@geonosis/doctor 1.0.0 → 1.1.0

package/dist/{chunk-R4AHDFE3.js → chunk-CG2LN4VW.js}

@@ -144,6 +144,164 @@ var checkBaseline = ({ ref, root }) => {
   ];
 };
 
+// src/deployed.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+var DEPLOYED_FILE = ".geonosis/deployed.json";
+var NOT_WRITTEN = "no .geonosis/deployed.json \u2014 it is written by the pipeline after promote, and its absence is not a pass";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var listOf = (found) => Array.isArray(found) ? found.filter((one) => typeof one === "string") : [];
+var finding2 = (verdict, subject, message) => ({
+  check: "deployed",
+  message,
+  subject,
+  verdict
+});
+var parseJsonc = (source) => {
+  let out = "";
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index] ?? "";
+    if (char === '"') {
+      const start = index;
+      index += 1;
+      for (; index < source.length; index += 1) {
+        if (source[index] === "\\") {
+          index += 1;
+          continue;
+        }
+        if (source[index] === '"') break;
+      }
+      out += source.slice(start, index + 1);
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "/") {
+      const end = source.indexOf("\n", index);
+      index = end === -1 ? source.length : end - 1;
+      continue;
+    }
+    if (char === "/" && source[index + 1] === "*") {
+      const end = source.indexOf("*/", index + 2);
+      index = end === -1 ? source.length : end + 1;
+      continue;
+    }
+    out += char;
+  }
+  return JSON.parse(out.replaceAll(/,(\s*[\]}])/g, "$1"));
+};
+var BINDING_LISTS = [
+  "ai",
+  "analytics_engine_datasets",
+  "browser",
+  "d1_databases",
+  "dispatch_namespaces",
+  "durable_objects",
+  "hyperdrive",
+  "kv_namespaces",
+  "mtls_certificates",
+  "queues",
+  "r2_buckets",
+  "send_email",
+  "services",
+  "vectorize",
+  "version_metadata",
+  "workflows"
+];
+var bindingsOf = (found) => {
+  if (Array.isArray(found)) return found.flatMap(bindingsOf);
+  if (!isRecord(found)) return [];
+  const named2 = found["binding"] ?? found["name"];
+  return [
+    ...typeof named2 === "string" ? [named2] : [],
+    ...Object.entries(found).filter(([key]) => key === "bindings" || key === "producers" || key === "consumers").flatMap(([, one]) => bindingsOf(one))
+  ];
+};
+var declaredIn = (config) => {
+  const triggers = config["triggers"];
+  const one = config["route"];
+  const listed = [
+    ...Array.isArray(config["routes"]) ? config["routes"] : [],
+    ...typeof one === "string" ? [one] : []
+  ];
+  return {
+    bindings: BINDING_LISTS.flatMap((key) => bindingsOf(config[key])),
+    crons: isRecord(triggers) ? listOf(triggers["crons"]) : [],
+    routes: listed.map((route) => isRecord(route) ? route["pattern"] : route).filter((pattern) => typeof pattern === "string")
+  };
+};
+var differences = (kind, declared, deployed) => {
+  const missing = declared.filter((name) => !deployed.includes(name));
+  const extra = deployed.filter((name) => !declared.includes(name));
+  return [
+    ...missing.length === 0 ? [] : [`declared but not deployed ${kind}: ${missing.join(", ")}`],
+    ...extra.length === 0 ? [] : [`deployed but not declared ${kind}: ${extra.join(", ")}`]
+  ];
+};
+var releaseOf = (root) => {
+  const path = join2(root, "geonosis.json");
+  if (!existsSync(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return isRecord(parsed) && isRecord(parsed["release"]) ? parsed["release"] : {};
+  } catch {
+    return {};
+  }
+};
+var checkDeployed = ({ root }) => {
+  const release = releaseOf(root);
+  if (release === void 0) return [];
+  const configs = listOf(release["wrangler"]);
+  const secrets = listOf(release["secrets"]);
+  if (configs.length === 0 && secrets.length === 0) {
+    return [
+      finding2(
+        "SKIP",
+        "geonosis.json",
+        "release.wrangler and release.secrets are both empty \u2014 this repo has declared nothing a deployment is supposed to carry"
+      )
+    ];
+  }
+  const env = typeof release["wranglerEnv"] === "string" ? release["wranglerEnv"] : void 0;
+  const declared = { bindings: [], crons: [], routes: [] };
+  for (const relative of configs) {
+    let parsed;
+    try {
+      parsed = parseJsonc(readFileSync2(join2(root, relative), "utf8"));
+    } catch (error) {
+      return [finding2("FAIL", relative, `could not be read: ${error.message}`)];
+    }
+    if (!isRecord(parsed)) return [finding2("FAIL", relative, "is not a wrangler configuration")];
+    const environments = parsed["env"];
+    const block = env !== void 0 && isRecord(environments) && isRecord(environments[env]) ? environments[env] : parsed;
+    const one = declaredIn(block);
+    declared.bindings.push(...one.bindings);
+    declared.crons.push(...one.crons);
+    declared.routes.push(...one.routes);
+  }
+  const path = join2(root, DEPLOYED_FILE);
+  if (!existsSync(path)) return [finding2("SKIP", DEPLOYED_FILE, NOT_WRITTEN)];
+  let reported;
+  try {
+    reported = JSON.parse(readFileSync2(path, "utf8"));
+  } catch (error) {
+    return [finding2("FAIL", DEPLOYED_FILE, `is not readable JSON: ${error.message}`)];
+  }
+  if (!isRecord(reported)) return [finding2("FAIL", DEPLOYED_FILE, "is not an object")];
+  const triggers = isRecord(reported["triggers"]) ? reported["triggers"] : {};
+  const drift = [
+    ...differences("crons", declared.crons, listOf(triggers["crons"])),
+    ...differences("routes", declared.routes, listOf(triggers["routes"])),
+    ...differences("bindings", declared.bindings, listOf(reported["bindings"])),
+    ...differences("secrets", secrets, listOf(reported["secrets"]))
+  ];
+  return [
+    drift.length === 0 ? finding2(
+      "OK",
+      DEPLOYED_FILE,
+      `what the tree declares is what the pipeline reported${typeof reported["at"] === "string" ? ` at ${reported["at"]}` : ""}`
+    ) : finding2("FAIL", DEPLOYED_FILE, drift.join("; "))
+  ];
+};
+
 // src/types.ts
 var CHECKS = [
   "loaded",
@@ -151,7 +309,8 @@ var CHECKS = [
   "baseline",
   "runner",
   "drift",
-  "observability"
+  "observability",
+  "deployed"
 ];
 var DoctorError = class extends Error {
   constructor(message) {
@@ -161,18 +320,18 @@ var DoctorError = class extends Error {
 };
 
 // src/resolve.ts
-import { existsSync, readFileSync as readFileSync2, realpathSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync } from "fs";
 import { createRequire } from "module";
-import { dirname, join as join2 } from "path";
+import { dirname, join as join3 } from "path";
 import { pathToFileURL } from "url";
-var resolveFrom = (dir, specifier) => createRequire(join2(dir, "noop.js")).resolve(specifier);
+var resolveFrom = (dir, specifier) => createRequire(join3(dir, "noop.js")).resolve(specifier);
 var packageDirOf = (entry, name) => {
   let dir = dirname(entry);
   for (; ; ) {
-    const manifest = join2(dir, "package.json");
-    if (existsSync(manifest)) {
+    const manifest = join3(dir, "package.json");
+    if (existsSync2(manifest)) {
       try {
-        const parsed = JSON.parse(readFileSync2(manifest, "utf8"));
+        const parsed = JSON.parse(readFileSync3(manifest, "utf8"));
         if (parsed.name === name) return dir;
       } catch {
       }
@@ -194,7 +353,16 @@ var pluginVersionOf = async (entry) => {
   }
   return version;
 };
-var corpusOfPlugin = (from, specifier) => join2(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
+var probesOf = async (entry, plugin) => {
+  const loaded = await import(pathToFileURL(entry).href);
+  return Object.fromEntries(
+    Object.entries(loaded.default?.rules ?? {}).filter(([, rule]) => typeof rule?.probe === "function").map(([name, rule]) => [
+      `${plugin}/${name}`,
+      rule.probe
+    ])
+  );
+};
+var corpusOfPlugin = (from, specifier) => join3(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
 var real = (path) => {
   try {
     return realpathSync(path);
@@ -205,8 +373,8 @@ var real = (path) => {
 var relativeToRoot = (root, path) => relativePath(real(root), real(path));
 
 // src/drift.ts
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join3, sep as sep2 } from "path";
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join4, sep as sep2 } from "path";
 var WORKFLOWS = ".github/workflows";
 var SETTINGS = ".claude/settings.json";
 var GEONOSIS = "geonosis.json";
@@ -214,7 +382,7 @@ var LAW = "CLAUDE.md";
 var CEILING = 200;
 var SWITCHED_OFF = /^\s*if:\s*(?:\$\{\{\s*)?false\b/m;
 var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
-var finding2 = (subject, verdict, message) => ({
+var finding3 = (subject, verdict, message) => ({
   check: "drift",
   message,
   subject,
@@ -232,27 +400,27 @@ var filesUnder = (dir, match) => {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join3(at, entry.name));
+        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join4(at, entry.name));
         continue;
       }
-      if (entry.isFile() && match(entry.name)) found.push(join3(at, entry.name));
+      if (entry.isFile() && match(entry.name)) found.push(join4(at, entry.name));
     }
   };
   walk2(dir);
   return found;
 };
 var ci = (root) => {
-  const dir = join3(root, WORKFLOWS);
-  if (!existsSync2(dir)) {
-    return [finding2(WORKFLOWS, "SKIP", "there are no workflows here to read")];
+  const dir = join4(root, WORKFLOWS);
+  if (!existsSync3(dir)) {
+    return [finding3(WORKFLOWS, "SKIP", "there are no workflows here to read")];
   }
   return filesUnder(dir, (name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((path) => {
     const at = relativePath(root, path);
-    return SWITCHED_OFF.test(readFileSync3(path, "utf8")) ? finding2(
+    return SWITCHED_OFF.test(readFileSync4(path, "utf8")) ? finding3(
       at,
       "FAIL",
       "a job or step here is switched off by a condition that can never be true \u2014 every gate downstream of it reports green having run nothing"
-    ) : finding2(at, "OK", "nothing in it is switched off");
+    ) : finding3(at, "OK", "nothing in it is switched off");
   });
 };
 var holds = (parent, child) => child === parent || child.startsWith(`${parent}${sep2}`);
@@ -268,10 +436,10 @@ var orphanTests = (root, workspaces) => {
     orphaned.set(at, [...orphaned.get(at) ?? [], relativePath(root, path)]);
   }
   if (orphaned.size === 0) {
-    return [finding2("test files", "OK", "every test file sits under a workspace that runs tests")];
+    return [finding3("test files", "OK", "every test file sits under a workspace that runs tests")];
   }
   return [...orphaned.entries()].map(
-    ([at, files]) => finding2(
+    ([at, files]) => finding3(
       at,
       "FAIL",
       `${files.length} test file(s) here and no test script to run them \u2014 ${files.slice(0, 3).join(", ")}`
@@ -279,10 +447,10 @@ var orphanTests = (root, workspaces) => {
   );
 };
 var readGeonosis = (root) => {
-  const path = join3(root, GEONOSIS);
-  if (!existsSync2(path)) return void 0;
+  const path = join4(root, GEONOSIS);
+  if (!existsSync3(path)) return void 0;
   try {
-    return JSON.parse(readFileSync3(path, "utf8"));
+    return JSON.parse(readFileSync4(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -291,34 +459,34 @@ var law = (root, config) => {
   const declared = config?.law ?? {};
   const file = typeof declared.file === "string" ? declared.file : LAW;
   const ceiling = typeof declared.maxLines === "number" ? declared.maxLines : CEILING;
-  const path = join3(root, file);
-  if (!existsSync2(path)) {
-    return [finding2(file, "SKIP", "there is no law file here to measure")];
+  const path = join4(root, file);
+  if (!existsSync3(path)) {
+    return [finding3(file, "SKIP", "there is no law file here to measure")];
   }
-  const source = readFileSync3(path, "utf8");
+  const source = readFileSync4(path, "utf8");
   const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
   return [
-    lines > ceiling ? finding2(
+    lines > ceiling ? finding3(
       file,
       "WARN",
       `${lines} lines against a ceiling of ${ceiling} \u2014 depth belongs in the skills and in the rules, where it is read`
-    ) : finding2(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
+    ) : finding3(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
   ];
 };
 var hooks = (root) => {
-  const path = join3(root, SETTINGS);
-  if (!existsSync2(path)) {
+  const path = join4(root, SETTINGS);
+  if (!existsSync3(path)) {
     return [
-      finding2(
+      finding3(
         SETTINGS,
         "WARN",
         "nothing here installs the kit\u2019s plugin, so none of the hooks, agents or skills reach this repo \u2014 the gates run, the method does not"
       )
     ];
   }
-  const source = readFileSync3(path, "utf8");
+  const source = readFileSync4(path, "utf8");
   return [
-    source.includes("geonosis") ? finding2(SETTINGS, "OK", "it installs the kit\u2019s plugin") : finding2(SETTINGS, "WARN", "it names no geonosis plugin or marketplace")
+    source.includes("geonosis") ? finding3(SETTINGS, "OK", "it installs the kit\u2019s plugin") : finding3(SETTINGS, "WARN", "it names no geonosis plugin or marketplace")
   ];
 };
 var READERS = {
@@ -339,7 +507,7 @@ var resolves = (root, name) => {
 var blocks = (root, config, readers) => {
   if (config === void 0) {
     return [
-      finding2(
+      finding3(
         GEONOSIS,
         "SKIP",
         "there is no geonosis.json here, so no block says what this repo asks the kit to do"
@@ -351,7 +519,7 @@ var blocks = (root, config, readers) => {
     const installed = resolves(root, name);
     if (declared && !installed) {
       return [
-        finding2(
+        finding3(
           name,
           "WARN",
           `geonosis.json has a "${block}" block and ${name} is not installed here \u2014 nothing reads it`
@@ -360,21 +528,21 @@ var blocks = (root, config, readers) => {
     }
     if (!declared && installed) {
       return [
-        finding2(
+        finding3(
           name,
           "WARN",
           `${name} is installed and geonosis.json has no "${block}" block \u2014 it runs on its defaults, whatever they are`
         )
       ];
     }
-    return declared ? [finding2(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
+    return declared ? [finding3(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
   });
 };
 var pluginDirsConfigured = (root) => {
-  const path = join3(root, ".oxlintrc.json");
-  if (!existsSync2(path)) return void 0;
+  const path = join4(root, ".oxlintrc.json");
+  if (!existsSync3(path)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
     const rule = parsed.rules?.["biological-architecture/no-unregistered-plugin-dir"];
     const options = Array.isArray(rule) ? rule[1] : void 0;
     if (options?.roots === void 0 || typeof options.registry !== "string") return void 0;
@@ -391,26 +559,26 @@ var pluginDirs = (root) => {
   const configured = pluginDirsConfigured(root);
   if (configured === void 0) {
     return [
-      finding2(
+      finding3(
         "plugin directories",
         "SKIP",
         "no-unregistered-plugin-dir is not configured here, so this repo has not said where its integrations live"
       )
     ];
   }
-  const registryPath = join3(root, configured.registry);
-  if (!existsSync2(registryPath)) {
-    return [finding2(configured.registry, "FAIL", "the registry the rule names is not there")];
+  const registryPath = join4(root, configured.registry);
+  if (!existsSync3(registryPath)) {
+    return [finding3(configured.registry, "FAIL", "the registry the rule names is not there")];
   }
-  const registry = readFileSync3(registryPath, "utf8");
+  const registry = readFileSync4(registryPath, "utf8");
   const unreachable = [];
   for (const rootDir of configured.roots) {
-    const at = join3(root, rootDir);
-    if (!existsSync2(at)) continue;
+    const at = join4(root, rootDir);
+    if (!existsSync3(at)) continue;
     for (const entry of readdirSync2(at, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const hasManifest = configured.manifests.some(
-        (name) => existsSync2(join3(at, entry.name, name))
+        (name) => existsSync3(join4(at, entry.name, name))
       );
       if (hasManifest && !registry.includes(entry.name)) {
         unreachable.push(`${rootDir}/${entry.name}`);
@@ -418,11 +586,11 @@ var pluginDirs = (root) => {
     }
   }
   return [
-    unreachable.length === 0 ? finding2(
+    unreachable.length === 0 ? finding3(
       configured.registry,
       "OK",
       "every directory under the declared roots is named by it"
-    ) : finding2(
+    ) : finding3(
       configured.registry,
       "FAIL",
       `${unreachable.length} directory(ies) it never names: ${unreachable.join(", ")}`
@@ -447,14 +615,15 @@ var checkDrift = ({
 
 // src/exercised.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { cpSync, existsSync as existsSync4, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { corpusOf, readManifest } from "@geonosis/lint-parity";
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
 var severityOf = (level) => Array.isArray(level) ? level[0] : level;
 var enabledRulesOf = (rules, plugin) => Object.keys(rules).filter((id) => id.startsWith(`${plugin}/`) && !OFF.has(severityOf(rules[id]))).toSorted();
-var finding3 = (subject, verdict, message) => ({
+var passes = (findings) => !findings.some((one) => one.verdict === "FAIL" || one.verdict === "UNJUDGED");
+var finding4 = (subject, verdict, message) => ({
   check: "exercised",
   message,
   subject,
@@ -466,9 +635,9 @@ var refusal = (error) => {
   return said.length > LIMIT ? `${said.slice(0, LIMIT)}\u2026` : said;
 };
 var reasonFrom = (config, oxlint) => {
-  const dir = mkdtempSync(join4(tmpdir(), "geonosis-doctor-why-"));
+  const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-why-"));
   try {
-    const probe = join4(dir, "probe.tsx");
+    const probe = join5(dir, "probe.tsx");
     writeFileSync(probe, "export const probe = 1\n");
     const run = spawnSync2(
       oxlint,
@@ -502,21 +671,59 @@ var ownReach = ({
     fired: new Set(reach.filter((one) => one.firedInA).map((one) => one.rule))
   };
 };
-var checkExercised = ({
+var optionsOf = (level) => Array.isArray(level) ? level.slice(1) : [];
+var under = (config, rule) => `${rule} under ${JSON.stringify(optionsOf(config.rules[rule]))}`;
+var throughProbes = ({
   config,
   corpus,
   oxlint,
+  probes,
+  silent
+}) => {
+  const refused = /* @__PURE__ */ new Map();
+  const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-probe-"));
+  const here = join5(dir, "corpus");
+  try {
+    cpSync(corpus, here, { recursive: true });
+    for (const rule of silent) {
+      const write = probes[rule];
+      if (write === void 0) continue;
+      try {
+        const probe = write(optionsOf(config.rules[rule]));
+        const at = join5(here, probe.path);
+        mkdirSync(dirname2(at), { recursive: true });
+        writeFileSync(at, probe.source);
+      } catch (error) {
+        refused.set(rule, String(error.message));
+      }
+    }
+    const reach = corpusOf({
+      configA: config.path,
+      configB: config.path,
+      corpus: here,
+      oxlint
+    }).reach;
+    return { fired: new Set(reach.filter((one) => one.firedInA).map((one) => one.rule)), refused };
+  } finally {
+    rmSync(dir, { force: true, recursive: true });
+  }
+};
+var checkExercised = async ({
+  config,
+  corpus,
+  entry,
+  oxlint,
   repoCorpus,
   root
 }) => {
-  const said = (verdict, message) => finding3(config.relative, verdict, message);
-  if (repoCorpus !== void 0 && !existsSync3(repoCorpus)) {
+  const said = (verdict, message) => finding4(config.relative, verdict, message);
+  if (repoCorpus !== void 0 && !existsSync4(repoCorpus)) {
     return said(
       "FAIL",
       `geonosis.json declares a reach corpus at ${relativeToRoot(root, repoCorpus)} and there is nothing there \u2014 a corpus that cannot be read is a claim, not evidence`
     );
   }
-  if (!existsSync3(corpus)) {
+  if (!existsSync4(corpus)) {
     return said(
       "SKIP",
       `the plugin loaded from here ships no corpus at ${relativeToRoot(root, corpus)} \u2014 nothing declares which rules it can be evidence about`
@@ -564,7 +771,38 @@ var checkExercised = ({
   }
   const silent = enabled.filter((rule) => !fired.has(rule) && !own.fired.has(rule));
   const where = own.claimed.length === 0 ? "" : ` (${own.fired.size} by this repo's own corpus)`;
-  return silent.length === 0 ? said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where}`) : said("FAIL", `${countOf(silent, "fire")} nowhere in the corpus: ${named(silent)}`);
+  if (silent.length === 0) {
+    return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where}`);
+  }
+  const probes = entry === void 0 ? {} : await probesOf(entry, manifest.plugin).catch(() => ({}));
+  const declared = silent.filter((rule) => probes[rule] !== void 0);
+  const unprobed = silent.filter((rule) => probes[rule] === void 0);
+  let probed = { fired: /* @__PURE__ */ new Set(), refused: /* @__PURE__ */ new Map() };
+  if (declared.length > 0) {
+    try {
+      probed = throughProbes({ config, corpus, oxlint, probes, silent: declared });
+    } catch (error) {
+      return said("FAIL", `the declared probes could not be run \u2014 ${refusal(error)}`);
+    }
+  }
+  const exercised = declared.filter((rule) => probed.fired.has(rule));
+  const inert = declared.filter((rule) => !probed.fired.has(rule));
+  const placed = inert.filter((rule) => !probed.refused.has(rule));
+  if (placed.length > 0) {
+    return said(
+      "FAIL",
+      `${countOf(placed, "fire")} nowhere in the corpus and nothing through the probe each declares either: ${named(placed.map((rule) => under(config, rule)))}`
+    );
+  }
+  const unplaceable = [
+    ...unprobed.map(
+      (rule) => `${rule} declares no probe, so ${optionsOf(config.rules[rule]).length === 0 ? "its scope" : JSON.stringify(optionsOf(config.rules[rule]))} does not reach the corpus`
+    ),
+    ...inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`)
+  ];
+  if (unplaceable.length > 0) return said("UNJUDGED", named(unplaceable));
+  const through = exercised.length === 1 ? "1 through its declared probe under this repo\u2019s options" : `${exercised.length} through their declared probes under this repo\u2019s options`;
+  return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${through}`);
 };
 
 // src/loaded.ts
@@ -638,7 +876,7 @@ var declaredFor = ({
   }
   return void 0;
 };
-var finding4 = (subject, verdict, message) => ({
+var finding5 = (subject, verdict, message) => ({
   check: "loaded",
   message,
   subject,
@@ -655,7 +893,7 @@ var oneConfig = async ({
   specifier,
   workspaces
 }) => {
-  const said = (verdict, message) => finding4(config.relative, verdict, `${specifier}: ${message}`);
+  const said = (verdict, message) => finding5(config.relative, verdict, `${specifier}: ${message}`);
   let loaded;
   try {
     loaded = await versionAt(resolveFrom(config.dir, specifier), specifier, root);
@@ -707,10 +945,10 @@ var copiesOf = async ({
     found.set(at, { from: [labelOf(workspace)], version: await pluginVersionOf(entry) });
   }
   if (found.size === 0) {
-    return finding4(specifier, "FAIL", "no workspace in this tree can resolve it at all");
+    return finding5(specifier, "FAIL", "no workspace in this tree can resolve it at all");
   }
   const listed = [...found.entries()].map(([at, one]) => `${at} ${one.version} (${one.from.join(", ")})`).join("; ");
-  return found.size === 1 ? finding4(specifier, "OK", `1 copy \u2014 ${listed}`) : finding4(
+  return found.size === 1 ? finding5(specifier, "OK", `1 copy \u2014 ${listed}`) : finding5(
     specifier,
     "WARN",
     `${found.size} copies \u2014 ${listed}. Which one oxlint runs depends on which directory its config sits in.`
@@ -725,7 +963,7 @@ var checkLoaded = async ({
   const specifiers = /* @__PURE__ */ new Set();
   for (const config of configs) {
     if (config.error !== void 0) {
-      findings.push(finding4(config.relative, "FAIL", config.error));
+      findings.push(finding5(config.relative, "FAIL", config.error));
       continue;
     }
     for (const specifier of config.jsPlugins.filter((name) => name.startsWith(SCOPE))) {
@@ -740,13 +978,13 @@ var checkLoaded = async ({
 };
 
 // src/observability.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 var GEONOSIS_FILE = "geonosis.json";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
-var finding5 = (verdict, subject, message) => ({
+var finding6 = (verdict, subject, message) => ({
   check: "observability",
   message,
   subject,
@@ -755,7 +993,7 @@ var finding5 = (verdict, subject, message) => ({
 var readGeonosis2 = (root) => {
   let text;
   try {
-    text = readFileSync4(join5(root, GEONOSIS_FILE), "utf8");
+    text = readFileSync5(join6(root, GEONOSIS_FILE), "utf8");
   } catch {
     return { present: false };
   }
@@ -773,25 +1011,25 @@ var readGeonosis2 = (root) => {
 var exporterFinding = (config) => {
   const sink = config.sink;
   if (typeof sink !== "string" || sink.trim() === "") {
-    return finding5(
+    return finding6(
       "FAIL",
       GEONOSIS_FILE,
       "observability.sink is not set, so nothing here says where errors are supposed to go \u2014 and a repo that cannot name its exporter has not got one"
     );
   }
   if (REACHES_NOTHING.has(sink.toLowerCase())) {
-    return finding5(
+    return finding6(
       "WARN",
       GEONOSIS_FILE,
       `the configured sink is "${sink}", which answers ok and reaches nothing. Correct in a dev tree; in a deployed one it is the instrument that cannot fail.`
     );
   }
-  return finding5("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
+  return finding6("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
 };
 var reachableFinding = async (config) => {
   const endpoint = config.endpoint;
   if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    return finding5(
+    return finding6(
       "SKIP",
       GEONOSIS_FILE,
       "no observability.endpoint was named, so whether the exporter is reachable was not asked"
@@ -801,13 +1039,13 @@ var reachableFinding = async (config) => {
   const timer = setTimeout(() => controller.abort(), HEAD_TIMEOUT_MS);
   try {
     const response = await fetch(endpoint, { method: "HEAD", signal: controller.signal });
-    return finding5(
+    return finding6(
       "OK",
       GEONOSIS_FILE,
       `${endpoint} is reachable \u2014 it answered ${response.status} to a HEAD`
     );
   } catch (error) {
-    return finding5(
+    return finding6(
       "FAIL",
       GEONOSIS_FILE,
       `${endpoint} is not reachable from here: ${error.message}. Every report this repo sends is going into that.`
@@ -819,7 +1057,7 @@ var reachableFinding = async (config) => {
 var ageFinding = (config, root, now) => {
   const file = config.lastEventFile;
   if (typeof file !== "string" || file.trim() === "") {
-    return finding5(
+    return finding6(
       "SKIP",
       GEONOSIS_FILE,
       "no observability.lastEventFile was configured, so when the last event arrived is not a question anything here can answer. Have the sink write { at, id, sink } on every capture and name the file."
@@ -828,27 +1066,27 @@ var ageFinding = (config, root, now) => {
   const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
   let record;
   try {
-    record = JSON.parse(readFileSync4(join5(root, file), "utf8"));
+    record = JSON.parse(readFileSync5(join6(root, file), "utf8"));
   } catch (error) {
-    return finding5(
+    return finding6(
       "FAIL",
       file,
       `the last event file could not be read: ${error.message}. A sink that has never written one has never captured anything.`
     );
   }
   if (typeof record.at !== "number" || !Number.isFinite(record.at)) {
-    return finding5(
+    return finding6(
       "FAIL",
       file,
       'the last event record has no numeric "at", so its age cannot be read \u2014 and an age nobody can read is not an age inside the window'
     );
   }
   const ageSeconds = Math.round((now - record.at) / 1e3);
-  return ageSeconds > maxAgeSeconds ? finding5(
+  return ageSeconds > maxAgeSeconds ? finding6(
     "FAIL",
     file,
     `the last event arrived ${ageSeconds}s ago, past the ${maxAgeSeconds}s window. An exporter that stopped, a key that was rotated and a sink that has been dropping since Tuesday all look exactly like this, and all of them leave a green build.`
-  ) : finding5(
+  ) : finding6(
     "OK",
     file,
     `the last event arrived ${ageSeconds}s ago, inside the ${maxAgeSeconds}s window`
@@ -857,16 +1095,16 @@ var ageFinding = (config, root, now) => {
 var probeFinding = (config) => {
   const probe = config.probe;
   if (typeof probe === "string" && probe.trim() !== "") {
-    return finding5("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
+    return finding6("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
   }
   if (typeof config.lastEventFile === "string" && config.lastEventFile.trim() !== "") {
-    return finding5(
+    return finding6(
       "OK",
       GEONOSIS_FILE,
       "no probe command, but a last event file is read above, so something does look at this exporter"
     );
   }
-  return finding5(
+  return finding6(
     "WARN",
     GEONOSIS_FILE,
     "neither observability.probe nor observability.lastEventFile is configured, so nothing in this repo has ever established that a report reaches the sink. Name a probe command \u2014 the doctor reports it, your gate runs it."
@@ -879,7 +1117,7 @@ var checkObservability = async ({
   const read = readGeonosis2(root);
   if (read.error !== void 0) {
     return [
-      finding5(
+      finding6(
         "FAIL",
         GEONOSIS_FILE,
         `${GEONOSIS_FILE} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
@@ -888,7 +1126,7 @@ var checkObservability = async ({
   }
   if (!read.present || read.config === void 0) {
     return [
-      finding5(
+      finding6(
         "SKIP",
         GEONOSIS_FILE,
         `no observability block in ${GEONOSIS_FILE}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
@@ -905,16 +1143,16 @@ var checkObservability = async ({
 };
 
 // src/repo-corpus.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { join as join7 } from "path";
 var GEONOSIS_FILE2 = "geonosis.json";
 var repoCorpusOf = (root) => {
-  const path = join6(root, GEONOSIS_FILE2);
-  if (!existsSync4(path)) return void 0;
+  const path = join7(root, GEONOSIS_FILE2);
+  if (!existsSync5(path)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf8"));
     const declared = parsed.doctor?.corpus;
-    return typeof declared === "string" && declared !== "" ? join6(root, declared) : void 0;
+    return typeof declared === "string" && declared !== "" ? join7(root, declared) : void 0;
   } catch {
     return void 0;
   }
@@ -923,8 +1161,9 @@ var repoCorpusOf = (root) => {
 // src/runner.ts
 var TEST_FAILURES = "testFailures";
 var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
+var RUNS_BUN_TEST = /(?:^|[\s;&|(])(?:bunx\s+)?bun\s+test(?:\s|$)/;
 var WRITES_A_REPORT = /--reporter[= ]\S*json|--outputFile/i;
-var finding6 = (subject, verdict, message) => ({
+var finding7 = (subject, verdict, message) => ({
   check: "runner",
   message,
   subject,
@@ -952,7 +1191,7 @@ var checkRunner = ({
     if (script === "") return [];
     const subject = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
     const said = (verdict, message) => [
-      finding6(subject, verdict, message)
+      finding7(subject, verdict, message)
     ];
     if (!RUNS_A_RUNNER.test(script)) {
       return said(
@@ -967,9 +1206,15 @@ var checkRunner = ({
     if (counter !== void 0) {
       return said("OK", `read by the ratchet's "${keyOf(counter)}" counter in report mode`);
     }
+    if (RUNS_BUN_TEST.test(script)) {
+      return said(
+        "OK",
+        `"${script}" is judged by its exit code, and bun test's exit code is a verdict: a planted failure exits 1, measured on bun 1.4.0 (2026-08-30). Nothing further is required here.`
+      );
+    }
     return said(
       "WARN",
-      `"${script}" \u2014 the test runner's exit code is the only verdict here; vitest-pool-workers exited 0 on failing tests for weeks in a consumer. Give the ratchet a ${TEST_FAILURES} counter in report mode covering this workspace, or have the script write a JSON report.`
+      `"${script}" runs vitest, whose exit code is the only verdict here; @cloudflare/vitest-pool-workers exited 0 on failing tests for weeks in a consumer. Give the ratchet a ${TEST_FAILURES} counter in report mode covering this workspace, or have the script write a JSON report.`
     );
   });
 };
@@ -981,28 +1226,33 @@ var exercisedOf = ({
   oxlint,
   repoCorpus,
   root
-}) => configs.flatMap(
-  (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map((specifier) => {
-    let corpus;
-    try {
-      corpus = corpusOfPlugin(config.dir, specifier);
-    } catch (error) {
-      return {
-        check: "exercised",
-        message: `${specifier}: ${String(error.message)}`,
-        subject: config.relative,
-        verdict: "SKIP"
-      };
-    }
-    const own = repoCorpus !== void 0 && config.relative === CONFIG_FILE ? repoCorpus : void 0;
-    return checkExercised({
-      config,
-      corpus,
-      oxlint,
-      ...own === void 0 ? {} : { repoCorpus: own },
-      root
-    });
-  })
+}) => Promise.all(
+  configs.flatMap(
+    (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map(async (specifier) => {
+      let corpus;
+      let entry;
+      try {
+        corpus = corpusOfPlugin(config.dir, specifier);
+        entry = resolveFrom(config.dir, specifier);
+      } catch (error) {
+        return {
+          check: "exercised",
+          message: `${specifier}: ${String(error.message)}`,
+          subject: config.relative,
+          verdict: "SKIP"
+        };
+      }
+      const own = repoCorpus !== void 0 && config.relative === CONFIG_FILE ? repoCorpus : void 0;
+      return checkExercised({
+        config,
+        corpus,
+        entry,
+        oxlint,
+        ...own === void 0 ? {} : { repoCorpus: own },
+        root
+      });
+    })
+  )
 );
 var skip = (message) => [
   { check: "baseline", message, subject: RATCHET_FILE, verdict: "SKIP" }
@@ -1020,7 +1270,7 @@ var baselineOf = ({
   return ref === void 0 ? skip("no ref was named and this repo has no origin/main to fall back on") : checkBaseline({ ref, root });
 };
 var ordered = (findings) => CHECKS.flatMap((check) => findings.filter((one) => one.check === check));
-var EMPTY = { FAIL: 0, OK: 0, SKIP: 0, WARN: 0 };
+var EMPTY = { FAIL: 0, OK: 0, SKIP: 0, UNJUDGED: 0, WARN: 0 };
 var countsOf = (findings) => findings.reduce((counts, one) => ({ ...counts, [one.verdict]: counts[one.verdict] + 1 }), {
   ...EMPTY
 });
@@ -1036,7 +1286,7 @@ var runDoctor = async ({
   const repoCorpus = repoCorpusOf(root);
   const found = ordered([
     ...await checkLoaded({ configs, root, workspaces }),
-    ...exercisedOf({
+    ...await exercisedOf({
       configs,
       oxlint: binary,
       ...repoCorpus === void 0 ? {} : { repoCorpus },
@@ -1045,13 +1295,14 @@ var runDoctor = async ({
     ...baselineOf({ baseline, root }),
     ...checkRunner({ ratchet: readRatchet(root), workspaces }),
     ...await checkObservability({ now: Date.now(), root }),
-    ...checkDrift({ root, workspaces })
+    ...checkDrift({ root, workspaces }),
+    ...checkDeployed({ root })
   ]);
   const findings = strict ? found.map((one) => one.verdict === "WARN" ? { ...one, verdict: "FAIL" } : one) : found;
   return {
     counts: countsOf(findings),
     findings,
-    ok: !findings.some((one) => one.verdict === "FAIL"),
+    ok: passes(findings),
     root
   };
 };
@@ -1059,13 +1310,14 @@ var runDoctor = async ({
 // src/report.ts
 var ABOUT = {
   baseline: "a number that may only shrink, against another ref",
+  deployed: "what the pipeline reported deploying is what the tree declares",
   drift: "the gates that were set up and are no longer running",
   exercised: "every enabled rule fires on at least one corpus file",
   loaded: "the plugin oxlint would load is the one the manifest pins",
   observability: "an exporter is configured, reachable, and something arrived through it lately",
   runner: "something reads the test runner\u2019s own report, not its exit code"
 };
-var WIDTH = 4;
+var WIDTH = 8;
 var lineOf = (one) => `  ${one.verdict.padEnd(WIDTH)} ${one.subject}: ${one.message}`;
 var sectionOf = (check, findings) => {
   const mine = findings.filter((one) => one.check === check);
@@ -1079,8 +1331,8 @@ var formatDoctor = ({ counts, findings, ok, root }) => [
   `geonosis-doctor \u2014 ${root}`,
   "",
   ...CHECKS.flatMap((check) => sectionOf(check, findings)),
-  `${CHECKS.length} checks, ${findings.length} lines: ${counts.OK} ok, ${counts.WARN} warned, ${counts.SKIP} skipped, ${counts.FAIL} failed`,
-  ok ? "doctor PASS \u2014 nothing here says the gates are measuring something other than what they claim." : "doctor FAIL \u2014 a line above is a gate reporting on something other than what it names.",
+  `${CHECKS.length} checks, ${findings.length} lines: ${counts.OK} ok, ${counts.WARN} warned, ${counts.SKIP} skipped, ${counts.UNJUDGED} unjudged, ${counts.FAIL} failed`,
+  ok ? "doctor PASS \u2014 nothing here says the gates are measuring something other than what they claim." : "doctor FAIL \u2014 a line above is a gate reporting on something other than what it names, or a question this could not ask at all.",
   ""
 ].join("\n");
 var formatJson = (report) => `${JSON.stringify(report, null, 2)}
@@ -1097,6 +1349,9 @@ export {
   readRatchet,
   defaultRef,
   checkBaseline,
+  DEPLOYED_FILE,
+  NOT_WRITTEN,
+  checkDeployed,
   CHECKS,
   DoctorError,
   resolveFrom,