@geonosis/oxlint-plugin-biological-architecture 1.0.0 → 1.2.0

package/dist/index.d.ts

@@ -1,6 +1,28 @@
 import { Preset } from './presets.js';
 export { PRESETS, PresetName, rulesOfPreset } from './presets.js';
 
+/**
+ * The file a rule says MUST fire it, given the options it was handed.
+ *
+ * `requireOption` closed one hole: an enabled rule with no option refuses the run instead of
+ * reading as a clean tree. It leaves the next one open. A rule CONFIGURED with a repo's own
+ * vocabulary — its own brand, `packages/workflows/src/`, `@repo/db` — cannot be exercised by a corpus
+ * that ships fixtures saying `acme` and `corpus/workflows/`, so "fires nowhere" is what an
+ * adoption's doctor reports about a rule the repo is enforcing perfectly well. Both consumers filed
+ * exactly that on 2026-08-30, and both were right about the fact and wrong about whose defect it is.
+ *
+ * A probe is the answer the rule itself can give: hand it the options and it writes the smallest
+ * source that must fire it under THOSE options, at a path that lands where it looks. It is a claim,
+ * so it is tested through the real binary — a probe that does not fire is a rule that cannot be
+ * exercised, and the honest thing then is to say so rather than to widen the probe until it does.
+ */
+type Probe = {
+    /** Repo-root-relative, `/`-separated. It must satisfy every PATH option the rule reads. */
+    path: string;
+    source: string;
+};
+type ProbeFn = (options: readonly unknown[]) => Probe;
+
 type Rule = {
     create: (context: never) => Record<string, unknown>;
     fixShape: string;
@@ -12,6 +34,13 @@ type Rule = {
         schema: unknown[];
         type: string;
     };
+    /**
+     * Present only on a rule whose REACH depends on an option. It answers with the smallest source
+     * that must fire the rule under the options it is handed, so a repo whose corpus carries no such
+     * file can still be shown the rule reaching something — and a rule with no probe that fires
+     * nowhere stays a failure, which is the whole point of the check that reads this.
+     */
+    probe?: ProbeFn;
 };
 declare const rules: Record<string, Rule>;
 type RuleName = string;

package/dist/index.js

@@ -602,6 +602,40 @@ var requireOption = (rule, value, option) => {
   return value;
 };
 
+// src/rules/lib/probe.ts
+var bagOf = (options) => typeof options[0] === "object" && options[0] !== null && !Array.isArray(options[0]) ? options[0] : {};
+var firstOf = (configured, fallback) => {
+  const [first] = configured !== void 0 && configured.length > 0 ? configured : fallback;
+  if (first === void 0) throw new Error("no value and no default to build a probe from");
+  return first;
+};
+var LOOKAHEAD = /\(\?[!=][^)]*\)/g;
+var OPTIONAL_GROUP = /\(\?:[^)]*\)\?/g;
+var FIRST_ALTERNATIVE = /\(\?:([^)|]*)\|[^)]*\)/g;
+var GROUP = /\(\?:([^)]*)\)/g;
+var ANY_SEGMENT = /\[\^\/\]\+|\.\+|\.\*/g;
+var OPTIONAL_CLASS = /\[[^\]]*\]\?/g;
+var CLASS = /\[([^\]])[^\]]*\]/g;
+var OPTIONAL_CHAR = /[^/]\?/g;
+var QUANTIFIER = /[*+]/g;
+var LINTABLE = /\.[cm]?[jt]sx?$/;
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
+var pathMatching = (pattern, leaf) => {
+  const literal = pattern.replaceAll(LOOKAHEAD, "").replaceAll(OPTIONAL_GROUP, "").replaceAll(FIRST_ALTERNATIVE, "$1").replaceAll(GROUP, "$1").replaceAll(ANY_SEGMENT, "probe").replaceAll(OPTIONAL_CLASS, "").replaceAll(CLASS, "$1").replaceAll(String.raw`\.`, ".").replaceAll(String.raw`\/`, "/").replaceAll(OPTIONAL_CHAR, "").replaceAll("^", "").replaceAll("$", "").replaceAll(QUANTIFIER, "");
+  const here = new RegExp(pattern);
+  const candidates = [
+    literal.endsWith("/") ? `${literal}${leaf}` : literal,
+    ...EXTENSIONS.map((extension) => `${literal}${extension}`)
+  ];
+  const found = candidates.find((one) => LINTABLE.test(one) && here.test(one));
+  if (found === void 0) {
+    throw new Error(
+      `no probe path can be built from the pattern ${pattern}: nothing of the shape "${candidates[0] ?? ""}" both matches it and is a file oxlint would parse. Write the file by hand, or narrow the option to a path a probe can be placed at.`
+    );
+  }
+  return found;
+};
+
 // src/rules/document-sagas-are-generic.ts
 var escapeForRegex = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var documentSagasAreGeneric = {
@@ -642,6 +676,17 @@ rule refuses the run.`,
       }
     ],
     type: "problem"
+  },
+  /** The guarded tree is compiled in, so only the kind vocabulary has to come from the options. */
+  probe(options) {
+    const { perKindPrefixes = [] } = bagOf(options);
+    return {
+      path: "packages/workflows/src/geonosis-probe-saga.ts",
+      source: `import { saga } from 'sagaflow-js'
+
+export const geonosisProbe = saga('${perKindPrefixes[0] ?? ""}.geonosis-probe', {})
+`
+    };
   }
 };
 var document_sagas_are_generic_default = documentSagasAreGeneric;
@@ -692,6 +737,17 @@ schema silently.`,
       }
     ],
     type: "problem"
+  },
+  /** The schema directory is compiled in; the forbidden table names are this repo's vocabulary. */
+  probe(options) {
+    const { perKindTables = [] } = bagOf(options);
+    return {
+      path: "packages/db/src/schema/geonosis-probe-table.ts",
+      source: `import { pgTable, text } from 'drizzle-orm/pg-core'
+
+export const geonosisProbe = pgTable('${perKindTables[0] ?? ""}', { id: text('id') })
+`
+    };
   }
 };
 var documents_share_one_table_default = documentsShareOneTable;
@@ -856,6 +912,20 @@ under another name.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * The emit with no budget at all — the shape the rule speaks about first. `emitters` defaults to
+   * Medusa's spelling, so the probe reads the option the way `create` does, default included: a
+   * repo that wraps the emit under its own name gets a probe naming ITS wrapper, and a repo that
+   * does not gets `emitEventStep`.
+   */
+  probe(options) {
+    const emitter = firstOf(bagOf(options).emitters, DEFAULT_EMITTERS);
+    return {
+      path: "geonosis-probe-emit.ts",
+      source: `export const geonosisProbe = () => ${emitter}({ eventName: 'geonosis.probe' })
+`
+    };
   }
 };
 var emit_declares_attempts_default = emitDeclaresAttempts;
@@ -996,6 +1066,17 @@ run.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * A family literal, which fires whatever the declared roles are — the question `exercised` asks
+   * is whether the rule RUNS here, and a probe built out of an undeclared role name would be
+   * defeated by a repo that happened to declare one spelled the same.
+   */
+  probe() {
+    return {
+      path: "geonosis-probe-font.tsx",
+      source: "export const GeonosisProbe = () => <p style={{ fontFamily: 'Georgia, serif' }} />\n"
+    };
   }
 };
 var font_roles_only_default = fontRolesOnly;
@@ -1076,6 +1157,36 @@ with no \`layers\` at all the rule refuses the run: walls nobody declared are no
       }
     ],
     type: "problem"
+  },
+  /**
+   * A file in one declared layer importing a specifier that lands in another it may not reach.
+   *
+   * Both halves come out of the same regex sources the walls are written in — the filename from the
+   * layer it must sit in, the import from the layer it must not reach — and both are re-tested
+   * against the patterns they were built from. A pair the inversion cannot express is a sentence
+   * rather than a silent zero: the walls are a repo's own vocabulary, so there is no fixture
+   * anywhere that could stand in for them.
+   */
+  probe(options) {
+    const { layers = [] } = bagOf(options);
+    for (const here of layers) {
+      const mayImport = new Set(here.mayImport ?? []);
+      const target = layers.find((other) => other.name !== here.name && !mayImport.has(other.name));
+      const [herePath] = here.paths;
+      const [targetPath] = target?.paths ?? [];
+      if (target === void 0 || herePath === void 0 || targetPath === void 0) continue;
+      const source = pathMatching(targetPath, "geonosis-probe-target.ts");
+      return {
+        path: pathMatching(herePath, "geonosis-probe-wall.ts"),
+        source: `import { geonosisProbe } from '${source}'
+
+export const geonosisProbeWall = geonosisProbe
+`
+      };
+    }
+    throw new Error(
+      "biological-architecture/layer-walls: every declared layer may import every other, so no single file can cross a wall \u2014 there is no wall here to probe."
+    );
   }
 };
 var layer_walls_default = layerWalls;
@@ -1467,6 +1578,15 @@ name.`,
       }
     ],
     type: "problem"
+  },
+  /** The unnamed overload, told by ARITY — two arguments, which is the shape that fires. */
+  probe(options) {
+    const block = firstOf(bagOf(options).blocks, DEFAULT_BLOCKS);
+    return {
+      path: "geonosis-probe-when.ts",
+      source: `export const geonosisProbe = (input) => ${block}(input, (values) => values.ok)
+`
+    };
   }
 };
 var named_when_block_default = namedWhenBlock;
@@ -1730,6 +1850,21 @@ exactly like a clean tree.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * The brand list is dielime's and the corpus says `acme`, so this rule reads as firing nowhere in
+   * the repo whose brands it was configured with — one of the two findings that opened this. The
+   * brand goes on a line of its own so no `allowedSubstrings` entry can strip it away: a CDN host
+   * is stripped before the scan, and a probe hiding inside one would prove the opposite of what it
+   * claims.
+   */
+  probe(options) {
+    const { brands = [] } = bagOf(options);
+    return {
+      path: "geonosis-probe-brand.ts",
+      source: `export const geonosisProbeBrand = '${brands[0] ?? ""}'
+`
+    };
   }
 };
 var no_brand_names_default = noBrandNames;
@@ -2232,6 +2367,16 @@ since the field names are the engine's and the label is the API's.`,
       }
     ],
     type: "problem"
+  },
+  /** One payload reading an estimate field, with no label beside it. */
+  probe(options) {
+    const bag = bagOf(options);
+    const field = firstOf(bag.estimateFields, DEFAULT_ESTIMATE_FIELDS);
+    return {
+      path: "geonosis-probe-count.ts",
+      source: `export const geonosisProbe = (metadata, rows) => ({ rows, total: metadata.${field} })
+`
+    };
   }
 };
 var no_index_count_as_exact_default = noIndexCountAsExact;
@@ -2502,6 +2647,18 @@ adds \`workflows/\` back.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * A default export in a file named `index`, inside a directory the loader still skips. The
+   * directory is a regex option, so the path is built back out of it and refused if it does not
+   * match — a probe placed outside the tree fires nothing however right its source is.
+   */
+  probe(options) {
+    const directory = firstOf(bagOf(options).directories, DEFAULT_DIRECTORIES);
+    return {
+      path: pathMatching(directory, "index.ts"),
+      source: "export default async function geonosisProbe() {\n  return { ok: true }\n}\n"
+    };
   }
 };
 var no_loader_side_effect_in_index_file_default = noLoaderSideEffectInIndexFile;
@@ -2599,7 +2756,8 @@ var no_logic_in_component_files_default = noLogicInComponentFiles;
 
 // src/rules/no-mock-db-in-integration.ts
 var RULE6 = "no-mock-db-in-integration";
-var MOCK_CALLS = /* @__PURE__ */ new Set(["jest.mock", "mock.module", "vi.mock"]);
+var BUN_MOCK = "mock.module";
+var MOCK_CALLS = /* @__PURE__ */ new Set(["jest.mock", BUN_MOCK, "vi.mock"]);
 var calleeOf = (node) => {
   const callee = node.callee;
   if (callee?.type !== "MemberExpression") return "";
@@ -2677,6 +2835,21 @@ mock call can be seen in: a handle built in a setup file and threaded through a
       }
     ],
     type: "problem"
+  },
+  /**
+   * A suite under the configured integration tree, mocking the module that IS the database —
+   * written in bun's spelling, which is what `BUN_MOCK` above is for and not a preference.
+   */
+  probe(options) {
+    const { dbModules = [], integrationDirs = [] } = bagOf(options);
+    const directory = (integrationDirs[0] ?? "").replace(/^\/+/, "").replace(/\/+$/, "");
+    return {
+      path: `${directory}/geonosis-probe/tests.ts`,
+      source: `import { mock } from 'bun:test'
+
+${BUN_MOCK}('${dbModules[0] ?? ""}')
+`
+    };
   }
 };
 var no_mock_db_in_integration_default = noMockDbInIntegration;
@@ -2769,6 +2942,21 @@ with no map to check reads exactly like a tree with no raw elements in it.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * The element→atom map is POSITIONAL, so the probe reads `options[0]` rather than a bag. The path
+   * goes into the first tier the run is scoped to, which is never `atoms` — inside the atom the raw
+   * element is the point of the file and the rule is deliberately silent there.
+   */
+  probe(options) {
+    const map = Array.isArray(options[0]) ? options[0] : [];
+    const scope = options[1]?.scope;
+    const tier = scope?.[0] ?? "molecules";
+    return {
+      path: `${tier}/geonosis-probe.tsx`,
+      source: `export const GeonosisProbe = () => <${map[0]?.element ?? ""} />
+`
+    };
   }
 };
 var no_raw_html_atoms_default = noRawHtmlAtoms;
@@ -3289,6 +3477,25 @@ rather than directories is out of scope \u2014 nothing under a root matches, so
       }
     ],
     type: "problem"
+  },
+  /**
+   * A directory under a configured root, carrying a manifest, that the registry does not name — and
+   * the one probe in this plugin a single file cannot make fire on its own.
+   *
+   * The rule reads the registry off disk, and a registry it cannot read is a configuration answer
+   * rather than a verdict about the tree, so it returns silently. The probe sits under `roots` and
+   * the registry sits at the consumer's own path; one file cannot be both. It fires when the
+   * registry ALSO exists beside it and fires nothing when it does not, which is the truth and is
+   * left as the truth: a probe widened until it fired would be this rule claiming evidence it does
+   * not have, which is precisely the defect the rule is about.
+   */
+  probe(options) {
+    const { manifests = [], roots = [] } = bagOf(options);
+    const root = trimSlashes(roots[0] ?? "");
+    return {
+      path: `${root}/geonosis-probe/${manifests[0] ?? ""}`,
+      source: "export const geonosisProbe = { id: 'geonosis-probe' }\n"
+    };
   }
 };
 var no_unregistered_plugin_dir_default = noUnregisteredPluginDir;
@@ -3579,6 +3786,20 @@ name"); left off, only the presence of a namespace is checked. \`scopes\` defaul
       }
     ],
     type: "problem"
+  },
+  /**
+   * A plugin route sitting bare on a scope: `/store` and nothing of the plugin's own after it. The
+   * package directory is invented rather than read, because the offence is a PATH shape and a
+   * directory that does not exist yet has the same one.
+   */
+  probe(options) {
+    const bag = bagOf(options);
+    const under = bag.packages?.find((one) => one.namespaced === true)?.under ?? "";
+    const scope = firstOf(bag.scopes, DEFAULT_SCOPES);
+    return {
+      path: `${under}/geonosis-probe/src/api/${scope}/route.ts`,
+      source: "export async function GET(req, res) {\n  res.json({ ok: true })\n}\n"
+    };
   }
 };
 var plugin_route_namespaced_default = pluginRouteNamespaced;
@@ -3766,6 +3987,25 @@ annotation wording.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * A route writing through a service in its own body, with no escape marker on it. The write name
+   * is built from the configured prefix, because `writesWith` reads a capital after the prefix and
+   * a probe spelling `creatething` would pass the rule it is meant to trip.
+   */
+  probe(options) {
+    const bag = bagOf(options);
+    const prefix = firstOf(bag.mutationPrefixes, DEFAULT_MUTATION_PREFIXES);
+    return {
+      path: pathMatching(firstOf(bag.paths, DEFAULT_PATHS), "route.ts"),
+      source: `export async function POST(req, res) {
+  const service = req.scope.resolve('geonosis_probe')
+  const made = await service.${prefix}GeonosisProbes(req.validatedBody)
+
+  res.json({ made })
+}
+`
+    };
   }
 };
 var route_no_inline_mutation_default = routeNoInlineMutation;
@@ -3773,10 +4013,10 @@ var route_no_inline_mutation_default = routeNoInlineMutation;
 // src/rules/router-schema-parity.ts
 import { existsSync as existsSync2 } from "fs";
 var RULE11 = "router-schema-parity";
-var EXTENSIONS = [".ts", ".tsx"];
+var EXTENSIONS2 = [".ts", ".tsx"];
 var trimSlashes2 = (path2) => path2.replace(/^\/+/, "").replace(/\/+$/, "");
 var baseOf = (file) => file.replace(/\.[cm]?[jt]sx?$/, "");
-var existsWithAnyExtension = (withoutExtension) => EXTENSIONS.map((extension) => `${withoutExtension}${extension}`).find(
+var existsWithAnyExtension = (withoutExtension) => EXTENSIONS2.map((extension) => `${withoutExtension}${extension}`).find(
   (path2) => existsSync2(path2)
 ) ?? null;
 var directlyUnder = (filename, directory) => {
@@ -3847,6 +4087,17 @@ repo-root-relative, because in one consumer they live in different packages.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * A router with no schema half. The two directories are repo-root-relative, and the missing half
+   * is a question about the tree the run is over: nothing writes the twin, so nothing is there.
+   */
+  probe(options) {
+    const { routers = "" } = bagOf(options);
+    return {
+      path: `${trimSlashes2(routers)}/geonosis-probe.ts`,
+      source: "export const geonosisProbeRouter = { list: () => [] }\n"
+    };
   }
 };
 var router_schema_parity_default = routerSchemaParity;
@@ -3954,6 +4205,16 @@ the 33 keys of 2.19 as its default \u2014 pin your own version's if you are not
       }
     ],
     type: "problem"
+  },
+  /** A module registered under a key the framework owns — the first of the configured list. */
+  probe(options) {
+    const bag = bagOf(options);
+    const factory = firstOf(bag.moduleFactories, DEFAULT_MODULE_FACTORIES);
+    return {
+      path: "geonosis-probe-module.ts",
+      source: `export default ${factory}('${firstOf(bag.reserved, MODULES_2_19)}', { service: class GeonosisProbeService {} })
+`
+    };
   }
 };
 var service_name_not_reserved_default = serviceNameNotReserved;
@@ -4290,6 +4551,29 @@ connection it uses rather than share one opened once per run \u2014 the wrapper
       }
     ],
     type: "problem"
+  },
+  /**
+   * during.day guards `packages/workflows/src/` and the shipped corpus guards
+   * `corpus/workflows/`, so its fixture lands outside the tree this repo asked about and the rule
+   * reads as firing nowhere in a package that enforces it on every file. This is the same fixture
+   * moved to where the option points — and out of the `wrapper`, which is the one file allowed
+   * to reach the engine.
+   */
+  probe(options) {
+    const { engine = "", within = "", wrapper } = bagOf(options);
+    const path2 = pathMatching(within, "geonosis-probe-engine-step.ts");
+    if (wrapper !== void 0 && new RegExp(wrapper).test(path2)) {
+      throw new Error(
+        `biological-architecture/${RULE14}: the probe path "${path2}" is also the \`wrapper\`, which is the one file allowed to reach \`${engine}\` \u2014 no single file inside \`within\` can both land where the rule looks and be somewhere it speaks.`
+      );
+    }
+    return {
+      path: path2,
+      source: `import { step } from '${engine}'
+
+export const probe = step('geonosis-probe', async () => ({ ok: true }))
+`
+    };
   }
 };
 var step_opens_its_own_cell_default = stepOpensItsOwnCell;
@@ -4404,6 +4688,16 @@ other than \`subscribers/\`.`,
       }
     ],
     type: "problem"
+  },
+  /** A subscriber config with an event and no id, inside the configured subscriber tree. */
+  probe(options) {
+    return {
+      path: pathMatching(
+        firstOf(bagOf(options).paths, DEFAULT_PATHS2),
+        "geonosis-probe.ts"
+      ),
+      source: "export default async function geonosisProbe() {}\n\nexport const config = { event: 'geonosis.probe' }\n"
+    };
   }
 };
 var subscriber_declares_id_default = subscriberDeclaresId;
@@ -5263,6 +5557,17 @@ exactly like a clean tree.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * A named colour in an inline style, which fires under any token prefix — the question is whether
+   * the rule RUNS in this repo, and a probe spelled out of the prefix would be defeated by a repo
+   * that happened to declare a token of the same name.
+   */
+  probe() {
+    return {
+      path: "geonosis-probe-colour.tsx",
+      source: "export const GeonosisProbe = () => <span style={{ color: 'rebeccapurple' }} />\n"
+    };
   }
 };
 var isNamedOnly = (value) => /^[a-z]+$/i.test(value.trim());
@@ -5378,6 +5683,26 @@ wraps the query steps.`,
       }
     ],
     type: "problem"
+  },
+  /**
+   * Two query steps in one body, one named and one not — which is one finding rather than two. A
+   * body with a single un-named step collides with nothing and is deliberately exempt, so a probe
+   * built from one would fire nothing and read as a rule that cannot be exercised.
+   */
+  probe(options) {
+    const bag = bagOf(options);
+    const factory = firstOf(bag.workflowFactories, DEFAULT_WORKFLOW_FACTORIES);
+    const step = firstOf(bag.queryStepCalls, DEFAULT_QUERY_STEP_CALLS);
+    return {
+      path: "geonosis-probe-query-steps.ts",
+      source: `export const geonosisProbe = ${factory}('geonosis-probe', () => {
+  const first = ${step}({ entity: 'first' }).config({ name: 'geonosis-probe-first' })
+  const second = ${step}({ entity: 'second' })
+
+  return { first, second }
+})
+`
+    };
   }
 };
 var unique_query_step_name_default = uniqueQueryStepName;

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@geonosis/oxlint-plugin-biological-architecture",
-  "version": "1.0.0",
+  "version": "1.2.0",
+  "types": "./dist/index.d.ts",
   "description": "Biological tier architecture as lint — the union of the dielime and during.day rule sets, shipped as presets.",
   "keywords": [
     "oxlint",
@@ -21,9 +22,18 @@
   "type": "module",
   "main": "dist/index.js",
   "exports": {
-    ".": "./dist/index.js",
-    "./discover-atoms": "./dist/discover-atoms.js",
-    "./presets": "./dist/presets.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./discover-atoms": {
+      "types": "./dist/discover-atoms.d.ts",
+      "default": "./dist/discover-atoms.js"
+    },
+    "./presets": {
+      "types": "./dist/presets.d.ts",
+      "default": "./dist/presets.js"
+    }
   },
   "files": [
     "corpus",
@@ -33,7 +43,7 @@
     "oxlint": ">=1.77"
   },
   "devDependencies": {
-    "@geonosis/lint-parity": "1.0.0"
+    "@geonosis/lint-parity": "1.2.0"
   },
   "engines": {
     "node": ">=22"