@systemfsoftware/oxlint-plugin-test-discipline 3.8.1 → 3.9.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @systemfsoftware/oxlint-plugin-test-discipline
 
+## 3.9.0
+
+### Minor Changes
+
+- Add `expect-boolean-predicate`, which refuses an `expect` on a predicate call, comparison, negation or `&&`/`||` asserted with `toBe(true|false)` and names the `toSatisfy` or `toEqual` rewrite, and `vitest-from-effect-vitest`, which refuses any value import from `vitest` — named, namespace, default, side-effect or dynamic — and names `@effect/vitest` as the rewrite; a type-only import stays legal. `prop-arbitrary-schema-origin` also checks the `of` entries of the object form `it.prop(name, { of, subject, runs }, holds)`.
+
 ## 3.8.1
 
 ### Patch Changes

package/README.md

@@ -4,19 +4,21 @@ Oxlint rules enforcing property-based test laws, test placement, and test naming
 
 ## Rules
 
-| Rule                                 | What it enforces                                                                                                                                                                                                                                                                                                                                                                        |
-| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `no-test-file-in-src`                | Under `src/`, the only sanctioned test file is a single-segment `<stem>.workflow.property.test.ts` inside a sanctioned test directory, plus the generated `schema-laws.test.ts` entry point. Every other test file is banned: a kernel, policy, or schema suite becomes an in-source `import.meta.vitest` block, and a public-surface test moves outside `src/` as an integration test. |
-| `src-property-test-cell`             | A property test under `src/` must be a single-segment `<stem>.workflow.property.test.ts` beside the `<stem>.workflow.ts` it covers. A source file whose suffix names a cell listed in `cellsRequiringTest` must also carry an in-source vitest block; that list is empty by default.                                                                                                    |
-| `test-file-outside-tests-dir`        | A test file outside `src/` must live under `tests/`.                                                                                                                                                                                                                                                                                                                                    |
-| `test-suffix-outside-src`            | Outside `src/`, a test file must end `.integration.test.ts`, `.differential.test.ts`, or `.trace.test.ts` — the three behaviour suffixes.                                                                                                                                                                                                                                               |
-| `tests-dir-helpers-in-fixtures`      | Under `tests/`, the only non-test modules are helpers and fixtures, and they live inside `tests/__fixtures__/`.                                                                                                                                                                                                                                                                         |
-| `no-io-module-in-source-test`        | An in-source `import.meta.vitest` test block is forbidden in a module that performs I/O — decided from the module's own syntax (a non-type import from a filesystem, process or network module, called at least once), never from its filename. Only the in-source-test idiom is judged: a module whose tests live in separate files is a no-op for this rule.                          |
-| `behaviour-test-requires-gherkin`    | A `.integration.test.ts` must import `makeFeature` from `@systemfsoftware/effect-gherkin-spec` and must not import test runners directly from `vitest` or `@effect/vitest`.                                                                                                                                                                                                             |
-| `behaviour-exercises-use-case`       | A `.integration.test.ts` must reach at least one shell entry — an executor/handler/adapter/store, the package `main`/`mod`/`index`, or a non-foundation package — so it drives a use case.                                                                                                                                                                                              |
-| `behaviour-one-feature-per-file`     | A `.integration.test.ts` must contain exactly one `Feature(...)` call; zero or two-or-more is the junk-drawer signal.                                                                                                                                                                                                                                                                   |
-| `differential-test-requires-harness` | A `.differential.test.ts` must import `@systemfsoftware/differential-spec` and invoke its harness; direct `vitest`/`@effect/vitest` imports and raw runner calls (`it`, `test`, `describe`, `it.effect`, and aliases) are forbidden, and importing the harness without invoking it is equally non-compliant.                                                                            |
-| `tests-import-public-api`            | Every file under the package-root `tests/` or `__tests__/` trees, regardless of basename, may not relative-import `src` or climb into an `internal` folder. Import the published package name or a sibling helper.                                                                                                                                                                      |
+| Rule                                 | What it enforces                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `no-test-file-in-src`                | Under `src/`, the only sanctioned test file is a single-segment `<stem>.workflow.property.test.ts` inside a sanctioned test directory, plus the generated `schema-laws.test.ts` entry point. Every other test file is banned: a kernel, policy, or schema suite becomes an in-source `import.meta.vitest` block, and a public-surface test moves outside `src/` as an integration test.                                                      |
+| `src-property-test-cell`             | A property test under `src/` must be a single-segment `<stem>.workflow.property.test.ts` beside the `<stem>.workflow.ts` it covers. A source file whose suffix names a cell listed in `cellsRequiringTest` must also carry an in-source vitest block; that list is empty by default.                                                                                                                                                         |
+| `test-file-outside-tests-dir`        | A test file outside `src/` must live under `tests/`.                                                                                                                                                                                                                                                                                                                                                                                         |
+| `test-suffix-outside-src`            | Outside `src/`, a test file must end `.integration.test.ts`, `.differential.test.ts`, or `.trace.test.ts` — the three behaviour suffixes.                                                                                                                                                                                                                                                                                                    |
+| `tests-dir-helpers-in-fixtures`      | Under `tests/`, the only non-test modules are helpers and fixtures, and they live inside `tests/__fixtures__/`.                                                                                                                                                                                                                                                                                                                              |
+| `no-io-module-in-source-test`        | An in-source `import.meta.vitest` test block is forbidden in a module that performs I/O — decided from the module's own syntax (a non-type import from a filesystem, process or network module, called at least once), never from its filename. Only the in-source-test idiom is judged: a module whose tests live in separate files is a no-op for this rule.                                                                               |
+| `behaviour-test-requires-gherkin`    | A `.integration.test.ts` must import `makeFeature` from `@systemfsoftware/effect-gherkin-spec` and must not import test runners directly from `vitest` or `@effect/vitest`.                                                                                                                                                                                                                                                                  |
+| `behaviour-exercises-use-case`       | A `.integration.test.ts` must reach at least one shell entry — an executor/handler/adapter/store, the package `main`/`mod`/`index`, or a non-foundation package — so it drives a use case.                                                                                                                                                                                                                                                   |
+| `behaviour-one-feature-per-file`     | A `.integration.test.ts` must contain exactly one `Feature(...)` call; zero or two-or-more is the junk-drawer signal.                                                                                                                                                                                                                                                                                                                        |
+| `differential-test-requires-harness` | A `.differential.test.ts` must import `@systemfsoftware/differential-spec` and invoke its harness; direct `vitest`/`@effect/vitest` imports and raw runner calls (`it`, `test`, `describe`, `it.effect`, and aliases) are forbidden, and importing the harness without invoking it is equally non-compliant.                                                                                                                                 |
+| `tests-import-public-api`            | Every file under the package-root `tests/` or `__tests__/` trees, regardless of basename, may not relative-import `src` or climb into an `internal` folder. Import the published package name or a sibling helper.                                                                                                                                                                                                                           |
+| `expect-boolean-predicate`           | An `expect(...)` asserted with `toBe(true)`, `toBe(false)`, `toEqual(true)` or `toEqual(false)` must wrap a boolean the code under test returned. A predicate call, comparison, negation or `&&` / `\|\|` evaluated in the test is refused, with the `toSatisfy` or `toEqual` rewrite as the fix.                                                                                                                                            |
+| `vitest-from-effect-vitest`          | Every value a test uses from Vitest is imported from `@effect/vitest`, which re-exports all of Vitest. Any value import from `vitest` — named, namespace, default, side-effect or dynamic — is refused; a type-only import stays legal. Exempt: the packages that drive Vitest's own runner instead of the fork (`vitest` itself, `vitest-conformance`, and `effect-spec-runtime`, whose `Register` calls Vitest's option-taking collector). |
 
 | suffix                        | layer        | doubles                  | location           |
 | ----------------------------- | ------------ | ------------------------ | ------------------ |
@@ -27,7 +29,7 @@ Oxlint rules enforcing property-based test laws, test placement, and test naming
 
 ## Enrollment
 
-The rules are turned on by `@systemfsoftware/oxlint-config/base`, which spreads `@systemfsoftware/oxlint-plugin-effect-dmmf`'s recommended set; that aggregate re-exports all nine under the `@systemfsoftware/effect-dmmf/` namespace, so a package extending only `base` already enforces them. `strict` adds three TypeScript rules and nothing from this plugin. Neither preset registers this plugin standalone in `jsPlugins`, so its own `recommended` config is never the thing being loaded.
+`@systemfsoftware/oxlint-config-recommended` loads this plugin in `jsPlugins` and turns on `expect-boolean-predicate` and `vitest-from-effect-vitest` at `error` in its default config. The rest of `configs.recommended` is exported from that preset as `rules`, but the default config does not enable it, so those rules fire only in a package that spreads it into its own `rules`.
 
 ## Testing
 

package/dist/index.d.ts

@@ -25,6 +25,8 @@ declare const _default: {
     'behaviour-one-feature-per-file': import("@oxlint/plugins").Rule;
     'no-pseudo-gherkin-unit-tests': import("@oxlint/plugins").Rule;
     'tests-dir-helpers-in-fixtures': import("@oxlint/plugins").Rule;
+    'expect-boolean-predicate': import("@oxlint/plugins").Rule;
+    'vitest-from-effect-vitest': import("@oxlint/plugins").Rule;
     'no-io-module-in-source-test': import("@oxlint/plugins").Rule;
     'tests-import-public-api': import("@oxlint/plugins").Rule;
     'differential-test-requires-harness': import("@oxlint/plugins").Rule;

package/dist/index.mjs

@@ -8,7 +8,7 @@ const EMIT_CALLEES = [
 ];
 const EXPECTED$3 = "a span declared once with Span.declare({ id, name, attrs }) and started through the start(attrs) it returns";
 const FIX$3 = "declare the span with Span.declare({ id, name, attrs }) and emit it with SomeSpan.start(attrs)";
-const meta$25 = {
+const meta$27 = {
 	type: "problem",
 	docs: { description: "Ban a raw span name passed to an emit API (startSpan, spanBuilder, startActiveSpan). Span names enter through Span.declare, never as a literal at the emit site." },
 	schema: [],
@@ -49,7 +49,7 @@ const inspect = (node) => {
 	};
 };
 const banRawSpanNameEmit = defineRule({
-	meta: meta$25,
+	meta: meta$27,
 	create(context) {
 		return { CallExpression(node) {
 			const emitCall = inspect(node);
@@ -99,12 +99,17 @@ const GHERKIN_PACKAGE = "@systemfsoftware/effect-gherkin-spec";
 const DIFFERENTIAL_PACKAGE = "@systemfsoftware/differential-spec";
 const TRACE_SPEC_PACKAGE = "@systemfsoftware/trace-spec";
 const FOREIGN_RUNNERS = /* @__PURE__ */ new Set(["vitest", "@effect/vitest"]);
+const RAW_VITEST_PACKAGES = {
+	"effect-spec-runtime": true,
+	"vitest": true,
+	"vitest-conformance": true
+};
 const RUNNER_NAMES = /* @__PURE__ */ new Set([
 	"it",
 	"test",
 	"describe"
 ]);
-const MESSAGE$7 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const MESSAGE$9 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
 const ABSENCE_MESSAGE = "{{name}} is untested. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
 //#endregion
 //#region src/rules/behaviour-exercises-use-case.config.ts
@@ -112,11 +117,11 @@ const NO_SUBJECT_IMPORT_NAME = "a *.integration.test.ts that reaches no package
 const NO_SUBJECT_IMPORT_EXPECTED = "an import of the package code under test";
 const NO_SUBJECT_IMPORT_ACTUAL = "a behaviour file whose every runtime import is vitest, @effect/vitest, the gherkin spec package, effect, a Node builtin, or the file itself";
 const NO_SUBJECT_IMPORT_FIX = "a behaviour test exercises a use case, so it has to reach the package. A file that imports nothing but its runner and effect is asserting over values it built in the same file. Ask whether the assertion tests anything at all: if it restates a literal, delete the scenario; if it states an invariant that holds over generated inputs, move it to a *.property.test.ts beside the cell that decides it. Type-only imports never count - they are erased before anything runs - while a side-effect import (import \"../src/x.js\", import {} from \"../src/x.js\") does count, because it executes that module.";
-const meta$24 = {
+const meta$26 = {
 	type: "problem",
 	docs: { description: "A *.integration.test.ts must import the package under test, not only its runner and effect, so the scenario exercises code that ships rather than values the test built itself." },
 	schema: [],
-	messages: { noSubjectImport: MESSAGE$7 }
+	messages: { noSubjectImport: MESSAGE$9 }
 };
 //#endregion
 //#region src/rules/path.ts
@@ -126,6 +131,7 @@ const basenameOf = (filename) => Array$1.lastNonEmpty(segmentsOf(filename));
 /** Directory segments only — the basename never counts as a directory. */
 const directoriesOf = (filename) => Array$1.initNonEmpty(segmentsOf(filename));
 const isUnderSrc = (filename) => directoriesOf(filename).includes("src");
+const isRawVitestPackage = (filename) => directoriesOf(filename).some((segment) => RAW_VITEST_PACKAGES[segment] === true);
 const isInSanctionedTestDir = (filename) => directoriesOf(filename).some((segment) => SANCTIONED_TEST_DIRS.has(segment));
 const isInTestsImportScope = (filename) => {
 	const segments = segmentsOf(filename);
@@ -225,7 +231,7 @@ const DIST_SEGMENT = /(?:^|\/)dist\//;
 * path names nothing satisfies the rule the same way a real one does.
 */
 const behaviourExercisesUseCase = defineRule({
-	meta: meta$24,
+	meta: meta$26,
 	create(context) {
 		let reached = false;
 		return {
@@ -275,13 +281,13 @@ const TOO_MANY_FEATURES_NAME = "a *.integration.test.ts accumulating multiple Fe
 const TOO_MANY_FEATURES_EXPECTED = "exactly one Feature(...) — every additional one signals a junk drawer";
 const TOO_MANY_FEATURES_ACTUAL = "a behaviour file with two or more Feature(...) calls";
 const TOO_MANY_FEATURES_FIX = "splitting a junk drawer into several smaller junk drawers is not an improvement. When separating scenarios surfaces assertions that restate a pure function return value — change detectors against a lookup table or constant — those get deleted, not rehoused. Each surviving capability keeps its own file with exactly one Feature.";
-const meta$23 = {
+const meta$25 = {
 	type: "problem",
 	docs: { description: "A *.integration.test.ts must contain exactly one Feature(...) call. Zero or two-or-more is the junk-drawer signal that produced 41 scenarios of pure-function assertions in a single file." },
 	schema: [],
 	messages: {
-		tooFewFeatures: MESSAGE$7,
-		tooManyFeatures: MESSAGE$7
+		tooFewFeatures: MESSAGE$9,
+		tooManyFeatures: MESSAGE$9
 	}
 };
 //#endregion
@@ -320,7 +326,7 @@ const hasAnyFeatureCall = (program) => {
 	return false;
 };
 const behaviourOneFeaturePerFile = defineRule({
-	meta: meta$23,
+	meta: meta$25,
 	create(context) {
 		return { "Program:exit"(node) {
 			if (!isBehaviourTest$2(basenameOf(context.filename))) return;
@@ -361,13 +367,13 @@ const MISSING_MAKE_FEATURE_NAME = "a *.integration.test.ts without makeFeature";
 const MISSING_MAKE_FEATURE_EXPECTED = "makeFeature imported from @systemfsoftware/effect-gherkin-spec";
 const MISSING_MAKE_FEATURE_ACTUAL = "a behaviour file that never constructs a Gherkin feature";
 const MISSING_MAKE_FEATURE_FIX = "import { makeFeature } from @systemfsoftware/effect-gherkin-spec and declare `const Feature = makeFeature({ it, layer })`";
-const meta$22 = {
+const meta$24 = {
 	type: "problem",
 	docs: { description: "A *.integration.test.ts must drive its suite through makeFeature from @systemfsoftware/effect-gherkin-spec and must not import test runners from vitest or @effect/vitest." },
 	schema: [],
 	messages: {
-		foreignRunner: MESSAGE$7,
-		missingMakeFeature: MESSAGE$7
+		foreignRunner: MESSAGE$9,
+		missingMakeFeature: MESSAGE$9
 	}
 };
 //#endregion
@@ -389,7 +395,7 @@ const foreignRunnerNameOf = (specifier) => {
 };
 const isBehaviourTest$1 = (basename) => basename.endsWith(INTEGRATION_SUFFIX);
 const behaviourTestRequiresGherkin = defineRule({
-	meta: meta$22,
+	meta: meta$24,
 	create(context) {
 		const basename = basenameOf(context.filename);
 		return { Program(node) {
@@ -452,7 +458,7 @@ const INVALID_BEHAVIOR_CASE_FIX = "Convert behavior to PascalCase (e.g., throwEr
 const INVALID_CONDITION_CASE_FIX = "Convert condition to PascalCase (e.g., passwordInvalid → PasswordInvalid)";
 const EMPTY_BEHAVIOR_ACTUAL = "Empty string between Should_ and _When_";
 const EMPTY_CONDITION_ACTUAL = "Empty string after _When_";
-const meta$21 = {
+const meta$23 = {
 	type: "suggestion",
 	docs: { description: "Enforce DAMP (Descriptive and Meaningful Phrases) test naming format: Should_[ExpectedBehavior]_When_[Condition]" },
 	schema: [],
@@ -532,7 +538,7 @@ const isTestFunctionCall = (node) => {
 	return false;
 };
 const dampTestNaming = defineRule({
-	meta: meta$21,
+	meta: meta$23,
 	create(context) {
 		return { CallExpression(node) {
 			if (!isTestFunctionCall(node)) return;
@@ -555,7 +561,7 @@ const dampTestNaming = defineRule({
 });
 //#endregion
 //#region src/rules/differential-test-requires-harness.config.ts
-const meta$20 = {
+const meta$22 = {
 	type: "problem",
 	docs: { description: "Differential tests must use @systemfsoftware/differential-spec harness. Raw runner calls (it, test, describe, and member forms like it.effect) and direct runner imports are forbidden in *.differential.test.ts files; importing the harness without invoking it is equally non-compliant." },
 	schema: [],
@@ -577,7 +583,7 @@ const recordHarnessBindings = (node, bindings) => {
 };
 const isForeignRunnerImport = (node) => typeof node.source.value === "string" && FOREIGN_RUNNERS.has(node.source.value);
 const differentialTestRequiresHarness = defineRule({
-	meta: meta$20,
+	meta: meta$22,
 	create(context) {
 		if (!context.filename.endsWith(".differential.test.ts")) return {};
 		const harnessBindings = /* @__PURE__ */ new Set();
@@ -648,16 +654,97 @@ const differentialTestRequiresHarness = defineRule({
 	}
 });
 //#endregion
+//#region src/rules/expect-boolean-predicate.config.ts
+const MESSAGE$8 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const BOOLEAN_MATCHERS = {
+	toBe: true,
+	toEqual: true
+};
+const COMPARISON_OPERATORS = {
+	"===": true,
+	"!==": true,
+	"==": true,
+	"!=": true,
+	"<": true,
+	"<=": true,
+	">": true,
+	">=": true,
+	instanceof: true,
+	in: true
+};
+const VIOLATION_NAME$4 = "a predicate evaluated in the test asserted against true or false";
+const VIOLATION_EXPECTED$1 = "expect(...) around a boolean the code under test returned";
+const VIOLATION_ACTUAL$1 = "expect(...) wraps a call, a comparison, a `!` or an `&&` / `||` evaluated in the test, so a failure reports `expected false to be true` instead of the values that disagreed";
+const VIOLATION_FIX$1 = "rewrite a predicate call as expect(x).toSatisfy(P) — e.g. expect(s.reading).toSatisfy(Result.isFailure) — and a comparison as expect(a).toEqual(b)";
+const meta$21 = {
+	type: "problem",
+	docs: { description: "An expect(...) asserted with toBe(true|false) or toEqual(true|false) must wrap a boolean the code under test returned. A predicate call, comparison, negation or && / || evaluated in the test is refused, with the toSatisfy or toEqual rewrite as the fix." },
+	schema: [],
+	messages: { booleanPredicate: MESSAGE$8 }
+};
+//#endregion
+//#region src/rules/expect-call.ts
+const EXPECT = "expect";
+const isExpectCallee = (callee) => callee.type === "Identifier" && callee.name === EXPECT;
+const expectCallOf = (node, acceptsMember) => {
+	if (node.callee.type !== "MemberExpression") return void 0;
+	let target = node.callee.object;
+	while (target.type === "MemberExpression") {
+		if (acceptsMember !== void 0 && acceptsMember(target) === false) return void 0;
+		target = target.object;
+	}
+	if (target.type !== "CallExpression" || isExpectCallee(target.callee) === false) return void 0;
+	return target;
+};
+//#endregion
+//#region src/rules/expect-boolean-predicate.ts
+const isNotMember = (member) => member.property.type === "Identifier" && member.property.name === "not";
+const isBooleanLiteral = (node) => node !== void 0 && node.type === "Literal" && typeof node.value === "boolean";
+/** The ARG positions `expect` exposes that no subject can fill by accident. */
+const isEvaluatedInTest = (arg) => {
+	switch (arg.type) {
+		case "CallExpression": return true;
+		case "UnaryExpression": return arg.operator === "!";
+		case "LogicalExpression": return arg.operator === "&&" || arg.operator === "||";
+		case "BinaryExpression": return COMPARISON_OPERATORS[arg.operator] === true;
+		default: return false;
+	}
+};
+const expectBooleanPredicate = defineRule({
+	meta: meta$21,
+	create(context) {
+		return { CallExpression(node) {
+			if (node.callee.type !== "MemberExpression" || node.callee.property.type !== "Identifier") return;
+			if (BOOLEAN_MATCHERS[node.callee.property.name] !== true) return;
+			if (!isBooleanLiteral(node.arguments[0])) return;
+			const receiver = expectCallOf(node, isNotMember);
+			if (receiver === void 0) return;
+			const arg = receiver.arguments[0];
+			if (arg === void 0 || !isEvaluatedInTest(arg)) return;
+			context.report({
+				node,
+				messageId: "booleanPredicate",
+				data: {
+					name: VIOLATION_NAME$4,
+					expected: VIOLATION_EXPECTED$1,
+					actual: VIOLATION_ACTUAL$1,
+					fix: VIOLATION_FIX$1
+				}
+			});
+		} };
+	}
+});
+//#endregion
 //#region src/rules/in-source-test-prop-only.config.ts
 const NON_PROP_CALL_NAME = "a non-property test call inside an `import.meta.vitest` block";
 const NON_PROP_CALL_EXPECTED = "only `it.prop` or `it.effect.prop` member-chain calls (standard modifiers included) with boolean predicates";
 const NON_PROP_CALL_ACTUAL = "a bare or member-chain test call other than `it.prop`/`it.effect.prop`";
 const NON_PROP_CALL_FIX = "delete the block — non-property in-source tests belong nowhere in `src/`; re-home a meaningful example through the cell public export as `*.integration.test.ts`, or rewrite a real invariant as `it.prop` over a schema-derived arbitrary";
-const meta$19 = {
+const meta$20 = {
 	type: "problem",
 	docs: { description: "In-source `if (import.meta.vitest)` blocks under src/ must contain only `it.prop` or `it.effect.prop` calls; every other test call fails — delete the block or rewrite the invariant as a property." },
 	schema: [],
-	messages: { nonPropCall: MESSAGE$7 }
+	messages: { nonPropCall: MESSAGE$9 }
 };
 //#endregion
 //#region src/rules/vitest-guard.ts
@@ -717,7 +804,7 @@ const rootNameOf = (node) => {
 	if (node.type === "CallExpression") return rootNameOf(node.callee);
 };
 const inSourceTestPropOnly = defineRule({
-	meta: meta$19,
+	meta: meta$20,
 	create(context) {
 		const filename = context.filename;
 		const basename = basenameOf(filename);
@@ -762,13 +849,13 @@ const NO_PRIVATE_TARGET_NAME = "an `import.meta.vitest` block touching no privat
 const NO_PRIVATE_TARGET_EXPECTED = "an in-source test exercising a non-exported module-level binding";
 const NO_PRIVATE_TARGET_ACTUAL = "an in-source block referencing only exported or imported names";
 const NO_PRIVATE_TARGET_FIX = "test the public surface from tests/ as *.integration.test.ts; in-source blocks exist for private helpers only — if the public behaviour you meant to cover is a pure function, delete the assertion: the type system already proves it";
-const meta$18 = {
+const meta$19 = {
 	type: "problem",
 	docs: { description: "In-source `if (import.meta.vitest)` blocks under src/ must be at module level and exercise at least one non-exported binding; other tests belong in tests/." },
 	schema: [],
 	messages: {
-		notModuleLevel: MESSAGE$7,
-		noPrivateTarget: MESSAGE$7
+		notModuleLevel: MESSAGE$9,
+		noPrivateTarget: MESSAGE$9
 	}
 };
 //#endregion
@@ -796,7 +883,7 @@ const collectPrivateNames = (body, out) => {
 	}
 };
 const inSourceTestTargetsPrivate = defineRule({
-	meta: meta$18,
+	meta: meta$19,
 	create(context) {
 		const filename = context.filename;
 		const basename = basenameOf(filename);
@@ -854,15 +941,15 @@ const inSourceTestTargetsPrivate = defineRule({
 });
 //#endregion
 //#region src/rules/no-assert-in-property.config.ts
-const MESSAGE$6 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const meta$17 = {
+const MESSAGE$7 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const meta$18 = {
 	type: "problem",
 	docs: { description: "Property predicates (it.prop / it.effect.prop) must never call expect(...), assert*(...), or raw fc.assert/fc.check. The boolean return IS the verdict — assertions fork the failure channel. assert* remains correct in normal (non-property) tests." },
 	schema: [],
 	messages: {
-		expectCall: MESSAGE$6,
-		assertCall: MESSAGE$6,
-		rawFcRun: MESSAGE$6
+		expectCall: MESSAGE$7,
+		assertCall: MESSAGE$7,
+		rawFcRun: MESSAGE$7
 	}
 };
 //#endregion
@@ -893,7 +980,7 @@ const isInsidePropPredicate = (node) => {
 	return isInsidePropPredicate(parent);
 };
 const noAssertInProperty = defineRule({
-	meta: meta$17,
+	meta: meta$18,
 	create(context) {
 		return { CallExpression(node) {
 			const callee = node.callee;
@@ -946,7 +1033,7 @@ const SKIP_WALK_KEYS = /* @__PURE__ */ new Set([
 	"range",
 	"parent"
 ]);
-const meta$16 = {
+const meta$17 = {
 	type: "problem",
 	docs: { description: "Flag an assertion whose subject and expectation are both built only from imported declarations and literals. Such an assertion invokes nothing, so no change to the behaviour under test can make it fail." },
 	schema: [],
@@ -996,15 +1083,6 @@ const dependsOnBehaviour = (node, imported) => {
 	}
 	return false;
 };
-const expectCallOf = (node) => {
-	if (node.callee.type !== "MemberExpression") return void 0;
-	let target = node.callee.object;
-	while (target.type === "MemberExpression") target = target.object;
-	if (target.type !== "CallExpression") return void 0;
-	const callee = target.callee;
-	if (!("name" in callee && callee.name === "expect")) return void 0;
-	return target;
-};
 const importedNames = (program) => {
 	const names = /* @__PURE__ */ new Set();
 	for (const statement of program.body) {
@@ -1014,7 +1092,7 @@ const importedNames = (program) => {
 	return names;
 };
 const noBehaviourlessAssertion = defineRule({
-	meta: meta$16,
+	meta: meta$17,
 	create(context) {
 		if (!TEST_FILE.test(context.filename)) return {};
 		const imported = importedNames(context.sourceCode.ast);
@@ -1084,7 +1162,7 @@ const IO_SOURCE_TEST_NAME = "An in-source `import.meta.vitest` test block";
 const IO_SOURCE_TEST_EXPECTED = "the tests of a module whose own source calls an I/O binding to live outside it — a separate test file, or a composition test with a double at the port";
 const IO_SOURCE_TEST_ACTUAL = "this module calls a binding imported from a filesystem, process or network module and guards tests in-source with `import.meta.vitest`";
 const IO_SOURCE_TEST_FIX = "test the module from outside its own source — a separate test file or a composition test doubling the boundary — or, when an assertion merely restates a literal the module already computes, it is a change detector: delete it. The verdict here is the file's own imports and calls, never its name";
-const meta$15 = {
+const meta$16 = {
 	type: "problem",
 	docs: { description: "Reports an in-source `import.meta.vitest` test block in a module whose own syntax shows a called, non-type import from a filesystem, process or network module. Judges only the in-source-test idiom — a module whose tests live in separate files is a no-op for this rule, whatever it imports." },
 	schema: [],
@@ -1105,7 +1183,7 @@ const bindingBase = (callee) => {
 	if (callee.type === "Identifier") return callee.name;
 };
 const noIoModuleInSourceTest = defineRule({
-	meta: meta$15,
+	meta: meta$16,
 	create(context) {
 		/** Local binding name -> specifier it was (non-type) imported from. */
 		const ioBindings = {};
@@ -1147,7 +1225,7 @@ const noIoModuleInSourceTest = defineRule({
 });
 //#endregion
 //#region src/rules/no-nested-quantification.config.ts
-const MESSAGE$5 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const MESSAGE$6 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
 const Options$2 = Schema.Struct({ exempt: Schema.Array(Schema.String).pipe(Schema.annotate({ description: "File basenames this rule stays silent on. An owner who has measured the cost and accepted it names the file here; the property still runs." }), Schema.withDecodingDefaultType(Effect.succeed([]))) });
 const ITERATOR_METHODS = /* @__PURE__ */ new Set([
 	"every",
@@ -1166,15 +1244,15 @@ const ITERATOR_METHODS = /* @__PURE__ */ new Set([
 ]);
 const CONSTANT_POOL_ARBITRARIES = /* @__PURE__ */ new Set(["constant", "constantFrom"]);
 const FASTCHECK_NAMESPACES = /* @__PURE__ */ new Set(["fc"]);
-const VIOLATION_NAME$2 = "quantification nested inside a property predicate";
+const VIOLATION_NAME$3 = "quantification nested inside a property predicate";
 const EXPECTED$2 = "per-case cost bounded by the draw, not by the draw times a second traversal — inspect a generated value with a fold whose body calls nothing, or move the inner quantifier into the generator so the shrinker can see it";
 const ACTUAL$2 = "the predicate iterates a value derived from a generated parameter and calls a free function inside that loop, so cost scales with the drawn size times whatever that call costs";
 const FIX$2 = "hoist the inner call out of the loop when its result does not vary per element; otherwise assert one drawn element per case and let numRuns supply the quantifier, or generate the pair and compare directly. If the cost is understood and accepted, add this file's basename to the rule's exempt option";
-const meta$14 = {
+const meta$15 = {
 	type: "problem",
 	docs: { description: "A property predicate must not quantify over its own generated value and call out again inside that loop. Per-case cost then scales with the drawn size rather than with the draw count, which is the shape Hypothesis reports as nested_given: the suite slows superlinearly as the generator widens, and a CI budget tuned on small draws times out on large ones. Iteration over a bound the generator does not control, and a fold whose body calls nothing, are both fine." },
 	schema: [Schema.toJsonSchemaDocument(Options$2).schema],
-	messages: { nestedQuantification: MESSAGE$5 }
+	messages: { nestedQuantification: MESSAGE$6 }
 };
 //#endregion
 //#region src/rules/no-nested-quantification.ts
@@ -1229,11 +1307,17 @@ const isConstantPool = (element) => {
 };
 const boundedPoolIndices = (call) => {
 	const bounded = /* @__PURE__ */ new Set();
-	const generators = call.arguments.find((argument) => argument.type === "ArrayExpression");
-	if (generators === void 0) return bounded;
-	generators.elements.forEach((element, index) => {
-		if (isConstantPool(element)) bounded.add(index);
-	});
+	const options = call.arguments[1];
+	if (options === void 0 || options.type !== "ObjectExpression") return bounded;
+	for (const property of options.properties) {
+		if (property.type !== "Property" || property.computed) continue;
+		if (property.key.type !== "Identifier" || property.key.name !== "of") continue;
+		if (property.value.type !== "ArrayExpression") return bounded;
+		property.value.elements.forEach((element, index) => {
+			if (isConstantPool(element)) bounded.add(index);
+		});
+		return bounded;
+	}
 	return bounded;
 };
 const drawnNamesIn = (predicate, bounded) => {
@@ -1241,12 +1325,12 @@ const drawnNamesIn = (predicate, bounded) => {
 	const addFrom = (value) => {
 		for (const name of identifiersIn(value)) drawn.add(name);
 	};
-	const [first, ...rest] = predicate.params;
-	if (isNode$3(first) && first.type === "ArrayPattern") first.elements.forEach((element, index) => {
+	const [, values, ...rest] = predicate.params;
+	if (isNode$3(values) && values.type === "ArrayPattern") values.elements.forEach((element, index) => {
 		if (bounded.has(index)) return;
 		addFrom(element);
 	});
-	else addFrom(first);
+	else addFrom(values);
 	addFrom(rest);
 	visit(predicate.body, (node) => {
 		if (node.type !== "VariableDeclarator") return;
@@ -1306,7 +1390,7 @@ const check = (context, call, predicate) => {
 			node: iteration.node,
 			messageId: "nestedQuantification",
 			data: {
-				name: VIOLATION_NAME$2,
+				name: VIOLATION_NAME$3,
 				expected: EXPECTED$2,
 				actual: ACTUAL$2,
 				fix: FIX$2
@@ -1321,7 +1405,7 @@ const check = (context, call, predicate) => {
 * and excluded; DISCHARGED_BY in the suite pins the unbounded recipe shape.
 */
 const noNestedQuantification = defineRule({
-	meta: meta$14,
+	meta: meta$15,
 	create(context) {
 		const options = Schema.decodeUnknownSync(Options$2)(context.options[0] ?? {});
 		const exempt = new Set(options.exempt);
@@ -1342,11 +1426,11 @@ const NO_LAYER_IN_FEATURE_NAME = "a *.integration.test.ts feature with no enviro
 const NO_LAYER_IN_FEATURE_EXPECTED = "a Feature builder chained with .withLayer(layer) or .withScenarioLayer(layer)";
 const NO_LAYER_IN_FEATURE_ACTUAL = "a Feature(...) call without .withLayer or .withScenarioLayer";
 const NO_LAYER_IN_FEATURE_FIX = "an integration test under WGI-CLS1 must declare its collaborator environment via .withLayer(...) or .withScenarioLayer(...). Chain .withLayer(Layer.empty) (or .withScenarioLayer(Layer.empty)) if the feature exercises in-memory collaborators without custom services, or provide the external boundary Layer it exercises (e.g. .withLayer(MyService.Live)).";
-const meta$13 = {
+const meta$14 = {
 	type: "problem",
 	docs: { description: "A *.integration.test.ts Feature builder must configure at least one environment Layer (.withLayer or .withScenarioLayer) to enforce real integration boundaries under WGI-CLS1." },
 	schema: [],
-	messages: { noLayerInFeature: MESSAGE$7 }
+	messages: { noLayerInFeature: MESSAGE$9 }
 };
 //#endregion
 //#region src/rules/no-pseudo-gherkin-unit-tests.ts
@@ -1377,7 +1461,7 @@ const findRootFeatureCall = (callNode) => {
 	return null;
 };
 const noPseudoGherkinUnitTests = defineRule({
-	meta: meta$13,
+	meta: meta$14,
 	create(context) {
 		if (!isBehaviourTest(basenameOf(context.filename))) return {};
 		return { CallExpression(node) {
@@ -1401,16 +1485,16 @@ const noPseudoGherkinUnitTests = defineRule({
 });
 //#endregion
 //#region src/rules/no-silent-return.config.ts
-const MESSAGE$4 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const meta$12 = {
+const MESSAGE$5 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const meta$13 = {
 	type: "problem",
 	docs: { description: "Property predicates (it.prop / it.effect.prop from @effect/vitest) must return a boolean verdict on every code path. fast-check counts undefined as success, so a bare return, a non-boolean return, or falling off the end of the body is a silent pass. Opaque values (identifiers, member expressions, calls) are trusted to be boolean; literals and operators are checked." },
 	schema: [],
 	messages: {
-		bareReturn: MESSAGE$4,
-		nonBooleanReturn: MESSAGE$4,
-		missingReturn: MESSAGE$4,
-		nonBooleanBody: MESSAGE$4
+		bareReturn: MESSAGE$5,
+		nonBooleanReturn: MESSAGE$5,
+		missingReturn: MESSAGE$5,
+		nonBooleanBody: MESSAGE$5
 	}
 };
 //#endregion
@@ -1550,7 +1634,7 @@ const checkFn = (context, fn) => {
 	if (!Array$1.last(body.body).pipe(Option.exists(pathExits))) report(context, fn, "missingReturn", "the predicate can fall off the end without returning — undefined is a silent pass");
 };
 const noSilentReturn = defineRule({
-	meta: meta$12,
+	meta: meta$13,
 	create(context) {
 		return { CallExpression(node) {
 			if (!isPropCallee(node.callee)) return;
@@ -1579,21 +1663,21 @@ const SCHEMA_TEST_DETAIL = {
 	actual: "an authored *.schema.test.ts restating generated coverage",
 	fix: "delete it. The generated laws already state round-trip identity and encode stability. What they cannot state is rejection — every input they draw comes from the arbitrary the schema itself supplies — so a refusal belongs in an in-source if (import.meta.vitest) block in the schema file, never here"
 };
-const meta$11 = {
+const meta$12 = {
 	type: "problem",
 	docs: { description: "Under src/, the only sanctioned test file is a single-segment <stem>.workflow.property.test.ts inside a sanctioned test directory, plus the generated schema-laws.test.ts entry point. Every other test file is banned: a kernel, policy, or schema suite becomes an in-source import.meta.vitest block, and a public-surface test moves outside src/ as an integration test. The sanctioned directory list is the sanctionedDirs option, defaulting to the one directory this repo runs." },
 	schema: [Schema.toJsonSchemaDocument(Options$1).schema],
 	messages: {
-		testFileInSrc: MESSAGE$7,
-		schemaTestInSrc: MESSAGE$7,
-		propertyTestOutsideTestsDir: MESSAGE$7
+		testFileInSrc: MESSAGE$9,
+		schemaTestInSrc: MESSAGE$9,
+		propertyTestOutsideTestsDir: MESSAGE$9
 	}
 };
 //#endregion
 //#region src/rules/no-test-file-in-src.ts
 const violationOf = (basename, isPropertyTest, dir) => basename.endsWith(".schema.test.ts") ? ["schemaTestInSrc", SCHEMA_TEST_DETAIL] : isPropertyTest ? ["propertyTestOutsideTestsDir", propertyTestLocationDetail(dir)] : ["testFileInSrc", testFileInSrcDetail(dir)];
 const noTestFileInSrc = defineRule({
-	meta: meta$11,
+	meta: meta$12,
 	create(context) {
 		const { sanctionedDirs } = Schema.decodeUnknownSync(Options$1)(context.options[0] ?? {});
 		const basename = basenameOf(context.filename);
@@ -1646,7 +1730,7 @@ const PREDICATE_SYMBOLS = /* @__PURE__ */ new Set([
 const NULLARY_PREDICATE_SYMBOLS = /* @__PURE__ */ new Set(["⊥"]);
 const PASCAL_CASE = /^[A-Z][a-z][a-zA-Z0-9]*$/;
 const DAMP_WORDS = /When|Should|Given|Then|Otherwise|After|Before/;
-const meta$10 = {
+const meta$11 = {
 	type: "suggestion",
 	docs: { description: "Enforce a complete formal-specification name for property-based tests (it.prop / it.effect.prop). Format: [ScopeSymbol][binder]_[Domain]_[PredicateSymbol][operand] (e.g., ∀x_DecodeEncode_=x, ∀l_Filter_⊆Input, →Shipped_Cancel_⊥Allowed). Both the quantifier and the predicate must carry an operand — a bare symbol specifies nothing." },
 	schema: [],
@@ -1690,7 +1774,7 @@ const parseSegments = (name) => {
 	};
 };
 const pbtNaming = defineRule({
-	meta: meta$10,
+	meta: meta$11,
 	create(context) {
 		return { CallExpression(node) {
 			if (!isPropCall(node)) return;
@@ -1782,8 +1866,8 @@ const pbtNaming = defineRule({
 });
 //#endregion
 //#region src/rules/prop-arbitrary-schema-origin.config.ts
-const MESSAGE$3 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const VIOLATION_NAME$1 = "a hand-built fast-check arbitrary with no schema underneath";
+const MESSAGE$4 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const VIOLATION_NAME$2 = "a hand-built fast-check arbitrary with no schema underneath";
 const EXPECTED$1 = "every in-source it.prop arbitrary derives from an Effect Schema — a schema reference, a schema-attached arbitrary annotation, or a pipe/map/oneof chain rooted in one; an input with no schema grows one first";
 const ACTUAL$1 = "the arbitrary is assembled from fast-check constructors alone, so the generator can emit shapes the schema never declared and the suite stays green while exercising almost nothing";
 const FIX$1 = "delete the block, or grow the schema the input needs and derive the arbitrary from it — Arbitrary.schema(schema) is the sanctioned derivation; nothing rewrites a hand-built generator into a property";
@@ -1798,13 +1882,13 @@ const SCHEMA_NAMESPACE_NAMES = {
 };
 const FASTCHECK_NAMESPACE_NAMES = { FastCheck: true };
 const COMBINATOR_CALLEES = { pipe: true };
-const meta$9 = {
+const meta$10 = {
 	type: "problem",
 	docs: { description: "Inside an import.meta.vitest in-source block, every it.prop / it.effect.prop arbitrary must derive from an Effect Schema — a schema reference, a schema-attached arbitrary annotation, or a chain rooted in one. A hand-built fast-check construction with no schema underneath reports; statically opaque arbitraries (unresolved or foreign bindings) fail open into the runtime domain audit." },
 	schema: [],
 	messages: {
-		handBuiltArbitrary: MESSAGE$3,
-		stockDerivedArbitrary: MESSAGE$3
+		handBuiltArbitrary: MESSAGE$4,
+		stockDerivedArbitrary: MESSAGE$4
 	}
 };
 //#endregion
@@ -2062,26 +2146,49 @@ const checkArbitraryFactory = (provenance, context, call) => {
 		}
 	});
 };
-const checkPropCall$1 = (provenance, context, call) => {
-	const arbitraries = call.arguments.find((argument) => argument.type === "ArrayExpression");
-	if (arbitraries === void 0) return;
-	for (const element of arbitraries.elements) {
+const reportHandBuilt = (provenance, context, node) => {
+	if (provenance.verdictOf(node, 0) !== "handBuilt") return;
+	context.report({
+		node,
+		messageId: "handBuiltArbitrary",
+		data: {
+			name: VIOLATION_NAME$2,
+			expected: EXPECTED$1,
+			actual: ACTUAL$1,
+			fix: FIX$1
+		}
+	});
+};
+const checkArrayOf = (provenance, context, of) => {
+	for (const element of of.elements) {
 		if (element === null) continue;
-		if (provenance.verdictOf(element, 0) !== "handBuilt") continue;
-		context.report({
-			node: element,
-			messageId: "handBuiltArbitrary",
-			data: {
-				name: VIOLATION_NAME$1,
-				expected: EXPECTED$1,
-				actual: ACTUAL$1,
-				fix: FIX$1
-			}
-		});
+		reportHandBuilt(provenance, context, element);
+	}
+};
+const checkRecordOf = (provenance, context, of) => {
+	for (const member of of.properties) {
+		if (member.type !== "Property" || member.computed) continue;
+		reportHandBuilt(provenance, context, member.value);
+	}
+};
+const checkPropCall$1 = (provenance, context, call) => {
+	const options = call.arguments[1];
+	if (options === void 0 || options.type !== "ObjectExpression") return;
+	for (const property of options.properties) {
+		if (property.type !== "Property" || property.computed) continue;
+		if (property.key.type !== "Identifier" || property.key.name !== "of") continue;
+		if (property.value.type === "ArrayExpression") {
+			checkArrayOf(provenance, context, property.value);
+			return;
+		}
+		if (property.value.type === "ObjectExpression") {
+			checkRecordOf(provenance, context, property.value);
+			return;
+		}
 	}
 };
 const propArbitrarySchemaOrigin = defineRule({
-	meta: meta$9,
+	meta: meta$10,
 	create(context) {
 		const provenance = new Provenance(context.sourceCode.getScope);
 		const collect = (value, out) => {
@@ -2140,16 +2247,16 @@ const propArbitrarySchemaOrigin = defineRule({
 });
 //#endregion
 //#region src/rules/prop-fixture-schema-origin.config.ts
-const MESSAGE$2 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const VIOLATION_NAME = "a hand-rolled recursive schema fixture inside a test block";
+const MESSAGE$3 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const VIOLATION_NAME$1 = "a hand-rolled recursive schema fixture inside a test block";
 const EXPECTED = "a recursive fixture schema enters the block through a named local builder call, or its recursion point declares its generation with a visible toCodecArbitrary derivation or a recursionBudget ceiling";
 const ACTUAL = "the union and its recursion cycle are assembled inline, so the suite exercises a surrogate universe the shipped schema contract never declared and no budget gate grades";
 const FIX = "hoist the members into a named builder the annotated and counterfactual fixtures share, or declare the recursion point's generation in its annotation";
-const meta$8 = {
+const meta$9 = {
 	type: "problem",
 	docs: { description: "Inside an import.meta.vitest in-source block or a *.test.ts file, a recursive schema union must enter through a named local builder or an imported helper, or its recursion point must declare its generation with a visible toCodecArbitrary derivation or recursionBudget ceiling. An inline hand-rolled recursive union reports; outside test scope the rule is silent, because production schemas are the derivation-cost rule domain." },
 	schema: [],
-	messages: { handRolledRecursiveFixture: MESSAGE$2 }
+	messages: { handRolledRecursiveFixture: MESSAGE$3 }
 };
 //#endregion
 //#region src/rules/prop-fixture-schema-origin.ts
@@ -2323,7 +2430,7 @@ const isNamedBuilderOrigin = (union, getScope) => {
 	return false;
 };
 const propFixtureSchemaOrigin = defineRule({
-	meta: meta$8,
+	meta: meta$9,
 	create(context) {
 		const getScope = context.sourceCode.getScope;
 		return { CallExpression(node) {
@@ -2340,7 +2447,7 @@ const propFixtureSchemaOrigin = defineRule({
 				node,
 				messageId: "handRolledRecursiveFixture",
 				data: {
-					name: VIOLATION_NAME,
+					name: VIOLATION_NAME$1,
 					expected: EXPECTED,
 					actual: ACTUAL,
 					fix: FIX
@@ -2351,7 +2458,7 @@ const propFixtureSchemaOrigin = defineRule({
 });
 //#endregion
 //#region src/rules/prop-generated-law-duplicate.config.ts
-const MESSAGE$1 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const MESSAGE$2 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
 const COMPILER_NAME = "a runtime probe of a compile-time guarantee";
 const COMPILER_EXPECTED = "the type checker owns brand and nominal-identity contracts — a dropped brand is a compile error at the consumer brand gate, not a failing property";
 const COMPILER_ACTUAL = "the predicate reflects over brand symbols at runtime, so it re-asserts what tsc already enforces and passes whenever the type system passes";
@@ -2360,13 +2467,13 @@ const NO_FUNCTION_NAME = "a property that tests no function";
 const NO_FUNCTION_EXPECTED = "every in-source property exercises domain logic — at least one call to a module-local function that is not a schema codec accessor — because a predicate that only feeds values through encode or decode tests the schema declaration, not code, and decode acceptance and refusal alike are generated or declared elsewhere";
 const NO_FUNCTION_ACTUAL = "no call in the predicate reaches module code — every call is a codec accessor, a schema wrapper, or an iteration combinator — so the property cannot fail unless the declaration it restates changes meaning";
 const NO_FUNCTION_FIX = "delete the prop; test the function that owns the decision — the workflow or a private helper in this module — with its input derived from a domain schema";
-const meta$7 = {
+const meta$8 = {
 	type: "problem",
 	docs: { description: "Inside an import.meta.vitest in-source block: a predicate that reflects over brand symbols re-asserts a compile-time guarantee, and a predicate containing no module-local non-codec function call tests a schema declaration instead of code. Both report." },
 	schema: [],
 	messages: {
-		compilerDuplicate: MESSAGE$1,
-		noDomainFunction: MESSAGE$1
+		compilerDuplicate: MESSAGE$2,
+		noDomainFunction: MESSAGE$2
 	}
 };
 //#endregion
@@ -2506,7 +2613,7 @@ const checkPropCall = (provenance, context, call) => {
 	});
 };
 const propGeneratedLawDuplicate = defineRule({
-	meta: meta$7,
+	meta: meta$8,
 	create(context) {
 		const provenance = new Provenance(context.sourceCode.getScope);
 		const collect = (value, out) => {
@@ -2549,17 +2656,17 @@ const propGeneratedLawDuplicate = defineRule({
 //#endregion
 //#region src/rules/property-file-purity.config.ts
 const PROPERTY_TEST_SUFFIX = ".property.test.ts";
-const MESSAGE = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const meta$6 = {
+const MESSAGE$1 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const meta$7 = {
 	type: "problem",
 	docs: { description: "Property tests live ONLY in *.property.test.ts files, and those files contain ONLY property tests. In a property file: no plain it()/test()/it.effect(), no raw fc.assert/fc.check/fc.property/fc.asyncProperty. In any other test file: no FastCheck import and no it.prop/it.effect.prop — move the property to a *.property.test.ts file." },
 	schema: [],
 	messages: {
-		plainIt: MESSAGE,
-		plainEffectIt: MESSAGE,
-		rawFastCheck: MESSAGE,
-		fastCheckImport: MESSAGE,
-		propCall: MESSAGE
+		plainIt: MESSAGE$1,
+		plainEffectIt: MESSAGE$1,
+		rawFastCheck: MESSAGE$1,
+		fastCheckImport: MESSAGE$1,
+		propCall: MESSAGE$1
 	}
 };
 //#endregion
@@ -2576,7 +2683,7 @@ const PROPERTY_FILE_KIND = {
 	plainFix: "move the scenario test to a plain *.test.ts file, or rewrite it as a property with arbitraries and a boolean-returning predicate",
 	rawFcExpected: "it.prop(...) or it.effect.prop(...) from @effect/vitest",
 	rawFcActualSuffix: "bypasses the vitest/Effect integration",
-	rawFcFix: "rewrite as it.prop(name, [arbitraries], predicate) returning a boolean; fc.* stays for building arbitraries (fc.pre, fc.stringMatching, ...)"
+	rawFcFix: "rewrite as it.prop(name, { of, subject, runs }, holds) returning a boolean; fc.* stays for building arbitraries (fc.pre, fc.stringMatching, ...)"
 };
 const DIFFERENTIAL_FILE_KIND = {
 	suffix: DIFFERENTIAL_SUFFIX,
@@ -2666,7 +2773,7 @@ const createScenarioFileVisitors = (context) => ({
 });
 const kindOf = (filename) => filename.endsWith(".differential.test.ts") ? DIFFERENTIAL_FILE_KIND : PROPERTY_FILE_KIND;
 const propertyFilePurity = defineRule({
-	meta: meta$6,
+	meta: meta$7,
 	create(context) {
 		if (!isTestFile(basenameOf(context.filename))) return {};
 		if (context.filename.endsWith(".property.test.ts") || context.filename.endsWith(".differential.test.ts")) return createPropertyFileVisitors(context, kindOf(context.filename));
@@ -2682,12 +2789,12 @@ const UNSANCTIONED_CELL_FIX = "rename it <stem>.workflow.property.test.ts beside
 const MISSING_CELL_TEST_EXPECTED = "a test for every cell suffix the consumer lists in cellsRequiringTest";
 const MISSING_CELL_TEST_ACTUAL = "a declared cell whose own module carries no `if (import.meta.vitest)` block";
 const MISSING_CELL_TEST_FIX = "add an `if (import.meta.vitest)` block to this module, or drop this cell from cellsRequiringTest and cover it with a colocated test in a sanctioned test directory — the rule reads the file it is given, so a sibling test file is invisible to it and a declared cell must satisfy the requirement from its own source";
-const meta$5 = {
+const meta$6 = {
 	type: "problem",
 	docs: { description: "A property test under src/ must be a single-segment <stem>.workflow.property.test.ts beside the <stem>.workflow.ts it covers; every other property-test basename is unsanctioned. A source file whose suffix names a cell listed in the cellsRequiringTest option must additionally carry an in-source vitest block; that list is empty by default, so the presence arm is opt-in per consumer." },
 	schema: [Schema.toJsonSchemaDocument(Options).schema],
 	messages: {
-		unsanctionedCell: MESSAGE$7,
+		unsanctionedCell: MESSAGE$9,
 		missingCellTest: ABSENCE_MESSAGE
 	}
 };
@@ -2695,7 +2802,7 @@ const meta$5 = {
 //#region src/rules/src-property-test-cell.ts
 const carriesInSourceBlock = (body) => body.some((statement) => statement.type === "IfStatement" && isVitestGuard(statement.test));
 const srcPropertyTestCell = defineRule({
-	meta: meta$5,
+	meta: meta$6,
 	create(context) {
 		const { cellsRequiringTest } = Schema.decodeUnknownSync(Options)(context.options[0] ?? {});
 		const filename = context.filename;
@@ -2748,7 +2855,7 @@ const testFileOutsideTestsDir = defineRule({
 		type: "problem",
 		docs: { description: "Test files outside src/ must live under a tests/ directory; free-standing test files have no sanctioned home." },
 		schema: [],
-		messages: { strayTestFile: MESSAGE$7 }
+		messages: { strayTestFile: MESSAGE$9 }
 	},
 	create(context) {
 		if (isUnderSrc(context.filename)) return {};
@@ -2780,7 +2887,7 @@ const testSuffixOutsideSrc = defineRule({
 		type: "problem",
 		docs: { description: "Outside src/, a test file ends .integration.test.ts, .differential.test.ts, or .trace.test.ts." },
 		schema: [],
-		messages: { unsanctionedSuffix: MESSAGE$7 }
+		messages: { unsanctionedSuffix: MESSAGE$9 }
 	},
 	create(context) {
 		const filename = context.filename;
@@ -2814,7 +2921,7 @@ const testsDirHelpersInFixtures = defineRule({
 		type: "problem",
 		docs: { description: "Under tests/, the only non-test modules are helpers and fixtures, and they live inside tests/__fixtures__/." },
 		schema: [],
-		messages: { helperOutsideFixtures: MESSAGE$7 }
+		messages: { helperOutsideFixtures: MESSAGE$9 }
 	},
 	create(context) {
 		const filename = context.filename;
@@ -2843,11 +2950,11 @@ const testsDirHelpersInFixtures = defineRule({
 const REACH_IN_EXPECTED = "a package name or subpath, or a sibling helper under the test tree";
 const REACH_IN_ACTUAL = "a relative import that reaches src or climbs into an internal folder";
 const REACH_IN_FIX = "rewrite onto the published package name when the binding is public. Delete the test when the subject is an internal";
-const meta$1 = {
+const meta$2 = {
 	type: "problem",
 	docs: { description: "Forbid package-level tests from relative-importing src or climbing into an internal folder" },
 	schema: [],
-	messages: { sourceReachIn: MESSAGE$7 }
+	messages: { sourceReachIn: MESSAGE$9 }
 };
 //#endregion
 //#region src/rules/tests-import-public-api.ts
@@ -2865,7 +2972,7 @@ const specifierOf = (node) => {
 	if (node.type === "Literal" && typeof node.value === "string") return node.value;
 };
 const testsImportPublicApi = defineRule({
-	meta: meta$1,
+	meta: meta$2,
 	create(context) {
 		if (!isInTestsImportScope(context.filename)) return {};
 		const reportIfForbidden = (sourceNode) => {
@@ -2923,14 +3030,14 @@ const HTTP_TERMINATION_FIX = "replace the HTTP assertion with a relation over th
 const RAW_EMIT_EXPECTED = "spans declared once with Span.declare({ id, name, attrs }) inside the traced cell; the spec observes the decoded graph";
 const RAW_EMIT_ACTUAL = "a raw span emit call inside a trace spec";
 const RAW_EMIT_FIX = "delete the emit; declare the span with Span.declare in the system under test and assert on the graph the spec receives";
-const meta = {
+const meta$1 = {
 	type: "problem",
 	docs: { description: "A *.trace.test.ts must import its harness from @systemfsoftware/trace-spec and terminate cases on relation holds over the declared span graph. Raw emit calls (startSpan, spanBuilder, startActiveSpan) and HTTP status, statusText, or body assertions (expect(res.status).toBe(200), expect(res).toHaveProperty(\"status\", 200), expect(res).resolves.toMatchObject({ status: 200 }), expect(res).toEqual(expect.objectContaining({ status: 200 }))) are forbidden — replacing that altitude is what a trace spec exists for." },
 	schema: [],
 	messages: {
-		missingHarnessImport: MESSAGE$7,
-		httpTermination: MESSAGE$7,
-		rawEmitCall: MESSAGE$7
+		missingHarnessImport: MESSAGE$9,
+		httpTermination: MESSAGE$9,
+		rawEmitCall: MESSAGE$9
 	}
 };
 //#endregion
@@ -3097,7 +3204,7 @@ const reportHttpTermination = (context, node) => {
 	});
 };
 const traceTestRequiresTaxonomy = defineRule({
-	meta,
+	meta: meta$1,
 	create(context) {
 		if (!context.filename.endsWith(".trace.test.ts")) return {};
 		let hasHarnessImport = false;
@@ -3126,6 +3233,56 @@ const traceTestRequiresTaxonomy = defineRule({
 	}
 });
 //#endregion
+//#region src/rules/vitest-from-effect-vitest.config.ts
+const MESSAGE = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const VIOLATION_NAME = "a value import from vitest";
+const VIOLATION_EXPECTED = "every test value imported from @effect/vitest, which re-exports all of Vitest";
+const VIOLATION_ACTUAL = "a named, namespace, default, side-effect or dynamic value import from vitest";
+const VIOLATION_FIX = "import it from @effect/vitest instead of vitest";
+const meta = {
+	type: "problem",
+	docs: { description: "Every value a test uses from Vitest is imported from @effect/vitest, which re-exports all of Vitest. Any value import from vitest — named, namespace, default, side-effect or dynamic — is refused; a type-only import stays legal." },
+	schema: [],
+	messages: { vitestImport: MESSAGE }
+};
+//#endregion
+//#region src/rules/vitest-from-effect-vitest.ts
+const isTypeOnly = (node) => {
+	if (node.importKind === "type") return true;
+	if (node.specifiers.length === 0) return false;
+	return node.specifiers.every((specifier) => specifier.type === "ImportSpecifier" && specifier.importKind === "type");
+};
+const isVitestLiteral = (node) => node.type === "Literal" && typeof node.value === "string" && node.value === "vitest";
+const vitestFromEffectVitest = defineRule({
+	meta,
+	create(context) {
+		if (isRawVitestPackage(context.filename)) return {};
+		const report = (node) => {
+			context.report({
+				node,
+				messageId: "vitestImport",
+				data: {
+					name: VIOLATION_NAME,
+					expected: VIOLATION_EXPECTED,
+					actual: VIOLATION_ACTUAL,
+					fix: VIOLATION_FIX
+				}
+			});
+		};
+		return {
+			ImportDeclaration(node) {
+				if (node.source.value !== "vitest") return;
+				if (isTypeOnly(node)) return;
+				report(node);
+			},
+			ImportExpression(node) {
+				if (!isVitestLiteral(node.source)) return;
+				report(node);
+			}
+		};
+	}
+});
+//#endregion
 //#region src/index.ts
 const PLUGIN_NAME = "@systemfsoftware/oxlint-plugin-test-discipline";
 const rule = (name) => `${PLUGIN_NAME}/${name}`;
@@ -3150,6 +3307,8 @@ const recommendedRules = {
 	[rule("behaviour-exercises-use-case")]: "error",
 	[rule("behaviour-one-feature-per-file")]: "error",
 	[rule("tests-dir-helpers-in-fixtures")]: "error",
+	[rule("expect-boolean-predicate")]: "error",
+	[rule("vitest-from-effect-vitest")]: "error",
 	[rule("no-io-module-in-source-test")]: "error",
 	[rule("tests-import-public-api")]: "error",
 	[rule("differential-test-requires-harness")]: "error",
@@ -3181,6 +3340,8 @@ var src_default = {
 		"behaviour-one-feature-per-file": behaviourOneFeaturePerFile,
 		"no-pseudo-gherkin-unit-tests": noPseudoGherkinUnitTests,
 		"tests-dir-helpers-in-fixtures": testsDirHelpersInFixtures,
+		"expect-boolean-predicate": expectBooleanPredicate,
+		"vitest-from-effect-vitest": vitestFromEffectVitest,
 		"no-io-module-in-source-test": noIoModuleInSourceTest,
 		"tests-import-public-api": testsImportPublicApi,
 		"differential-test-requires-harness": differentialTestRequiresHarness,

package/dist/oxlint-plugin-test-discipline-untrimmed.d.ts

@@ -26,6 +26,8 @@ declare const _default: {
         'behaviour-one-feature-per-file': Rule;
         'no-pseudo-gherkin-unit-tests': Rule;
         'tests-dir-helpers-in-fixtures': Rule;
+        'expect-boolean-predicate': Rule;
+        'vitest-from-effect-vitest': Rule;
         'no-io-module-in-source-test': Rule;
         'tests-import-public-api': Rule;
         'differential-test-requires-harness': Rule;

package/dist/oxlint-plugin-test-discipline.d.ts

@@ -26,6 +26,8 @@ declare const _default: {
         'behaviour-one-feature-per-file': Rule;
         'no-pseudo-gherkin-unit-tests': Rule;
         'tests-dir-helpers-in-fixtures': Rule;
+        'expect-boolean-predicate': Rule;
+        'vitest-from-effect-vitest': Rule;
         'no-io-module-in-source-test': Rule;
         'tests-import-public-api': Rule;
         'differential-test-requires-harness': Rule;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@systemfsoftware/oxlint-plugin-test-discipline",
   "license": "Apache-2.0",
-  "version": "3.8.1",
+  "version": "3.9.0",
   "author": "Ryan Lee <drdgvhbh@gmail.com>",
   "repository": {
     "type": "git",