@geonosis/doctor 1.0.0 → 1.2.0

package/dist/doctor-cli.js

@@ -1,12 +1,13 @@
 import {
+  CHECKS,
   formatDoctor,
   formatJson,
   runDoctor
-} from "./chunk-R4AHDFE3.js";
+} from "./chunk-ZJCUTDQW.js";
 
 // src/doctor-cli.ts
 import { resolve } from "path";
-var USAGE = `geonosis-doctor [--root <dir>] [--json] [--strict] [--baseline-against [<ref>]] [--oxlint <path>]
+var USAGE = `geonosis-doctor [--root <dir>] [--only <check,\u2026>] [--json] [--strict] [--baseline-against [<ref>]] [--oxlint <path>]
 
 Five questions a version bump is not finished until something has asked. The first four are ways
 enforcement has reported green while measuring nothing; the fifth asks whether it is still there.
@@ -42,14 +43,22 @@ enforcement has reported green while measuring nothing; the fifth asks whether i
               geonosis.json set, no .claude/settings.json installing the plugin, and a
               geonosis.json block whose package is not installed (or the reverse).
 
+  deployed    What the pipeline REPORTED deploying, in .geonosis/deployed.json, against what the
+              tree declares in the wrangler configs geonosis.json names and release.secrets.
+              "versions upload" applies no triggers, so a cron edited in a config is silently
+              ignored in production for ever with a green pipeline; a secret can be put outside the
+              gate entirely. SKIPs with the sentence when the file is absent \u2014 its absence is not a
+              pass \u2014 and reads the file rather than importing @geonosis/release.
+
 exercised reads the corpus the loaded plugin ships, and \u2014 when geonosis.json names one under
 doctor.corpus \u2014 the corpus THIS repo ships for its own options. Three rules cannot be answered any
 other way: layer-walls fires on a repo's own layer names, no-brand-names on its brand, and
 plugin-route-namespaced on its package root, while the shipped corpus says acme and layers/core.
 
-Exits 1 when any line is a FAIL, 2 when the run could not be made at all. --strict promotes every
-WARN to a FAIL. --json prints the whole report for a CI step to read.`;
-var VALUED = /* @__PURE__ */ new Set(["--oxlint", "--root"]);
+Exits 1 when any line is a FAIL or an UNJUDGED \u2014 a question this could not ask is not a pass \u2014 and
+2 when the run could not be made at all. --strict promotes every WARN to a FAIL. --json prints the
+whole report for a CI step to read.`;
+var VALUED = /* @__PURE__ */ new Set(["--only", "--oxlint", "--root"]);
 var parseDoctorArgs = (argv, cwd) => {
   const read = {};
   let baseline;
@@ -77,9 +86,15 @@ var parseDoctorArgs = (argv, cwd) => {
     read[flag] = value;
     index += 1;
   }
+  const only = read["--only"]?.split(",").map((one) => one.trim()).filter((one) => one !== "");
+  const unknown = (only ?? []).filter((one) => !CHECKS.includes(one));
+  if (unknown.length > 0) {
+    throw new Error(`no check called ${unknown.join(", ")} \u2014 the checks are ${CHECKS.join(", ")}`);
+  }
   return {
     ...baseline === void 0 ? {} : { baseline },
     json,
+    ...only === void 0 || only.length === 0 ? {} : { only },
     ...read["--oxlint"] === void 0 ? {} : { oxlint: resolve(cwd, read["--oxlint"]) },
     root: resolve(cwd, read["--root"] ?? cwd),
     strict

package/dist/index.d.ts

@@ -1,15 +1,22 @@
 /**
- * The five questions a bump is not finished until something has asked, in the order a run asks
- * them. The first four are ways enforcement has reported green while measuring nothing; the fifth
- * asks whether the gate is still there at all.
+ * The questions a bump is not finished until something has asked, in the order a run asks them.
+ * The first four are ways enforcement has reported green while measuring nothing; `drift` asks
+ * whether the gate is still there at all; `observability` and `deployed` ask the same question one
+ * layer out — whether what was reported is what happened.
  */
-declare const CHECKS: readonly ["loaded", "exercised", "baseline", "runner", "drift", "observability"];
+declare const CHECKS: readonly ["loaded", "exercised", "baseline", "runner", "drift", "observability", "deployed"];
 type CheckName = (typeof CHECKS)[number];
 /**
  * `SKIP` is a first-class answer and is printed like any other: a check whose line is missing reads
  * as a check that passed, and that is the failure this whole package is about.
+ *
+ * `UNJUDGED` is the fifth, and it is neither OK nor FAIL. The question could not be ASKED — the
+ * corpus has no file this repo's options would reach and the rule declares no probe to make one —
+ * so the run does not pass, and the sentence says why instead of accusing the repo. The difference
+ * matters because a FAIL over a rule the repo is enforcing correctly is an invitation to delete the
+ * rule, and one consumer names exactly such a rule as live enforcement in its own law.
  */
-type Verdict = 'FAIL' | 'OK' | 'SKIP' | 'WARN';
+type Verdict = 'FAIL' | 'OK' | 'SKIP' | 'UNJUDGED' | 'WARN';
 type Finding = {
     check: CheckName;
     message: string;
@@ -58,13 +65,18 @@ type DoctorOptions = {
         ref?: string;
     };
     oxlint?: string;
+    /** Run these checks and no other — one question, asked fast, belongs in a sub-second gate. */
+    only?: CheckName[];
     root: string;
     strict?: boolean;
 };
 type DoctorReport = {
     counts: Record<Verdict, number>;
     findings: Finding[];
-    /** False as soon as one line is a FAIL — after `--strict` has promoted the warnings. */
+    /**
+     * False as soon as one line is a FAIL or an UNJUDGED — after `--strict` has promoted the
+     * warnings. "We could not tell" is not a pass; it is the quietest way there is of reading green.
+     */
     ok: boolean;
     root: string;
 };
@@ -86,6 +98,24 @@ declare const checkBaseline: ({ ref, root }: {
     root: string;
 }) => Finding[];
 
+/**
+ * The `loaded` lie one layer out: what a pipeline SAID it deployed, against what the tree declares.
+ *
+ * `wrangler versions upload` applies no triggers, so a cron or a route edited in the config is
+ * silently ignored in production for ever, with a green pipeline; `wrangler secret put` creates and
+ * deploys a version outside the gate entirely. Nothing in either consumer measured any of it.
+ *
+ * This reads the FILE the consumer's pipeline writes after promote — `.geonosis/deployed.json` —
+ * and imports nothing of `@geonosis/release`, the same discipline `observability` follows: a check
+ * that needed the package it checks cannot run in the tree where that package is missing. The
+ * comparison is duplicated on purpose; it is set differences over four lists.
+ */
+declare const DEPLOYED_FILE = ".geonosis/deployed.json";
+declare const NOT_WRITTEN = "no .geonosis/deployed.json \u2014 it is written by the pipeline after promote, and its absence is not a pass";
+declare const checkDeployed: ({ root }: {
+    root: string;
+}) => Finding[];
+
 declare const CONFIG_FILE = ".oxlintrc.json";
 declare const MANIFEST_FILE = "package.json";
 declare const RATCHET_FILE = "geonosis.ratchet.json";
@@ -96,7 +126,7 @@ declare const discoverConfigs: (root: string) => DiscoveredConfig[];
 declare const discoverWorkspaces: (root: string) => Workspace[];
 declare const readRatchet: (root: string) => RatchetConfig | undefined;
 
-declare const runDoctor: ({ baseline, oxlint, root, strict, }: DoctorOptions) => Promise<DoctorReport>;
+declare const runDoctor: ({ baseline, only, oxlint, root, strict, }: DoctorOptions) => Promise<DoctorReport>;
 
 /** Which kit package reads which block of `geonosis.json`. */
 declare const READERS: Record<string, string>;
@@ -133,14 +163,16 @@ declare const enabledRulesOf: (rules: Record<string, unknown>, plugin: string) =
  * place where the difference is visible, so the question is asked there, under THIS config's
  * options, because the options are usually where the reach went.
  */
-declare const checkExercised: ({ config, corpus, oxlint, repoCorpus, root, }: {
+declare const checkExercised: ({ config, corpus, entry, oxlint, repoCorpus, root, }: {
     config: DiscoveredConfig;
     corpus: string;
+    /** The plugin module oxlint loads from this config's directory — where the probes are read. */
+    entry?: string;
     oxlint: string;
     /** The corpus this repo ships for its OWN options, when `geonosis.json` declares one. */
     repoCorpus?: string;
     root: string;
-}) => Finding;
+}) => Promise<Finding>;
 
 /** The scope this tool asks about. A config's other plugins are somebody else's release to check. */
 declare const SCOPE = "@geonosis/";
@@ -240,16 +272,19 @@ declare const corpusOfPlugin: (from: string, specifier: string) => string;
 declare const relativeToRoot: (root: string, path: string) => string;
 
 /**
- * A test runner's exit code is not a verdict; its summary is.
+ * Whether a test runner's exit code is a verdict — asked of the runner the script actually names,
+ * not of runners in general.
  *
  * `@cloudflare/vitest-pool-workers` exited 0 over suites it had just reported as failing, for
  * weeks, in a consumer — so every gate that trusted the status read green over red. The fix is a
- * runner that writes its own report and something that reads it; this says which workspaces have
- * neither.
+ * runner that writes its own report and something that reads it; this says which vitest workspaces
+ * have neither. `bun test` was measured and does not have the defect, so it is told the two apart:
+ * a WARN that names the wrong runner's sin is a line a reader learns to skip, and the lines it
+ * teaches them to skip are the true ones next to it.
  */
 declare const checkRunner: ({ ratchet, workspaces, }: {
     ratchet?: RatchetConfig;
     workspaces: Workspace[];
 }) => Finding[];
 
-export { CHECKS, CONFIG_FILE, type CheckName, type DiscoveredConfig, DoctorError, type DoctorOptions, type DoctorReport, type Finding, GEONOSIS_FILE, type LastEventRecord, MANIFEST_FILE, type Manifest, type ObservabilityConfig, RATCHET_FILE, READERS, type RatchetConfig, SCOPE, type Verdict, type Workspace, checkBaseline, checkDrift, checkExercised, checkLoaded, checkObservability, checkRunner, corpusOfPlugin, declaredFor, defaultRef, discoverConfigs, discoverWorkspaces, enabledRulesOf, formatDoctor, formatJson, packageDirOf, pluginVersionOf, readConfig, readRatchet, relativePath, relativeToRoot, repoCorpusOf, resolveFrom, runDoctor, satisfies };
+export { CHECKS, CONFIG_FILE, type CheckName, DEPLOYED_FILE, type DiscoveredConfig, DoctorError, type DoctorOptions, type DoctorReport, type Finding, GEONOSIS_FILE, type LastEventRecord, MANIFEST_FILE, type Manifest, NOT_WRITTEN, type ObservabilityConfig, RATCHET_FILE, READERS, type RatchetConfig, SCOPE, type Verdict, type Workspace, checkBaseline, checkDeployed, checkDrift, checkExercised, checkLoaded, checkObservability, checkRunner, corpusOfPlugin, declaredFor, defaultRef, discoverConfigs, discoverWorkspaces, enabledRulesOf, formatDoctor, formatJson, packageDirOf, pluginVersionOf, readConfig, readRatchet, relativePath, relativeToRoot, repoCorpusOf, resolveFrom, runDoctor, satisfies };

package/dist/index.js

@@ -1,13 +1,16 @@
 import {
   CHECKS,
   CONFIG_FILE,
+  DEPLOYED_FILE,
   DoctorError,
   GEONOSIS_FILE,
   MANIFEST_FILE,
+  NOT_WRITTEN,
   RATCHET_FILE,
   READERS,
   SCOPE,
   checkBaseline,
+  checkDeployed,
   checkDrift,
   checkExercised,
   checkLoaded,
@@ -31,17 +34,20 @@ import {
   resolveFrom,
   runDoctor,
   satisfies
-} from "./chunk-R4AHDFE3.js";
+} from "./chunk-ZJCUTDQW.js";
 export {
   CHECKS,
   CONFIG_FILE,
+  DEPLOYED_FILE,
   DoctorError,
   GEONOSIS_FILE,
   MANIFEST_FILE,
+  NOT_WRITTEN,
   RATCHET_FILE,
   READERS,
   SCOPE,
   checkBaseline,
+  checkDeployed,
   checkDrift,
   checkExercised,
   checkLoaded,

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@geonosis/doctor",
-  "version": "1.0.0",
+  "version": "1.2.0",
+  "types": "./dist/index.d.ts",
   "description": "The adoption doctor — declared ≠ loaded, enabled ≠ exercised, a baseline that grew, a runner whose exit code is the only verdict.",
   "keywords": [
     "oxlint",
@@ -24,14 +25,17 @@
     "geonosis-doctor": "bin/geonosis-doctor.mjs"
   },
   "exports": {
-    ".": "./dist/index.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
   },
   "files": [
     "bin",
     "dist"
   ],
   "dependencies": {
-    "@geonosis/lint-parity": "1.0.0"
+    "@geonosis/lint-parity": "1.2.0"
   },
   "peerDependencies": {
     "oxlint": ">=1.77"