@mintwork/honest-tests 0.0.0-stage → 0.1.1

package/dist/mutate/runner.js

@@ -0,0 +1,379 @@
+import { spawn } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { delimiter, dirname, extname, join, relative, resolve, sep } from 'node:path';
+import { adapterFor } from '../adapters/index.js';
+import { resolveTestScript, scopedTestCommand } from '../adapters/js/index.js';
+import { DEFAULT_IGNORED_DIRS, discoverTestFiles } from '../core/engine.js';
+export class MutationError extends Error {
+    output;
+    constructor(message, output = '') {
+        super(message);
+        this.output = output;
+    }
+}
+function findUp(start, name) {
+    let dir = start;
+    for (;;) {
+        const candidate = join(dir, name);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/** Nearest node_modules that holds installed packages (not just a `.vite` cache dir). */
+function findNodeModules(start) {
+    let dir = start;
+    for (;;) {
+        const candidate = join(dir, 'node_modules');
+        if (existsSync(candidate)) {
+            const entries = readdirSync(candidate).filter((e) => e !== '.vite' && e !== '.cache' && e !== '.vite-temp');
+            if (entries.length > 0)
+                return candidate;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/** Every `node_modules/.bin` from `start` upward, so `vitest`/`jest` resolve like they do under npm. */
+function binPaths(start) {
+    const out = [];
+    let dir = start;
+    for (;;) {
+        const bin = join(dir, 'node_modules', '.bin');
+        if (existsSync(bin))
+            out.push(bin);
+        const parent = dirname(dir);
+        if (parent === dir)
+            return out;
+        dir = parent;
+    }
+}
+function sourceFiles(dir, exts, out = []) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        const p = join(dir, e.name);
+        if (e.isDirectory()) {
+            if (!DEFAULT_IGNORED_DIRS.has(e.name))
+                sourceFiles(p, exts, out);
+        }
+        else if (e.isFile() && exts.includes(extname(e.name).toLowerCase()))
+            out.push(p);
+    }
+    return out;
+}
+/**
+ * Test files that import `target` directly or through other local modules
+ * (`test -> Page.jsx -> lib/format.js`). Direct-import-only selection misses
+ * tests that exercise the target through its callers, which shows up as
+ * false survivors.
+ */
+export function findRelatedTests(root, target, adapter) {
+    if (!adapter.localImports || !adapter.moduleId) {
+        return discoverTestFiles([root], root).filter((f) => adapter.testImportsTarget?.(f, readFileSync(f, 'utf8'), target));
+    }
+    const importers = new Map();
+    for (const file of sourceFiles(root, adapter.extensions)) {
+        let src;
+        try {
+            src = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const id of new Set(adapter.localImports(file, src)))
+            importers.set(id, [...(importers.get(id) ?? []), file]);
+    }
+    const tests = new Set();
+    const seen = new Set([adapter.moduleId(target)]);
+    const queue = [...seen];
+    while (queue.length) {
+        for (const file of importers.get(queue.shift()) ?? []) {
+            if (adapter.isTestFile(toPosix(file))) {
+                tests.add(file);
+                continue;
+            }
+            const id = adapter.moduleId(file);
+            if (!seen.has(id)) {
+                seen.add(id);
+                queue.push(id);
+            }
+        }
+    }
+    return [...tests].sort();
+}
+/** Nearest ancestor (or `root` itself) that is a pnpm/yarn/npm workspace root. */
+function workspaceRootOf(root) {
+    let dir = root;
+    for (;;) {
+        if (existsSync(join(dir, 'pnpm-workspace.yaml')))
+            return dir;
+        try {
+            const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+            if (pkg.workspaces)
+                return dir;
+        }
+        catch {
+            /* no package.json here */
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+const linkType = process.platform === 'win32' ? 'junction' : 'dir';
+function copyProject(from, to) {
+    cpSync(from, to, {
+        recursive: true,
+        filter: (src) => {
+            const rel = relative(from, src);
+            return !rel.split(sep).includes('node_modules') && rel.split(sep)[0] !== '.git';
+        },
+    });
+}
+/** Every node_modules directory under `dir` (not descending into them). */
+function nodeModulesDirs(dir, out = []) {
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        if (!e.isDirectory() || e.name === '.git')
+            continue;
+        const p = join(dir, e.name);
+        if (e.name === 'node_modules')
+            out.push(p);
+        else
+            nodeModulesDirs(p, out);
+    }
+    return out;
+}
+/**
+ * Copy the project into `tmp` and return the directory to run tests in.
+ *
+ * Plain packages: `tmp/` is the copy and `tmp/node_modules` links to the nearest installed node_modules.
+ * Workspace packages (`pkgs/core` in a pnpm/yarn/npm monorepo): the whole workspace is copied (without
+ * node_modules and .git) so root configs, tsconfig project references and sibling packages resolve,
+ * and every node_modules directory is linked back at the same relative spot.
+ */
+function prepareCopy(root, tmp) {
+    const ws = workspaceRootOf(root);
+    if (!ws || ws === root) {
+        copyProject(root, tmp);
+        const nm = findNodeModules(root);
+        if (nm)
+            symlinkSync(nm, join(tmp, 'node_modules'), linkType);
+        return tmp;
+    }
+    copyProject(ws, tmp);
+    for (const nm of nodeModulesDirs(ws)) {
+        const dest = join(tmp, relative(ws, nm));
+        if (existsSync(dest))
+            continue;
+        mkdirSync(dirname(dest), { recursive: true });
+        symlinkSync(nm, dest, linkType);
+    }
+    return join(tmp, relative(ws, root));
+}
+function toPosix(p) {
+    return p.split(sep).join('/');
+}
+function cleanEnv(extraPath) {
+    const env = {};
+    for (const [k, v] of Object.entries(process.env)) {
+        // Don't leak an outer vitest/jest worker context into the child run.
+        if (/^(VITEST|JEST_WORKER_ID|TINYPOOL|__VITEST)/.test(k))
+            continue;
+        env[k] = v;
+    }
+    const pathKey = Object.keys(env).find((k) => k.toUpperCase() === 'PATH') ?? 'PATH';
+    env[pathKey] = [...extraPath, env[pathKey] ?? ''].join(delimiter);
+    env.FORCE_COLOR = '0';
+    env.NO_COLOR = '1';
+    return env;
+}
+/** Test runs in flight. They run in their own process group, so Ctrl-C doesn't reach them by itself. */
+const running = new Set();
+function killTree(child) {
+    try {
+        if (child.pid && process.platform !== 'win32')
+            process.kill(-child.pid, 'SIGKILL');
+        else
+            child.kill('SIGKILL');
+    }
+    catch {
+        /* already gone */
+    }
+}
+/** Kill every in-flight test run (and its children). Used on Ctrl-C/SIGTERM before removing the copy. */
+export function killRunningTests() {
+    for (const child of running)
+        killTree(child);
+}
+function runCommand(command, cwd, timeoutMs, extraPath) {
+    return new Promise((resolvePromise) => {
+        const started = Date.now();
+        const child = spawn(command, {
+            cwd,
+            shell: true,
+            env: cleanEnv(extraPath),
+            detached: process.platform !== 'win32',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        running.add(child);
+        child.on('exit', () => running.delete(child));
+        // Keep the start (where runners print the actual error) and the end (the summary).
+        let head = '';
+        let tail = '';
+        let dropped = false;
+        const collect = (d) => {
+            const text = d.toString();
+            if (head.length < 6_000) {
+                const room = 6_000 - head.length;
+                head += text.slice(0, room);
+                tail += text.slice(room);
+            }
+            else
+                tail += text;
+            if (tail.length > 16_000) {
+                tail = tail.slice(-16_000);
+                dropped = true;
+            }
+        };
+        const output = () => (dropped ? `${head}\n…\n${tail}` : head + tail);
+        child.stdout?.on('data', collect);
+        child.stderr?.on('data', collect);
+        let timedOut = false;
+        const kill = () => killTree(child);
+        const timer = setTimeout(() => {
+            timedOut = true;
+            kill();
+        }, timeoutMs);
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            resolvePromise({ code, timedOut, output: output(), durationMs: Date.now() - started });
+        });
+        child.on('error', (err) => {
+            clearTimeout(timer);
+            resolvePromise({ code: 1, timedOut, output: output() + String(err), durationMs: Date.now() - started });
+        });
+    });
+}
+function shellQuote(s) {
+    return /^[\w./@:-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Mutation-test one source file.
+ *
+ * Safety: the project is copied to a fresh temp directory (node_modules is
+ * symlinked, never copied or written by us). Mutants are written only inside
+ * the copy, restored after every run, and the copy is deleted at the end —
+ * including on Ctrl-C. Your working tree is never modified.
+ */
+export async function mutate(opts) {
+    const cwd = resolve(opts.cwd ?? process.cwd());
+    const target = resolve(cwd, opts.target);
+    if (!existsSync(target))
+        throw new MutationError(`Target file not found: ${opts.target}`);
+    const adapter = adapterFor(target);
+    if (!adapter?.generateMutants)
+        throw new MutationError(`Mutation is not supported for ${opts.target} yet.`);
+    const pkg = opts.root ? join(resolve(cwd, opts.root), 'package.json') : findUp(dirname(target), 'package.json');
+    if (!pkg || !existsSync(pkg))
+        throw new MutationError(`Could not find a package.json above ${opts.target}; pass --root.`);
+    const root = dirname(pkg);
+    const relTarget = relative(root, target);
+    if (relTarget.startsWith('..'))
+        throw new MutationError(`Target ${opts.target} is outside project root ${root}.`);
+    // Which tests exercise this file?
+    const relatedTests = findRelatedTests(root, target, adapter).map((f) => toPosix(relative(root, f)));
+    let command = opts.testCmd ?? null;
+    if (command) {
+        command = command.replace('{files}', relatedTests.map(shellQuote).join(' '));
+    }
+    else {
+        command = adapter.defaultTestCommand?.(root) ?? null;
+        if (!command)
+            throw new MutationError('Could not determine how to run tests (no "test" script in package.json). Pass --test-cmd "<command>".');
+        command = scopedTestCommand(resolveTestScript(root), relatedTests.map(shellQuote)) ?? command;
+    }
+    const source = readFileSync(target, 'utf8');
+    const all = adapter.generateMutants(target, source);
+    const mutants = all.slice(0, opts.maxMutants ?? 100);
+    const sourceLines = source.split(/\r?\n/);
+    const tmp = mkdtempSync(join(tmpdir(), 'honest-tests-'));
+    const cleanup = () => rmSync(tmp, { recursive: true, force: true });
+    const onSignal = (sig) => {
+        killRunningTests();
+        cleanup();
+        process.kill(process.pid, sig);
+    };
+    process.once('SIGINT', onSignal);
+    process.once('SIGTERM', onSignal);
+    try {
+        const work = prepareCopy(root, tmp);
+        const tmpTarget = join(work, relTarget);
+        // Real bin dirs, not the symlinked copy: pnpm's .bin shims resolve paths relative to their own
+        // location, and from inside the temp dir `../../node_modules/.pnpm` points nowhere.
+        const extraPath = binPaths(root);
+        const baseline = await runCommand(command, work, opts.timeoutMs ?? 5 * 60_000, extraPath);
+        if (baseline.code !== 0) {
+            throw new MutationError(baseline.timedOut
+                ? `Test command timed out before any mutation (${command}). If it starts a watcher or needs services, pass --test-cmd "<command that runs once>".`
+                : `Tests fail before any mutation (exit ${baseline.code}). Fix them first — mutation results would be meaningless.`, baseline.output);
+        }
+        const timeoutMs = opts.timeoutMs ?? Math.max(10_000, baseline.durationMs * 4 + 5_000);
+        const results = [];
+        for (const m of mutants) {
+            let outcome;
+            try {
+                writeFileSync(tmpTarget, source.slice(0, m.start) + m.replacement + source.slice(m.end));
+                outcome = await runCommand(command, work, timeoutMs, extraPath);
+            }
+            finally {
+                writeFileSync(tmpTarget, source);
+            }
+            const status = outcome.timedOut ? 'timeout' : outcome.code === 0 ? 'survived' : 'killed';
+            const r = { ...m, file: toPosix(relative(cwd, target)), status, sourceLine: (sourceLines[m.line - 1] ?? '').trim(), durationMs: outcome.durationMs };
+            results.push(r);
+            opts.onProgress?.(results.length, mutants.length, r);
+        }
+        const killed = results.filter((r) => r.status === 'killed').length;
+        const timedOut = results.filter((r) => r.status === 'timeout').length;
+        const survived = results.filter((r) => r.status === 'survived').length;
+        return {
+            target: toPosix(relative(cwd, target)),
+            root: toPosix(relative(cwd, root)) || '.',
+            command,
+            relatedTests,
+            baselineMs: baseline.durationMs,
+            generated: all.length,
+            tested: results.length,
+            killed,
+            survived,
+            timedOut,
+            score: results.length ? Math.round(((killed + timedOut) / results.length) * 1000) / 10 : 100,
+            mutants: results,
+        };
+    }
+    finally {
+        process.removeListener('SIGINT', onSignal);
+        process.removeListener('SIGTERM', onSignal);
+        cleanup();
+    }
+}

package/dist/report/colors.d.ts

@@ -0,0 +1,11 @@
+export declare const c: {
+    bold: (s: string) => string;
+    dim: (s: string) => string;
+    red: (s: string) => string;
+    green: (s: string) => string;
+    yellow: (s: string) => string;
+    blue: (s: string) => string;
+    magenta: (s: string) => string;
+    cyan: (s: string) => string;
+    gray: (s: string) => string;
+};

package/dist/report/colors.js

@@ -0,0 +1,13 @@
+const enabled = !process.env.NO_COLOR && (process.env.FORCE_COLOR ? process.env.FORCE_COLOR !== '0' : !!process.stdout.isTTY);
+const wrap = (open, close) => (s) => (enabled ? `\x1b[${open}m${s}\x1b[${close}m` : s);
+export const c = {
+    bold: wrap(1, 22),
+    dim: wrap(2, 22),
+    red: wrap(31, 39),
+    green: wrap(32, 39),
+    yellow: wrap(33, 39),
+    blue: wrap(34, 39),
+    magenta: wrap(35, 39),
+    cyan: wrap(36, 39),
+    gray: wrap(90, 39),
+};

package/dist/report/human.d.ts

@@ -0,0 +1,6 @@
+import type { AuditResult } from '../core/engine.js';
+import type { MutationReport } from '../mutate/runner.js';
+export declare function formatAudit(r: AuditResult, opts?: {
+    verbose?: boolean;
+}): string;
+export declare function formatMutation(m: MutationReport): string;

package/dist/report/human.js

@@ -0,0 +1,79 @@
+import { c } from './colors.js';
+const SEV = {
+    error: (s) => c.red(s),
+    warning: (s) => c.yellow(s),
+    info: (s) => c.blue(s),
+};
+function plural(n, word) {
+    return `${n} ${word}${n === 1 ? '' : 's'}`;
+}
+export function formatAudit(r, opts = {}) {
+    const out = [];
+    let currentFile = '';
+    for (const f of r.findings) {
+        if (f.file !== currentFile) {
+            currentFile = f.file;
+            out.push('', c.bold(c.cyan(f.file)));
+        }
+        out.push(`  ${c.gray(`${f.line}:${f.column}`.padEnd(7))} ${SEV[f.severity](f.severity.padEnd(7))} ${f.message} ${c.dim(f.ruleId)}`);
+        out.push(`          ${c.gray('│')} ${c.dim(f.evidence)}`);
+        if (opts.verbose)
+            out.push(`          ${c.gray('└')} ${c.green('fix:')} ${f.fix}`);
+    }
+    for (const u of r.unsupported) {
+        out.push(c.gray(`  skipped ${u.file} (${u.language} support is on the roadmap)`));
+    }
+    for (const p of r.parseErrors) {
+        out.push(c.yellow(`  could not parse ${p.file}: ${p.message}`));
+    }
+    out.push('');
+    const { error, warning, suspiciousTests } = r.summary;
+    if (r.filesScanned === 0 && r.parseErrors.length === 0) {
+        // "✓ 0 tests: no fake tests found" reads as a pass; it's really "nothing was checked".
+        out.push(c.yellow('No test files found. honest-tests looks for *.test.* / *.spec.* / test.* files and __tests__/ dirs ' +
+            '(vitest, jest, node:test, mocha-style it/describe). Pass test files or directories explicitly if yours are named differently.'));
+    }
+    else if (r.findings.length === 0) {
+        out.push(c.green(c.bold(`✓ ${plural(r.testsScanned, 'test')} in ${plural(r.filesScanned, 'file')}: no fake tests found.`)));
+    }
+    else {
+        if (suspiciousTests > 0) {
+            out.push(c.bold(`${c.red(String(suspiciousTests))} of ${r.testsScanned} tests can't fail (or don't test what they claim).`));
+        }
+        out.push(`${plural(r.filesScanned, 'file')}, ${plural(r.testsScanned, 'test')}: ${SEV.error(plural(error, 'error'))}, ${SEV.warning(plural(warning, 'warning'))}.` +
+            (opts.verbose ? '' : c.dim(' Run with --verbose for fixes.')));
+    }
+    return out.join('\n').replace(/^\n/, '');
+}
+export function formatMutation(m) {
+    const out = [];
+    out.push('', c.bold(`Mutation check: ${m.target}`));
+    out.push(c.dim(`  command: ${m.command}`));
+    const shown = m.relatedTests.slice(0, 6).join(', ') + (m.relatedTests.length > 6 ? `, … ${m.relatedTests.length - 6} more` : '');
+    if (m.relatedTests.length)
+        out.push(c.dim(`  tests:   ${shown}`));
+    else
+        out.push(c.yellow('  no test file imports this target (directly or via other modules); ran the full test command'));
+    if (m.generated > m.tested)
+        out.push(c.yellow(`  tested ${m.tested} of ${m.generated} mutants (raise --max-mutants for more)`));
+    const survivors = m.mutants.filter((x) => x.status === 'survived');
+    if (survivors.length) {
+        out.push('', c.bold(c.red(`  ${plural(survivors.length, 'mutant')} survived — your tests don't actually check these lines:`)));
+        const byLine = new Map();
+        for (const s of survivors)
+            byLine.set(s.line, [...(byLine.get(s.line) ?? []), s]);
+        for (const [line, list] of byLine) {
+            out.push('', `  ${c.gray(`${m.target}:${line}`)}  ${list[0].sourceLine}`);
+            for (const s of list)
+                out.push(`      ${c.red('✗')} ${s.description}`);
+        }
+    }
+    const score = m.score;
+    const color = score >= 90 ? c.green : score >= 60 ? c.yellow : c.red;
+    out.push('');
+    out.push(`  ${c.bold('Mutation score:')} ${color(c.bold(`${score}%`))} ` +
+        c.dim(`(${m.killed} killed, ${m.timedOut} timed out, ${m.survived} survived of ${m.tested}; baseline ${(m.baselineMs / 1000).toFixed(1)}s)`));
+    if (survivors.length === 0)
+        out.push(c.green('  ✓ Every mutation was caught. These tests actually test something.'));
+    return out.join('\n');
+}

package/dist/report/json.d.ts

@@ -0,0 +1,4 @@
+import type { AuditResult } from '../core/engine.js';
+import type { MutationReport } from '../mutate/runner.js';
+export declare const JSON_SCHEMA_VERSION = 1;
+export declare function toJson(audit: AuditResult | null, mutation: MutationReport | null): string;

package/dist/report/json.js

@@ -0,0 +1,8 @@
+export const JSON_SCHEMA_VERSION = 1;
+export function toJson(audit, mutation) {
+    return JSON.stringify({
+        schemaVersion: JSON_SCHEMA_VERSION,
+        ...(audit ?? {}),
+        ...(mutation ? { mutation } : {}),
+    }, null, 2);
+}

package/dist/rules/asserts-on-mock.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../core/types.js';
+export declare const assertsOnMock: Rule;

package/dist/rules/asserts-on-mock.js

@@ -0,0 +1,53 @@
+import { atAssertion, code, eachTest } from './helpers.js';
+export const assertsOnMock = {
+    id: 'asserts-on-mock',
+    severity: 'error',
+    description: 'Asserts on the return value of a mock the test configured itself — it tests the mock, not the code.',
+    fix: 'Call the real unit under test (which uses the mock as a dependency) and assert on what the unit produces. Assert on the mock only for interactions (toHaveBeenCalledWith).',
+    check(file) {
+        const out = [];
+        for (const t of eachTest(file)) {
+            const configured = new Map();
+            for (const m of t.mockSetups)
+                if (m.configuresReturn && !configured.has(m.target))
+                    configured.set(m.target, m.line);
+            if (configured.size === 0)
+                continue;
+            const restores = t.mockRestores ?? [];
+            // Lines of setups that share a declaration (`const spy = vi.spyOn(o, 'm')` registers `spy` and `o.m`).
+            const setupLines = (target) => new Set(t.mockSetups.filter((m) => m.target === target).map((m) => m.line));
+            /** The mock still returns its configured value at `line` (not restored/reset in between). */
+            const activeAt = (target, line) => {
+                const lines = setupLines(target);
+                const setupLine = configured.get(target);
+                return !restores.some((r) => {
+                    if (r.line <= setupLine || r.line >= line)
+                        return false;
+                    if (r.target === null || r.target === target)
+                        return true;
+                    return [...setupLines(r.target)].some((l) => lines.has(l));
+                });
+            };
+            for (const a of t.assertions) {
+                const s = a.subject;
+                if (!s || a.matcherKind === 'called' || a.matcherKind === 'none')
+                    continue;
+                let hit;
+                if (s.kind === 'call' && s.calleeText && configured.has(s.calleeText))
+                    hit = s.calleeText;
+                else if (s.kind === 'identifier' && s.aliasCalleeText && configured.has(s.aliasCalleeText))
+                    hit = s.aliasCalleeText;
+                // Only `.mock.results` echoes configured return values; `.mock.calls`, `.lastCall`,
+                // `.invocationCallOrder`, `.instances` record what the code under test did with the mock.
+                else if (s.kind === 'member')
+                    hit = [...configured.keys()].find((k) => s.text.startsWith(`${k}.mock.results`));
+                if (hit && !activeAt(hit, a.line))
+                    hit = undefined;
+                if (hit) {
+                    out.push(atAssertion(t, a, `Asserts on what mock ${code(hit)} returns (configured on line ${configured.get(hit)}) — this verifies the mock, not your code.`));
+                }
+            }
+        }
+        return out;
+    },
+};

package/dist/rules/asserts-on-own-literal.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../core/types.js';
+export declare const assertsOnOwnLiteral: Rule;

package/dist/rules/asserts-on-own-literal.js

@@ -0,0 +1,36 @@
+import { atAssertion, code, eachTest } from './helpers.js';
+/**
+ * Matchers that only look at the value they're given. `throws`/`called` fail on a plain value, snapshots
+ * are snapshot-only's call, and custom matchers (`expect(msg).toHaveBeenWarnedTimes(1)`) may use the
+ * literal as a key into state the code under test changed — so unknown matchers never count.
+ */
+const VALUE_KINDS = new Set(['equal', 'truthy', 'falsy', 'defined', 'undefined', 'null', 'length', 'compare-gte', 'compare-other', 'type']);
+const VALUE_MATCHERS = /^(toContain|toContainEqual|toMatch|toBeNaN|include|includes|contain|contains|match|matches|oneOf|toBeOneOf)$/;
+/** Property probes see inherited properties too, so code that pollutes a prototype can make them fail. */
+const PROPERTY_PROBES = /^(toHaveProperty|property|nestedProperty|haveOwnProperty|ownProperty|ownPropertyDescriptor|keys|any|all)$/;
+export const assertsOnOwnLiteral = {
+    id: 'asserts-on-own-literal',
+    severity: 'error',
+    description: 'Asserts on an object/array literal the test just built — no code under test is involved, so it can never fail.',
+    fix: 'Pass the literal through the code under test and assert on what it returns. For type-only checks use a compile-time test (expectTypeOf, tsd, `// @ts-expect-error`) instead of a runtime assertion.',
+    check(file) {
+        const out = [];
+        for (const t of eachTest(file)) {
+            for (const a of t.assertions) {
+                const s = a.subject;
+                if (!s?.ownLiteral || PROPERTY_PROBES.test(a.matcher ?? ''))
+                    continue;
+                if (!VALUE_KINDS.has(a.matcherKind) && !(a.matcherKind === 'other' && VALUE_MATCHERS.test(a.matcher ?? '')))
+                    continue;
+                if (!a.args.every((x) => x.kind === 'literal' || x.pureLiteral))
+                    continue;
+                // `expect({a: 1}).toEqual({a: 1})` is tautological-assertion's finding.
+                if (a.args[0] && a.args[0].text === s.text)
+                    continue;
+                const { name, line } = s.ownLiteral;
+                out.push(atAssertion(t, a, `Asserts on ${code(s.text)}, which comes only from the literal ${code(name)} built on line ${line} — no code under test runs, so this can never fail.`));
+            }
+        }
+        return out;
+    },
+};

package/dist/rules/catch-only-assertion.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../core/types.js';
+export declare const catchOnlyAssertion: Rule;

package/dist/rules/catch-only-assertion.js

@@ -0,0 +1,22 @@
+import { atAssertion, eachTest } from './helpers.js';
+export const catchOnlyAssertion = {
+    id: 'catch-only-assertion',
+    severity: 'error',
+    description: 'Assertions live only in a catch block; if the code stops throwing, the catch never runs and the test passes.',
+    fix: 'Use expect(() => fn()).toThrow(...) / await expect(p).rejects.toThrow(...), or add expect.assertions(n) at the top of the test.',
+    check(file) {
+        const out = [];
+        for (const t of eachTest(file)) {
+            if (t.hasAssertionCountGuard)
+                continue;
+            const inCatch = t.assertions.filter((a) => a.context.inCatch && !a.context.catchGuarded);
+            if (inCatch.length === 0)
+                continue;
+            const onlyCatch = inCatch.length === t.assertions.length && t.helperAssertionCalls === 0;
+            out.push(atAssertion(t, inCatch[0], onlyCatch
+                ? 'All assertions are inside a catch block — if the code stops throwing, this test still passes.'
+                : 'Assertion inside a catch block is skipped whenever the code does not throw.', { severity: onlyCatch ? 'error' : 'warning' }));
+        }
+        return out;
+    },
+};

package/dist/rules/conditional-assertion.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../core/types.js';
+export declare const conditionalAssertion: Rule;

package/dist/rules/conditional-assertion.js

@@ -0,0 +1,30 @@
+import { atAssertion, eachTest } from './helpers.js';
+export const conditionalAssertion = {
+    id: 'conditional-assertion',
+    severity: 'warning',
+    description: 'Assertion is guarded by an if/ternary/&&, so the test passes without checking anything when the guard is false.',
+    fix: 'Assert the condition itself (expect(result).toBeDefined()), then assert unconditionally. Split data-dependent branches into separate tests.',
+    check(file) {
+        const out = [];
+        for (const t of eachTest(file)) {
+            // A guard that re-tests something already asserted (`expect(r.success).toBe(false); if (!r.success) ...`)
+            // only narrows types — the branch is guaranteed to run. The earlier assertion may itself sit behind
+            // such a narrowing guard (nested `if (!r.success) { expect(i.code)...; if (i.code === 'x') ... }`).
+            const memo = new Map();
+            const runsAlways = (x) => {
+                if (!x.context.inConditional)
+                    return true;
+                let r = memo.get(x);
+                if (r === undefined) {
+                    r = (x.context.guards ?? []).every((g) => t.assertions.some((p) => p.line < x.line && p.subject?.text === g && runsAlways(p)));
+                    memo.set(x, r);
+                }
+                return r;
+            };
+            const a = t.assertions.find((x) => x.context.inConditional && !x.context.inCatch && !runsAlways(x));
+            if (a)
+                out.push(atAssertion(t, a, 'Assertion only runs when a condition holds — when it does not, the test passes silently.'));
+        }
+        return out;
+    },
+};