@geonosis/doctor 1.3.0 → 1.4.0

package/dist/{chunk-7BRGHYQR.js → chunk-R4OLFNI6.js}

@@ -325,6 +325,7 @@ var CHECKS = [
   "exercised",
   "baseline",
   "runner",
+  "envelope",
   "drift",
   "observability",
   "deployed"
@@ -1089,17 +1090,102 @@ var checkDrift = ({
   ];
 };
 
+// src/envelope.ts
+import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+var ENVELOPES_DIR = ".geonosis/envelopes";
+var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one";
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var finding4 = (verdict, subject, message) => ({
+  check: "envelope",
+  message,
+  subject,
+  verdict
+});
+var lengthOf = (value) => Array.isArray(value) ? value.length : void 0;
+var NEXT = "Next: re-run the tool that wrote it and read the numbers it prints \u2014 a run that has lost count of its own inputs is a bug in that tool, not in this tree";
+var judge = (subject, name, parsed) => {
+  if (!isRecord2(parsed)) return finding4("FAIL", subject, `is not an object. ${NEXT}`);
+  const tool = parsed["tool"];
+  if (typeof tool !== "string" || tool.trim() === "") {
+    return finding4(
+      "FAIL",
+      subject,
+      `names no tool, so nothing here says which run it is about. ${NEXT}`
+    );
+  }
+  if (tool !== name) {
+    return finding4(
+      "FAIL",
+      subject,
+      `is written by "${tool}", not "${name}" \u2014 a tool writing another tool's envelope leaves both of their numbers unattributable. ${NEXT}`
+    );
+  }
+  const version = parsed["version"];
+  if (typeof version !== "string" || version.trim() === "") {
+    return finding4(
+      "FAIL",
+      subject,
+      `${tool}: names no version, so nothing dates this run and a stale envelope reads exactly like a fresh one. ${NEXT}`
+    );
+  }
+  const considered = parsed["considered"];
+  const read = parsed["read"];
+  const refused = lengthOf(parsed["refused"]);
+  const excused = lengthOf(parsed["excused"]);
+  if (typeof considered !== "number" || typeof read !== "number" || refused === void 0 || excused === void 0) {
+    return finding4(
+      "FAIL",
+      subject,
+      `${tool}: has no considered/read/refused/excused to check \u2014 the four numbers ARE the envelope, and a file without them measures nothing. ${NEXT}`
+    );
+  }
+  const accounted = read + refused + excused;
+  return considered === accounted ? finding4(
+    "OK",
+    subject,
+    `${tool} considered ${considered} and accounts for all of them \u2014 ${read} read + ${refused} refused + ${excused} excused`
+  ) : finding4(
+    "FAIL",
+    subject,
+    `${tool}: considered ${considered} but accounts for ${accounted} \u2014 ${read} read + ${refused} refused + ${excused} excused. It reported on fewer things than it was handed, and every verdict it printed is over the smaller number. ${NEXT}`
+  );
+};
+var checkEnvelopes = ({ root }) => {
+  const dir = join5(root, ENVELOPES_DIR);
+  const files = existsSync4(dir) ? readdirSync3(dir).filter((name) => name.endsWith(".json")).toSorted() : [];
+  if (files.length === 0) return [finding4("SKIP", ENVELOPES_DIR, NO_ENVELOPES)];
+  return files.map((name) => {
+    const subject = `${ENVELOPES_DIR}/${name}`;
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync5(join5(dir, name), "utf8"));
+    } catch (error) {
+      return finding4("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
+    }
+    return judge(subject, name.replace(/\.json$/, ""), parsed);
+  });
+};
+
 // src/exercised.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { cpSync, existsSync as existsSync4, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import {
+  cpSync,
+  existsSync as existsSync5,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync as readFileSync6,
+  rmSync,
+  writeFileSync
+} from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join6, resolve } from "path";
 import { corpusOf, readManifest } from "@geonosis/lint-parity";
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
 var severityOf = (level) => Array.isArray(level) ? level[0] : level;
 var enabledRulesOf = (rules, plugin) => Object.keys(rules).filter((id) => id.startsWith(`${plugin}/`) && !OFF.has(severityOf(rules[id]))).toSorted();
 var passes = (findings) => !findings.some((one) => one.verdict === "FAIL" || one.verdict === "UNJUDGED");
-var finding4 = (subject, verdict, message) => ({
+var finding5 = (subject, verdict, message) => ({
   check: "exercised",
   message,
   subject,
@@ -1111,9 +1197,9 @@ var refusal = (error) => {
   return said.length > LIMIT ? `${said.slice(0, LIMIT)}\u2026` : said;
 };
 var reasonFrom = (config, oxlint) => {
-  const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-why-"));
+  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-why-"));
   try {
-    const probe = join5(dir, "probe.tsx");
+    const probe = join6(dir, "probe.tsx");
     writeFileSync(probe, "export const probe = 1\n");
     const run = spawnSync2(
       oxlint,
@@ -1180,6 +1266,20 @@ var enabledHere = (config, plugin) => [
     ...config.overrides.flatMap((one) => enabledRulesOf(one.rules, plugin))
   ])
 ].toSorted();
+var concreteDirOf = (glob) => {
+  const segments = glob.split("/");
+  const out = [];
+  for (const segment of segments.slice(0, -1)) {
+    if (segment === "**") continue;
+    if (segment === "*") {
+      out.push("geonosis");
+      continue;
+    }
+    if (segment.includes("*") || segment.includes("{")) return void 0;
+    out.push(segment);
+  }
+  return out.join("/");
+};
 var throughProbes = ({
   config,
   corpus,
@@ -1189,8 +1289,8 @@ var throughProbes = ({
 }) => {
   const refused = /* @__PURE__ */ new Map();
   const placed = /* @__PURE__ */ new Set();
-  const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-probe-"));
-  const here = join5(dir, "corpus");
+  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-probe-"));
+  const here = join6(dir, "corpus");
   try {
     cpSync(corpus, here, { recursive: true });
     for (const rule of silent) {
@@ -1204,18 +1304,34 @@ var throughProbes = ({
           const files = write(layer.options);
           if (files.length === 0) throw new Error("its probe declares no file at all");
           const claims = layer.files.length === 0 || files.some((file) => layer.files.some((glob) => matchesGlob(glob, file.path)));
+          let mounted = files;
           if (!claims) {
-            unclaimed.push(
-              `its probe lands at ${files[0]?.path ?? ""}, which the entry enabling it claims none of: ${layer.files.join(", ")}`
-            );
-            continue;
+            const rehomed = layer.files.map((glob) => {
+              const home = concreteDirOf(glob);
+              if (home === void 0) return void 0;
+              const extension = /^\*(\.[\w.]+)$/.exec(glob.split("/").at(-1) ?? "")?.[1];
+              const moved = files.map((file) => {
+                const base = file.path.split("/").at(-1) ?? file.path;
+                const adapted = extension === void 0 || base.endsWith(extension) ? base : base.replace(/\.[^.]+$/, extension);
+                const kept = layer.files.some((one) => matchesGlob(one, `${home}/${base}`));
+                return { ...file, path: `${home}/${kept ? base : adapted}` };
+              });
+              return moved.every((file) => layer.files.some((one) => matchesGlob(one, file.path))) ? moved : void 0;
+            }).find((moved) => moved !== void 0);
+            if (rehomed === void 0) {
+              unclaimed.push(
+                `its probe lands at ${files[0]?.path ?? ""}, which the entry enabling it claims none of (and no claimed path could be synthesized): ${layer.files.join(", ")}`
+              );
+              continue;
+            }
+            mounted = rehomed;
           }
-          for (const file of files) {
-            const at = join5(here, file.path);
-            if (placed.has(at)) continue;
-            placed.add(at);
-            mkdirSync(dirname2(at), { recursive: true });
-            writeFileSync(at, file.source);
+          for (const file of mounted) {
+            const at2 = join6(here, file.path);
+            if (placed.has(at2)) continue;
+            placed.add(at2);
+            mkdirSync(dirname2(at2), { recursive: true });
+            writeFileSync(at2, file.source);
           }
           anyPlaced = true;
         }
@@ -1224,13 +1340,28 @@ var throughProbes = ({
         refused.set(rule, String(error.message));
       }
     }
-    const reach = corpusOf({
-      configA: config.path,
-      configB: config.path,
-      corpus: here,
-      oxlint
-    }).reach;
-    return { fired: new Set(reach.filter((one) => one.firedInA).map((one) => one.rule)), refused };
+    const probeConfig = JSON.parse(readFileSync6(config.path, "utf8"));
+    const configDir = dirname2(config.path);
+    probeConfig.jsPlugins = (probeConfig.jsPlugins ?? []).map(
+      (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve(configDir, spec) : packageDirOf(resolveFrom(configDir, spec), spec)
+    );
+    const at = join6(here, ".oxlintrc-geonosis-probe.json");
+    writeFileSync(at, JSON.stringify(probeConfig, null, 2));
+    const run = spawnSync2(
+      oxlint,
+      ["-c", at, "--format", "json", "--no-ignore", "--disable-nested-config", here],
+      { cwd: dir, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
+    );
+    const fired = /* @__PURE__ */ new Set();
+    try {
+      const parsed = JSON.parse(run.stdout || "{}");
+      for (const one of parsed.diagnostics ?? []) {
+        const renamed = /^([\w@./-]+)\((.+)\)$/.exec(one.code ?? "");
+        if (renamed !== null) fired.add(`${renamed[1]}/${renamed[2]}`);
+      }
+    } catch {
+    }
+    return { fired, refused };
   } finally {
     rmSync(dir, { force: true, recursive: true });
   }
@@ -1243,14 +1374,14 @@ var checkExercised = async ({
   repoCorpus,
   root
 }) => {
-  const said = (verdict, message) => finding4(config.relative, verdict, message);
-  if (repoCorpus !== void 0 && !existsSync4(repoCorpus)) {
+  const said = (verdict, message) => finding5(config.relative, verdict, message);
+  if (repoCorpus !== void 0 && !existsSync5(repoCorpus)) {
     return said(
       "FAIL",
       `geonosis.json declares a reach corpus at ${relativeToRoot(root, repoCorpus)} and there is nothing there \u2014 a corpus that cannot be read is a claim, not evidence`
     );
   }
-  if (!existsSync4(corpus)) {
+  if (!existsSync5(corpus)) {
     return said(
       "SKIP",
       `the plugin loaded from here ships no corpus at ${relativeToRoot(root, corpus)} \u2014 nothing declares which rules it can be evidence about`
@@ -1301,7 +1432,8 @@ var checkExercised = async ({
   if (silent.length === 0) {
     return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where}`);
   }
-  const probes = entry === void 0 ? {} : await probesOf(entry, manifest.plugin).catch(() => ({}));
+  const loadedProbes = entry === void 0 ? null : await probesOf(entry, manifest.plugin).catch(() => null);
+  const probes = loadedProbes ?? {};
   const declared = silent.filter((rule) => probes[rule] !== void 0);
   const unprobed = silent.filter((rule) => probes[rule] === void 0);
   let probed = { fired: /* @__PURE__ */ new Set(), refused: /* @__PURE__ */ new Map() };
@@ -1321,13 +1453,18 @@ var checkExercised = async ({
       `${countOf(placed, "fire")} nowhere in the corpus and nothing through the probe each declares either: ${named(placed.map((rule) => under(config, rule)))}`
     );
   }
-  const unplaceable = [
-    ...unprobed.map(
-      (rule) => `${rule} declares no probe, so ${optionSetsOf(config, rule).every((options) => options.length === 0) ? "its scope" : under(config, rule)} does not reach the corpus`
-    ),
-    ...inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`)
-  ];
-  if (unplaceable.length > 0) return said("UNJUDGED", named(unplaceable));
+  const unplaceable = inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`);
+  const kitNote = unprobed.length === 0 || loadedProbes === null ? "" : `the loaded plugin ships no probe for ${unprobed.length === 1 ? "this enabled rule" : `${unprobed.length} enabled rules`} \u2014 the kit's omission, not this repo's (geonosis #131): ${unprobed.join(", ")}`;
+  const unknowable = loadedProbes === null ? unprobed.map(
+    (rule) => `${rule} declares no probe, so ${optionSetsOf(config, rule).every((options) => options.length === 0) ? "its scope" : under(config, rule)} does not reach the corpus`
+  ) : [];
+  if (unplaceable.length > 0 || unknowable.length > 0) {
+    return said(
+      "UNJUDGED",
+      named([...unknowable, ...unplaceable]) + (kitNote === "" ? "" : ` \u2014 and ${kitNote}`)
+    );
+  }
+  if (kitNote !== "") return said("WARN", kitNote);
   const through = exercised.length === 1 ? "1 through its declared probe under this repo\u2019s options" : `${exercised.length} through their declared probes under this repo\u2019s options`;
   return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${through}`);
 };
@@ -1403,7 +1540,7 @@ var declaredFor = ({
   }
   return void 0;
 };
-var finding5 = (subject, verdict, message) => ({
+var finding6 = (subject, verdict, message) => ({
   check: "loaded",
   message,
   subject,
@@ -1420,7 +1557,7 @@ var oneConfig = async ({
   specifier,
   workspaces
 }) => {
-  const said = (verdict, message) => finding5(config.relative, verdict, `${specifier}: ${message}`);
+  const said = (verdict, message) => finding6(config.relative, verdict, `${specifier}: ${message}`);
   let loaded;
   try {
     loaded = await versionAt(resolveFrom(config.dir, specifier), specifier, root);
@@ -1472,10 +1609,10 @@ var copiesOf = async ({
     found.set(at, { from: [labelOf(workspace)], version: await pluginVersionOf(entry) });
   }
   if (found.size === 0) {
-    return finding5(specifier, "FAIL", "no workspace in this tree can resolve it at all");
+    return finding6(specifier, "FAIL", "no workspace in this tree can resolve it at all");
   }
   const listed = [...found.entries()].map(([at, one]) => `${at} ${one.version} (${one.from.join(", ")})`).join("; ");
-  return found.size === 1 ? finding5(specifier, "OK", `1 copy \u2014 ${listed}`) : finding5(
+  return found.size === 1 ? finding6(specifier, "OK", `1 copy \u2014 ${listed}`) : finding6(
     specifier,
     "WARN",
     `${found.size} copies \u2014 ${listed}. Which one oxlint runs depends on which directory its config sits in.`
@@ -1490,7 +1627,7 @@ var checkLoaded = async ({
   const specifiers = /* @__PURE__ */ new Set();
   for (const config of configs) {
     if (config.error !== void 0) {
-      findings.push(finding5(config.relative, "FAIL", config.error));
+      findings.push(finding6(config.relative, "FAIL", config.error));
       continue;
     }
     for (const specifier of config.jsPlugins.filter((name) => name.startsWith(SCOPE))) {
@@ -1505,13 +1642,13 @@ var checkLoaded = async ({
 };
 
 // src/observability.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join7 } from "path";
 var GEONOSIS_FILE = "geonosis.json";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
-var finding6 = (verdict, subject, message) => ({
+var finding7 = (verdict, subject, message) => ({
   check: "observability",
   message,
   subject,
@@ -1520,7 +1657,7 @@ var finding6 = (verdict, subject, message) => ({
 var readGeonosis2 = (root) => {
   let text;
   try {
-    text = readFileSync5(join6(root, GEONOSIS_FILE), "utf8");
+    text = readFileSync7(join7(root, GEONOSIS_FILE), "utf8");
   } catch {
     return { present: false };
   }
@@ -1538,25 +1675,25 @@ var readGeonosis2 = (root) => {
 var exporterFinding = (config) => {
   const sink = config.sink;
   if (typeof sink !== "string" || sink.trim() === "") {
-    return finding6(
+    return finding7(
       "FAIL",
       GEONOSIS_FILE,
       "observability.sink is not set, so nothing here says where errors are supposed to go \u2014 and a repo that cannot name its exporter has not got one"
     );
   }
   if (REACHES_NOTHING.has(sink.toLowerCase())) {
-    return finding6(
+    return finding7(
       "WARN",
       GEONOSIS_FILE,
       `the configured sink is "${sink}", which answers ok and reaches nothing. Correct in a dev tree; in a deployed one it is the instrument that cannot fail.`
     );
   }
-  return finding6("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
+  return finding7("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
 };
 var reachableFinding = async (config) => {
   const endpoint = config.endpoint;
   if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    return finding6(
+    return finding7(
       "SKIP",
       GEONOSIS_FILE,
       "no observability.endpoint was named, so whether the exporter is reachable was not asked"
@@ -1566,13 +1703,13 @@ var reachableFinding = async (config) => {
   const timer = setTimeout(() => controller.abort(), HEAD_TIMEOUT_MS);
   try {
     const response = await fetch(endpoint, { method: "HEAD", signal: controller.signal });
-    return finding6(
+    return finding7(
       "OK",
       GEONOSIS_FILE,
       `${endpoint} is reachable \u2014 it answered ${response.status} to a HEAD`
     );
   } catch (error) {
-    return finding6(
+    return finding7(
       "FAIL",
       GEONOSIS_FILE,
       `${endpoint} is not reachable from here: ${error.message}. Every report this repo sends is going into that.`
@@ -1584,7 +1721,7 @@ var reachableFinding = async (config) => {
 var ageFinding = (config, root, now) => {
   const file = config.lastEventFile;
   if (typeof file !== "string" || file.trim() === "") {
-    return finding6(
+    return finding7(
       "SKIP",
       GEONOSIS_FILE,
       "no observability.lastEventFile was configured, so when the last event arrived is not a question anything here can answer. Have the sink write { at, id, sink } on every capture and name the file."
@@ -1593,27 +1730,27 @@ var ageFinding = (config, root, now) => {
   const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
   let record;
   try {
-    record = JSON.parse(readFileSync5(join6(root, file), "utf8"));
+    record = JSON.parse(readFileSync7(join7(root, file), "utf8"));
   } catch (error) {
-    return finding6(
+    return finding7(
       "FAIL",
       file,
       `the last event file could not be read: ${error.message}. A sink that has never written one has never captured anything.`
     );
   }
   if (typeof record.at !== "number" || !Number.isFinite(record.at)) {
-    return finding6(
+    return finding7(
       "FAIL",
       file,
       'the last event record has no numeric "at", so its age cannot be read \u2014 and an age nobody can read is not an age inside the window'
     );
   }
   const ageSeconds = Math.round((now - record.at) / 1e3);
-  return ageSeconds > maxAgeSeconds ? finding6(
+  return ageSeconds > maxAgeSeconds ? finding7(
     "FAIL",
     file,
     `the last event arrived ${ageSeconds}s ago, past the ${maxAgeSeconds}s window. An exporter that stopped, a key that was rotated and a sink that has been dropping since Tuesday all look exactly like this, and all of them leave a green build.`
-  ) : finding6(
+  ) : finding7(
     "OK",
     file,
     `the last event arrived ${ageSeconds}s ago, inside the ${maxAgeSeconds}s window`
@@ -1622,16 +1759,16 @@ var ageFinding = (config, root, now) => {
 var probeFinding = (config) => {
   const probe = config.probe;
   if (typeof probe === "string" && probe.trim() !== "") {
-    return finding6("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
+    return finding7("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
   }
   if (typeof config.lastEventFile === "string" && config.lastEventFile.trim() !== "") {
-    return finding6(
+    return finding7(
       "OK",
       GEONOSIS_FILE,
       "no probe command, but a last event file is read above, so something does look at this exporter"
     );
   }
-  return finding6(
+  return finding7(
     "WARN",
     GEONOSIS_FILE,
     "neither observability.probe nor observability.lastEventFile is configured, so nothing in this repo has ever established that a report reaches the sink. Name a probe command \u2014 the doctor reports it, your gate runs it."
@@ -1644,7 +1781,7 @@ var checkObservability = async ({
   const read = readGeonosis2(root);
   if (read.error !== void 0) {
     return [
-      finding6(
+      finding7(
         "FAIL",
         GEONOSIS_FILE,
         `${GEONOSIS_FILE} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
@@ -1653,7 +1790,7 @@ var checkObservability = async ({
   }
   if (!read.present || read.config === void 0) {
     return [
-      finding6(
+      finding7(
         "SKIP",
         GEONOSIS_FILE,
         `no observability block in ${GEONOSIS_FILE}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
@@ -1670,16 +1807,16 @@ var checkObservability = async ({
 };
 
 // src/repo-corpus.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
+import { join as join8 } from "path";
 var GEONOSIS_FILE2 = "geonosis.json";
 var repoCorpusOf = (root) => {
-  const path = join7(root, GEONOSIS_FILE2);
-  if (!existsSync5(path)) return void 0;
+  const path = join8(root, GEONOSIS_FILE2);
+  if (!existsSync6(path)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
+    const parsed = JSON.parse(readFileSync8(path, "utf8"));
     const declared = parsed.doctor?.corpus;
-    return typeof declared === "string" && declared !== "" ? join7(root, declared) : void 0;
+    return typeof declared === "string" && declared !== "" ? join8(root, declared) : void 0;
   } catch {
     return void 0;
   }
@@ -1690,7 +1827,7 @@ var TEST_FAILURES = "testFailures";
 var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
 var RUNS_BUN_TEST = /(?:^|[\s;&|(])(?:bunx\s+)?bun\s+test(?:\s|$)/;
 var WRITES_A_REPORT = /--reporter[= ]\S*json|--outputFile/i;
-var finding7 = (subject, verdict, message) => ({
+var finding8 = (subject, verdict, message) => ({
   check: "runner",
   message,
   subject,
@@ -1718,7 +1855,7 @@ var checkRunner = ({
     if (script === "") return [];
     const subject = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
     const said = (verdict, message) => [
-      finding7(subject, verdict, message)
+      finding8(subject, verdict, message)
     ];
     if (!RUNS_A_RUNNER.test(script)) {
       return said(
@@ -1838,6 +1975,7 @@ var runDoctor = async ({
     ],
     ["baseline", () => baselineOf({ baseline, root })],
     ["runner", () => checkRunner({ ratchet: readRatchet(root), workspaces })],
+    ["envelope", () => checkEnvelopes({ root })],
     ["observability", () => checkObservability({ now: Date.now(), root })],
     ["drift", () => checkDrift({ root, workspaces })],
     ["deployed", () => checkDeployed({ root })]
@@ -1859,6 +1997,7 @@ var ABOUT = {
   baseline: "a number that may only shrink, against another ref",
   deployed: "what the pipeline reported deploying is what the tree declares",
   drift: "the gates that were set up and are no longer running",
+  envelope: "every gate read as many things as it was handed",
   exercised: "every enabled rule fires on at least one corpus file",
   loaded: "the plugin oxlint would load is the one the manifest pins",
   observability: "an exporter is configured, reachable, and something arrived through it lately",
@@ -1912,6 +2051,9 @@ export {
   relativeToRoot,
   READERS,
   checkDrift,
+  ENVELOPES_DIR,
+  NO_ENVELOPES,
+  checkEnvelopes,
   enabledRulesOf,
   checkExercised,
   SCOPE,

package/dist/doctor-cli.js

@@ -3,7 +3,7 @@ import {
   formatDoctor,
   formatJson,
   runDoctor
-} from "./chunk-7BRGHYQR.js";
+} from "./chunk-R4OLFNI6.js";
 
 // src/doctor-cli.ts
 import { resolve } from "path";
@@ -25,6 +25,13 @@ var ABOUT = {
               through pnpm/npx/bunx and therefore cannot start, a law over the ceiling its own
               geonosis.json declared, nothing enabling the plugin in either scope, and a
               geonosis.json block no manifest declares a package for (or the reverse).`,
+  envelope: `The arithmetic under every other line: for each .geonosis/envelopes/<tool>.json a gate
+              wrote, considered === read + refused + excused. Four denominator bugs landed in one
+              day and every one of them was GREEN \u2014 a migrations run that reported on three of four
+              files, a plan check that printed "PASS \u2014 0 plan(s)" over a directory of twenty-one, a
+              parity run over a tree the second config ignored. Each published a numerator and no
+              denominator. Reads the files and imports nothing of the tools that wrote them; no
+              envelopes at all is a SKIP with the sentence.`,
   exercised: `Every rule a config enables, against the corpus the loaded plugin ships. A rule at
               "error" that can never fire is indistinguishable from a clean tree.`,
   loaded: `The plugin oxlint would LOAD from each config's directory, against the version that

package/dist/index.d.ts

@@ -5,11 +5,12 @@ type Overrides = {
 
 /**
  * The questions a bump is not finished until something has asked, in the order a run asks them.
- * The first four are ways enforcement has reported green while measuring nothing; `drift` asks
- * whether the gate is still there at all; `observability` and `deployed` ask the same question one
- * layer out — whether what was reported is what happened.
+ * The first four are ways enforcement has reported green while measuring nothing; `envelope` asks
+ * the arithmetic underneath all of them — whether a gate read as many things as it was handed;
+ * `drift` asks whether the gate is still there at all; `observability` and `deployed` ask the same
+ * question one layer out — whether what was reported is what happened.
  */
-declare const CHECKS: readonly ["loaded", "exercised", "baseline", "runner", "drift", "observability", "deployed"];
+declare const CHECKS: readonly ["loaded", "exercised", "baseline", "runner", "envelope", "drift", "observability", "deployed"];
 type CheckName = (typeof CHECKS)[number];
 /**
  * `SKIP` is a first-class answer and is printed like any other: a check whose line is missing reads
@@ -163,6 +164,27 @@ declare const checkDrift: ({ readers, root, userSettings, workspaces, }: {
     workspaces: Workspace[];
 }) => Finding[];
 
+/**
+ * The one line that catches a denominator bug: for every envelope a tool wrote,
+ * `considered === read + refused + excused`.
+ *
+ * Four of them landed in one day, all green — a migrations run that reported on three of four
+ * files, a plan check that printed `PASS — 0 plan(s)` over a directory of twenty-one, a parity run
+ * over a tree the second config had ignored, a validator that walked a list it had already
+ * filtered. Every one published a numerator and no denominator, so nothing could be wrong.
+ *
+ * This READS the files and imports nothing of the tools that wrote them — the same discipline
+ * `deployed` and `observability` follow. A check that needed the package it checks cannot run in
+ * the tree where that package is missing, which is the first case it exists to find; and this one
+ * has to work over a consumer's `.geonosis/` with no kit installed at all. The arithmetic is
+ * duplicated here on purpose: it is one comparison over three numbers, and it is the check.
+ */
+declare const ENVELOPES_DIR = ".geonosis/envelopes";
+declare const NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one";
+declare const checkEnvelopes: ({ root }: {
+    root: string;
+}) => Finding[];
+
 /**
  * The rules of one plugin a config actually turns on. A rule NAMED in a config is not a rule
  * enabled by it — `"off"` is how a config records a rule it decided against, and counting those as
@@ -291,4 +313,4 @@ declare const checkRunner: ({ ratchet, workspaces, }: {
     workspaces: Workspace[];
 }) => Finding[];
 
-export { CHECKS, CONFIG_FILE, type CheckName, DEPLOYED_FILE, type DiscoveredConfig, DoctorError, type DoctorOptions, type DoctorReport, type Finding, GEONOSIS_FILE, type LastEventRecord, MANIFEST_FILE, type Manifest, NOT_WRITTEN, type ObservabilityConfig, RATCHET_FILE, READERS, type RatchetConfig, SCOPE, type Verdict, type Workspace, checkBaseline, checkDeployed, checkDrift, checkExercised, checkLoaded, checkObservability, checkRunner, corpusOfPlugin, declaredFor, defaultRef, discoverConfigs, discoverWorkspaces, enabledRulesOf, formatDoctor, formatJson, packageDirOf, pluginVersionOf, readConfig, readRatchet, relativePath, relativeToRoot, repoCorpusOf, resolveFrom, runDoctor, satisfies };
+export { CHECKS, CONFIG_FILE, type CheckName, DEPLOYED_FILE, type DiscoveredConfig, DoctorError, type DoctorOptions, type DoctorReport, ENVELOPES_DIR, type Finding, GEONOSIS_FILE, type LastEventRecord, MANIFEST_FILE, type Manifest, NOT_WRITTEN, NO_ENVELOPES, type ObservabilityConfig, RATCHET_FILE, READERS, type RatchetConfig, SCOPE, type Verdict, type Workspace, checkBaseline, checkDeployed, checkDrift, checkEnvelopes, checkExercised, checkLoaded, checkObservability, checkRunner, corpusOfPlugin, declaredFor, defaultRef, discoverConfigs, discoverWorkspaces, enabledRulesOf, formatDoctor, formatJson, packageDirOf, pluginVersionOf, readConfig, readRatchet, relativePath, relativeToRoot, repoCorpusOf, resolveFrom, runDoctor, satisfies };

package/dist/index.js

@@ -3,15 +3,18 @@ import {
   CONFIG_FILE,
   DEPLOYED_FILE,
   DoctorError,
+  ENVELOPES_DIR,
   GEONOSIS_FILE,
   MANIFEST_FILE,
   NOT_WRITTEN,
+  NO_ENVELOPES,
   RATCHET_FILE,
   READERS,
   SCOPE,
   checkBaseline,
   checkDeployed,
   checkDrift,
+  checkEnvelopes,
   checkExercised,
   checkLoaded,
   checkObservability,
@@ -34,21 +37,24 @@ import {
   resolveFrom,
   runDoctor,
   satisfies
-} from "./chunk-7BRGHYQR.js";
+} from "./chunk-R4OLFNI6.js";
 export {
   CHECKS,
   CONFIG_FILE,
   DEPLOYED_FILE,
   DoctorError,
+  ENVELOPES_DIR,
   GEONOSIS_FILE,
   MANIFEST_FILE,
   NOT_WRITTEN,
+  NO_ENVELOPES,
   RATCHET_FILE,
   READERS,
   SCOPE,
   checkBaseline,
   checkDeployed,
   checkDrift,
+  checkEnvelopes,
   checkExercised,
   checkLoaded,
   checkObservability,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/doctor",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "types": "./dist/index.d.ts",
   "description": "The adoption doctor — declared ≠ loaded, enabled ≠ exercised, a baseline that grew, a runner whose exit code is the only verdict.",
   "keywords": [
@@ -35,7 +35,7 @@
     "dist"
   ],
   "dependencies": {
-    "@geonosis/lint-parity": "1.3.0"
+    "@geonosis/lint-parity": "1.4.0"
   },
   "peerDependencies": {
     "oxlint": ">=1.77"