@fairfox/polly 0.82.1 → 0.84.0

package/dist/tools/bdd/src/run.d.ts

@@ -0,0 +1,8 @@
+import type { RunResult } from "./types.ts";
+export interface RunOptions {
+    featureFiles: string[];
+    stepFiles: string[];
+    /** Only run scenarios carrying this tag (without leading @); ~tag negates. */
+    tagFilter?: string;
+}
+export declare function runFeatures(options: RunOptions): Promise<RunResult>;

package/dist/tools/bdd/src/scaffold.d.ts

@@ -0,0 +1,7 @@
+export interface ScaffoldResult {
+    created: boolean;
+    featurePath: string;
+    messages: string[];
+    fields: string[];
+}
+export declare function scaffoldFeature(cwd: string, name: string, configPath: string): Promise<ScaffoldResult>;

package/dist/tools/bdd/src/steps.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The step-binding registry and matcher.
+ *
+ * `defineStep()` is the consumer-facing keystone: one call registers a binding
+ * that the runner executes (`given`/`when`/`then`) AND the verify extractor
+ * reads (`message`/`stateExpr`). `defineWorld()` records how to build and
+ * cold-reset the real-factory world.
+ *
+ * Patterns use a small Cucumber-expression subset: `{string}`, `{int}`,
+ * `{float}`, `{word}`. Everything else is matched literally. That covers
+ * declarative steps without dragging in the full cucumber-expressions library.
+ *
+ * The registry lives on `globalThis`, not in a module-level array, on purpose:
+ * `polly bdd` ships as two bundles (the CLI and the `@fairfox/polly/bdd`
+ * library export). `build-lib` runs with `splitting: false`, so this module is
+ * *inlined separately into each bundle* — a module-level array would give the
+ * runner and the consumer's `defineWorld` two different registries. A single
+ * global slot is the standard cross-bundle-singleton fix.
+ */
+import type { StepBinding, StepKeyword, WorldDef } from "./types.ts";
+interface CompiledBinding {
+    binding: StepBinding;
+    regex: RegExp;
+}
+interface RegistryState {
+    bindings: CompiledBinding[];
+    worldDef: WorldDef | null;
+}
+declare global {
+    var __pollyBddRegistry__: RegistryState | undefined;
+}
+/** Translate a Cucumber-expression pattern into an anchored RegExp. */
+export declare function compilePattern(pattern: string): RegExp;
+export declare function defineStep(binding: StepBinding): void;
+export declare function defineWorld(def: WorldDef): void;
+export declare function getWorldDef(): WorldDef | null;
+/** Drop all registrations — used between isolated runs/tests. */
+export declare function resetRegistry(): void;
+export interface StepMatch {
+    binding: StepBinding;
+    args: string[];
+}
+/**
+ * Find the binding whose pattern matches `text`. Captured groups become the
+ * step arguments (the `{string}` alternation yields two groups per token, so
+ * we drop the undefined half).
+ *
+ * When `keyword` is given, a binding that *has* the callback for that keyword
+ * wins over one that merely matches the text — so the same phrase can serve as
+ * a `given` precondition in one scenario and a `then` assertion in another.
+ */
+export declare function matchStep(text: string, keyword?: StepKeyword): StepMatch | null;
+/** Snapshot of all registered bindings (for the verify extractor). */
+export declare function registeredBindings(): StepBinding[];
+export {};

package/dist/tools/bdd/src/types.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Shared types for the polly BDD runner.
+ *
+ * The keystone is {@link StepBinding}: one declaration that speaks BOTH layers.
+ * Its `given`/`when`/`then` callbacks drive the *runtime* (the real factory bus
+ * + state signals); its `message`/`stateExpr` strings are statically extracted
+ * for the *verify* cross-link — exactly the dual-use trick `requires()`/
+ * `ensures()` already use (a runtime no-op whose argument text is read by the
+ * TLA+ codegen). See tools/bdd/README.md.
+ */
+/** The minimal slice of a polly MessageBus the runner drives. */
+export interface BusLike {
+    send: (payload: {
+        type: string;
+        [k: string]: unknown;
+    }, options?: {
+        target?: string | string[];
+        tabId?: number;
+        timeout?: number;
+    }) => Promise<unknown>;
+}
+/** The minimal slice of a preact-style signal the runner reads/resets. */
+export interface SignalLike<T = unknown> {
+    value: T;
+}
+/**
+ * Per-scenario execution context handed to every step callback. The bus and
+ * signals are the *real* ones the app uses; `vars` is scratch space for a
+ * scenario (e.g. an id captured in a `When` and asserted in a `Then`).
+ */
+export interface World {
+    bus: BusLike;
+    signals: Record<string, SignalLike>;
+    vars: Record<string, unknown>;
+    /** Response returned by the most recent `bus.send` in a `When`. */
+    lastResponse?: unknown;
+    /** Error thrown by the most recent `When`, if any (for rejection asserts). */
+    lastError?: unknown;
+}
+/**
+ * A step callback: receives the world and the values captured from the text.
+ * The return value is captured as `world.lastResponse` when not undefined — so
+ * a `when` can simply `return world.bus.send(...)` and a later `then` asserts on
+ * the response. `given`/`then` typically return nothing.
+ */
+export type StepFn = (world: World, ...args: string[]) => unknown;
+/**
+ * A step binding — declared once, read by two consumers.
+ *
+ * Runtime: the runner calls `given`/`when`/`then`.
+ * Formal:  the verify extractor reads `message` (the message type a `when`
+ *          sends) and `stateExpr` (the TS state expression a `given`/`then`
+ *          establishes or asserts), turning the scenario into a trace it can
+ *          check against the verification config and TLA+ model.
+ */
+export interface StepBinding {
+    /** Cucumber-expression pattern, e.g. `the user logs in as {string}`. */
+    pattern: string;
+    given?: StepFn;
+    when?: StepFn;
+    then?: StepFn;
+    /** Formal metadata: the message type a `when` step sends. */
+    message?: string;
+    /** Formal metadata: the TS state expression a `given`/`then` establishes/asserts. */
+    stateExpr?: string;
+}
+/** How the app builds and cold-resets its real-factory world. */
+export interface WorldDef {
+    /** Build the world once per runner process (real factory + handlers). */
+    create: () => World | Promise<World>;
+    /** Cold-start reset run before every scenario (signals back to initial). */
+    reset: (world: World) => void | Promise<void>;
+    /**
+     * Optional cleanup run once after all scenarios, even on failure. Most worlds
+     * need nothing (in-process signals die with the runner), but a world that
+     * holds real resources — browsers, an embedded relay, sockets — releases them
+     * here so the runner exits cleanly instead of hanging on live handles.
+     */
+    teardown?: (world: World) => void | Promise<void>;
+}
+export type StepKeyword = "given" | "when" | "then";
+export interface ParsedStep {
+    /** Normalized keyword — And/But resolve to the previous concrete keyword. */
+    keyword: StepKeyword;
+    /** The raw keyword as written (Given/When/Then/And/But), for reporting. */
+    rawKeyword: string;
+    text: string;
+    line: number;
+}
+export interface ParsedScenario {
+    name: string;
+    tags: string[];
+    steps: ParsedStep[];
+    line: number;
+    /** True when expanded from a Scenario Outline row. */
+    fromOutline?: boolean;
+}
+export interface ParsedFeature {
+    name: string;
+    description: string;
+    tags: string[];
+    /** Background steps prepended to every scenario, already keyword-normalized. */
+    background: ParsedStep[];
+    scenarios: ParsedScenario[];
+    file: string;
+}
+export type StepOutcome = "pass" | "fail" | "undefined" | "skipped";
+export interface StepResult {
+    text: string;
+    rawKeyword: string;
+    outcome: StepOutcome;
+    message?: string;
+}
+export type ScenarioOutcome = "pass" | "fail" | "undefined" | "deferred-formal";
+export interface ScenarioResult {
+    feature: string;
+    scenario: string;
+    tags: string[];
+    outcome: ScenarioOutcome;
+    steps: StepResult[];
+    file: string;
+}
+export interface RunResult {
+    scenarios: ScenarioResult[];
+    passed: number;
+    failed: number;
+    undefinedSteps: number;
+    deferred: number;
+    ok: boolean;
+}
+/** A step matched to its binding's formal metadata. */
+export interface TraceStep {
+    text: string;
+    keyword: StepKeyword;
+    message?: string;
+    stateExpr?: string;
+    /** True when the step text matched no registered binding. */
+    unbound?: boolean;
+}
+/**
+ * A scenario reduced to the same vocabulary the verify config speaks:
+ * Given (initial state exprs) → When (message types) → Then (state exprs).
+ */
+export interface ScenarioTrace {
+    feature: string;
+    scenario: string;
+    tags: string[];
+    given: TraceStep[];
+    when: TraceStep[];
+    then: TraceStep[];
+    file: string;
+}

package/dist/tools/bdd/src/witness.d.ts

@@ -0,0 +1,23 @@
+/** A scenario reduced to the post-state it claims, ready for the verify witness. */
+export interface ScenarioWitness {
+    feature: string;
+    scenario: string;
+    tags: string[];
+    file: string;
+    /**
+     * The conjoined Then-predicate (TS, `signal.field` dialect, values
+     * substituted) — e.g. `user.loggedIn === true && user.role === "admin"`.
+     * `null` when the scenario has no state-observable outcome to witness.
+     */
+    predicate: string | null;
+    /** Dotted state-field paths the predicate references (for subsystem routing). */
+    fields: string[];
+    /** Then-step texts skipped: a bare field ref, no binding, or a runtime-only check. */
+    skipped: string[];
+}
+/**
+ * Reduce every scenario in the given feature files to a {@link ScenarioWitness}.
+ * Step modules are loaded for their `defineStep` side effects (the same import
+ * trick {@link extractTraces} uses) so `matchStep` can resolve each Then.
+ */
+export declare function extractWitnesses(featureFiles: string[], stepFiles: string[]): Promise<ScenarioWitness[]>;

package/dist/tools/quality/src/cli.js

@@ -842,9 +842,109 @@ async function checkNoAsCasting(options) {
   }
   return { violations, print: () => printViolations(violations) };
 }
-// tools/quality/src/no-require.ts
+// tools/quality/src/no-fixed-waits.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 import { Glob as Glob2 } from "bun";
+var HINT = "wait on a real condition (poll loop, web-first assertion, microtask flush) or a sanctioned delay primitive";
+var RULES = [
+  { pattern: /\.waitForTimeout\s*\(/, message: `waitForTimeout is a fixed sleep — ${HINT}` },
+  { pattern: /\bBun\.sleep\s*\(/, message: `Bun.sleep is a fixed sleep — ${HINT}` },
+  {
+    pattern: /\bsetTimeout\s*\(\s*(?:resolve|r|res|done)\s*,/,
+    message: `setTimeout resolving a promise is a fixed sleep — ${HINT}`
+  },
+  {
+    pattern: /\bsetTimeout\s*\(\s*\(\s*\)\s*=>\s*(?:resolve|r|res|done)\b/,
+    message: `setTimeout resolving a promise is a fixed sleep — ${HINT}`
+  },
+  {
+    pattern: /new\s+Promise\b.*\(\s*\(?\s*([A-Za-z_$][\w$]*)\s*\)?\s*=>.*\bsetTimeout\s*\(\s*\1\b/,
+    message: `Promise wrapping setTimeout is a fixed sleep — ${HINT}`
+  }
+];
+var DEFAULT_EXCLUDE = ["node_modules", "dist", ".git", ".bun", "build", "coverage"];
+function skipString(text, i) {
+  const quote = text[i];
+  if (quote !== '"' && quote !== "'" && quote !== "`")
+    return i;
+  let j = i + 1;
+  while (j < text.length && text[j] !== quote) {
+    if (text[j] === "\\")
+      j++;
+    j++;
+  }
+  return j;
+}
+function codeOnly(line) {
+  let out = "";
+  for (let i = 0;i < line.length; i++) {
+    const ch = line[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const end = skipString(line, i);
+      out += " ".repeat(end - i + 1);
+      i = end;
+      continue;
+    }
+    if (ch === "/" && line[i + 1] === "/")
+      break;
+    out += ch;
+  }
+  return out;
+}
+function scanText(content, filePath = "<text>") {
+  const violations = [];
+  const lines = content.split(`
+`);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*")) {
+      continue;
+    }
+    const code = codeOnly(line);
+    const rule = RULES.find((r) => r.pattern.test(code));
+    if (rule)
+      violations.push({ file: filePath, line: i + 1, content: trimmed, message: rule.message });
+  }
+  return violations;
+}
+function isExcluded(relative3, excludeDirs, excludeFiles) {
+  if (relative3.split("/").some((s) => excludeDirs.has(s)))
+    return true;
+  const normalized = relative3.replace(/\\/g, "/");
+  return excludeFiles.some((suffix) => normalized.endsWith(suffix));
+}
+function printViolations2(violations) {
+  if (violations.length === 0) {
+    logger.log("[no-fixed-waits] ✅ No violations found.");
+    return;
+  }
+  logger.log(`[no-fixed-waits] ❌ ${violations.length} fixed-duration wait(s) found:
+`);
+  for (const v of violations) {
+    logger.log(`  ${v.file}:${v.line}`);
+    logger.log(`    ${v.content}`);
+    logger.log(`    \uD83D\uDCA1 ${v.message}`);
+    logger.log("");
+  }
+}
+async function checkNoFixedWaits(options) {
+  const { rootDir } = options;
+  const excludeDirs = new Set(options.exclude ?? DEFAULT_EXCLUDE);
+  const excludeFiles = [...options.excludeFiles ?? [], "no-fixed-waits.ts"];
+  const glob = new Glob2(options.filePatterns ?? "**/*.{ts,tsx}");
+  const violations = [];
+  for await (const file of glob.scan({ cwd: rootDir, absolute: true })) {
+    const relative3 = file.replace(`${rootDir}/`, "");
+    if (isExcluded(relative3, excludeDirs, excludeFiles))
+      continue;
+    violations.push(...scanText(readFileSync2(file, "utf-8"), relative3));
+  }
+  return { violations, print: () => printViolations2(violations) };
+}
+// tools/quality/src/no-require.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { Glob as Glob3 } from "bun";
 function isLineRequireClean(line) {
   if (!line.includes("require")) {
     return true;
@@ -912,7 +1012,7 @@ async function checkNoRequire(options) {
   const rootDir = options.rootDir;
   const excludeDirs = new Set(options.exclude ?? ["node_modules", "dist", ".git", ".bun"]);
   const pattern = options.filePatterns ?? "**/*.{ts,tsx}";
-  const glob = new Glob2(pattern);
+  const glob = new Glob3(pattern);
   const violations = [];
   for await (const file of glob.scan({ cwd: rootDir, absolute: true })) {
     const relative3 = file.replace(`${rootDir}/`, "");
@@ -920,7 +1020,7 @@ async function checkNoRequire(options) {
     if (segments.some((s) => excludeDirs.has(s))) {
       continue;
     }
-    const content = readFileSync2(file, "utf-8");
+    const content = readFileSync3(file, "utf-8");
     violations.push(...findRequireViolations(relative3, content));
   }
   return {
@@ -928,6 +1028,157 @@ async function checkNoRequire(options) {
     print: () => printRequireViolations(violations)
   };
 }
+// tools/quality/src/no-tautology-ensures.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { Glob as Glob4 } from "bun";
+var DEFAULT_PRIMITIVES = ["ensures", "requires"];
+var DEFAULT_EXCLUDE2 = [
+  "node_modules",
+  "dist",
+  ".git",
+  ".bun",
+  "coverage",
+  "specs",
+  "tests",
+  "__tests__",
+  "examples"
+];
+var LITERAL = /^(true|false|null|undefined|\d+(\.\d+)?|"[^"]*"|'[^']*'|`[^`]*`)$/;
+function tautologyReason(predicate) {
+  const trimmed = predicate.trim();
+  if (LITERAL.test(trimmed))
+    return `literal '${trimmed}'`;
+  const cmp = trimmed.match(/^(.+?)\s*(===|!==|==|!=)\s*(.+)$/);
+  if (cmp) {
+    const lhs = cmp[1]?.trim() ?? "";
+    const rhs = cmp[3]?.trim() ?? "";
+    if (LITERAL.test(lhs) && LITERAL.test(rhs))
+      return `literal-vs-literal '${trimmed}'`;
+  }
+  return;
+}
+function skipString2(text, i) {
+  const quote = text[i];
+  if (quote !== '"' && quote !== "'" && quote !== "`")
+    return i;
+  let j = i + 1;
+  while (j < text.length && text[j] !== quote) {
+    if (text[j] === "\\")
+      j++;
+    j++;
+  }
+  return j;
+}
+function findClosingParen(text, openIdx) {
+  let depth = 0;
+  for (let i = openIdx;i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "(") {
+      depth++;
+    } else if (ch === ")") {
+      if (--depth === 0)
+        return i;
+    } else {
+      i = skipString2(text, i);
+    }
+  }
+  return -1;
+}
+function splitTopLevelArgs(args) {
+  const parts = [];
+  let depth = 0;
+  let start = 0;
+  for (let i = 0;i < args.length; i++) {
+    const ch = args[i];
+    if (ch === "(" || ch === "[" || ch === "{") {
+      depth++;
+    } else if (ch === ")" || ch === "]" || ch === "}") {
+      depth--;
+    } else if (ch === "," && depth === 0) {
+      parts.push(args.slice(start, i));
+      start = i + 1;
+    } else {
+      i = skipString2(args, i);
+    }
+  }
+  parts.push(args.slice(start));
+  return parts.map((p) => p.trim());
+}
+function isFileExcluded2(relative3, excludeDirs, excludeFiles) {
+  const segments = relative3.split("/");
+  if (segments.some((s) => excludeDirs.has(s)))
+    return true;
+  const basename = segments[segments.length - 1] ?? "";
+  return excludeFiles.has(basename) || excludeFiles.has(relative3);
+}
+function isNonCall(line, lineBefore) {
+  const isImport = /\b(import|export)\b/.test(line) && line.includes("{") && !line.includes(";");
+  const isFrom = /\b(import|export)\b.*\bfrom\b/.test(line);
+  return isImport || isFrom || lineBefore.includes("//");
+}
+function findViolations2(relative3, content, callPattern) {
+  const results = [];
+  callPattern.lastIndex = 0;
+  let match = callPattern.exec(content);
+  while (match !== null) {
+    const current = match;
+    match = callPattern.exec(content);
+    const openIdx = current.index + current[0].length - 1;
+    const lineStart = content.lastIndexOf(`
+`, current.index) + 1;
+    const lineEnd = content.indexOf(`
+`, current.index);
+    const line = content.slice(lineStart, lineEnd === -1 ? content.length : lineEnd);
+    if (isNonCall(line, content.slice(lineStart, current.index)))
+      continue;
+    const closeIdx = findClosingParen(content, openIdx);
+    if (closeIdx === -1)
+      continue;
+    const predicate = splitTopLevelArgs(content.slice(openIdx + 1, closeIdx))[0];
+    const reason = predicate ? tautologyReason(predicate) : undefined;
+    if (reason === undefined)
+      continue;
+    results.push({
+      file: relative3,
+      line: content.slice(0, current.index).split(`
+`).length,
+      content: line.trim(),
+      reason: `${current[1] ?? "ensures"}(...) predicate is a ${reason}`
+    });
+  }
+  return results;
+}
+function printViolations3(violations) {
+  if (violations.length === 0) {
+    logger.log("[no-tautology-ensures] ✅ No violations found.");
+    return;
+  }
+  logger.log(`[no-tautology-ensures] ❌ ${violations.length} violation(s) found:
+`);
+  for (const v of violations) {
+    logger.log(`  ${v.file}:${v.line}`);
+    logger.log(`    ${v.content}`);
+    logger.log(`    \uD83D\uDCA1 ${v.reason}`);
+    logger.log("");
+  }
+  logger.log("[no-tautology-ensures] A verify predicate must reference state — a literal asserts nothing.");
+}
+async function checkNoTautologyEnsures(options) {
+  const { rootDir } = options;
+  const excludeDirs = new Set(options.exclude ?? DEFAULT_EXCLUDE2);
+  const excludeFiles = new Set([...options.excludeFiles ?? [], "no-tautology-ensures.ts"]);
+  const primitives = options.primitives ?? DEFAULT_PRIMITIVES;
+  const callPattern = new RegExp(`\\b(${primitives.join("|")})\\s*\\(`, "g");
+  const glob = new Glob4(options.filePatterns ?? "**/*.{ts,tsx}");
+  const violations = [];
+  for await (const file of glob.scan({ cwd: rootDir, absolute: true })) {
+    const relative3 = file.replace(`${rootDir}/`, "");
+    if (isFileExcluded2(relative3, excludeDirs, excludeFiles))
+      continue;
+    violations.push(...findViolations2(relative3, readFileSync4(file, "utf-8"), callPattern));
+  }
+  return { violations, print: () => printViolations3(violations) };
+}
 // tools/quality/src/secrets.ts
 import { readFile } from "node:fs/promises";
 import { join as join3 } from "node:path";
@@ -1463,7 +1714,7 @@ import { join as join11 } from "node:path";
 
 // tools/quality/src/plugins/core.ts
 import { join as join10 } from "node:path";
-import { Glob as Glob5 } from "bun";
+import { Glob as Glob7 } from "bun";
 
 // tools/quality/src/plugins/cliche-checks.ts
 import { readdir as readdir3 } from "node:fs/promises";
@@ -1886,7 +2137,7 @@ var additionalCoreChecks = [
 // tools/quality/src/plugins/extra-checks.ts
 import { readdir as readdir5 } from "node:fs/promises";
 import { join as join8, relative as relative5 } from "node:path";
-import { Glob as Glob3 } from "bun";
+import { Glob as Glob5 } from "bun";
 var SKIP_DIRS_DEFAULT2 = ["node_modules", ".git", "dist", ".bun", ".cache"];
 function isCommentLine2(trimmed) {
   return trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*");
@@ -2024,7 +2275,7 @@ function buildHookRegex(banned) {
 }
 function isAllowedByGlob(rel, allowedFiles) {
   for (const pattern of allowedFiles) {
-    if (new Glob3(pattern).match(rel))
+    if (new Glob5(pattern).match(rel))
       return true;
   }
   return false;
@@ -2091,7 +2342,7 @@ var DEFAULT_TYPOGRAPHIC = {
 };
 function fileMatchesAnyGlob(rel, globs) {
   for (const g of globs) {
-    if (new Glob3(g).match(rel))
+    if (new Glob5(g).match(rel))
       return true;
   }
   return false;
@@ -2159,7 +2410,7 @@ var extraCoreChecks = [
 // tools/quality/src/plugins/import-checks.ts
 import { readdir as readdir6 } from "node:fs/promises";
 import { join as join9, relative as relative6 } from "node:path";
-import { Glob as Glob4 } from "bun";
+import { Glob as Glob6 } from "bun";
 var SKIP_DIRS_DEFAULT3 = ["node_modules", ".git", "dist", ".bun", ".cache"];
 function isCommentLine3(trimmed) {
   return trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*");
@@ -2186,7 +2437,7 @@ async function walkScannableFiles2(dir, skipDirs, out) {
 }
 function isAllowedByGlob2(rel, globs) {
   for (const g of globs) {
-    if (new Glob4(g).match(rel))
+    if (new Glob6(g).match(rel))
       return true;
   }
   return false;
@@ -2414,7 +2665,7 @@ async function runTscFor(packagePath, rootDir) {
 async function findWorkspaces(rootDir, patterns) {
   const out = [];
   for (const pattern of patterns) {
-    const glob = new Glob4(`${pattern}/tsconfig.json`);
+    const glob = new Glob6(`${pattern}/tsconfig.json`);
     for await (const file of glob.scan({ cwd: rootDir, absolute: true })) {
       out.push(file.replace(/\/tsconfig\.json$/, ""));
     }
@@ -2472,7 +2723,7 @@ async function scanFiles(rootDir, cfg) {
   const excludePackages = new Set(cfg.excludePackages ?? []);
   const excludeFiles = new Set(cfg.excludeFiles ?? []);
   const pattern = cfg.filePatterns ?? "**/*.{ts,tsx}";
-  const glob = new Glob5(pattern);
+  const glob = new Glob7(pattern);
   const out = [];
   for await (const file of glob.scan({ cwd: rootDir, absolute: true })) {
     const rel = file.replace(`${rootDir}/`, "");
@@ -2527,6 +2778,42 @@ var noRequire = {
     };
   }
 };
+var noTautologyEnsures = {
+  id: "polly:no-tautology-ensures",
+  description: "Ban ensures/requires whose predicate is a literal (asserts nothing)",
+  filesRead: (cfg, root) => scanFiles(root, resolveScanConfig(cfg)),
+  run: async ({ rootDir, config }) => {
+    const cfg = resolveScanConfig(config);
+    const result = await checkNoTautologyEnsures({
+      rootDir,
+      ...cfg.exclude ? { exclude: cfg.exclude } : {},
+      ...cfg.excludeFiles ? { excludeFiles: cfg.excludeFiles } : {},
+      ...cfg.filePatterns ? { filePatterns: cfg.filePatterns } : {}
+    });
+    return {
+      ok: result.violations.length === 0,
+      messages: result.violations.map((v) => `${v.file}:${v.line}: ${v.content} — ${v.reason}`)
+    };
+  }
+};
+var noFixedWaits = {
+  id: "polly:no-fixed-waits",
+  description: "Ban fixed-duration sleeps (waitForTimeout / Bun.sleep / promise-wrapped setTimeout)",
+  filesRead: (cfg, root) => scanFiles(root, resolveScanConfig(cfg)),
+  run: async ({ rootDir, config }) => {
+    const cfg = resolveScanConfig(config);
+    const result = await checkNoFixedWaits({
+      rootDir,
+      exclude: cfg.exclude ?? DEFAULT_EXCLUDES,
+      ...cfg.excludeFiles ? { excludeFiles: cfg.excludeFiles } : {},
+      ...cfg.filePatterns ? { filePatterns: cfg.filePatterns } : {}
+    });
+    return {
+      ok: result.violations.length === 0,
+      messages: result.violations.map((v) => `${v.file}:${v.line}: ${v.content} — ${v.message}`)
+    };
+  }
+};
 var secrets = {
   id: "polly:secrets",
   description: "Run `gitleaks detect` against the working tree",
@@ -2588,13 +2875,15 @@ var gitignoreCrossCheck = {
     };
   }
 };
-var POLLY_CORE_VERSION = "0.48.0";
+var POLLY_CORE_VERSION = "0.49.0";
 var pollyCorePlugin = {
   name: "polly",
   version: POLLY_CORE_VERSION,
   checks: [
     noAsCasting,
     noRequire,
+    noTautologyEnsures,
+    noFixedWaits,
     secrets,
     gitignoreCrossCheck,
     ...additionalCoreChecks,
@@ -2625,14 +2914,14 @@ async function loadQualityConfig(rootDir, explicitPath) {
 // tools/quality/src/plugins/polly-ui.ts
 import { readdir as readdir7 } from "node:fs/promises";
 import { join as join12, relative as relative7 } from "node:path";
-import { Glob as Glob6 } from "bun";
+import { Glob as Glob8 } from "bun";
 var SKIP_DIRS_DEFAULT4 = ["node_modules", ".git", "dist", ".bun", ".cache"];
 function isCommentLine4(trimmed) {
   return trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*");
 }
 function isAllowedByGlob3(rel, globs) {
   for (const g of globs) {
-    if (new Glob6(g).match(rel))
+    if (new Glob8(g).match(rel))
       return true;
   }
   return false;
@@ -3050,4 +3339,4 @@ switch (subcommand) {
 }
 process.exit(exitCode);
 
-//# debugId=BE14883E9B3EB87B64756E2164756E21
+//# debugId=6610E9614AC8E6B464756E2164756E21