause <id>                           Quiesce a module without uninstalling it (container keeps running)
+    Options:
+      --cascade                        Also pause every dependent module, consumers first
+      --stop-infra                     Also stop the module's container or service
+      --reason <text>                  Why the pause was taken, recorded on the module
+      --dry-run                        Print the ordered plan and change nothing
+      --yes                            Skip the cascade confirmation
+
+  unpause <id>                         Redeploy a paused module, rebinding it to current providers
+    Options:
+      --cascade                        Also unpause every dependent module, providers first
+      --dry-run                        Print the ordered plan and change nothing
+      --yes                            Skip the cascade confirmation
+
   verify <id>                          Verify module integrity (signature + checksums)
                                          (legacy alias: 'audit')
 
@@ -647,6 +664,12 @@ Examples:
   celilo module publish ./modules/*                # publish every module in a dir
   celilo module list
   celilo module remove homebridge
+
+  # Swap a capability provider (e.g. a replaced edge router):
+  celilo module pause --cascade greenwave --reason "ISP swapped the router"
+  celilo module remove greenwave
+  celilo module import axon && celilo module deploy axon
+  celilo module unpause --cascade axon
   celilo module verify homebridge
   celilo module config set homebridge hostname myhost
   celilo module config set homebridge container_ip "192.168.0.110/24"
@@ -1395,8 +1418,8 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
     const { main: runPublish } = await import('./commands/publish');
     await runPublish(publishArgv);
     // runPublish handles its own console output (multi-phase, multi-line);
-    // returning an empty success message tells the outer CLI loop to skip
-    // the clack outro and exit 0 cleanly. Any failure inside runPublish
+    // returning an empty success message tells the outer CLI loop to write
+    // nothing more and exit 0 cleanly. Any failure inside runPublish
     // calls process.exit() directly and never returns here.
     return { success: true, message: '' };
   }
@@ -1425,6 +1448,8 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         return handleEventsResyncSubscriptions();
       case 'list-pending':
         return handleEventsListPending(parsed.args, parsed.flags);
+      case 'list-failed':
+        return handleEventsListFailed(parsed.args, parsed.flags);
       case 'list-unanswered':
         return handleEventsListUnanswered(parsed.args, parsed.flags);
       case 'drain':
@@ -1495,6 +1520,10 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         return handleModuleHealth(parsed.args, parsed.flags);
       case 'operations':
         return handleModuleOperations(parsed.args, parsed.flags);
+      case 'pause':
+        return handleModulePause(parsed.args, parsed.flags);
+      case 'unpause':
+        return handleModuleUnpause(parsed.args, parsed.flags);
       case 'remove':
         return handleModuleRemove(parsed.args, parsed.flags);
       case 'update':
@@ -2461,31 +2490,31 @@ export async function main(): Promise<void> {
         process.exit(0);
       }
 
-      // Script-friendly commands bypass clack and write directly to stdout
-      if (result.rawOutput) {
-        process.stdout.write(`${result.message}\n`);
-        process.exit(0);
-      }
-
       // Empty message → command already emitted its own output (e.g. via
-      // ProgressDisplay) and doesn't want a clack outro on top.
+      // ProgressDisplay) and doesn't want anything written on top.
       if (!result.message) {
         process.exit(0);
       }
 
-      // Handle multi-line messages: split on section boundaries (\n\n) so
-      // lines within a section are logged together (avoiding clack's per-call spacing).
-      const sections = result.message.split('\n\n');
-      p.log.success(sections[0]);
-      for (let i = 1; i < sections.length; i++) {
-        if (sections[i].trim()) {
-          p.log.message(sections[i]);
-        }
-      }
+      // A successful command's message IS its result, so it goes to stdout
+      // verbatim — no glyph, no `│  ` prefix, no re-wrapping on `\n\n`.
+      //
+      // `rawOutput` no longer selects a different destination; it is kept
+      // because it still records which commands are contractually
+      // machine-readable, and because JSON payloads must never acquire a
+      // decoration if this branch ever grows one again (celilo#698).
+      //
+      // The old path split the message on `\n\n` and fed each section to the
+      // clack renderer, which prefixed every line. That is what made
+      // `line.startsWith('<module-id> ')` over `celilo module list` match
+      // nothing — read in celilo#695 as a missing module rather than as a
+      // parse failure, at the cost of a full e2e run.
+      process.stdout.write(`${result.message}\n`);
       process.exit(0);
     }
 
-    p.log.error(`Error: ${result.error}`);
+    // Diagnostics go to stderr so a caller can separate them from the result.
+    uiLog.error(`Error: ${result.error}`);
     if (result.details) {
       console.error('Details:', result.details);
     }

package/src/cli/json-output.test.ts

@@ -0,0 +1,162 @@
+/**
+ * Recurrence gate for celilo#698 — a command that emits JSON must emit JSON
+ * that parses, with no preprocessing.
+ *
+ * `cli/index.ts` already implements the rule: a `CommandResult` carrying
+ * `rawOutput: true` is written straight to stdout, while everything else goes
+ * through the decorating renderer that prefixes each line with `│  ` and wraps
+ * it in ANSI colour. A JSON payload that forgets the flag therefore reaches
+ * stdout as something no `JSON.parse` will accept — and the workaround
+ * (`| sed 's/\x1b\[[0-9;]*m//g'`) got written into CLAUDE.md instead of the fix.
+ *
+ * Two gates here, deliberately different in kind:
+ *
+ *  1. `emits parseable JSON` — spawns the REAL CLI and parses its raw stdout.
+ *     This is the honest end-to-end check, and it is the one that fails today
+ *     without the fix. It cannot use `CLIContext`: that harness drives the CLI
+ *     in `CLI_SERVER_MODE`, which returns `result.message` over a protocol and
+ *     never exercises the stdout renderer where the bug lives.
+ *
+ *  2. `every JSON CommandResult sets rawOutput` — a static scan, so a NEW
+ *     command that forgets the flag fails even though nobody added it to the
+ *     table above.
+ *
+ * Lives under `src/` rather than `test-integration/` for one blunt reason:
+ * `test-integration/` is run by no CI workflow (the `validate` job runs
+ * `test:unit`, which is `bun test src/`), so a gate placed there would never
+ * have failed anything. See celilo#703.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { spawnSync } from 'node:child_process';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { type IntegrationTestContext, setupIntegrationTest } from '@/test-utils/integration';
+
+const COMMANDS_DIR = join(import.meta.dir, 'commands');
+
+/**
+ * Commands whose stdout is a JSON document. Each is spawned as a real process
+ * and its stdout handed to `JSON.parse` verbatim.
+ *
+ * `events` verbs share one `jsonResult()` helper, so a few representatives
+ * cover all 16 of its call sites; the rest are the distinct `--json` surfaces.
+ */
+const JSON_COMMANDS = [
+  'events status',
+  'events tail --limit 5',
+  'events list-subscribers',
+  'module list --json',
+  'module health --json',
+  'system audit --json',
+  'alerts list --json',
+  'commands --json',
+] as const;
+
+describe('celilo#698 — JSON commands emit parseable JSON', () => {
+  let ctx: IntegrationTestContext;
+
+  beforeAll(async () => {
+    ctx = await setupIntegrationTest();
+  });
+
+  afterAll(async () => {
+    await ctx.cleanup();
+  });
+
+  for (const command of JSON_COMMANDS) {
+    test(`celilo ${command} emits parseable JSON`, () => {
+      const result = spawnSync('bun', ['run', 'src/cli/index.ts', ...command.split(' ')], {
+        encoding: 'utf8',
+        env: {
+          ...process.env,
+          CELILO_DB_PATH: ctx.dbPath,
+          CELILO_DATA_DIR: ctx.dataDir,
+          CELILO_SUPPRESS_DEPRECATION: '1',
+        },
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 60_000,
+      });
+
+      expect(
+        result.status,
+        `celilo ${command} exited ${result.status}\nstderr: ${result.stderr}`,
+      ).toBe(0);
+
+      // Verbatim: no ANSI stripping, no prefix removal, no line filtering.
+      // If this throws, the payload went through the decorating renderer.
+      expect(() => JSON.parse(result.stdout)).not.toThrow();
+    });
+  }
+});
+
+/**
+ * Walk from the index of a `{` to the index just past its matching `}`,
+ * skipping over string literals so a brace inside a string doesn't unbalance
+ * the count.
+ */
+function objectEnd(source: string, open: number): number {
+  let depth = 0;
+  for (let i = open; i < source.length; i++) {
+    const char = source[i];
+    if (char === '{') {
+      depth++;
+    } else if (char === '}') {
+      depth--;
+      if (depth === 0) return i + 1;
+    } else if (char === '"' || char === "'" || char === '`') {
+      const quote = char;
+      i++;
+      while (i < source.length && source[i] !== quote) {
+        if (source[i] === '\\') i++;
+        i++;
+      }
+    }
+  }
+  return -1;
+}
+
+/** Index of the `{` opening the object literal that encloses `index`. */
+function enclosingObjectStart(source: string, index: number): number {
+  let depth = 0;
+  for (let i = index; i >= 0; i--) {
+    if (source[i] === '}') {
+      depth++;
+    } else if (source[i] === '{') {
+      if (depth === 0) return i;
+      depth--;
+    }
+  }
+  return -1;
+}
+
+describe('celilo#698 recurrence gate — every JSON CommandResult sets rawOutput', () => {
+  const files = readdirSync(COMMANDS_DIR).filter(
+    (f) => f.endsWith('.ts') && !f.endsWith('.test.ts'),
+  );
+
+  test('command files exist to scan', () => {
+    expect(files.length).toBeGreaterThan(0);
+  });
+
+  for (const file of files) {
+    test(`${file} sets rawOutput on every JSON message`, () => {
+      const source = readFileSync(join(COMMANDS_DIR, file), 'utf8');
+      const pattern = /\bmessage:\s*JSON\.stringify\b/g;
+      let match: RegExpExecArray | null = pattern.exec(source);
+
+      while (match !== null) {
+        const open = enclosingObjectStart(source, match.index);
+        const literal = open < 0 ? '' : source.slice(open, objectEnd(source, open));
+        const line = source.slice(0, match.index).split('\n').length;
+
+        expect(
+          /\brawOutput\b/.test(literal),
+          `${file}:${line} returns a JSON message without rawOutput: true. Without the flag the payload goes through the decorating renderer and no longer parses. Add \`rawOutput: true\` to the same result object.`,
+        ).toBe(true);
+
+        match = pattern.exec(source);
+      }
+    });
+  }
+});