@jterrazz/test 15.0.0 → 15.1.1

package/dist/oxlint.cjs

@@ -4,7 +4,6 @@ Object.defineProperties(exports, {
 });
 let node_path = require("node:path");
 let node_fs = require("node:fs");
-let node_url = require("node:url");
 //#region src/lint/fs-cache.ts
 /**
 * Cached filesystem probes for the fs-anchored rules (a9w, c2, c6, c7, i2).
@@ -70,7 +69,7 @@ function readFileCached(path) {
 */
 /** Split a path into its non-empty segments (posix or win separators). */
 function segments(path) {
-	return path.split(/[/\\]/).filter(Boolean);
+	return path.split(/[/\\]/u).filter(Boolean);
 }
 /**
 * The `specs/` directory a file belongs to: the NEAREST ancestor named `specs`,
@@ -112,7 +111,8 @@ function stringValue(node) {
 	if (node.type === "TemplateLiteral") {
 		const expressions = node.expressions;
 		const quasis = node.quasis;
-		if (expressions?.length === 0 && quasis?.length === 1) return quasis[0].value?.cooked;
+		const onlyQuasi = quasis?.[0];
+		if (expressions?.length === 0 && quasis?.length === 1 && onlyQuasi !== void 0) return onlyQuasi.value?.cooked;
 	}
 }
 /** The property name of a non-computed member expression, if identifiable. */
@@ -483,7 +483,7 @@ const RULE_DOCS = {
 	},
 	"f3-specs-public-entry": {
 		channel: "statique",
-		convention: "Depuis `specs/`, seul l’import en profondeur des INTERNES du framework est interdit : un chemin relatif résolvant dans `src/{core,integrations,vitest,lint}/` du dépôt du framework, ou tout `@jterrazz/test/<subpath>` autre que `@jterrazz/test/oxlint`. Les imports de la source de SA PROPRE app par un consommateur sont toujours permis (c’est le motif documenté) ; seul `specs/integrations/` peut importer en profondeur `src/integrations/**`.",
+		convention: "Depuis `specs/`, seul l’import en profondeur des INTERNES du framework est interdit : un chemin relatif résolvant dans `src/{specification,integrations,vitest,lint}/` du dépôt du framework, ou tout `@jterrazz/test/<subpath>` que la map `exports` du paquet ne publie pas — les subpaths publiés sont exemptés, LUS du manifeste comme en F1, qui en tient la liste. Les imports de la source de SA PROPRE app par un consommateur sont toujours permis (c’est le motif documenté) ; seul `specs/integrations/` peut importer en profondeur `src/integrations/**`.",
 		family: "F",
 		id: "F3",
 		rationale: "Tester par la surface publique garde les specs découplées des chemins internes du framework, sans gêner le consommateur qui importe sa propre app."
@@ -893,83 +893,6 @@ const a1SpecificationFile = {
 	}
 };
 //#endregion
-//#region src/core/specification/shared/binding.ts
-/**
-* Compose-binding resolution and the case conversions it shares with the
-* automatic env injection (CONVENTIONS A6 / B6).
-*
-* A services-record key is written in the natural TypeScript style
-* (`analyticsDb`), while a compose service name is kebab-case
-* (`analytics-db`). These helpers bridge the two vocabularies deterministically
-* so the record key stays the single source of truth and `composeService`
-* remains a rare escape hatch.
-*/
-/**
-* Convert a record key to its kebab-case form: camelCase boundaries become
-* `-`, everything is lowercased. `analyticsDb` → `analytics-db`, `db` → `db`.
-*/
-function toKebabCase(key) {
-	return key.replace(/(?<lower>[a-z0-9])(?<upper>[A-Z])/g, "$<lower>-$<upper>").toLowerCase();
-}
-//#endregion
-//#region src/lint/rules/a10-duplicate-binding.ts
-/** The compose service an entry binds to: explicit `composeService`, else the key's kebab form. */
-function canonicalBinding(entry, key) {
-	const factory = entry.value;
-	if (factory?.type === "CallExpression") {
-		const options = factory.arguments?.[0];
-		if (options?.type === "ObjectExpression") {
-			const explicit = stringValue(findProperty(options, "composeService")?.value);
-			if (explicit !== void 0) return explicit;
-		}
-	}
-	return toKebabCase(key);
-}
-/**
-* CONVENTIONS A10 — within one `services` record, two keys that derive (or
-* pin via `composeService`) the SAME compose service name are a silent
-* collision: the record is a map, and the second binding would shadow the
-* first. Detected on the same kebab derivation the runtime binding uses
-* (`analyticsDb` and `analytics-db` both → `analytics-db`), and across explicit
-* `composeService` values.
-*/
-const a10DuplicateBinding = {
-	create(context) {
-		return { CallExpression(node) {
-			if (specificationMember(node) === void 0) return;
-			for (const argument of node.arguments ?? []) {
-				const record = findProperty(argument, "services")?.value;
-				if (record?.type !== "ObjectExpression") continue;
-				const seen = /* @__PURE__ */ new Map();
-				for (const entry of record.properties ?? []) {
-					const key = propertyKeyName(entry);
-					if (key === void 0) continue;
-					const binding = canonicalBinding(entry, key);
-					const first = seen.get(binding);
-					if (first !== void 0) {
-						context.report({
-							data: {
-								binding,
-								first,
-								key
-							},
-							messageId: "duplicate",
-							node: entry
-						});
-						continue;
-					}
-					seen.set(binding, key);
-				}
-			}
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["a10-duplicate-binding"],
-		messages: { duplicate: "Service keys \"{{first}}\" and \"{{key}}\" both bind to compose service \"{{binding}}\" — one shadows the other; rename a key or set distinct composeService values (A10 — see docs/13-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
 //#region src/lint/rules/a2-known-constructors.ts
 /** The five constructors, and only five (A2 — see docs/13-linting.md). */
 const KNOWN_CONSTRUCTORS = /* @__PURE__ */ new Set([
@@ -1132,6 +1055,25 @@ const a5ModeWithServer = {
 	}
 };
 //#endregion
+//#region src/specification/facets/_common/binding.ts
+/**
+* Compose-binding resolution and the case conversions it shares with the
+* automatic env injection (CONVENTIONS A6 / B6).
+*
+* A services-record key is written in the natural TypeScript style
+* (`analyticsDb`), while a compose service name is kebab-case
+* (`analytics-db`). These helpers bridge the two vocabularies deterministically
+* so the record key stays the single source of truth and `composeService`
+* remains a rare escape hatch.
+*/
+/**
+* Convert a record key to its kebab-case form: camelCase boundaries become
+* `-`, everything is lowercased. `analyticsDb` → `analytics-db`, `db` → `db`.
+*/
+function toKebabCase(key) {
+	return key.replaceAll(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower>-$<upper>").toLowerCase();
+}
+//#endregion
 //#region src/lint/rules/a6w-redundant-compose-service.ts
 /**
 * CONVENTIONS A6 (warning) — `composeService:` is the escape hatch for
@@ -1173,7 +1115,7 @@ const a6wRedundantComposeService = {
 	}
 };
 //#endregion
-//#region src/core/specification/shared/resolve.ts
+//#region src/specification/facets/_common/resolve.ts
 /** What makes a directory a project root — a manifest, or a test stack. */
 const ROOT_MARKERS = ["package.json", "docker/compose.test.yaml"];
 /**
@@ -1240,7 +1182,65 @@ const a9wRedundantRoot = {
 	}
 };
 //#endregion
-//#region src/core/specification/shared/ground.ts
+//#region src/lint/rules/a10-duplicate-binding.ts
+/** The compose service an entry binds to: explicit `composeService`, else the key's kebab form. */
+function canonicalBinding(entry, key) {
+	const factory = entry.value;
+	if (factory?.type === "CallExpression") {
+		const options = factory.arguments?.[0];
+		if (options?.type === "ObjectExpression") {
+			const explicit = stringValue(findProperty(options, "composeService")?.value);
+			if (explicit !== void 0) return explicit;
+		}
+	}
+	return toKebabCase(key);
+}
+/**
+* CONVENTIONS A10 — within one `services` record, two keys that derive (or
+* pin via `composeService`) the SAME compose service name are a silent
+* collision: the record is a map, and the second binding would shadow the
+* first. Detected on the same kebab derivation the runtime binding uses
+* (`analyticsDb` and `analytics-db` both → `analytics-db`), and across explicit
+* `composeService` values.
+*/
+const a10DuplicateBinding = {
+	create(context) {
+		return { CallExpression(node) {
+			if (specificationMember(node) === void 0) return;
+			for (const argument of node.arguments ?? []) {
+				const record = findProperty(argument, "services")?.value;
+				if (record?.type !== "ObjectExpression") continue;
+				const seen = /* @__PURE__ */ new Map();
+				for (const entry of record.properties ?? []) {
+					const key = propertyKeyName(entry);
+					if (key === void 0) continue;
+					const binding = canonicalBinding(entry, key);
+					const first = seen.get(binding);
+					if (first !== void 0) {
+						context.report({
+							data: {
+								binding,
+								first,
+								key
+							},
+							messageId: "duplicate",
+							node: entry
+						});
+						continue;
+					}
+					seen.set(binding, key);
+				}
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a10-duplicate-binding"],
+		messages: { duplicate: "Service keys \"{{first}}\" and \"{{key}}\" both bind to compose service \"{{binding}}\" — one shadows the other; rename a key or set distinct composeService values (A10 — see docs/13-linting.md)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/specification/facets/_common/ground.ts
 /**
 * The GROUND a row of specs stands on — the naming law of a spec tree.
 *
@@ -1281,7 +1281,7 @@ const RENAMED_GROUND_DIRS = {
 	seeds: GROUND_SEEDS
 };
 //#endregion
-//#region src/core/specification/shared/fixtures.ts
+//#region src/specification/facets/_common/fixtures.ts
 /**
 * Fixture path resolution + copy semantics for the `cli` facet's `.fixture()`.
 *
@@ -1328,7 +1328,7 @@ const b2KnownFixtureMarker = {
 			const args = node.arguments ?? [];
 			const path = leadingText(args[0]);
 			if (path === void 0 || !path.startsWith("$")) return;
-			const marker = path.replace(/\/+$/, "").split("/")[0];
+			const marker = path.replace(/\/+$/u, "").split("/")[0] ?? "";
 			if (!KNOWN.has(marker)) context.report({
 				data: {
 					known: [...KNOWN_FIXTURE_MARKERS].join(", "),
@@ -1462,7 +1462,7 @@ const b5AwaitUsing = {
 };
 //#endregion
 //#region src/lint/rules/b6w-redundant-env-url.ts
-const URL_KEY = /^[A-Z0-9]+(?:_[A-Z0-9]+)*_URL$/;
+const URL_KEY = /^[A-Z0-9]+(?:_[A-Z0-9]+)*_URL$/u;
 /**
 * CONVENTIONS B6 (warning) — in `cli` mode with services, the framework
 * already injects `<KEY>_URL` for every service (plus the unambiguous
@@ -1498,7 +1498,7 @@ const b6wRedundantEnvUrl = {
 //#endregion
 //#region src/lint/rules/b8-kebab-trigger.ts
 /** Stable kebab-case job identifier: `nightly-report`, `send-welcome-emails`. */
-const KEBAB_CASE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const KEBAB_CASE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
 /**
 * CONVENTIONS B8 — a job `name` passed to `.trigger()` is a stable kebab-case
 * identifier; it is a contract between the app and its tests. Only string
@@ -1754,212 +1754,71 @@ const c1DomainStructure = {
 	}
 };
 //#endregion
-//#region src/lint/rules/c10-contracts-boundary.ts
-/** A specifier reaching into a provider folder — the internal half of contracts/. */
-const INTERNAL_UNIT = /(?:^|\/)contracts\/(?:anthropic|http|openai)\//u;
+//#region src/lint/rules/c2-http-only-requests.ts
+const TEST_FILE$12 = /\.test\.[cm]?[jt]sx?$/u;
 /**
-* CONVENTIONS C10 — the contracts boundary. A feature's `contracts/` folder has
-* a PUBLIC half (`*.contracts.ts` facades: the default export is the world, the
-* named exports are its scenarios) and an INTERNAL half (the `http/`, `openai/`
-* and `anthropic/` unit contracts the facades compose). Outside `contracts/`,
-* importing a unit is an error — a test routes through the facade, so a
-* scenario is named once, next to the world it derives from.
+* CONVENTIONS C2 — `_requests/` contains only `.http` files (a request file is
+* a COMPLETE request: method, path, headers, body). Anchored on the feature's
+* visited test file: when `<feature>/<feature>.test.ts` is linted, its sibling
+* `_requests/` directory is probed (cached readdir) and any non-`.http` entry
+* is reported on the test file.
 */
-const c10ContractsBoundary = {
+const c2HttpOnlyRequests = {
 	create(context) {
-		const parts = segments(context.physicalFilename);
-		if (!parts.includes("specs")) return {};
-		if (parts.slice(0, -1).includes("contracts")) return {};
-		return importSourceVisitor(({ node, source }) => {
-			if (INTERNAL_UNIT.test(source)) context.report({
-				data: { source },
-				messageId: "internal",
+		const file = context.physicalFilename;
+		if (!TEST_FILE$12.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const requestsDir = (0, node_path.join)((0, node_path.dirname)(file), GROUND_REQUESTS);
+			for (const entry of listDirectory(requestsDir) ?? []) if (!entry.endsWith(".http")) context.report({
+				data: { entry },
+				messageId: "notHttp",
 				node
 			});
-		});
+		} };
 	},
 	meta: {
-		docs: RULE_DOCS["c10-contracts-boundary"],
-		messages: { internal: "Import \"{{source}}\" reaches into a provider folder — only contracts/*.contracts.ts is importable from a test; add a named scenario export there instead (C10 — see docs/13-linting.md)." },
+		docs: RULE_DOCS["c2-http-only-requests"],
+		messages: { notHttp: "_requests/{{entry}} is not a .http file — _requests/ contains only complete .http request files (C2 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/c11-contract-data-pairing.ts
-const TEST_FILE$12 = /\.test\.[cm]?[jt]sx?$/;
-/** The provider folders that may carry data files. */
-const PROVIDERS$1 = [
+//#region src/lint/rules/c4-contract-shape.ts
+/** The only directories a `contracts/` root may hold — the provider carriers. */
+const PROVIDERS$1 = /* @__PURE__ */ new Set([
 	"anthropic",
 	"http",
 	"openai"
-];
-/** Data files: served payloads and matched inputs, both owned by a contract. */
-const DATA_SUFFIXES = [".request.ts", ".response.json"];
-/** The owning contract of a data file: its name up to the FIRST dot, `.ts`. */
-function ownerOf(entry) {
-	return `${entry.slice(0, entry.indexOf("."))}.ts`;
+]);
+const TEST_FILE$11 = /\.test\.[cm]?[jt]sx?$/u;
+/** A file oxlint itself visits — the AST half of the rule reports on those. */
+const SOURCE_FILE = /\.[cm]?[jt]sx?$/u;
+/** The public facade of a feature: `contracts/<kebab>.contracts.ts`. */
+const COMPOSITE_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.contracts\.[cm]?ts$/u;
+/** An internal unit contract: `contracts/<provider>/<kebab>.ts`. */
+const UNIT_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[cm]?ts$/u;
+/** Matched data next to its contract: `contracts/<provider>/<stem>.request.ts`. */
+const REQUEST_DATA_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.request\.[cm]?ts$/u;
+/** The name a specifier/declaration exports under, when it is `default`. */
+function exportsDefault(node) {
+	return (node.specifiers ?? []).some((specifier) => {
+		const exported = specifier.exported;
+		return exported?.type === "Identifier" && exported.name === "default" || stringValue(exported) === "default";
+	});
+}
+/** Is this node a `defineContract(...)` call? */
+function isDefineContract(node) {
+	const callee = node.callee;
+	return node.type === "CallExpression" && callee?.type === "Identifier" && callee.name === "defineContract";
+}
+/** A default export that may legitimately produce a contract (value or factory). */
+function producesContract(declaration) {
+	if (declaration === void 0) return false;
+	return isDefineContract(declaration) || declaration.type === "ArrowFunctionExpression" || declaration.type === "FunctionDeclaration" || declaration.type === "FunctionExpression" || declaration.type === "Identifier";
 }
 /**
-* CONVENTIONS C11 — data is owned by a contract. Inside a provider folder every
-* `*.response.json` (served payload) and `*.request.ts` (matched prompt/body)
-* pairs with the sibling `<stem>.ts` that serves it, where the stem is the name
-* up to the FIRST dot: `events.fr.response.json` belongs to `events.ts`. A data
-* file with no owner is dead weight no test can reach — reported on the feature's
-* test file, since oxlint never visits a `.json`.
-*/
-const c11ContractDataPairing = {
-	create(context) {
-		const file = context.physicalFilename;
-		if (!TEST_FILE$12.test(file) || !segments(file).includes("specs")) return {};
-		return { Program(node) {
-			const contractsDir = (0, node_path.join)((0, node_path.dirname)(file), "contracts");
-			for (const provider of PROVIDERS$1) {
-				const entries = listDirectory((0, node_path.join)(contractsDir, provider));
-				if (entries === null) continue;
-				const present = new Set(entries);
-				for (const entry of entries) {
-					if (!DATA_SUFFIXES.some((suffix) => entry.endsWith(suffix))) continue;
-					const owner = ownerOf(entry);
-					if (!present.has(owner)) context.report({
-						data: {
-							entry,
-							owner,
-							provider
-						},
-						messageId: "orphan",
-						node
-					});
-				}
-			}
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c11-contract-data-pairing"],
-		messages: { orphan: "contracts/{{provider}}/{{entry}} has no owning contract — data pairs with the sibling {{owner}} (stem = name up to the first dot) (C11 — see docs/13-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c13-underscored-ground.ts
-const TEST_FILE$11 = /\.test\.[cm]?[jt]sx?$/;
-/**
-* CONVENTIONS C13 — the ground of a spec carries a leading underscore. A
-* directory named `fixtures/`, `expected/`, `requests/` or `seeds/` under
-* `specs/` is a pre-14 name: since `@jterrazz/test` 14.0.0 the four are
-* `_fixtures/`, `_expected/`, `_requests/` and `_seeds/`, with no compatibility
-* fallback.
-*
-* The catch this rule exists for: a consumer that upgrades and keeps the old
-* names loses nothing loudly. Every resolver — `.fixture()`, `.seed()`,
-* `.request()`, `toMatch()` — looks under the underscored name, finds nothing,
-* and the tree becomes invisible rather than wrong. The failure that follows is
-* "fixture does not exist" on every spec at once, one step removed from the
-* cause; this rule states the cause and the rename.
-*
-* Anchored on the feature's visited test file, exactly as C2/C7/C11 are: the
-* spec's own sibling directories are probed, plus the `$FIXTURES` pool at the
-* nearest specs root. A DOMAIN folder named after the ground it holds
-* (`specs/api/requests/_requests/`) is never a probe target — only what sits
-* beside a spec is.
-*/
-const c13UnderscoredGround = {
-	create(context) {
-		const file = context.physicalFilename;
-		const anchor = specsAnchor(file);
-		if (!TEST_FILE$11.test(file) || anchor === void 0) return {};
-		return { Program(node) {
-			const seen = /* @__PURE__ */ new Set();
-			const probe = (parent, legacy) => {
-				const path = (0, node_path.join)(parent, legacy);
-				if (seen.has(path) || !isDirectory(path)) return;
-				seen.add(path);
-				context.report({
-					data: {
-						ground: RENAMED_GROUND_DIRS[legacy],
-						legacy
-					},
-					messageId: "notUnderscored",
-					node
-				});
-			};
-			for (const legacy of Object.keys(RENAMED_GROUND_DIRS)) probe((0, node_path.dirname)(file), legacy);
-			probe(anchor.directory, "fixtures");
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c13-underscored-ground"],
-		messages: { notUnderscored: "The directory \"{{legacy}}/\" is a pre-14 ground name — rename it to \"{{ground}}/\" (`git mv {{legacy}} {{ground}}`). What a spec stands on carries the underscore; a spec's own folder never does, and no resolver reads the un-underscored name (C13 — see docs/13-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c2-http-only-requests.ts
-const TEST_FILE$10 = /\.test\.[cm]?[jt]sx?$/;
-/**
-* CONVENTIONS C2 — `_requests/` contains only `.http` files (a request file is
-* a COMPLETE request: method, path, headers, body). Anchored on the feature's
-* visited test file: when `<feature>/<feature>.test.ts` is linted, its sibling
-* `_requests/` directory is probed (cached readdir) and any non-`.http` entry
-* is reported on the test file.
-*/
-const c2HttpOnlyRequests = {
-	create(context) {
-		const file = context.physicalFilename;
-		if (!TEST_FILE$10.test(file) || !segments(file).includes("specs")) return {};
-		return { Program(node) {
-			const requestsDir = (0, node_path.join)((0, node_path.dirname)(file), GROUND_REQUESTS);
-			for (const entry of listDirectory(requestsDir) ?? []) if (!entry.endsWith(".http")) context.report({
-				data: { entry },
-				messageId: "notHttp",
-				node
-			});
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c2-http-only-requests"],
-		messages: { notHttp: "_requests/{{entry}} is not a .http file — _requests/ contains only complete .http request files (C2 — see docs/13-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c4-contract-shape.ts
-/** The only directories a `contracts/` root may hold — the provider carriers. */
-const PROVIDERS = /* @__PURE__ */ new Set([
-	"anthropic",
-	"http",
-	"openai"
-]);
-const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/;
-/** A file oxlint itself visits — the AST half of the rule reports on those. */
-const SOURCE_FILE = /\.[cm]?[jt]sx?$/;
-/** The public facade of a feature: `contracts/<kebab>.contracts.ts`. */
-const COMPOSITE_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.contracts\.[cm]?ts$/u;
-/** An internal unit contract: `contracts/<provider>/<kebab>.ts`. */
-const UNIT_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[cm]?ts$/u;
-/** Matched data next to its contract: `contracts/<provider>/<stem>.request.ts`. */
-const REQUEST_DATA_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.request\.[cm]?ts$/u;
-/** Served data next to its contract: `contracts/<provider>/<stem>[.<qualifier>].response.json`. */
-const RESPONSE_DATA_FILE = /\.response\.json$/;
-/** The name a specifier/declaration exports under, when it is `default`. */
-function exportsDefault(node) {
-	return (node.specifiers ?? []).some((specifier) => {
-		const exported = specifier.exported;
-		return exported?.type === "Identifier" && exported.name === "default" || stringValue(exported) === "default";
-	});
-}
-/** Is this node a `defineContract(...)` call? */
-function isDefineContract(node) {
-	const callee = node.callee;
-	return node.type === "CallExpression" && callee?.type === "Identifier" && callee.name === "defineContract";
-}
-/** A default export that may legitimately produce a contract (value or factory). */
-function producesContract(declaration) {
-	if (declaration === void 0) return false;
-	return isDefineContract(declaration) || declaration.type === "ArrowFunctionExpression" || declaration.type === "FunctionDeclaration" || declaration.type === "FunctionExpression" || declaration.type === "Identifier";
-}
-/**
-* The provider a `request:` value implies, when the builder is written as
-* `<provider>.<verb>(…)` — the only statically decidable form.
+* The provider a `request:` value implies, when the builder is written as
+* `<provider>.<verb>(…)` — the only statically decidable form.
 */
 function requestProvider(request) {
 	if (request?.type !== "CallExpression") return;
@@ -1987,7 +1846,7 @@ function checkLayout(context, node, contractsDir) {
 			});
 			continue;
 		}
-		if (!PROVIDERS.has(entry)) {
+		if (!PROVIDERS$1.has(entry)) {
 			context.report({
 				data: { entry },
 				messageId: "badProviderDir",
@@ -2003,7 +1862,7 @@ function checkLayout(context, node, contractsDir) {
 			messageId: "providerSubfolder",
 			node
 		});
-		else if (!/\.[cm]?ts$/u.test(child) && !RESPONSE_DATA_FILE.test(child)) context.report({
+		else if (!/\.[cm]?ts$/u.test(child) && !child.endsWith(".response.json")) context.report({
 			data: {
 				child,
 				provider: entry
@@ -2072,7 +1931,7 @@ function checkUnit(context, program, base, provider) {
 		if (isDefineContract(node)) {
 			const argument = node.arguments?.[0];
 			const declared = requestProvider(argument === void 0 ? void 0 : findProperty(argument, "request")?.value);
-			if (declared !== void 0 && PROVIDERS.has(declared) && declared !== provider) context.report({
+			if (declared !== void 0 && PROVIDERS$1.has(declared) && declared !== provider) context.report({
 				data: {
 					declared,
 					provider
@@ -2114,7 +1973,7 @@ const c4ContractShape = {
 		if (!parts.includes("specs")) return {};
 		const contractsIndex = parts.lastIndexOf("contracts");
 		if (contractsIndex === -1) {
-			if (!TEST_FILE$9.test(file)) return {};
+			if (!TEST_FILE$11.test(file)) return {};
 			return { Program(node) {
 				checkLayout(context, node, (0, node_path.join)((0, node_path.dirname)(file), "contracts"));
 			} };
@@ -2125,8 +1984,8 @@ const c4ContractShape = {
 			checkComposite(context, node, base);
 		} };
 		if (depth === 2) {
-			const provider = parts[contractsIndex + 1];
-			return PROVIDERS.has(provider) ? { Program(node) {
+			const provider = parts[contractsIndex + 1] ?? "";
+			return PROVIDERS$1.has(provider) ? { Program(node) {
 				checkUnit(context, node, base, provider);
 			} } : {};
 		}
@@ -2159,7 +2018,7 @@ const c4ContractShape = {
 };
 //#endregion
 //#region src/lint/rules/c6-tomatch-extension.ts
-const TEST_FILE$8 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$10 = /\.test\.[cm]?[jt]sx?$/u;
 /** Does the expect(…) subject chain contain a `.directory(…)` call? */
 function subjectIsDirectory(toMatchCallee) {
 	const expectCall = toMatchCallee.object;
@@ -2184,7 +2043,7 @@ function subjectIsDirectory(toMatchCallee) {
 const c6ToMatchExtension = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$8.test(file) || !segments(file).includes("specs")) return {};
+		if (!TEST_FILE$10.test(file) || !segments(file).includes("specs")) return {};
 		return { CallExpression(node) {
 			const callee = node.callee;
 			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
@@ -2209,7 +2068,7 @@ const c6ToMatchExtension = {
 };
 //#endregion
 //#region src/lint/rules/c7-seeds-sql-only.ts
-const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/u;
 /**
 * CONVENTIONS C7 — `.seed()` carries DATABASE state only: `_seeds/` contains
 * nothing but `*.sql` fragments. File state goes through `.fixture()`; there
@@ -2219,7 +2078,7 @@ const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/;
 const c7SeedsSqlOnly = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$7.test(file) || !segments(file).includes("specs")) return {};
+		if (!TEST_FILE$9.test(file) || !segments(file).includes("specs")) return {};
 		return { Program(node) {
 			const seedsDir = (0, node_path.join)((0, node_path.dirname)(file), GROUND_SEEDS);
 			for (const entry of listDirectory(seedsDir) ?? []) if (!entry.endsWith(".sql")) context.report({
@@ -2237,7 +2096,7 @@ const c7SeedsSqlOnly = {
 };
 //#endregion
 //#region src/lint/rules/c8-referenced-fixture-exists.ts
-const TEST_FILE$6 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$8 = /\.test\.[cm]?[jt]sx?$/u;
 /** The ground directory each fixture-referencing verb reads from. */
 const VERB_ROOTS = {
 	request: GROUND_REQUESTS,
@@ -2270,7 +2129,7 @@ const c8ReferencedFixtureExists = {
 	create(context) {
 		const file = context.physicalFilename;
 		const anchor = specsAnchor(file);
-		if (!TEST_FILE$6.test(file) || anchor === void 0) return {};
+		if (!TEST_FILE$8.test(file) || anchor === void 0) return {};
 		const featureDir = (0, node_path.dirname)(file);
 		return { CallExpression(node) {
 			const callee = node.callee;
@@ -2280,7 +2139,7 @@ const c8ReferencedFixtureExists = {
 			if (verb === "fixture") {
 				const value = stringValue(args[0]);
 				if (value === void 0 || !looksLikePath(value)) return;
-				const target = resolveFixture(value.replace(/\/+$/, ""), featureDir, anchor.directory);
+				const target = resolveFixture(value.replace(/\/+$/u, ""), featureDir, anchor.directory);
 				if (target !== void 0 && !isFile(target) && !isDirectory(target)) context.report({
 					data: {
 						path: value,
@@ -2295,7 +2154,7 @@ const c8ReferencedFixtureExists = {
 			if (root === void 0) return;
 			const value = stringValue(args[0]);
 			if (value === void 0 || !looksLikePath(value)) return;
-			const target = (0, node_path.join)(featureDir, root, value.replace(/\/+$/, ""));
+			const target = (0, node_path.join)(featureDir, root, value.replace(/\/+$/u, ""));
 			if (!(verb === "toMatch" ? isFile(target) || isDirectory(target) : isFile(target))) context.report({
 				data: {
 					path: `${root}/${value}`,
@@ -2313,231 +2172,142 @@ const c8ReferencedFixtureExists = {
 	}
 };
 //#endregion
-//#region src/lint/rules/d12w-response-body-probe.ts
-/** A test reading the response body this many times (or more) is a cluster. */
-const DEFAULT_THRESHOLD = 3;
-/** Is `node` the `x.response.body` member access itself? */
-function isResponseBody(node) {
-	if (node.type !== "MemberExpression" || memberPropertyName(node) !== "body") return false;
-	const object = node.object;
-	return object !== void 0 && memberPropertyName(object) === "response";
-}
-/** Peel `await`, `as T`, and `!` off an initializer to reach its core expression. */
-function unwrap(node) {
-	let current = node ?? void 0;
-	while (current != null) if (current.type === "AwaitExpression") current = current.argument ?? void 0;
-	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression") current = current.expression ?? void 0;
-	else if (current.type === "ParenthesizedExpression") current = current.expression ?? void 0;
-	else return current;
-}
+//#region src/lint/rules/c10-contracts-boundary.ts
+/** A specifier reaching into a provider folder — the internal half of contracts/. */
+const INTERNAL_UNIT = /(?:^|\/)contracts\/(?:anthropic|http|openai)\//u;
 /**
-* CONVENTIONS D12 (warning) — a full-response golden is the norm for API
-* assertions (the D11 boundary, mechanized). A test that accumulates a CLUSTER
-* of raw body probes — reading `.response.body` (or a variable cast from it)
-* `threshold`+ times in one test callback — should collapse into one golden:
-* `expect(result.response).toMatch('case.http')`. One or two probes stay silent
-* (a legitimate scalpel: absence, a single-field delta, third-party output).
-*
-* A probe is a body-rooted read: a direct `.response.body` use, or a field
-* access on the local binding a `const body = result.response.body as {…}`
-* introduces. The count is the same threshold the golden transformation applies.
+* CONVENTIONS C10 — the contracts boundary. A feature's `contracts/` folder has
+* a PUBLIC half (`*.contracts.ts` facades: the default export is the world, the
+* named exports are its scenarios) and an INTERNAL half (the `http/`, `openai/`
+* and `anthropic/` unit contracts the facades compose). Outside `contracts/`,
+* importing a unit is an error — a test routes through the facade, so a
+* scenario is named once, next to the world it derives from.
 */
-const d12wResponseBodyProbe = {
+const c10ContractsBoundary = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		const threshold = context.options[0]?.threshold ?? DEFAULT_THRESHOLD;
-		return { CallExpression(node) {
-			if (!isTestCallee(node.callee)) return;
-			const callback = findTestCallback(node.arguments ?? []);
-			if (callback === void 0) return;
-			const aliases = /* @__PURE__ */ new Set();
-			let responseBodyNodes = 0;
-			walk(callback, (inner) => {
-				if (isResponseBody(inner)) responseBodyNodes++;
-				if (inner.type === "VariableDeclarator") {
-					const init = unwrap(inner.init);
-					const id = inner.id;
-					if (init !== void 0 && isResponseBody(init) && id?.type === "Identifier") aliases.add(id.name);
-				}
-			});
-			let aliasReads = 0;
-			walk(callback, (inner) => {
-				if (inner.type !== "MemberExpression") return;
-				const object = inner.object;
-				if (object?.type === "Identifier" && aliases.has(object.name)) aliasReads++;
-			});
-			const probes = responseBodyNodes - aliases.size + aliasReads;
-			if (probes >= threshold) context.report({
-				data: { count: String(probes) },
-				messageId: "bodyProbeCluster",
+		const parts = segments(context.physicalFilename);
+		if (!parts.includes("specs")) return {};
+		if (parts.slice(0, -1).includes("contracts")) return {};
+		return importSourceVisitor(({ node, source }) => {
+			if (INTERNAL_UNIT.test(source)) context.report({
+				data: { source },
+				messageId: "internal",
 				node
 			});
-		} };
+		});
 	},
 	meta: {
-		docs: RULE_DOCS["d12w-response-body-probe"],
-		defaultOptions: [{ threshold: DEFAULT_THRESHOLD }],
-		messages: { bodyProbeCluster: "{{count}} body probes in one test — this wants a full golden: expect(result.response).toMatch('x.http') (D12 — see docs/13-linting.md)." },
-		schema: [{
-			additionalProperties: false,
-			properties: { threshold: {
-				minimum: 1,
-				type: "integer"
-			} },
-			type: "object"
-		}],
-		type: "suggestion"
+		docs: RULE_DOCS["c10-contracts-boundary"],
+		messages: { internal: "Import \"{{source}}\" reaches into a provider folder — only contracts/*.contracts.ts is importable from a test; add a named scenario export there instead (C10 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/d13w-unfrozen-negative-fixture.ts
-/**
-* Does `arguments[1]` of a `toMatch(name, options)` call carry `{ frozen: true }`?
-* A frozen fixture opts out of update-mode rewriting, so it is exempt.
-*/
-function hasFrozenOption(args) {
-	const options = args[1];
-	if (options === void 0 || options.type !== "ObjectExpression") return false;
-	const value = findProperty(options, "frozen")?.value;
-	return value?.type === "Literal" && value.value === true;
-}
-/**
-* Is this `toMatch(…)` call nested inside a WRAPPING `expect(…)` — the shape of a
-* negative assertion (`expect(() => …toMatch(…)).toThrow()` or
-* `expect(…toMatch(…)).rejects.toThrow()`)? The subject's own `expect(x)` is the
-* member OBJECT of `.toMatch` (a descendant), never an ancestor, so a positive
-* `expect(x).toMatch('f')` never trips this. The walk stays inside the current
-* expression: it stops at the first statement boundary or non-`expect` call, so
-* a `toMatch` merely written inside `inUpdateMode(() => …)` is NOT flagged.
-*/
-const TRANSPARENT_ANCESTORS = /* @__PURE__ */ new Set([
-	"ArrowFunctionExpression",
-	"AwaitExpression",
-	"ChainExpression",
-	"MemberExpression",
-	"ParenthesizedExpression",
-	"TSAsExpression",
-	"TSNonNullExpression"
-]);
-function isWrappedInExpect(node) {
-	let current = node.parent;
-	while (current !== void 0) {
-		if (current.type === "CallExpression") {
-			const callee = current.callee;
-			return callee?.type === "Identifier" && callee.name === "expect";
-		}
-		if (!TRANSPARENT_ANCESTORS.has(current.type)) return false;
-		current = current.parent;
-	}
-	return false;
+//#region src/lint/rules/c11-contract-data-pairing.ts
+const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/u;
+/** The provider folders that may carry data files. */
+const PROVIDERS = [
+	"anthropic",
+	"http",
+	"openai"
+];
+/** Data files: served payloads and matched inputs, both owned by a contract. */
+const DATA_SUFFIXES = [".request.ts", ".response.json"];
+/** The owning contract of a data file: its name up to the FIRST dot, `.ts`. */
+function ownerOf(entry) {
+	return `${entry.slice(0, entry.indexOf("."))}.ts`;
 }
 /**
-* CONVENTIONS D13 (warning) — a `toMatch` whose failure is the behaviour under
-* test (wrapped in `expect(() => …).toThrow()` or `expect(…).rejects.toThrow()`)
-* asserts a DELIBERATELY-WRONG or MISSING fixture. Under `TEST_UPDATE=1` an
-* unfrozen fixture is silently rewritten with the actual output — the matcher
-* writes instead of throwing — which destroys the negative case (the assertion
-* then no longer throws). Pass `{ frozen: true }` so the fixture is never
-* rewritten and the mismatch/error still throws in update mode.
-*
-* The structural signal is precise for the wrapped forms; a `toMatch` routed
-* through a helper that owns the try/catch (`catchMessage(() => …toMatch(…))`)
-* is out of static reach — see the D13 process note for that residue.
+* CONVENTIONS C11 — data is owned by a contract. Inside a provider folder every
+* `*.response.json` (served payload) and `*.request.ts` (matched prompt/body)
+* pairs with the sibling `<stem>.ts` that serves it, where the stem is the name
+* up to the FIRST dot: `events.fr.response.json` belongs to `events.ts`. A data
+* file with no owner is dead weight no test can reach — reported on the feature's
+* test file, since oxlint never visits a `.json`.
 */
-const d13wUnfrozenNegativeFixture = {
+const c11ContractDataPairing = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		return { CallExpression(node) {
-			const callee = node.callee;
-			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
-			if (!isWrappedInExpect(node)) return;
-			if (hasFrozenOption(node.arguments ?? [])) return;
-			context.report({
-				messageId: "unfrozenNegativeFixture",
-				node
-			});
+		const file = context.physicalFilename;
+		if (!TEST_FILE$7.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const contractsDir = (0, node_path.join)((0, node_path.dirname)(file), "contracts");
+			for (const provider of PROVIDERS) {
+				const entries = listDirectory((0, node_path.join)(contractsDir, provider));
+				if (entries === null) continue;
+				const present = new Set(entries);
+				for (const entry of entries) {
+					if (!DATA_SUFFIXES.some((suffix) => entry.endsWith(suffix))) continue;
+					const owner = ownerOf(entry);
+					if (!present.has(owner)) context.report({
+						data: {
+							entry,
+							owner,
+							provider
+						},
+						messageId: "orphan",
+						node
+					});
+				}
+			}
 		} };
 	},
 	meta: {
-		docs: RULE_DOCS["d13w-unfrozen-negative-fixture"],
-		messages: { unfrozenNegativeFixture: "This toMatch asserts a mismatch (wrapped in expect(…).toThrow/.rejects) — pass { frozen: true } so TEST_UPDATE=1 never overwrites the deliberately-wrong fixture (D13 — see docs/13-linting.md)." },
-		type: "suggestion"
+		docs: RULE_DOCS["c11-contract-data-pairing"],
+		messages: { orphan: "contracts/{{provider}}/{{entry}} has no owning contract — data pairs with the sibling {{owner}} (stem = name up to the first dot) (C11 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/d15w-status-only-probe.ts
-/** An HTTP status code lives in this range — the numeric-literal gate. */
-const MIN_STATUS = 100;
-const MAX_STATUS = 599;
-/** Matchers that pin a single value — the shape of a status probe. */
-const EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual"]);
-/** Is `node` an `expect(…)` call (bare `expect` identifier callee)? */
-function isExpectCall(node) {
-	if (node?.type !== "CallExpression") return false;
-	const callee = node.callee;
-	return callee?.type === "Identifier" && callee.name === "expect";
-}
-/** Is `node` a numeric literal in the HTTP status range (100–599)? */
-function isStatusLiteral(node) {
-	if (node?.type !== "Literal" || typeof node.value !== "number") return false;
-	const value = node.value;
-	return Number.isInteger(value) && value >= MIN_STATUS && value <= MAX_STATUS;
-}
-/**
-* Is `node` a status probe — `expect(X.status).toBe(N)` / `.toEqual(N)` where
-* `X.status` is any `.status` member access and `N` is a numeric literal in the
-* HTTP status range? The numeric-literal gate keeps container-status STRINGS
-* (`expect(neo.status).toBe('running')`) out.
-*/
-function isStatusProbe(node) {
-	if (node.type !== "CallExpression") return false;
-	const callee = node.callee;
-	if (callee?.type !== "MemberExpression") return false;
-	const matcher = memberPropertyName(callee);
-	if (matcher === void 0 || !EQUALITY_MATCHERS.has(matcher)) return false;
-	const expectCall = callee.object;
-	if (!isExpectCall(expectCall)) return false;
-	const subject = (expectCall?.arguments ?? [])[0];
-	if (subject?.type !== "MemberExpression" || memberPropertyName(subject) !== "status") return false;
-	const expected = (node.arguments ?? [])[0];
-	return isStatusLiteral(expected);
-}
+//#region src/lint/rules/c13-underscored-ground.ts
+const TEST_FILE$6 = /\.test\.[cm]?[jt]sx?$/u;
 /**
-* CONVENTIONS D11/D15 (warning) — a spec test whose ONLY assertions are HTTP
-* status probes (`expect(X.status).toBe(N)` / `.toEqual(N)`, N a numeric literal
-* 100–599) throws away the full-response golden. Pin the whole response instead:
-* `expect(result.response).toMatch('case.http')`.
+* CONVENTIONS C13 — the ground of a spec carries a leading underscore. A
+* directory named `fixtures/`, `expected/`, `requests/` or `seeds/` under
+* `specs/` is a pre-14 name: since `@jterrazz/test` 14.0.0 the four are
+* `_fixtures/`, `_expected/`, `_requests/` and `_seeds/`, with no compatibility
+* fallback.
 *
-* This complements d12w (which needs a CLUSTER of ≥3 body probes): the lone
-* `expect(result.status).toBe(422)` as a test's sole assertion falls below that
-* threshold yet still hides everything the response carries. The rule fires only
-* when EVERY `expect(…)` in the callback is a status probe — a status probe
-* sitting NEXT TO a real assertion (a golden, `toMatchRows`, `toContain`, …) is
-* the legitimate scalpel and stays silent.
+* The catch this rule exists for: a consumer that upgrades and keeps the old
+* names loses nothing loudly. Every resolver — `.fixture()`, `.seed()`,
+* `.request()`, `toMatch()` — looks under the underscored name, finds nothing,
+* and the tree becomes invisible rather than wrong. The failure that follows is
+* "fixture does not exist" on every spec at once, one step removed from the
+* cause; this rule states the cause and the rename.
+*
+* Anchored on the feature's visited test file, exactly as C2/C7/C11 are: the
+* spec's own sibling directories are probed, plus the `$FIXTURES` pool at the
+* nearest specs root. A DOMAIN folder named after the ground it holds
+* (`specs/api/requests/_requests/`) is never a probe target — only what sits
+* beside a spec is.
 */
-const d15wStatusOnlyProbe = {
+const c13UnderscoredGround = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		return { CallExpression(node) {
-			if (!isTestCallee(node.callee)) return;
-			const callback = findTestCallback(node.arguments ?? []);
-			if (callback === void 0) return;
-			let expectCalls = 0;
-			let statusProbes = 0;
-			walk(callback, (inner) => {
-				if (isExpectCall(inner)) expectCalls++;
-				if (isStatusProbe(inner)) statusProbes++;
-			});
-			if (expectCalls >= 1 && statusProbes === expectCalls) context.report({
-				messageId: "statusOnlyProbe",
-				node
-			});
+		const file = context.physicalFilename;
+		const anchor = specsAnchor(file);
+		if (!TEST_FILE$6.test(file) || anchor === void 0) return {};
+		return { Program(node) {
+			const seen = /* @__PURE__ */ new Set();
+			const probe = (parent, legacy) => {
+				const path = (0, node_path.join)(parent, legacy);
+				if (seen.has(path) || !isDirectory(path)) return;
+				seen.add(path);
+				context.report({
+					data: {
+						ground: RENAMED_GROUND_DIRS[legacy] ?? legacy,
+						legacy
+					},
+					messageId: "notUnderscored",
+					node
+				});
+			};
+			for (const legacy of Object.keys(RENAMED_GROUND_DIRS)) probe((0, node_path.dirname)(file), legacy);
+			probe(anchor.directory, "fixtures");
 		} };
 	},
 	meta: {
-		docs: RULE_DOCS["d15w-status-only-probe"],
-		messages: { statusOnlyProbe: "The test's only assertion(s) are status probes — pin the full response: expect(result.response).toMatch('case.http') (D11 — see docs/13-linting.md)." },
-		type: "suggestion"
+		docs: RULE_DOCS["c13-underscored-ground"],
+		messages: { notUnderscored: "The directory \"{{legacy}}/\" is a pre-14 ground name — rename it to \"{{ground}}/\" (`git mv {{legacy}} {{ground}}`). What a spec stands on carries the underscore; a spec's own folder never does, and no resolver reads the un-underscored name (C13 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
@@ -2673,7 +2443,7 @@ const KNOWN_TOKEN_LITERAL = new RegExp(`^\\{\\{(?:${[
 	"url",
 	"uuid",
 	"workdir"
-].join("|")})(?:#[\\w.-]+)?\\}\\}$`);
+].join("|")})(?:#[\\w.-]+)?\\}\\}$`, "u");
 /**
 * Is this function a pure chain of `.replace(…, '{{token}}')` normalisations?
 * Accepts an arrow with an expression body or a single-return body whose
@@ -2685,8 +2455,9 @@ function isTokenEquivalentTransform(fn) {
 	let expression = fn.body;
 	if (expression?.type === "BlockStatement") {
 		const statements = expression.body ?? [];
-		if (statements.length !== 1 || statements[0].type !== "ReturnStatement") return false;
-		expression = statements[0].argument;
+		const [only] = statements;
+		if (statements.length !== 1 || only?.type !== "ReturnStatement") return false;
+		expression = only.argument;
 	}
 	let sawReplace = false;
 	while (expression?.type === "CallExpression") {
@@ -2762,9 +2533,9 @@ const d8wTextBypass = {
 };
 //#endregion
 //#region src/lint/rules/d9w-single-use-ref.ts
-const TEST_FILE$5 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$5 = /\.test\.[cm]?[jt]sx?$/u;
 /** A captured-ref token: `{{kind#ref}}`. Captures the ref name. */
-const REF_TOKEN = /\{\{[A-Za-z][A-Za-z0-9]*#(?<ref>[\w.-]+)\}\}/g;
+const REF_TOKEN = /\{\{[A-Za-z][A-Za-z0-9]*#(?<ref>[\w.-]+)\}\}/gu;
 /** Is this call `match.ref(...)`? */
 function isMatchRef(node) {
 	const callee = node.callee;
@@ -2819,7 +2590,7 @@ const d9wSingleUseRef = {
 				if (memberPropertyName(node.callee) === "toMatch") {
 					const name = stringValue(node.arguments?.[0]);
 					if (name !== void 0) {
-						const target = (0, node_path.join)(featureDir, GROUND_EXPECTED, name.replace(/\/+$/, ""));
+						const target = (0, node_path.join)(featureDir, GROUND_EXPECTED, name.replace(/\/+$/u, ""));
 						for (const ref of refsInFixture(target)) {
 							bump(ref);
 							if (!fixtureNodes.has(ref)) fixtureNodes.set(ref, node);
@@ -2844,6 +2615,234 @@ const d9wSingleUseRef = {
 	}
 };
 //#endregion
+//#region src/lint/rules/d12w-response-body-probe.ts
+/** A test reading the response body this many times (or more) is a cluster. */
+const DEFAULT_THRESHOLD = 3;
+/** Is `node` the `x.response.body` member access itself? */
+function isResponseBody(node) {
+	if (node.type !== "MemberExpression" || memberPropertyName(node) !== "body") return false;
+	const object = node.object;
+	return object !== void 0 && memberPropertyName(object) === "response";
+}
+/** Peel `await`, `as T`, and `!` off an initializer to reach its core expression. */
+function unwrap(node) {
+	let current = node ?? void 0;
+	while (current != null) if (current.type === "AwaitExpression") current = current.argument ?? void 0;
+	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression") current = current.expression ?? void 0;
+	else if (current.type === "ParenthesizedExpression") current = current.expression ?? void 0;
+	else return current;
+}
+/**
+* CONVENTIONS D12 (warning) — a full-response golden is the norm for API
+* assertions (the D11 boundary, mechanized). A test that accumulates a CLUSTER
+* of raw body probes — reading `.response.body` (or a variable cast from it)
+* `threshold`+ times in one test callback — should collapse into one golden:
+* `expect(result.response).toMatch('case.http')`. One or two probes stay silent
+* (a legitimate scalpel: absence, a single-field delta, third-party output).
+*
+* A probe is a body-rooted read: a direct `.response.body` use, or a field
+* access on the local binding a `const body = result.response.body as {…}`
+* introduces. The count is the same threshold the golden transformation applies.
+*/
+const d12wResponseBodyProbe = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		const threshold = context.options[0]?.threshold ?? DEFAULT_THRESHOLD;
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			const aliases = /* @__PURE__ */ new Set();
+			let responseBodyNodes = 0;
+			walk(callback, (inner) => {
+				if (isResponseBody(inner)) responseBodyNodes++;
+				if (inner.type === "VariableDeclarator") {
+					const init = unwrap(inner.init);
+					const id = inner.id;
+					if (init !== void 0 && isResponseBody(init) && id?.type === "Identifier") aliases.add(id.name);
+				}
+			});
+			let aliasReads = 0;
+			walk(callback, (inner) => {
+				if (inner.type !== "MemberExpression") return;
+				const object = inner.object;
+				if (object?.type === "Identifier" && aliases.has(object.name)) aliasReads++;
+			});
+			const probes = responseBodyNodes - aliases.size + aliasReads;
+			if (probes >= threshold) context.report({
+				data: { count: String(probes) },
+				messageId: "bodyProbeCluster",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d12w-response-body-probe"],
+		defaultOptions: [{ threshold: DEFAULT_THRESHOLD }],
+		messages: { bodyProbeCluster: "{{count}} body probes in one test — this wants a full golden: expect(result.response).toMatch('x.http') (D12 — see docs/13-linting.md)." },
+		schema: [{
+			additionalProperties: false,
+			properties: { threshold: {
+				minimum: 1,
+				type: "integer"
+			} },
+			type: "object"
+		}],
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d13w-unfrozen-negative-fixture.ts
+/**
+* Does `arguments[1]` of a `toMatch(name, options)` call carry `{ frozen: true }`?
+* A frozen fixture opts out of update-mode rewriting, so it is exempt.
+*/
+function hasFrozenOption(args) {
+	const options = args[1];
+	if (options === void 0 || options.type !== "ObjectExpression") return false;
+	const value = findProperty(options, "frozen")?.value;
+	return value?.type === "Literal" && value.value === true;
+}
+/**
+* Is this `toMatch(…)` call nested inside a WRAPPING `expect(…)` — the shape of a
+* negative assertion (`expect(() => …toMatch(…)).toThrow()` or
+* `expect(…toMatch(…)).rejects.toThrow()`)? The subject's own `expect(x)` is the
+* member OBJECT of `.toMatch` (a descendant), never an ancestor, so a positive
+* `expect(x).toMatch('f')` never trips this. The walk stays inside the current
+* expression: it stops at the first statement boundary or non-`expect` call, so
+* a `toMatch` merely written inside `inUpdateMode(() => …)` is NOT flagged.
+*/
+const TRANSPARENT_ANCESTORS = /* @__PURE__ */ new Set([
+	"ArrowFunctionExpression",
+	"AwaitExpression",
+	"ChainExpression",
+	"MemberExpression",
+	"ParenthesizedExpression",
+	"TSAsExpression",
+	"TSNonNullExpression"
+]);
+function isWrappedInExpect(node) {
+	let current = node.parent;
+	while (current !== void 0) {
+		if (current.type === "CallExpression") {
+			const callee = current.callee;
+			return callee?.type === "Identifier" && callee.name === "expect";
+		}
+		if (!TRANSPARENT_ANCESTORS.has(current.type)) return false;
+		current = current.parent;
+	}
+	return false;
+}
+/**
+* CONVENTIONS D13 (warning) — a `toMatch` whose failure is the behaviour under
+* test (wrapped in `expect(() => …).toThrow()` or `expect(…).rejects.toThrow()`)
+* asserts a DELIBERATELY-WRONG or MISSING fixture. Under `TEST_UPDATE=1` an
+* unfrozen fixture is silently rewritten with the actual output — the matcher
+* writes instead of throwing — which destroys the negative case (the assertion
+* then no longer throws). Pass `{ frozen: true }` so the fixture is never
+* rewritten and the mismatch/error still throws in update mode.
+*
+* The structural signal is precise for the wrapped forms; a `toMatch` routed
+* through a helper that owns the try/catch (`catchMessage(() => …toMatch(…))`)
+* is out of static reach — see the D13 process note for that residue.
+*/
+const d13wUnfrozenNegativeFixture = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
+			if (!isWrappedInExpect(node)) return;
+			if (hasFrozenOption(node.arguments ?? [])) return;
+			context.report({
+				messageId: "unfrozenNegativeFixture",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d13w-unfrozen-negative-fixture"],
+		messages: { unfrozenNegativeFixture: "This toMatch asserts a mismatch (wrapped in expect(…).toThrow/.rejects) — pass { frozen: true } so TEST_UPDATE=1 never overwrites the deliberately-wrong fixture (D13 — see docs/13-linting.md)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d15w-status-only-probe.ts
+/** An HTTP status code lives in this range — the numeric-literal gate. */
+const MIN_STATUS = 100;
+const MAX_STATUS = 599;
+/** Matchers that pin a single value — the shape of a status probe. */
+const EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual"]);
+/** Is `node` an `expect(…)` call (bare `expect` identifier callee)? */
+function isExpectCall(node) {
+	if (node?.type !== "CallExpression") return false;
+	const callee = node.callee;
+	return callee?.type === "Identifier" && callee.name === "expect";
+}
+/** Is `node` a numeric literal in the HTTP status range (100–599)? */
+function isStatusLiteral(node) {
+	if (node?.type !== "Literal" || typeof node.value !== "number") return false;
+	const { value } = node;
+	return Number.isInteger(value) && value >= MIN_STATUS && value <= MAX_STATUS;
+}
+/**
+* Is `node` a status probe — `expect(X.status).toBe(N)` / `.toEqual(N)` where
+* `X.status` is any `.status` member access and `N` is a numeric literal in the
+* HTTP status range? The numeric-literal gate keeps container-status STRINGS
+* (`expect(neo.status).toBe('running')`) out.
+*/
+function isStatusProbe(node) {
+	if (node.type !== "CallExpression") return false;
+	const callee = node.callee;
+	if (callee?.type !== "MemberExpression") return false;
+	const matcher = memberPropertyName(callee);
+	if (matcher === void 0 || !EQUALITY_MATCHERS.has(matcher)) return false;
+	const expectCall = callee.object;
+	if (!isExpectCall(expectCall)) return false;
+	const subject = (expectCall?.arguments ?? [])[0];
+	if (subject?.type !== "MemberExpression" || memberPropertyName(subject) !== "status") return false;
+	const expected = (node.arguments ?? [])[0];
+	return isStatusLiteral(expected);
+}
+/**
+* CONVENTIONS D11/D15 (warning) — a spec test whose ONLY assertions are HTTP
+* status probes (`expect(X.status).toBe(N)` / `.toEqual(N)`, N a numeric literal
+* 100–599) throws away the full-response golden. Pin the whole response instead:
+* `expect(result.response).toMatch('case.http')`.
+*
+* This complements d12w (which needs a CLUSTER of ≥3 body probes): the lone
+* `expect(result.status).toBe(422)` as a test's sole assertion falls below that
+* threshold yet still hides everything the response carries. The rule fires only
+* when EVERY `expect(…)` in the callback is a status probe — a status probe
+* sitting NEXT TO a real assertion (a golden, `toMatchRows`, `toContain`, …) is
+* the legitimate scalpel and stays silent.
+*/
+const d15wStatusOnlyProbe = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			let expectCalls = 0;
+			let statusProbes = 0;
+			walk(callback, (inner) => {
+				if (isExpectCall(inner)) expectCalls++;
+				if (isStatusProbe(inner)) statusProbes++;
+			});
+			if (expectCalls >= 1 && statusProbes === expectCalls) context.report({
+				messageId: "statusOnlyProbe",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d15w-status-only-probe"],
+		messages: { statusOnlyProbe: "The test's only assertion(s) are status probes — pin the full response: expect(result.response).toMatch('case.http') (D11 — see docs/13-linting.md)." },
+		type: "suggestion"
+	}
+};
+//#endregion
 //#region src/lint/package-exports.ts
 /**
 * The subpaths this package actually publishes, read from its OWN
@@ -2897,7 +2896,7 @@ function findOwnManifest(startDir) {
 */
 function declaredSubpaths(startDir) {
 	if (startDir === void 0 && cached !== null) return cached;
-	const exports = findOwnManifest(startDir ?? (0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href)))?.exports;
+	const exports = findOwnManifest(startDir ?? __dirname)?.exports;
 	const subpaths = exports !== null && typeof exports === "object" ? Object.keys(exports).filter((key) => key.startsWith("./") && key !== ".").map((key) => `${PACKAGE$2}/${key.slice(2)}`).sort() : [];
 	if (startDir === void 0) cached = subpaths;
 	return subpaths;
@@ -2939,10 +2938,10 @@ const f1NoSubpathImport = {
 };
 //#endregion
 //#region src/lint/rules/f2-no-test-imports-in-prod.ts
-const TEST_FILE$4 = /\.(?:test|fixtures|specification)\.[cm]?[jt]sx?$/;
-const CONFIG_FILE = /(?:^|[/\\])[\w.-]*\.config\.[cm]?[jt]s$/;
-const TEST_IMPORT$1 = /\.(?:test|fixtures)(?:\.[cm]?[jt]sx?)?$/;
-const TOOL_SUBPATH$1 = "@jterrazz/test/oxlint";
+const TEST_FILE$4 = /\.(?:test|fixtures|specification)\.[cm]?[jt]sx?$/u;
+const CONFIG_FILE = /(?:^|[/\\])[\w.-]*\.config\.[cm]?[jt]s$/u;
+const TEST_IMPORT$1 = /\.(?:test|fixtures)(?:\.[cm]?[jt]sx?)?$/u;
+const TOOL_SUBPATH = "@jterrazz/test/oxlint";
 /**
 * CONVENTIONS F2 — production code never imports a test artefact. In a
 * non-test file (not `*.test.ts` / `*.fixtures.ts` / `*.specification.ts`,
@@ -2961,7 +2960,7 @@ const f2NoTestImportsInProd = {
 		const file = context.filename;
 		if (TEST_FILE$4.test(file) || CONFIG_FILE.test(file) || isUnderSpecs(file)) return {};
 		return { ...importSourceVisitor(({ node, source }) => {
-			if (source === TOOL_SUBPATH$1) return;
+			if (source === TOOL_SUBPATH) return;
 			if (source === "vitest" || source.startsWith("vitest/")) context.report({
 				data: { source },
 				messageId: "testImport",
@@ -2988,7 +2987,6 @@ const f2NoTestImportsInProd = {
 //#endregion
 //#region src/lint/rules/f3-specs-public-entry.ts
 const PACKAGE = "@jterrazz/test";
-const TOOL_SUBPATH = "@jterrazz/test/oxlint";
 /**
 * The framework's own top-level `src/` layers. Deep-importing any of these from
 * a spec couples the spec to internals the public entry exists to hide. These
@@ -2998,20 +2996,27 @@ const TOOL_SUBPATH = "@jterrazz/test/oxlint";
 * `server: () => createApp()` importing `../../src/app.js`).
 */
 const FRAMEWORK_LAYERS = /* @__PURE__ */ new Set([
-	"core",
 	"integrations",
 	"lint",
+	"specification",
 	"vitest"
 ]);
 /**
 * CONVENTIONS F3 — from `specs/`, deep-importing the FRAMEWORK's internals is
 * forbidden: a relative path resolving inside the framework repo's
-* `src/{core,integrations,vitest,lint}/`, or any `@jterrazz/test/<subpath>`
-* other than the sanctioned tool-facing `@jterrazz/test/oxlint`. A consumer's
-* imports of its OWN app source are always allowed — that is the pattern.
+* `src/{specification,integrations,vitest,lint}/`, or a `@jterrazz/test/<subpath>`
+* the package does not publish. A consumer's imports of its OWN app source are
+* always allowed — that is the pattern.
+*
+* The exempt subpaths are not listed here: they are read from the package's own
+* `exports` map, the same source F1 uses. A published subpath IS the public
+* surface — reaching `@jterrazz/test/vitest` from a specs-tree `vitest.config.ts`
+* is the prescribed gesture, not a leak — so what a spec must not reach is what
+* the manifest never published. The root entry (`.`) is not a subpath and never
+* concerned this branch: `@jterrazz/test` is the public entry F3 points at.
 *
-* Distinct from F1 (which bans `@jterrazz/test/<subpath>` from any file): F3 is
-* the specs-specific guard that also reaches relative framework-internal paths.
+* Distinct from F1 (which judges the same specifiers from any file): F3 is the
+* specs-specific guard that also reaches relative framework-internal paths.
 * Documented exception: specs under `specs/integrations/` may deep-import the
 * integration module they cover (`src/integrations/**`).
 */
@@ -3019,12 +3024,17 @@ const f3SpecsPublicEntry = {
 	create(context) {
 		const anchor = specsAnchor(context.filename);
 		if (anchor === void 0) return {};
+		const published = new Set(declaredSubpaths());
+		const exempt = published.size === 0 ? "none" : [...published].join(", ");
 		const underIntegrations = anchor.relative[0] === "integrations";
 		return { ...importSourceVisitor(({ node, source }) => {
 			if (source.startsWith(`${PACKAGE}/`)) {
-				if (source === TOOL_SUBPATH) return;
+				if (published.has(source)) return;
 				context.report({
-					data: { source },
+					data: {
+						published: exempt,
+						source
+					},
 					messageId: "deepImport",
 					node
 				});
@@ -3032,11 +3042,14 @@ const f3SpecsPublicEntry = {
 			}
 			const marker = source.indexOf("/src/");
 			if (marker === -1 && !source.startsWith("src/")) return;
-			const layer = (marker === -1 ? source.slice(4) : source.slice(marker + 5)).split("/")[0];
+			const layer = (marker === -1 ? source.slice(4) : source.slice(marker + 5)).split("/")[0] ?? "";
 			if (!FRAMEWORK_LAYERS.has(layer)) return;
 			if (underIntegrations && layer === "integrations") return;
 			context.report({
-				data: { source },
+				data: {
+					published: exempt,
+					source
+				},
 				messageId: "deepImport",
 				node
 			});
@@ -3044,14 +3057,14 @@ const f3SpecsPublicEntry = {
 	},
 	meta: {
 		docs: RULE_DOCS["f3-specs-public-entry"],
-		messages: { deepImport: "specs/ must not deep-import framework internals — reach the framework via its public entry (@jterrazz/test, or src/index.js in this repo), not \"{{source}}\" (F3 — see docs/13-linting.md; only @jterrazz/test/oxlint, and src/integrations/** from specs/integrations/, are exempt)." },
+		messages: { deepImport: "specs/ must not deep-import framework internals — reach the framework via its public entry (@jterrazz/test, or src/index.js in this repo), not \"{{source}}\" (F3 — see docs/13-linting.md). Exempt: the published subpaths {{published}}, and src/integrations/** from specs/integrations/." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/f4-no-test-to-test-import.ts
-const TEST_FILE$3 = /\.test\.[cm]?[jt]sx?$/;
-const TEST_IMPORT = /\.test(?:\.[cm]?[jt]sx?)?$/;
+const TEST_FILE$3 = /\.test\.[cm]?[jt]sx?$/u;
+const TEST_IMPORT = /\.test(?:\.[cm]?[jt]sx?)?$/u;
 /**
 * CONVENTIONS F4 — a `*.test.ts` never imports another `*.test.ts`. Shared
 * test data belongs in a `*.fixtures.ts` neighbour (F5), shared runners in a
@@ -3076,8 +3089,8 @@ const f4NoTestToTestImport = {
 };
 //#endregion
 //#region src/lint/rules/f5-fixtures-only-from-tests.ts
-const TEST_FILE$2 = /\.test\.[cm]?[jt]sx?$/;
-const FIXTURES_IMPORT = /\.fixtures(?:\.[cm]?[jt]sx?)?$/;
+const TEST_FILE$2 = /\.test\.[cm]?[jt]sx?$/u;
+const FIXTURES_IMPORT = /\.fixtures(?:\.[cm]?[jt]sx?)?$/u;
 /**
 * CONVENTIONS F5 — a `*.fixtures.ts` module is only importable from
 * `*.test.ts` files. Any other importer (prod code, a specification file,
@@ -3102,7 +3115,7 @@ const f5FixturesOnlyFromTests = {
 };
 //#endregion
 //#region src/lint/rules/i1-layer-boundaries.ts
-const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/;
+const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/u;
 function matchesPackage(source, packages) {
 	return packages.some((name) => source === name || source.startsWith(`${name}/`));
 }
@@ -3114,7 +3127,7 @@ function pathInsideSrc(path) {
 }
 /** Strip a `.js`/`.ts`-style extension for exact-path comparison. */
 function withoutExtension(path) {
-	return path.replace(/\.[cm]?[jt]sx?$/, "");
+	return path.replace(/\.[cm]?[jt]sx?$/u, "");
 }
 /** Does `target` match one of the declared paths (prefix, or exact module)? */
 function matchesPath(target, patterns) {
@@ -3231,7 +3244,7 @@ const i1LayerBoundaries = {
 };
 //#endregion
 //#region src/lint/rules/i2-sibling-test-naming.ts
-const TEST_FILE$1 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$1 = /\.test\.[cm]?[jt]sx?$/u;
 /**
 * CONVENTIONS I2 — module tests are NEIGHBOURS: the test of `<file>.ts` is
 * `<file>.test.ts` next to it (Go's `foo_test.go` parity). Flags, on visited
@@ -3259,7 +3272,7 @@ const i2SiblingTestNaming = {
 						".js"
 					].map((extension) => file.replace(TEST_FILE$1, extension));
 					if (!neighbours.some(isFile)) context.report({
-						data: { expected: neighbours[0].split(/[/\\]/).at(-1) ?? "" },
+						data: { expected: neighbours[0]?.split(/[/\\]/u).at(-1) ?? "" },
 						messageId: "orphanTest",
 						node
 					});
@@ -3286,7 +3299,7 @@ const i2SiblingTestNaming = {
 };
 //#endregion
 //#region src/lint/rules/i4-no-vi-mock-in-src.ts
-const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE = /\.test\.[cm]?[jt]sx?$/u;
 const DATA_ASSET = new RegExp(`\\.(?:${[
 	"avif",
 	"bin",
@@ -3324,10 +3337,10 @@ const DATA_ASSET = new RegExp(`\\.(?:${[
 	"yaml",
 	"yml",
 	"zip"
-].join("|")})$`, "i");
+].join("|")})$`, "iu");
 /** A bundler suffix (`./payload.json?raw`, `./doc.md#frag`) is not part of the extension. */
 function withoutSuffix(source) {
-	return source.replace(/[?#].*$/, "");
+	return source.replace(/[?#].*$/u, "");
 }
 /**
 * CONVENTIONS I4 — in module tests under `src/`, mocks and data are CODE:
@@ -3567,7 +3580,7 @@ const plugin = {
 *
 *     'jterrazz/b5-await-using': ['error', { runners: ['dockerCli'] }]
 */
-const recommendedRules = Object.fromEntries(Object.keys(plugin.rules).map((rule) => [`jterrazz/${rule}`, /^\w+w-/.test(rule) ? "warn" : "error"]));
+const recommendedRules = Object.fromEntries(Object.keys(plugin.rules).map((rule) => [`jterrazz/${rule}`, /^\w+w-/u.test(rule) ? "warn" : "error"]));
 /**
 * The composable testing fragment — wire the plugin, enable the whole
 * catalogue, and ship the one override every strict consumer needs. Designed