@jterrazz/test 15.0.0 → 15.1.0

package/dist/oxlint.cjs

@@ -4,7 +4,6 @@ Object.defineProperties(exports, {
 });
 let node_path = require("node:path");
 let node_fs = require("node:fs");
-let node_url = require("node:url");
 //#region src/lint/fs-cache.ts
 /**
 * Cached filesystem probes for the fs-anchored rules (a9w, c2, c6, c7, i2).
@@ -70,7 +69,7 @@ function readFileCached(path) {
 */
 /** Split a path into its non-empty segments (posix or win separators). */
 function segments(path) {
-	return path.split(/[/\\]/).filter(Boolean);
+	return path.split(/[/\\]/u).filter(Boolean);
 }
 /**
 * The `specs/` directory a file belongs to: the NEAREST ancestor named `specs`,
@@ -112,7 +111,8 @@ function stringValue(node) {
 	if (node.type === "TemplateLiteral") {
 		const expressions = node.expressions;
 		const quasis = node.quasis;
-		if (expressions?.length === 0 && quasis?.length === 1) return quasis[0].value?.cooked;
+		const onlyQuasi = quasis?.[0];
+		if (expressions?.length === 0 && quasis?.length === 1 && onlyQuasi !== void 0) return onlyQuasi.value?.cooked;
 	}
 }
 /** The property name of a non-computed member expression, if identifiable. */
@@ -483,7 +483,7 @@ const RULE_DOCS = {
 	},
 	"f3-specs-public-entry": {
 		channel: "statique",
-		convention: "Depuis `specs/`, seul l’import en profondeur des INTERNES du framework est interdit : un chemin relatif résolvant dans `src/{core,integrations,vitest,lint}/` du dépôt du framework, ou tout `@jterrazz/test/<subpath>` autre que `@jterrazz/test/oxlint`. Les imports de la source de SA PROPRE app par un consommateur sont toujours permis (c’est le motif documenté) ; seul `specs/integrations/` peut importer en profondeur `src/integrations/**`.",
+		convention: "Depuis `specs/`, seul l’import en profondeur des INTERNES du framework est interdit : un chemin relatif résolvant dans `src/{specification,integrations,vitest,lint}/` du dépôt du framework, ou tout `@jterrazz/test/<subpath>` autre que `@jterrazz/test/oxlint`. Les imports de la source de SA PROPRE app par un consommateur sont toujours permis (c’est le motif documenté) ; seul `specs/integrations/` peut importer en profondeur `src/integrations/**`.",
 		family: "F",
 		id: "F3",
 		rationale: "Tester par la surface publique garde les specs découplées des chemins internes du framework, sans gêner le consommateur qui importe sa propre app."
@@ -893,83 +893,6 @@ const a1SpecificationFile = {
 	}
 };
 //#endregion
-//#region src/core/specification/shared/binding.ts
-/**
-* Compose-binding resolution and the case conversions it shares with the
-* automatic env injection (CONVENTIONS A6 / B6).
-*
-* A services-record key is written in the natural TypeScript style
-* (`analyticsDb`), while a compose service name is kebab-case
-* (`analytics-db`). These helpers bridge the two vocabularies deterministically
-* so the record key stays the single source of truth and `composeService`
-* remains a rare escape hatch.
-*/
-/**
-* Convert a record key to its kebab-case form: camelCase boundaries become
-* `-`, everything is lowercased. `analyticsDb` → `analytics-db`, `db` → `db`.
-*/
-function toKebabCase(key) {
-	return key.replace(/(?<lower>[a-z0-9])(?<upper>[A-Z])/g, "$<lower>-$<upper>").toLowerCase();
-}
-//#endregion
-//#region src/lint/rules/a10-duplicate-binding.ts
-/** The compose service an entry binds to: explicit `composeService`, else the key's kebab form. */
-function canonicalBinding(entry, key) {
-	const factory = entry.value;
-	if (factory?.type === "CallExpression") {
-		const options = factory.arguments?.[0];
-		if (options?.type === "ObjectExpression") {
-			const explicit = stringValue(findProperty(options, "composeService")?.value);
-			if (explicit !== void 0) return explicit;
-		}
-	}
-	return toKebabCase(key);
-}
-/**
-* CONVENTIONS A10 — within one `services` record, two keys that derive (or
-* pin via `composeService`) the SAME compose service name are a silent
-* collision: the record is a map, and the second binding would shadow the
-* first. Detected on the same kebab derivation the runtime binding uses
-* (`analyticsDb` and `analytics-db` both → `analytics-db`), and across explicit
-* `composeService` values.
-*/
-const a10DuplicateBinding = {
-	create(context) {
-		return { CallExpression(node) {
-			if (specificationMember(node) === void 0) return;
-			for (const argument of node.arguments ?? []) {
-				const record = findProperty(argument, "services")?.value;
-				if (record?.type !== "ObjectExpression") continue;
-				const seen = /* @__PURE__ */ new Map();
-				for (const entry of record.properties ?? []) {
-					const key = propertyKeyName(entry);
-					if (key === void 0) continue;
-					const binding = canonicalBinding(entry, key);
-					const first = seen.get(binding);
-					if (first !== void 0) {
-						context.report({
-							data: {
-								binding,
-								first,
-								key
-							},
-							messageId: "duplicate",
-							node: entry
-						});
-						continue;
-					}
-					seen.set(binding, key);
-				}
-			}
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["a10-duplicate-binding"],
-		messages: { duplicate: "Service keys \"{{first}}\" and \"{{key}}\" both bind to compose service \"{{binding}}\" — one shadows the other; rename a key or set distinct composeService values (A10 — see docs/13-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
 //#region src/lint/rules/a2-known-constructors.ts
 /** The five constructors, and only five (A2 — see docs/13-linting.md). */
 const KNOWN_CONSTRUCTORS = /* @__PURE__ */ new Set([
@@ -1132,6 +1055,25 @@ const a5ModeWithServer = {
 	}
 };
 //#endregion
+//#region src/specification/facets/_common/binding.ts
+/**
+* Compose-binding resolution and the case conversions it shares with the
+* automatic env injection (CONVENTIONS A6 / B6).
+*
+* A services-record key is written in the natural TypeScript style
+* (`analyticsDb`), while a compose service name is kebab-case
+* (`analytics-db`). These helpers bridge the two vocabularies deterministically
+* so the record key stays the single source of truth and `composeService`
+* remains a rare escape hatch.
+*/
+/**
+* Convert a record key to its kebab-case form: camelCase boundaries become
+* `-`, everything is lowercased. `analyticsDb` → `analytics-db`, `db` → `db`.
+*/
+function toKebabCase(key) {
+	return key.replaceAll(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower>-$<upper>").toLowerCase();
+}
+//#endregion
 //#region src/lint/rules/a6w-redundant-compose-service.ts
 /**
 * CONVENTIONS A6 (warning) — `composeService:` is the escape hatch for
@@ -1173,7 +1115,7 @@ const a6wRedundantComposeService = {
 	}
 };
 //#endregion
-//#region src/core/specification/shared/resolve.ts
+//#region src/specification/facets/_common/resolve.ts
 /** What makes a directory a project root — a manifest, or a test stack. */
 const ROOT_MARKERS = ["package.json", "docker/compose.test.yaml"];
 /**
@@ -1240,7 +1182,65 @@ const a9wRedundantRoot = {
 	}
 };
 //#endregion
-//#region src/core/specification/shared/ground.ts
+//#region src/lint/rules/a10-duplicate-binding.ts
+/** The compose service an entry binds to: explicit `composeService`, else the key's kebab form. */
+function canonicalBinding(entry, key) {
+	const factory = entry.value;
+	if (factory?.type === "CallExpression") {
+		const options = factory.arguments?.[0];
+		if (options?.type === "ObjectExpression") {
+			const explicit = stringValue(findProperty(options, "composeService")?.value);
+			if (explicit !== void 0) return explicit;
+		}
+	}
+	return toKebabCase(key);
+}
+/**
+* CONVENTIONS A10 — within one `services` record, two keys that derive (or
+* pin via `composeService`) the SAME compose service name are a silent
+* collision: the record is a map, and the second binding would shadow the
+* first. Detected on the same kebab derivation the runtime binding uses
+* (`analyticsDb` and `analytics-db` both → `analytics-db`), and across explicit
+* `composeService` values.
+*/
+const a10DuplicateBinding = {
+	create(context) {
+		return { CallExpression(node) {
+			if (specificationMember(node) === void 0) return;
+			for (const argument of node.arguments ?? []) {
+				const record = findProperty(argument, "services")?.value;
+				if (record?.type !== "ObjectExpression") continue;
+				const seen = /* @__PURE__ */ new Map();
+				for (const entry of record.properties ?? []) {
+					const key = propertyKeyName(entry);
+					if (key === void 0) continue;
+					const binding = canonicalBinding(entry, key);
+					const first = seen.get(binding);
+					if (first !== void 0) {
+						context.report({
+							data: {
+								binding,
+								first,
+								key
+							},
+							messageId: "duplicate",
+							node: entry
+						});
+						continue;
+					}
+					seen.set(binding, key);
+				}
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a10-duplicate-binding"],
+		messages: { duplicate: "Service keys \"{{first}}\" and \"{{key}}\" both bind to compose service \"{{binding}}\" — one shadows the other; rename a key or set distinct composeService values (A10 — see docs/13-linting.md)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/specification/facets/_common/ground.ts
 /**
 * The GROUND a row of specs stands on — the naming law of a spec tree.
 *
@@ -1281,7 +1281,7 @@ const RENAMED_GROUND_DIRS = {
 	seeds: GROUND_SEEDS
 };
 //#endregion
-//#region src/core/specification/shared/fixtures.ts
+//#region src/specification/facets/_common/fixtures.ts
 /**
 * Fixture path resolution + copy semantics for the `cli` facet's `.fixture()`.
 *
@@ -1328,7 +1328,7 @@ const b2KnownFixtureMarker = {
 			const args = node.arguments ?? [];
 			const path = leadingText(args[0]);
 			if (path === void 0 || !path.startsWith("$")) return;
-			const marker = path.replace(/\/+$/, "").split("/")[0];
+			const marker = path.replace(/\/+$/u, "").split("/")[0] ?? "";
 			if (!KNOWN.has(marker)) context.report({
 				data: {
 					known: [...KNOWN_FIXTURE_MARKERS].join(", "),
@@ -1462,7 +1462,7 @@ const b5AwaitUsing = {
 };
 //#endregion
 //#region src/lint/rules/b6w-redundant-env-url.ts
-const URL_KEY = /^[A-Z0-9]+(?:_[A-Z0-9]+)*_URL$/;
+const URL_KEY = /^[A-Z0-9]+(?:_[A-Z0-9]+)*_URL$/u;
 /**
 * CONVENTIONS B6 (warning) — in `cli` mode with services, the framework
 * already injects `<KEY>_URL` for every service (plus the unambiguous
@@ -1498,7 +1498,7 @@ const b6wRedundantEnvUrl = {
 //#endregion
 //#region src/lint/rules/b8-kebab-trigger.ts
 /** Stable kebab-case job identifier: `nightly-report`, `send-welcome-emails`. */
-const KEBAB_CASE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const KEBAB_CASE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
 /**
 * CONVENTIONS B8 — a job `name` passed to `.trigger()` is a stable kebab-case
 * identifier; it is a contract between the app and its tests. Only string
@@ -1754,212 +1754,71 @@ const c1DomainStructure = {
 	}
 };
 //#endregion
-//#region src/lint/rules/c10-contracts-boundary.ts
-/** A specifier reaching into a provider folder — the internal half of contracts/. */
-const INTERNAL_UNIT = /(?:^|\/)contracts\/(?:anthropic|http|openai)\//u;
+//#region src/lint/rules/c2-http-only-requests.ts
+const TEST_FILE$12 = /\.test\.[cm]?[jt]sx?$/u;
 /**
-* CONVENTIONS C10 — the contracts boundary. A feature's `contracts/` folder has
-* a PUBLIC half (`*.contracts.ts` facades: the default export is the world, the
-* named exports are its scenarios) and an INTERNAL half (the `http/`, `openai/`
-* and `anthropic/` unit contracts the facades compose). Outside `contracts/`,
-* importing a unit is an error — a test routes through the facade, so a
-* scenario is named once, next to the world it derives from.
+* CONVENTIONS C2 — `_requests/` contains only `.http` files (a request file is
+* a COMPLETE request: method, path, headers, body). Anchored on the feature's
+* visited test file: when `<feature>/<feature>.test.ts` is linted, its sibling
+* `_requests/` directory is probed (cached readdir) and any non-`.http` entry
+* is reported on the test file.
 */
-const c10ContractsBoundary = {
+const c2HttpOnlyRequests = {
 	create(context) {
-		const parts = segments(context.physicalFilename);
-		if (!parts.includes("specs")) return {};
-		if (parts.slice(0, -1).includes("contracts")) return {};
-		return importSourceVisitor(({ node, source }) => {
-			if (INTERNAL_UNIT.test(source)) context.report({
-				data: { source },
-				messageId: "internal",
+		const file = context.physicalFilename;
+		if (!TEST_FILE$12.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const requestsDir = (0, node_path.join)((0, node_path.dirname)(file), GROUND_REQUESTS);
+			for (const entry of listDirectory(requestsDir) ?? []) if (!entry.endsWith(".http")) context.report({
+				data: { entry },
+				messageId: "notHttp",
 				node
 			});
-		});
+		} };
 	},
 	meta: {
-		docs: RULE_DOCS["c10-contracts-boundary"],
-		messages: { internal: "Import \"{{source}}\" reaches into a provider folder — only contracts/*.contracts.ts is importable from a test; add a named scenario export there instead (C10 — see docs/13-linting.md)." },
+		docs: RULE_DOCS["c2-http-only-requests"],
+		messages: { notHttp: "_requests/{{entry}} is not a .http file — _requests/ contains only complete .http request files (C2 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/c11-contract-data-pairing.ts
-const TEST_FILE$12 = /\.test\.[cm]?[jt]sx?$/;
-/** The provider folders that may carry data files. */
-const PROVIDERS$1 = [
+//#region src/lint/rules/c4-contract-shape.ts
+/** The only directories a `contracts/` root may hold — the provider carriers. */
+const PROVIDERS$1 = /* @__PURE__ */ new Set([
 	"anthropic",
 	"http",
 	"openai"
-];
-/** Data files: served payloads and matched inputs, both owned by a contract. */
-const DATA_SUFFIXES = [".request.ts", ".response.json"];
-/** The owning contract of a data file: its name up to the FIRST dot, `.ts`. */
-function ownerOf(entry) {
-	return `${entry.slice(0, entry.indexOf("."))}.ts`;
+]);
+const TEST_FILE$11 = /\.test\.[cm]?[jt]sx?$/u;
+/** A file oxlint itself visits — the AST half of the rule reports on those. */
+const SOURCE_FILE = /\.[cm]?[jt]sx?$/u;
+/** The public facade of a feature: `contracts/<kebab>.contracts.ts`. */
+const COMPOSITE_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.contracts\.[cm]?ts$/u;
+/** An internal unit contract: `contracts/<provider>/<kebab>.ts`. */
+const UNIT_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[cm]?ts$/u;
+/** Matched data next to its contract: `contracts/<provider>/<stem>.request.ts`. */
+const REQUEST_DATA_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.request\.[cm]?ts$/u;
+/** The name a specifier/declaration exports under, when it is `default`. */
+function exportsDefault(node) {
+	return (node.specifiers ?? []).some((specifier) => {
+		const exported = specifier.exported;
+		return exported?.type === "Identifier" && exported.name === "default" || stringValue(exported) === "default";
+	});
+}
+/** Is this node a `defineContract(...)` call? */
+function isDefineContract(node) {
+	const callee = node.callee;
+	return node.type === "CallExpression" && callee?.type === "Identifier" && callee.name === "defineContract";
+}
+/** A default export that may legitimately produce a contract (value or factory). */
+function producesContract(declaration) {
+	if (declaration === void 0) return false;
+	return isDefineContract(declaration) || declaration.type === "ArrowFunctionExpression" || declaration.type === "FunctionDeclaration" || declaration.type === "FunctionExpression" || declaration.type === "Identifier";
 }
 /**
-* CONVENTIONS C11 — data is owned by a contract. Inside a provider folder every
-* `*.response.json` (served payload) and `*.request.ts` (matched prompt/body)
-* pairs with the sibling `<stem>.ts` that serves it, where the stem is the name
-* up to the FIRST dot: `events.fr.response.json` belongs to `events.ts`. A data
-* file with no owner is dead weight no test can reach — reported on the feature's
-* test file, since oxlint never visits a `.json`.
-*/
-const c11ContractDataPairing = {
-	create(context) {
-		const file = context.physicalFilename;
-		if (!TEST_FILE$12.test(file) || !segments(file).includes("specs")) return {};
-		return { Program(node) {
-			const contractsDir = (0, node_path.join)((0, node_path.dirname)(file), "contracts");
-			for (const provider of PROVIDERS$1) {
-				const entries = listDirectory((0, node_path.join)(contractsDir, provider));
-				if (entries === null) continue;
-				const present = new Set(entries);
-				for (const entry of entries) {
-					if (!DATA_SUFFIXES.some((suffix) => entry.endsWith(suffix))) continue;
-					const owner = ownerOf(entry);
-					if (!present.has(owner)) context.report({
-						data: {
-							entry,
-							owner,
-							provider
-						},
-						messageId: "orphan",
-						node
-					});
-				}
-			}
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c11-contract-data-pairing"],
-		messages: { orphan: "contracts/{{provider}}/{{entry}} has no owning contract — data pairs with the sibling {{owner}} (stem = name up to the first dot) (C11 — see docs/13-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c13-underscored-ground.ts
-const TEST_FILE$11 = /\.test\.[cm]?[jt]sx?$/;
-/**
-* CONVENTIONS C13 — the ground of a spec carries a leading underscore. A
-* directory named `fixtures/`, `expected/`, `requests/` or `seeds/` under
-* `specs/` is a pre-14 name: since `@jterrazz/test` 14.0.0 the four are
-* `_fixtures/`, `_expected/`, `_requests/` and `_seeds/`, with no compatibility
-* fallback.
-*
-* The catch this rule exists for: a consumer that upgrades and keeps the old
-* names loses nothing loudly. Every resolver — `.fixture()`, `.seed()`,
-* `.request()`, `toMatch()` — looks under the underscored name, finds nothing,
-* and the tree becomes invisible rather than wrong. The failure that follows is
-* "fixture does not exist" on every spec at once, one step removed from the
-* cause; this rule states the cause and the rename.
-*
-* Anchored on the feature's visited test file, exactly as C2/C7/C11 are: the
-* spec's own sibling directories are probed, plus the `$FIXTURES` pool at the
-* nearest specs root. A DOMAIN folder named after the ground it holds
-* (`specs/api/requests/_requests/`) is never a probe target — only what sits
-* beside a spec is.
-*/
-const c13UnderscoredGround = {
-	create(context) {
-		const file = context.physicalFilename;
-		const anchor = specsAnchor(file);
-		if (!TEST_FILE$11.test(file) || anchor === void 0) return {};
-		return { Program(node) {
-			const seen = /* @__PURE__ */ new Set();
-			const probe = (parent, legacy) => {
-				const path = (0, node_path.join)(parent, legacy);
-				if (seen.has(path) || !isDirectory(path)) return;
-				seen.add(path);
-				context.report({
-					data: {
-						ground: RENAMED_GROUND_DIRS[legacy],
-						legacy
-					},
-					messageId: "notUnderscored",
-					node
-				});
-			};
-			for (const legacy of Object.keys(RENAMED_GROUND_DIRS)) probe((0, node_path.dirname)(file), legacy);
-			probe(anchor.directory, "fixtures");
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c13-underscored-ground"],
-		messages: { notUnderscored: "The directory \"{{legacy}}/\" is a pre-14 ground name — rename it to \"{{ground}}/\" (`git mv {{legacy}} {{ground}}`). What a spec stands on carries the underscore; a spec's own folder never does, and no resolver reads the un-underscored name (C13 — see docs/13-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c2-http-only-requests.ts
-const TEST_FILE$10 = /\.test\.[cm]?[jt]sx?$/;
-/**
-* CONVENTIONS C2 — `_requests/` contains only `.http` files (a request file is
-* a COMPLETE request: method, path, headers, body). Anchored on the feature's
-* visited test file: when `<feature>/<feature>.test.ts` is linted, its sibling
-* `_requests/` directory is probed (cached readdir) and any non-`.http` entry
-* is reported on the test file.
-*/
-const c2HttpOnlyRequests = {
-	create(context) {
-		const file = context.physicalFilename;
-		if (!TEST_FILE$10.test(file) || !segments(file).includes("specs")) return {};
-		return { Program(node) {
-			const requestsDir = (0, node_path.join)((0, node_path.dirname)(file), GROUND_REQUESTS);
-			for (const entry of listDirectory(requestsDir) ?? []) if (!entry.endsWith(".http")) context.report({
-				data: { entry },
-				messageId: "notHttp",
-				node
-			});
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c2-http-only-requests"],
-		messages: { notHttp: "_requests/{{entry}} is not a .http file — _requests/ contains only complete .http request files (C2 — see docs/13-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c4-contract-shape.ts
-/** The only directories a `contracts/` root may hold — the provider carriers. */
-const PROVIDERS = /* @__PURE__ */ new Set([
-	"anthropic",
-	"http",
-	"openai"
-]);
-const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/;
-/** A file oxlint itself visits — the AST half of the rule reports on those. */
-const SOURCE_FILE = /\.[cm]?[jt]sx?$/;
-/** The public facade of a feature: `contracts/<kebab>.contracts.ts`. */
-const COMPOSITE_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.contracts\.[cm]?ts$/u;
-/** An internal unit contract: `contracts/<provider>/<kebab>.ts`. */
-const UNIT_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[cm]?ts$/u;
-/** Matched data next to its contract: `contracts/<provider>/<stem>.request.ts`. */
-const REQUEST_DATA_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.request\.[cm]?ts$/u;
-/** Served data next to its contract: `contracts/<provider>/<stem>[.<qualifier>].response.json`. */
-const RESPONSE_DATA_FILE = /\.response\.json$/;
-/** The name a specifier/declaration exports under, when it is `default`. */
-function exportsDefault(node) {
-	return (node.specifiers ?? []).some((specifier) => {
-		const exported = specifier.exported;
-		return exported?.type === "Identifier" && exported.name === "default" || stringValue(exported) === "default";
-	});
-}
-/** Is this node a `defineContract(...)` call? */
-function isDefineContract(node) {
-	const callee = node.callee;
-	return node.type === "CallExpression" && callee?.type === "Identifier" && callee.name === "defineContract";
-}
-/** A default export that may legitimately produce a contract (value or factory). */
-function producesContract(declaration) {
-	if (declaration === void 0) return false;
-	return isDefineContract(declaration) || declaration.type === "ArrowFunctionExpression" || declaration.type === "FunctionDeclaration" || declaration.type === "FunctionExpression" || declaration.type === "Identifier";
-}
-/**
-* The provider a `request:` value implies, when the builder is written as
-* `<provider>.<verb>(…)` — the only statically decidable form.
+* The provider a `request:` value implies, when the builder is written as
+* `<provider>.<verb>(…)` — the only statically decidable form.
 */
 function requestProvider(request) {
 	if (request?.type !== "CallExpression") return;
@@ -1987,7 +1846,7 @@ function checkLayout(context, node, contractsDir) {
 			});
 			continue;
 		}
-		if (!PROVIDERS.has(entry)) {
+		if (!PROVIDERS$1.has(entry)) {
 			context.report({
 				data: { entry },
 				messageId: "badProviderDir",
@@ -2003,7 +1862,7 @@ function checkLayout(context, node, contractsDir) {
 			messageId: "providerSubfolder",
 			node
 		});
-		else if (!/\.[cm]?ts$/u.test(child) && !RESPONSE_DATA_FILE.test(child)) context.report({
+		else if (!/\.[cm]?ts$/u.test(child) && !child.endsWith(".response.json")) context.report({
 			data: {
 				child,
 				provider: entry
@@ -2072,7 +1931,7 @@ function checkUnit(context, program, base, provider) {
 		if (isDefineContract(node)) {
 			const argument = node.arguments?.[0];
 			const declared = requestProvider(argument === void 0 ? void 0 : findProperty(argument, "request")?.value);
-			if (declared !== void 0 && PROVIDERS.has(declared) && declared !== provider) context.report({
+			if (declared !== void 0 && PROVIDERS$1.has(declared) && declared !== provider) context.report({
 				data: {
 					declared,
 					provider
@@ -2114,7 +1973,7 @@ const c4ContractShape = {
 		if (!parts.includes("specs")) return {};
 		const contractsIndex = parts.lastIndexOf("contracts");
 		if (contractsIndex === -1) {
-			if (!TEST_FILE$9.test(file)) return {};
+			if (!TEST_FILE$11.test(file)) return {};
 			return { Program(node) {
 				checkLayout(context, node, (0, node_path.join)((0, node_path.dirname)(file), "contracts"));
 			} };
@@ -2125,8 +1984,8 @@ const c4ContractShape = {
 			checkComposite(context, node, base);
 		} };
 		if (depth === 2) {
-			const provider = parts[contractsIndex + 1];
-			return PROVIDERS.has(provider) ? { Program(node) {
+			const provider = parts[contractsIndex + 1] ?? "";
+			return PROVIDERS$1.has(provider) ? { Program(node) {
 				checkUnit(context, node, base, provider);
 			} } : {};
 		}
@@ -2159,7 +2018,7 @@ const c4ContractShape = {
 };
 //#endregion
 //#region src/lint/rules/c6-tomatch-extension.ts
-const TEST_FILE$8 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$10 = /\.test\.[cm]?[jt]sx?$/u;
 /** Does the expect(…) subject chain contain a `.directory(…)` call? */
 function subjectIsDirectory(toMatchCallee) {
 	const expectCall = toMatchCallee.object;
@@ -2184,7 +2043,7 @@ function subjectIsDirectory(toMatchCallee) {
 const c6ToMatchExtension = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$8.test(file) || !segments(file).includes("specs")) return {};
+		if (!TEST_FILE$10.test(file) || !segments(file).includes("specs")) return {};
 		return { CallExpression(node) {
 			const callee = node.callee;
 			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
@@ -2209,7 +2068,7 @@ const c6ToMatchExtension = {
 };
 //#endregion
 //#region src/lint/rules/c7-seeds-sql-only.ts
-const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/u;
 /**
 * CONVENTIONS C7 — `.seed()` carries DATABASE state only: `_seeds/` contains
 * nothing but `*.sql` fragments. File state goes through `.fixture()`; there
@@ -2219,7 +2078,7 @@ const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/;
 const c7SeedsSqlOnly = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$7.test(file) || !segments(file).includes("specs")) return {};
+		if (!TEST_FILE$9.test(file) || !segments(file).includes("specs")) return {};
 		return { Program(node) {
 			const seedsDir = (0, node_path.join)((0, node_path.dirname)(file), GROUND_SEEDS);
 			for (const entry of listDirectory(seedsDir) ?? []) if (!entry.endsWith(".sql")) context.report({
@@ -2237,7 +2096,7 @@ const c7SeedsSqlOnly = {
 };
 //#endregion
 //#region src/lint/rules/c8-referenced-fixture-exists.ts
-const TEST_FILE$6 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$8 = /\.test\.[cm]?[jt]sx?$/u;
 /** The ground directory each fixture-referencing verb reads from. */
 const VERB_ROOTS = {
 	request: GROUND_REQUESTS,
@@ -2270,7 +2129,7 @@ const c8ReferencedFixtureExists = {
 	create(context) {
 		const file = context.physicalFilename;
 		const anchor = specsAnchor(file);
-		if (!TEST_FILE$6.test(file) || anchor === void 0) return {};
+		if (!TEST_FILE$8.test(file) || anchor === void 0) return {};
 		const featureDir = (0, node_path.dirname)(file);
 		return { CallExpression(node) {
 			const callee = node.callee;
@@ -2280,7 +2139,7 @@ const c8ReferencedFixtureExists = {
 			if (verb === "fixture") {
 				const value = stringValue(args[0]);
 				if (value === void 0 || !looksLikePath(value)) return;
-				const target = resolveFixture(value.replace(/\/+$/, ""), featureDir, anchor.directory);
+				const target = resolveFixture(value.replace(/\/+$/u, ""), featureDir, anchor.directory);
 				if (target !== void 0 && !isFile(target) && !isDirectory(target)) context.report({
 					data: {
 						path: value,
@@ -2295,7 +2154,7 @@ const c8ReferencedFixtureExists = {
 			if (root === void 0) return;
 			const value = stringValue(args[0]);
 			if (value === void 0 || !looksLikePath(value)) return;
-			const target = (0, node_path.join)(featureDir, root, value.replace(/\/+$/, ""));
+			const target = (0, node_path.join)(featureDir, root, value.replace(/\/+$/u, ""));
 			if (!(verb === "toMatch" ? isFile(target) || isDirectory(target) : isFile(target))) context.report({
 				data: {
 					path: `${root}/${value}`,
@@ -2313,231 +2172,142 @@ const c8ReferencedFixtureExists = {
 	}
 };
 //#endregion
-//#region src/lint/rules/d12w-response-body-probe.ts
-/** A test reading the response body this many times (or more) is a cluster. */
-const DEFAULT_THRESHOLD = 3;
-/** Is `node` the `x.response.body` member access itself? */
-function isResponseBody(node) {
-	if (node.type !== "MemberExpression" || memberPropertyName(node) !== "body") return false;
-	const object = node.object;
-	return object !== void 0 && memberPropertyName(object) === "response";
-}
-/** Peel `await`, `as T`, and `!` off an initializer to reach its core expression. */
-function unwrap(node) {
-	let current = node ?? void 0;
-	while (current != null) if (current.type === "AwaitExpression") current = current.argument ?? void 0;
-	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression") current = current.expression ?? void 0;
-	else if (current.type === "ParenthesizedExpression") current = current.expression ?? void 0;
-	else return current;
-}
+//#region src/lint/rules/c10-contracts-boundary.ts
+/** A specifier reaching into a provider folder — the internal half of contracts/. */
+const INTERNAL_UNIT = /(?:^|\/)contracts\/(?:anthropic|http|openai)\//u;
 /**
-* CONVENTIONS D12 (warning) — a full-response golden is the norm for API
-* assertions (the D11 boundary, mechanized). A test that accumulates a CLUSTER
-* of raw body probes — reading `.response.body` (or a variable cast from it)
-* `threshold`+ times in one test callback — should collapse into one golden:
-* `expect(result.response).toMatch('case.http')`. One or two probes stay silent
-* (a legitimate scalpel: absence, a single-field delta, third-party output).
-*
-* A probe is a body-rooted read: a direct `.response.body` use, or a field
-* access on the local binding a `const body = result.response.body as {…}`
-* introduces. The count is the same threshold the golden transformation applies.
+* CONVENTIONS C10 — the contracts boundary. A feature's `contracts/` folder has
+* a PUBLIC half (`*.contracts.ts` facades: the default export is the world, the
+* named exports are its scenarios) and an INTERNAL half (the `http/`, `openai/`
+* and `anthropic/` unit contracts the facades compose). Outside `contracts/`,
+* importing a unit is an error — a test routes through the facade, so a
+* scenario is named once, next to the world it derives from.
 */
-const d12wResponseBodyProbe = {
+const c10ContractsBoundary = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		const threshold = context.options[0]?.threshold ?? DEFAULT_THRESHOLD;
-		return { CallExpression(node) {
-			if (!isTestCallee(node.callee)) return;
-			const callback = findTestCallback(node.arguments ?? []);
-			if (callback === void 0) return;
-			const aliases = /* @__PURE__ */ new Set();
-			let responseBodyNodes = 0;
-			walk(callback, (inner) => {
-				if (isResponseBody(inner)) responseBodyNodes++;
-				if (inner.type === "VariableDeclarator") {
-					const init = unwrap(inner.init);
-					const id = inner.id;
-					if (init !== void 0 && isResponseBody(init) && id?.type === "Identifier") aliases.add(id.name);
-				}
-			});
-			let aliasReads = 0;
-			walk(callback, (inner) => {
-				if (inner.type !== "MemberExpression") return;
-				const object = inner.object;
-				if (object?.type === "Identifier" && aliases.has(object.name)) aliasReads++;
-			});
-			const probes = responseBodyNodes - aliases.size + aliasReads;
-			if (probes >= threshold) context.report({
-				data: { count: String(probes) },
-				messageId: "bodyProbeCluster",
+		const parts = segments(context.physicalFilename);
+		if (!parts.includes("specs")) return {};
+		if (parts.slice(0, -1).includes("contracts")) return {};
+		return importSourceVisitor(({ node, source }) => {
+			if (INTERNAL_UNIT.test(source)) context.report({
+				data: { source },
+				messageId: "internal",
 				node
 			});
-		} };
+		});
 	},
 	meta: {
-		docs: RULE_DOCS["d12w-response-body-probe"],
-		defaultOptions: [{ threshold: DEFAULT_THRESHOLD }],
-		messages: { bodyProbeCluster: "{{count}} body probes in one test — this wants a full golden: expect(result.response).toMatch('x.http') (D12 — see docs/13-linting.md)." },
-		schema: [{
-			additionalProperties: false,
-			properties: { threshold: {
-				minimum: 1,
-				type: "integer"
-			} },
-			type: "object"
-		}],
-		type: "suggestion"
+		docs: RULE_DOCS["c10-contracts-boundary"],
+		messages: { internal: "Import \"{{source}}\" reaches into a provider folder — only contracts/*.contracts.ts is importable from a test; add a named scenario export there instead (C10 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/d13w-unfrozen-negative-fixture.ts
-/**
-* Does `arguments[1]` of a `toMatch(name, options)` call carry `{ frozen: true }`?
-* A frozen fixture opts out of update-mode rewriting, so it is exempt.
-*/
-function hasFrozenOption(args) {
-	const options = args[1];
-	if (options === void 0 || options.type !== "ObjectExpression") return false;
-	const value = findProperty(options, "frozen")?.value;
-	return value?.type === "Literal" && value.value === true;
+//#region src/lint/rules/c11-contract-data-pairing.ts
+const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/u;
+/** The provider folders that may carry data files. */
+const PROVIDERS = [
+	"anthropic",
+	"http",
+	"openai"
+];
+/** Data files: served payloads and matched inputs, both owned by a contract. */
+const DATA_SUFFIXES = [".request.ts", ".response.json"];
+/** The owning contract of a data file: its name up to the FIRST dot, `.ts`. */
+function ownerOf(entry) {
+	return `${entry.slice(0, entry.indexOf("."))}.ts`;
 }
 /**
-* Is this `toMatch(…)` call nested inside a WRAPPING `expect(…)` — the shape of a
-* negative assertion (`expect(() => …toMatch(…)).toThrow()` or
-* `expect(…toMatch(…)).rejects.toThrow()`)? The subject's own `expect(x)` is the
-* member OBJECT of `.toMatch` (a descendant), never an ancestor, so a positive
-* `expect(x).toMatch('f')` never trips this. The walk stays inside the current
-* expression: it stops at the first statement boundary or non-`expect` call, so
-* a `toMatch` merely written inside `inUpdateMode(() => …)` is NOT flagged.
+* CONVENTIONS C11 — data is owned by a contract. Inside a provider folder every
+* `*.response.json` (served payload) and `*.request.ts` (matched prompt/body)
+* pairs with the sibling `<stem>.ts` that serves it, where the stem is the name
+* up to the FIRST dot: `events.fr.response.json` belongs to `events.ts`. A data
+* file with no owner is dead weight no test can reach — reported on the feature's
+* test file, since oxlint never visits a `.json`.
 */
-const TRANSPARENT_ANCESTORS = /* @__PURE__ */ new Set([
-	"ArrowFunctionExpression",
-	"AwaitExpression",
-	"ChainExpression",
-	"MemberExpression",
-	"ParenthesizedExpression",
-	"TSAsExpression",
-	"TSNonNullExpression"
-]);
-function isWrappedInExpect(node) {
-	let current = node.parent;
-	while (current !== void 0) {
-		if (current.type === "CallExpression") {
-			const callee = current.callee;
-			return callee?.type === "Identifier" && callee.name === "expect";
-		}
-		if (!TRANSPARENT_ANCESTORS.has(current.type)) return false;
-		current = current.parent;
-	}
-	return false;
-}
-/**
-* CONVENTIONS D13 (warning) — a `toMatch` whose failure is the behaviour under
-* test (wrapped in `expect(() => …).toThrow()` or `expect(…).rejects.toThrow()`)
-* asserts a DELIBERATELY-WRONG or MISSING fixture. Under `TEST_UPDATE=1` an
-* unfrozen fixture is silently rewritten with the actual output — the matcher
-* writes instead of throwing — which destroys the negative case (the assertion
-* then no longer throws). Pass `{ frozen: true }` so the fixture is never
-* rewritten and the mismatch/error still throws in update mode.
-*
-* The structural signal is precise for the wrapped forms; a `toMatch` routed
-* through a helper that owns the try/catch (`catchMessage(() => …toMatch(…))`)
-* is out of static reach — see the D13 process note for that residue.
-*/
-const d13wUnfrozenNegativeFixture = {
+const c11ContractDataPairing = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		return { CallExpression(node) {
-			const callee = node.callee;
-			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
-			if (!isWrappedInExpect(node)) return;
-			if (hasFrozenOption(node.arguments ?? [])) return;
-			context.report({
-				messageId: "unfrozenNegativeFixture",
-				node
-			});
+		const file = context.physicalFilename;
+		if (!TEST_FILE$7.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const contractsDir = (0, node_path.join)((0, node_path.dirname)(file), "contracts");
+			for (const provider of PROVIDERS) {
+				const entries = listDirectory((0, node_path.join)(contractsDir, provider));
+				if (entries === null) continue;
+				const present = new Set(entries);
+				for (const entry of entries) {
+					if (!DATA_SUFFIXES.some((suffix) => entry.endsWith(suffix))) continue;
+					const owner = ownerOf(entry);
+					if (!present.has(owner)) context.report({
+						data: {
+							entry,
+							owner,
+							provider
+						},
+						messageId: "orphan",
+						node
+					});
+				}
+			}
 		} };
 	},
 	meta: {
-		docs: RULE_DOCS["d13w-unfrozen-negative-fixture"],
-		messages: { unfrozenNegativeFixture: "This toMatch asserts a mismatch (wrapped in expect(…).toThrow/.rejects) — pass { frozen: true } so TEST_UPDATE=1 never overwrites the deliberately-wrong fixture (D13 — see docs/13-linting.md)." },
-		type: "suggestion"
+		docs: RULE_DOCS["c11-contract-data-pairing"],
+		messages: { orphan: "contracts/{{provider}}/{{entry}} has no owning contract — data pairs with the sibling {{owner}} (stem = name up to the first dot) (C11 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/d15w-status-only-probe.ts
-/** An HTTP status code lives in this range — the numeric-literal gate. */
-const MIN_STATUS = 100;
-const MAX_STATUS = 599;
-/** Matchers that pin a single value — the shape of a status probe. */
-const EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual"]);
-/** Is `node` an `expect(…)` call (bare `expect` identifier callee)? */
-function isExpectCall(node) {
-	if (node?.type !== "CallExpression") return false;
-	const callee = node.callee;
-	return callee?.type === "Identifier" && callee.name === "expect";
-}
-/** Is `node` a numeric literal in the HTTP status range (100–599)? */
-function isStatusLiteral(node) {
-	if (node?.type !== "Literal" || typeof node.value !== "number") return false;
-	const value = node.value;
-	return Number.isInteger(value) && value >= MIN_STATUS && value <= MAX_STATUS;
-}
-/**
-* Is `node` a status probe — `expect(X.status).toBe(N)` / `.toEqual(N)` where
-* `X.status` is any `.status` member access and `N` is a numeric literal in the
-* HTTP status range? The numeric-literal gate keeps container-status STRINGS
-* (`expect(neo.status).toBe('running')`) out.
-*/
-function isStatusProbe(node) {
-	if (node.type !== "CallExpression") return false;
-	const callee = node.callee;
-	if (callee?.type !== "MemberExpression") return false;
-	const matcher = memberPropertyName(callee);
-	if (matcher === void 0 || !EQUALITY_MATCHERS.has(matcher)) return false;
-	const expectCall = callee.object;
-	if (!isExpectCall(expectCall)) return false;
-	const subject = (expectCall?.arguments ?? [])[0];
-	if (subject?.type !== "MemberExpression" || memberPropertyName(subject) !== "status") return false;
-	const expected = (node.arguments ?? [])[0];
-	return isStatusLiteral(expected);
-}
+//#region src/lint/rules/c13-underscored-ground.ts
+const TEST_FILE$6 = /\.test\.[cm]?[jt]sx?$/u;
 /**
-* CONVENTIONS D11/D15 (warning) — a spec test whose ONLY assertions are HTTP
-* status probes (`expect(X.status).toBe(N)` / `.toEqual(N)`, N a numeric literal
-* 100–599) throws away the full-response golden. Pin the whole response instead:
-* `expect(result.response).toMatch('case.http')`.
+* CONVENTIONS C13 — the ground of a spec carries a leading underscore. A
+* directory named `fixtures/`, `expected/`, `requests/` or `seeds/` under
+* `specs/` is a pre-14 name: since `@jterrazz/test` 14.0.0 the four are
+* `_fixtures/`, `_expected/`, `_requests/` and `_seeds/`, with no compatibility
+* fallback.
 *
-* This complements d12w (which needs a CLUSTER of ≥3 body probes): the lone
-* `expect(result.status).toBe(422)` as a test's sole assertion falls below that
-* threshold yet still hides everything the response carries. The rule fires only
-* when EVERY `expect(…)` in the callback is a status probe — a status probe
-* sitting NEXT TO a real assertion (a golden, `toMatchRows`, `toContain`, …) is
-* the legitimate scalpel and stays silent.
+* The catch this rule exists for: a consumer that upgrades and keeps the old
+* names loses nothing loudly. Every resolver — `.fixture()`, `.seed()`,
+* `.request()`, `toMatch()` — looks under the underscored name, finds nothing,
+* and the tree becomes invisible rather than wrong. The failure that follows is
+* "fixture does not exist" on every spec at once, one step removed from the
+* cause; this rule states the cause and the rename.
+*
+* Anchored on the feature's visited test file, exactly as C2/C7/C11 are: the
+* spec's own sibling directories are probed, plus the `$FIXTURES` pool at the
+* nearest specs root. A DOMAIN folder named after the ground it holds
+* (`specs/api/requests/_requests/`) is never a probe target — only what sits
+* beside a spec is.
 */
-const d15wStatusOnlyProbe = {
+const c13UnderscoredGround = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		return { CallExpression(node) {
-			if (!isTestCallee(node.callee)) return;
-			const callback = findTestCallback(node.arguments ?? []);
-			if (callback === void 0) return;
-			let expectCalls = 0;
-			let statusProbes = 0;
-			walk(callback, (inner) => {
-				if (isExpectCall(inner)) expectCalls++;
-				if (isStatusProbe(inner)) statusProbes++;
-			});
-			if (expectCalls >= 1 && statusProbes === expectCalls) context.report({
-				messageId: "statusOnlyProbe",
-				node
-			});
+		const file = context.physicalFilename;
+		const anchor = specsAnchor(file);
+		if (!TEST_FILE$6.test(file) || anchor === void 0) return {};
+		return { Program(node) {
+			const seen = /* @__PURE__ */ new Set();
+			const probe = (parent, legacy) => {
+				const path = (0, node_path.join)(parent, legacy);
+				if (seen.has(path) || !isDirectory(path)) return;
+				seen.add(path);
+				context.report({
+					data: {
+						ground: RENAMED_GROUND_DIRS[legacy] ?? legacy,
+						legacy
+					},
+					messageId: "notUnderscored",
+					node
+				});
+			};
+			for (const legacy of Object.keys(RENAMED_GROUND_DIRS)) probe((0, node_path.dirname)(file), legacy);
+			probe(anchor.directory, "fixtures");
 		} };
 	},
 	meta: {
-		docs: RULE_DOCS["d15w-status-only-probe"],
-		messages: { statusOnlyProbe: "The test's only assertion(s) are status probes — pin the full response: expect(result.response).toMatch('case.http') (D11 — see docs/13-linting.md)." },
-		type: "suggestion"
+		docs: RULE_DOCS["c13-underscored-ground"],
+		messages: { notUnderscored: "The directory \"{{legacy}}/\" is a pre-14 ground name — rename it to \"{{ground}}/\" (`git mv {{legacy}} {{ground}}`). What a spec stands on carries the underscore; a spec's own folder never does, and no resolver reads the un-underscored name (C13 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
@@ -2673,7 +2443,7 @@ const KNOWN_TOKEN_LITERAL = new RegExp(`^\\{\\{(?:${[
 	"url",
 	"uuid",
 	"workdir"
-].join("|")})(?:#[\\w.-]+)?\\}\\}$`);
+].join("|")})(?:#[\\w.-]+)?\\}\\}$`, "u");
 /**
 * Is this function a pure chain of `.replace(…, '{{token}}')` normalisations?
 * Accepts an arrow with an expression body or a single-return body whose
@@ -2685,8 +2455,9 @@ function isTokenEquivalentTransform(fn) {
 	let expression = fn.body;
 	if (expression?.type === "BlockStatement") {
 		const statements = expression.body ?? [];
-		if (statements.length !== 1 || statements[0].type !== "ReturnStatement") return false;
-		expression = statements[0].argument;
+		const [only] = statements;
+		if (statements.length !== 1 || only?.type !== "ReturnStatement") return false;
+		expression = only.argument;
 	}
 	let sawReplace = false;
 	while (expression?.type === "CallExpression") {
@@ -2762,9 +2533,9 @@ const d8wTextBypass = {
 };
 //#endregion
 //#region src/lint/rules/d9w-single-use-ref.ts
-const TEST_FILE$5 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$5 = /\.test\.[cm]?[jt]sx?$/u;
 /** A captured-ref token: `{{kind#ref}}`. Captures the ref name. */
-const REF_TOKEN = /\{\{[A-Za-z][A-Za-z0-9]*#(?<ref>[\w.-]+)\}\}/g;
+const REF_TOKEN = /\{\{[A-Za-z][A-Za-z0-9]*#(?<ref>[\w.-]+)\}\}/gu;
 /** Is this call `match.ref(...)`? */
 function isMatchRef(node) {
 	const callee = node.callee;
@@ -2819,7 +2590,7 @@ const d9wSingleUseRef = {
 				if (memberPropertyName(node.callee) === "toMatch") {
 					const name = stringValue(node.arguments?.[0]);
 					if (name !== void 0) {
-						const target = (0, node_path.join)(featureDir, GROUND_EXPECTED, name.replace(/\/+$/, ""));
+						const target = (0, node_path.join)(featureDir, GROUND_EXPECTED, name.replace(/\/+$/u, ""));
 						for (const ref of refsInFixture(target)) {
 							bump(ref);
 							if (!fixtureNodes.has(ref)) fixtureNodes.set(ref, node);
@@ -2844,6 +2615,234 @@ const d9wSingleUseRef = {
 	}
 };
 //#endregion
+//#region src/lint/rules/d12w-response-body-probe.ts
+/** A test reading the response body this many times (or more) is a cluster. */
+const DEFAULT_THRESHOLD = 3;
+/** Is `node` the `x.response.body` member access itself? */
+function isResponseBody(node) {
+	if (node.type !== "MemberExpression" || memberPropertyName(node) !== "body") return false;
+	const object = node.object;
+	return object !== void 0 && memberPropertyName(object) === "response";
+}
+/** Peel `await`, `as T`, and `!` off an initializer to reach its core expression. */
+function unwrap(node) {
+	let current = node ?? void 0;
+	while (current != null) if (current.type === "AwaitExpression") current = current.argument ?? void 0;
+	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression") current = current.expression ?? void 0;
+	else if (current.type === "ParenthesizedExpression") current = current.expression ?? void 0;
+	else return current;
+}
+/**
+* CONVENTIONS D12 (warning) — a full-response golden is the norm for API
+* assertions (the D11 boundary, mechanized). A test that accumulates a CLUSTER
+* of raw body probes — reading `.response.body` (or a variable cast from it)
+* `threshold`+ times in one test callback — should collapse into one golden:
+* `expect(result.response).toMatch('case.http')`. One or two probes stay silent
+* (a legitimate scalpel: absence, a single-field delta, third-party output).
+*
+* A probe is a body-rooted read: a direct `.response.body` use, or a field
+* access on the local binding a `const body = result.response.body as {…}`
+* introduces. The count is the same threshold the golden transformation applies.
+*/
+const d12wResponseBodyProbe = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		const threshold = context.options[0]?.threshold ?? DEFAULT_THRESHOLD;
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			const aliases = /* @__PURE__ */ new Set();
+			let responseBodyNodes = 0;
+			walk(callback, (inner) => {
+				if (isResponseBody(inner)) responseBodyNodes++;
+				if (inner.type === "VariableDeclarator") {
+					const init = unwrap(inner.init);
+					const id = inner.id;
+					if (init !== void 0 && isResponseBody(init) && id?.type === "Identifier") aliases.add(id.name);
+				}
+			});
+			let aliasReads = 0;
+			walk(callback, (inner) => {
+				if (inner.type !== "MemberExpression") return;
+				const object = inner.object;
+				if (object?.type === "Identifier" && aliases.has(object.name)) aliasReads++;
+			});
+			const probes = responseBodyNodes - aliases.size + aliasReads;
+			if (probes >= threshold) context.report({
+				data: { count: String(probes) },
+				messageId: "bodyProbeCluster",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d12w-response-body-probe"],
+		defaultOptions: [{ threshold: DEFAULT_THRESHOLD }],
+		messages: { bodyProbeCluster: "{{count}} body probes in one test — this wants a full golden: expect(result.response).toMatch('x.http') (D12 — see docs/13-linting.md)." },
+		schema: [{
+			additionalProperties: false,
+			properties: { threshold: {
+				minimum: 1,
+				type: "integer"
+			} },
+			type: "object"
+		}],
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d13w-unfrozen-negative-fixture.ts
+/**
+* Does `arguments[1]` of a `toMatch(name, options)` call carry `{ frozen: true }`?
+* A frozen fixture opts out of update-mode rewriting, so it is exempt.
+*/
+function hasFrozenOption(args) {
+	const options = args[1];
+	if (options === void 0 || options.type !== "ObjectExpression") return false;
+	const value = findProperty(options, "frozen")?.value;
+	return value?.type === "Literal" && value.value === true;
+}
+/**
+* Is this `toMatch(…)` call nested inside a WRAPPING `expect(…)` — the shape of a
+* negative assertion (`expect(() => …toMatch(…)).toThrow()` or
+* `expect(…toMatch(…)).rejects.toThrow()`)? The subject's own `expect(x)` is the
+* member OBJECT of `.toMatch` (a descendant), never an ancestor, so a positive
+* `expect(x).toMatch('f')` never trips this. The walk stays inside the current
+* expression: it stops at the first statement boundary or non-`expect` call, so
+* a `toMatch` merely written inside `inUpdateMode(() => …)` is NOT flagged.
+*/
+const TRANSPARENT_ANCESTORS = /* @__PURE__ */ new Set([
+	"ArrowFunctionExpression",
+	"AwaitExpression",
+	"ChainExpression",
+	"MemberExpression",
+	"ParenthesizedExpression",
+	"TSAsExpression",
+	"TSNonNullExpression"
+]);
+function isWrappedInExpect(node) {
+	let current = node.parent;
+	while (current !== void 0) {
+		if (current.type === "CallExpression") {
+			const callee = current.callee;
+			return callee?.type === "Identifier" && callee.name === "expect";
+		}
+		if (!TRANSPARENT_ANCESTORS.has(current.type)) return false;
+		current = current.parent;
+	}
+	return false;
+}
+/**
+* CONVENTIONS D13 (warning) — a `toMatch` whose failure is the behaviour under
+* test (wrapped in `expect(() => …).toThrow()` or `expect(…).rejects.toThrow()`)
+* asserts a DELIBERATELY-WRONG or MISSING fixture. Under `TEST_UPDATE=1` an
+* unfrozen fixture is silently rewritten with the actual output — the matcher
+* writes instead of throwing — which destroys the negative case (the assertion
+* then no longer throws). Pass `{ frozen: true }` so the fixture is never
+* rewritten and the mismatch/error still throws in update mode.
+*
+* The structural signal is precise for the wrapped forms; a `toMatch` routed
+* through a helper that owns the try/catch (`catchMessage(() => …toMatch(…))`)
+* is out of static reach — see the D13 process note for that residue.
+*/
+const d13wUnfrozenNegativeFixture = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
+			if (!isWrappedInExpect(node)) return;
+			if (hasFrozenOption(node.arguments ?? [])) return;
+			context.report({
+				messageId: "unfrozenNegativeFixture",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d13w-unfrozen-negative-fixture"],
+		messages: { unfrozenNegativeFixture: "This toMatch asserts a mismatch (wrapped in expect(…).toThrow/.rejects) — pass { frozen: true } so TEST_UPDATE=1 never overwrites the deliberately-wrong fixture (D13 — see docs/13-linting.md)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d15w-status-only-probe.ts
+/** An HTTP status code lives in this range — the numeric-literal gate. */
+const MIN_STATUS = 100;
+const MAX_STATUS = 599;
+/** Matchers that pin a single value — the shape of a status probe. */
+const EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual"]);
+/** Is `node` an `expect(…)` call (bare `expect` identifier callee)? */
+function isExpectCall(node) {
+	if (node?.type !== "CallExpression") return false;
+	const callee = node.callee;
+	return callee?.type === "Identifier" && callee.name === "expect";
+}
+/** Is `node` a numeric literal in the HTTP status range (100–599)? */
+function isStatusLiteral(node) {
+	if (node?.type !== "Literal" || typeof node.value !== "number") return false;
+	const { value } = node;
+	return Number.isInteger(value) && value >= MIN_STATUS && value <= MAX_STATUS;
+}
+/**
+* Is `node` a status probe — `expect(X.status).toBe(N)` / `.toEqual(N)` where
+* `X.status` is any `.status` member access and `N` is a numeric literal in the
+* HTTP status range? The numeric-literal gate keeps container-status STRINGS
+* (`expect(neo.status).toBe('running')`) out.
+*/
+function isStatusProbe(node) {
+	if (node.type !== "CallExpression") return false;
+	const callee = node.callee;
+	if (callee?.type !== "MemberExpression") return false;
+	const matcher = memberPropertyName(callee);
+	if (matcher === void 0 || !EQUALITY_MATCHERS.has(matcher)) return false;
+	const expectCall = callee.object;
+	if (!isExpectCall(expectCall)) return false;
+	const subject = (expectCall?.arguments ?? [])[0];
+	if (subject?.type !== "MemberExpression" || memberPropertyName(subject) !== "status") return false;
+	const expected = (node.arguments ?? [])[0];
+	return isStatusLiteral(expected);
+}
+/**
+* CONVENTIONS D11/D15 (warning) — a spec test whose ONLY assertions are HTTP
+* status probes (`expect(X.status).toBe(N)` / `.toEqual(N)`, N a numeric literal
+* 100–599) throws away the full-response golden. Pin the whole response instead:
+* `expect(result.response).toMatch('case.http')`.
+*
+* This complements d12w (which needs a CLUSTER of ≥3 body probes): the lone
+* `expect(result.status).toBe(422)` as a test's sole assertion falls below that
+* threshold yet still hides everything the response carries. The rule fires only
+* when EVERY `expect(…)` in the callback is a status probe — a status probe
+* sitting NEXT TO a real assertion (a golden, `toMatchRows`, `toContain`, …) is
+* the legitimate scalpel and stays silent.
+*/
+const d15wStatusOnlyProbe = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			let expectCalls = 0;
+			let statusProbes = 0;
+			walk(callback, (inner) => {
+				if (isExpectCall(inner)) expectCalls++;
+				if (isStatusProbe(inner)) statusProbes++;
+			});
+			if (expectCalls >= 1 && statusProbes === expectCalls) context.report({
+				messageId: "statusOnlyProbe",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d15w-status-only-probe"],
+		messages: { statusOnlyProbe: "The test's only assertion(s) are status probes — pin the full response: expect(result.response).toMatch('case.http') (D11 — see docs/13-linting.md)." },
+		type: "suggestion"
+	}
+};
+//#endregion
 //#region src/lint/package-exports.ts
 /**
 * The subpaths this package actually publishes, read from its OWN
@@ -2897,7 +2896,7 @@ function findOwnManifest(startDir) {
 */
 function declaredSubpaths(startDir) {
 	if (startDir === void 0 && cached !== null) return cached;
-	const exports = findOwnManifest(startDir ?? (0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href)))?.exports;
+	const exports = findOwnManifest(startDir ?? __dirname)?.exports;
 	const subpaths = exports !== null && typeof exports === "object" ? Object.keys(exports).filter((key) => key.startsWith("./") && key !== ".").map((key) => `${PACKAGE$2}/${key.slice(2)}`).sort() : [];
 	if (startDir === void 0) cached = subpaths;
 	return subpaths;
@@ -2939,9 +2938,9 @@ const f1NoSubpathImport = {
 };
 //#endregion
 //#region src/lint/rules/f2-no-test-imports-in-prod.ts
-const TEST_FILE$4 = /\.(?:test|fixtures|specification)\.[cm]?[jt]sx?$/;
-const CONFIG_FILE = /(?:^|[/\\])[\w.-]*\.config\.[cm]?[jt]s$/;
-const TEST_IMPORT$1 = /\.(?:test|fixtures)(?:\.[cm]?[jt]sx?)?$/;
+const TEST_FILE$4 = /\.(?:test|fixtures|specification)\.[cm]?[jt]sx?$/u;
+const CONFIG_FILE = /(?:^|[/\\])[\w.-]*\.config\.[cm]?[jt]s$/u;
+const TEST_IMPORT$1 = /\.(?:test|fixtures)(?:\.[cm]?[jt]sx?)?$/u;
 const TOOL_SUBPATH$1 = "@jterrazz/test/oxlint";
 /**
 * CONVENTIONS F2 — production code never imports a test artefact. In a
@@ -2998,15 +2997,15 @@ const TOOL_SUBPATH = "@jterrazz/test/oxlint";
 * `server: () => createApp()` importing `../../src/app.js`).
 */
 const FRAMEWORK_LAYERS = /* @__PURE__ */ new Set([
-	"core",
 	"integrations",
 	"lint",
+	"specification",
 	"vitest"
 ]);
 /**
 * CONVENTIONS F3 — from `specs/`, deep-importing the FRAMEWORK's internals is
 * forbidden: a relative path resolving inside the framework repo's
-* `src/{core,integrations,vitest,lint}/`, or any `@jterrazz/test/<subpath>`
+* `src/{specification,integrations,vitest,lint}/`, or any `@jterrazz/test/<subpath>`
 * other than the sanctioned tool-facing `@jterrazz/test/oxlint`. A consumer's
 * imports of its OWN app source are always allowed — that is the pattern.
 *
@@ -3032,7 +3031,7 @@ const f3SpecsPublicEntry = {
 			}
 			const marker = source.indexOf("/src/");
 			if (marker === -1 && !source.startsWith("src/")) return;
-			const layer = (marker === -1 ? source.slice(4) : source.slice(marker + 5)).split("/")[0];
+			const layer = (marker === -1 ? source.slice(4) : source.slice(marker + 5)).split("/")[0] ?? "";
 			if (!FRAMEWORK_LAYERS.has(layer)) return;
 			if (underIntegrations && layer === "integrations") return;
 			context.report({
@@ -3050,8 +3049,8 @@ const f3SpecsPublicEntry = {
 };
 //#endregion
 //#region src/lint/rules/f4-no-test-to-test-import.ts
-const TEST_FILE$3 = /\.test\.[cm]?[jt]sx?$/;
-const TEST_IMPORT = /\.test(?:\.[cm]?[jt]sx?)?$/;
+const TEST_FILE$3 = /\.test\.[cm]?[jt]sx?$/u;
+const TEST_IMPORT = /\.test(?:\.[cm]?[jt]sx?)?$/u;
 /**
 * CONVENTIONS F4 — a `*.test.ts` never imports another `*.test.ts`. Shared
 * test data belongs in a `*.fixtures.ts` neighbour (F5), shared runners in a
@@ -3076,8 +3075,8 @@ const f4NoTestToTestImport = {
 };
 //#endregion
 //#region src/lint/rules/f5-fixtures-only-from-tests.ts
-const TEST_FILE$2 = /\.test\.[cm]?[jt]sx?$/;
-const FIXTURES_IMPORT = /\.fixtures(?:\.[cm]?[jt]sx?)?$/;
+const TEST_FILE$2 = /\.test\.[cm]?[jt]sx?$/u;
+const FIXTURES_IMPORT = /\.fixtures(?:\.[cm]?[jt]sx?)?$/u;
 /**
 * CONVENTIONS F5 — a `*.fixtures.ts` module is only importable from
 * `*.test.ts` files. Any other importer (prod code, a specification file,
@@ -3102,7 +3101,7 @@ const f5FixturesOnlyFromTests = {
 };
 //#endregion
 //#region src/lint/rules/i1-layer-boundaries.ts
-const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/;
+const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/u;
 function matchesPackage(source, packages) {
 	return packages.some((name) => source === name || source.startsWith(`${name}/`));
 }
@@ -3114,7 +3113,7 @@ function pathInsideSrc(path) {
 }
 /** Strip a `.js`/`.ts`-style extension for exact-path comparison. */
 function withoutExtension(path) {
-	return path.replace(/\.[cm]?[jt]sx?$/, "");
+	return path.replace(/\.[cm]?[jt]sx?$/u, "");
 }
 /** Does `target` match one of the declared paths (prefix, or exact module)? */
 function matchesPath(target, patterns) {
@@ -3231,7 +3230,7 @@ const i1LayerBoundaries = {
 };
 //#endregion
 //#region src/lint/rules/i2-sibling-test-naming.ts
-const TEST_FILE$1 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$1 = /\.test\.[cm]?[jt]sx?$/u;
 /**
 * CONVENTIONS I2 — module tests are NEIGHBOURS: the test of `<file>.ts` is
 * `<file>.test.ts` next to it (Go's `foo_test.go` parity). Flags, on visited
@@ -3259,7 +3258,7 @@ const i2SiblingTestNaming = {
 						".js"
 					].map((extension) => file.replace(TEST_FILE$1, extension));
 					if (!neighbours.some(isFile)) context.report({
-						data: { expected: neighbours[0].split(/[/\\]/).at(-1) ?? "" },
+						data: { expected: neighbours[0]?.split(/[/\\]/u).at(-1) ?? "" },
 						messageId: "orphanTest",
 						node
 					});
@@ -3286,7 +3285,7 @@ const i2SiblingTestNaming = {
 };
 //#endregion
 //#region src/lint/rules/i4-no-vi-mock-in-src.ts
-const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE = /\.test\.[cm]?[jt]sx?$/u;
 const DATA_ASSET = new RegExp(`\\.(?:${[
 	"avif",
 	"bin",
@@ -3324,10 +3323,10 @@ const DATA_ASSET = new RegExp(`\\.(?:${[
 	"yaml",
 	"yml",
 	"zip"
-].join("|")})$`, "i");
+].join("|")})$`, "iu");
 /** A bundler suffix (`./payload.json?raw`, `./doc.md#frag`) is not part of the extension. */
 function withoutSuffix(source) {
-	return source.replace(/[?#].*$/, "");
+	return source.replace(/[?#].*$/u, "");
 }
 /**
 * CONVENTIONS I4 — in module tests under `src/`, mocks and data are CODE:
@@ -3567,7 +3566,7 @@ const plugin = {
 *
 *     'jterrazz/b5-await-using': ['error', { runners: ['dockerCli'] }]
 */
-const recommendedRules = Object.fromEntries(Object.keys(plugin.rules).map((rule) => [`jterrazz/${rule}`, /^\w+w-/.test(rule) ? "warn" : "error"]));
+const recommendedRules = Object.fromEntries(Object.keys(plugin.rules).map((rule) => [`jterrazz/${rule}`, /^\w+w-/u.test(rule) ? "warn" : "error"]));
 /**
 * The composable testing fragment — wire the plugin, enable the whole
 * catalogue, and ship the one override every strict consumer needs. Designed