@geonosis/doctor 1.0.0

package/dist/chunk-R4AHDFE3.js

@@ -0,0 +1,1122 @@
+// src/discover.ts
+import { readdirSync, readFileSync, statSync } from "fs";
+import { join, relative as relativeTo, sep } from "path";
+var CONFIG_FILE = ".oxlintrc.json";
+var MANIFEST_FILE = "package.json";
+var RATCHET_FILE = "geonosis.ratchet.json";
+var NEVER_WALKED = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
+var skipped = (name) => name.startsWith(".") || NEVER_WALKED.has(name);
+var relativePath = (root, path) => relativeTo(root, path).split(sep).join("/");
+var walk = (dir, onFile) => {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (!skipped(entry.name)) walk(join(dir, entry.name), onFile);
+      continue;
+    }
+    if (entry.isFile()) onFile(join(dir, entry.name), entry.name);
+  }
+};
+var parse = (path) => JSON.parse(readFileSync(path, "utf8"));
+var readConfig = (path, root) => {
+  const dir = join(path, "..");
+  const relative = relativePath(root, path);
+  try {
+    const config = parse(path);
+    const jsPlugins = Array.isArray(config.jsPlugins) ? config.jsPlugins.filter((one) => typeof one === "string") : [];
+    const rules = typeof config.rules === "object" && config.rules !== null ? config.rules : {};
+    return { dir, jsPlugins, path, relative, rules };
+  } catch (error) {
+    return {
+      dir,
+      error: `could not read it: ${error.message}`,
+      jsPlugins: [],
+      path,
+      relative,
+      rules: {}
+    };
+  }
+};
+var discoverConfigs = (root) => {
+  const found = [];
+  walk(root, (path, name) => {
+    if (name === CONFIG_FILE) found.push(readConfig(path, root));
+  });
+  return found.toSorted((a, b) => a.relative.localeCompare(b.relative));
+};
+var discoverWorkspaces = (root) => {
+  const found = [];
+  walk(root, (path, name) => {
+    if (name !== MANIFEST_FILE) return;
+    let manifest;
+    try {
+      manifest = parse(path);
+    } catch {
+      return;
+    }
+    found.push({ dir: join(path, ".."), manifest, relative: relativePath(root, join(path, "..")) });
+  });
+  return found.toSorted((a, b) => a.relative.localeCompare(b.relative));
+};
+var readRatchet = (root) => {
+  const path = join(root, RATCHET_FILE);
+  try {
+    statSync(path);
+  } catch {
+    return void 0;
+  }
+  const config = parse(path);
+  return {
+    baseline: typeof config.baseline === "string" ? config.baseline : "gate-baseline.json",
+    counters: Array.isArray(config.counters) ? config.counters : []
+  };
+};
+
+// src/baseline.ts
+import { spawnSync } from "child_process";
+var DEFAULT_REF = "origin/main";
+var git = (root, args) => {
+  const run = spawnSync("git", args, { cwd: root, encoding: "utf8" });
+  return { code: run.status ?? -1, output: `${run.stdout ?? ""}${run.stderr ?? ""}` };
+};
+var defaultRef = (root) => git(root, ["rev-parse", "--verify", "--quiet", DEFAULT_REF]).code === 0 ? DEFAULT_REF : void 0;
+var numbersAt = (root, ref, path) => {
+  const shown = git(root, ["show", `${ref}:${path}`]);
+  if (shown.code !== 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(shown.output);
+  } catch {
+    return void 0;
+  }
+  const numbers = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value === "number") numbers[key] = value;
+  }
+  return numbers;
+};
+var finding = (subject, verdict, message) => ({
+  check: "baseline",
+  message,
+  subject,
+  verdict
+});
+var checkBaseline = ({ ref, root }) => {
+  const ratchet = readRatchet(root);
+  if (ratchet === void 0) {
+    return [
+      finding(
+        RATCHET_FILE,
+        "SKIP",
+        `no ${RATCHET_FILE} at this root \u2014 there is no baseline for a ref to be compared against`
+      )
+    ];
+  }
+  const path = ratchet.baseline;
+  const here = numbersAt(root, "HEAD", path);
+  if (here === void 0) {
+    return [finding(path, "SKIP", `HEAD has no readable ${path} \u2014 nothing committed to compare`)];
+  }
+  const there = numbersAt(root, ref, path);
+  if (there === void 0) {
+    return [
+      finding(
+        path,
+        "SKIP",
+        `${ref} has no readable ${path} \u2014 this repo cannot be compared against it`
+      )
+    ];
+  }
+  const grew = Object.entries(there).filter(([key, was]) => (here[key] ?? was) > was).map(
+    ([key, was]) => finding(path, "FAIL", `${key} ${was} \u2192 ${here[key] ?? was} (grew against ${ref})`)
+  );
+  return grew.length > 0 ? grew : [
+    finding(
+      path,
+      "OK",
+      `no counter grew against ${ref} (${Object.keys(there).length} compared)`
+    )
+  ];
+};
+
+// src/types.ts
+var CHECKS = [
+  "loaded",
+  "exercised",
+  "baseline",
+  "runner",
+  "drift",
+  "observability"
+];
+var DoctorError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DoctorError";
+  }
+};
+
+// src/resolve.ts
+import { existsSync, readFileSync as readFileSync2, realpathSync } from "fs";
+import { createRequire } from "module";
+import { dirname, join as join2 } from "path";
+import { pathToFileURL } from "url";
+var resolveFrom = (dir, specifier) => createRequire(join2(dir, "noop.js")).resolve(specifier);
+var packageDirOf = (entry, name) => {
+  let dir = dirname(entry);
+  for (; ; ) {
+    const manifest = join2(dir, "package.json");
+    if (existsSync(manifest)) {
+      try {
+        const parsed = JSON.parse(readFileSync2(manifest, "utf8"));
+        if (parsed.name === name) return dir;
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      throw new DoctorError(`${entry} sits under no package.json naming "${name}"`);
+    }
+    dir = parent;
+  }
+};
+var pluginVersionOf = async (entry) => {
+  const loaded = await import(pathToFileURL(entry).href);
+  const version = loaded.default?.meta?.version;
+  if (typeof version !== "string") {
+    throw new DoctorError(
+      `${entry} exports no default plugin carrying a meta.version \u2014 nothing in it says which version oxlint loaded`
+    );
+  }
+  return version;
+};
+var corpusOfPlugin = (from, specifier) => join2(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
+var real = (path) => {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+};
+var relativeToRoot = (root, path) => relativePath(real(root), real(path));
+
+// src/drift.ts
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join3, sep as sep2 } from "path";
+var WORKFLOWS = ".github/workflows";
+var SETTINGS = ".claude/settings.json";
+var GEONOSIS = "geonosis.json";
+var LAW = "CLAUDE.md";
+var CEILING = 200;
+var SWITCHED_OFF = /^\s*if:\s*(?:\$\{\{\s*)?false\b/m;
+var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+var finding2 = (subject, verdict, message) => ({
+  check: "drift",
+  message,
+  subject,
+  verdict
+});
+var NEVER_WALKED2 = /* @__PURE__ */ new Set(["build", "coverage", "dist", "node_modules", "storybook-static"]);
+var filesUnder = (dir, match) => {
+  const found = [];
+  const walk2 = (at) => {
+    let entries;
+    try {
+      entries = readdirSync2(at, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join3(at, entry.name));
+        continue;
+      }
+      if (entry.isFile() && match(entry.name)) found.push(join3(at, entry.name));
+    }
+  };
+  walk2(dir);
+  return found;
+};
+var ci = (root) => {
+  const dir = join3(root, WORKFLOWS);
+  if (!existsSync2(dir)) {
+    return [finding2(WORKFLOWS, "SKIP", "there are no workflows here to read")];
+  }
+  return filesUnder(dir, (name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((path) => {
+    const at = relativePath(root, path);
+    return SWITCHED_OFF.test(readFileSync3(path, "utf8")) ? finding2(
+      at,
+      "FAIL",
+      "a job or step here is switched off by a condition that can never be true \u2014 every gate downstream of it reports green having run nothing"
+    ) : finding2(at, "OK", "nothing in it is switched off");
+  });
+};
+var holds = (parent, child) => child === parent || child.startsWith(`${parent}${sep2}`);
+var ownersOf = (path, workspaces) => workspaces.filter((one) => holds(one.dir, path)).toSorted((a, b) => b.dir.length - a.dir.length);
+var orphanTests = (root, workspaces) => {
+  const orphaned = /* @__PURE__ */ new Map();
+  for (const path of filesUnder(root, (name) => TEST_FILE.test(name))) {
+    const owners = ownersOf(path, workspaces);
+    if (owners.some((one) => typeof one.manifest.scripts?.test === "string")) continue;
+    const owner = owners[0];
+    if (owner === void 0) continue;
+    const at = owner.relative === "" ? "package.json" : `${owner.relative}/package.json`;
+    orphaned.set(at, [...orphaned.get(at) ?? [], relativePath(root, path)]);
+  }
+  if (orphaned.size === 0) {
+    return [finding2("test files", "OK", "every test file sits under a workspace that runs tests")];
+  }
+  return [...orphaned.entries()].map(
+    ([at, files]) => finding2(
+      at,
+      "FAIL",
+      `${files.length} test file(s) here and no test script to run them \u2014 ${files.slice(0, 3).join(", ")}`
+    )
+  );
+};
+var readGeonosis = (root) => {
+  const path = join3(root, GEONOSIS);
+  if (!existsSync2(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+};
+var law = (root, config) => {
+  const declared = config?.law ?? {};
+  const file = typeof declared.file === "string" ? declared.file : LAW;
+  const ceiling = typeof declared.maxLines === "number" ? declared.maxLines : CEILING;
+  const path = join3(root, file);
+  if (!existsSync2(path)) {
+    return [finding2(file, "SKIP", "there is no law file here to measure")];
+  }
+  const source = readFileSync3(path, "utf8");
+  const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
+  return [
+    lines > ceiling ? finding2(
+      file,
+      "WARN",
+      `${lines} lines against a ceiling of ${ceiling} \u2014 depth belongs in the skills and in the rules, where it is read`
+    ) : finding2(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
+  ];
+};
+var hooks = (root) => {
+  const path = join3(root, SETTINGS);
+  if (!existsSync2(path)) {
+    return [
+      finding2(
+        SETTINGS,
+        "WARN",
+        "nothing here installs the kit\u2019s plugin, so none of the hooks, agents or skills reach this repo \u2014 the gates run, the method does not"
+      )
+    ];
+  }
+  const source = readFileSync3(path, "utf8");
+  return [
+    source.includes("geonosis") ? finding2(SETTINGS, "OK", "it installs the kit\u2019s plugin") : finding2(SETTINGS, "WARN", "it names no geonosis plugin or marketplace")
+  ];
+};
+var READERS = {
+  ledger: "@geonosis/ledger",
+  review: "@geonosis/review",
+  testbed: "@geonosis/testbed",
+  verify: "@geonosis/verify",
+  walk: "@geonosis/walk"
+};
+var resolves = (root, name) => {
+  try {
+    resolveFrom(root, name);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var blocks = (root, config, readers) => {
+  if (config === void 0) {
+    return [
+      finding2(
+        GEONOSIS,
+        "SKIP",
+        "there is no geonosis.json here, so no block says what this repo asks the kit to do"
+      )
+    ];
+  }
+  return Object.entries(readers).flatMap(([block, name]) => {
+    const declared = config[block] !== void 0;
+    const installed = resolves(root, name);
+    if (declared && !installed) {
+      return [
+        finding2(
+          name,
+          "WARN",
+          `geonosis.json has a "${block}" block and ${name} is not installed here \u2014 nothing reads it`
+        )
+      ];
+    }
+    if (!declared && installed) {
+      return [
+        finding2(
+          name,
+          "WARN",
+          `${name} is installed and geonosis.json has no "${block}" block \u2014 it runs on its defaults, whatever they are`
+        )
+      ];
+    }
+    return declared ? [finding2(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
+  });
+};
+var pluginDirsConfigured = (root) => {
+  const path = join3(root, ".oxlintrc.json");
+  if (!existsSync2(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const rule = parsed.rules?.["biological-architecture/no-unregistered-plugin-dir"];
+    const options = Array.isArray(rule) ? rule[1] : void 0;
+    if (options?.roots === void 0 || typeof options.registry !== "string") return void 0;
+    return {
+      manifests: options.manifests ?? ["index.ts"],
+      registry: options.registry,
+      roots: options.roots
+    };
+  } catch {
+    return void 0;
+  }
+};
+var pluginDirs = (root) => {
+  const configured = pluginDirsConfigured(root);
+  if (configured === void 0) {
+    return [
+      finding2(
+        "plugin directories",
+        "SKIP",
+        "no-unregistered-plugin-dir is not configured here, so this repo has not said where its integrations live"
+      )
+    ];
+  }
+  const registryPath = join3(root, configured.registry);
+  if (!existsSync2(registryPath)) {
+    return [finding2(configured.registry, "FAIL", "the registry the rule names is not there")];
+  }
+  const registry = readFileSync3(registryPath, "utf8");
+  const unreachable = [];
+  for (const rootDir of configured.roots) {
+    const at = join3(root, rootDir);
+    if (!existsSync2(at)) continue;
+    for (const entry of readdirSync2(at, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const hasManifest = configured.manifests.some(
+        (name) => existsSync2(join3(at, entry.name, name))
+      );
+      if (hasManifest && !registry.includes(entry.name)) {
+        unreachable.push(`${rootDir}/${entry.name}`);
+      }
+    }
+  }
+  return [
+    unreachable.length === 0 ? finding2(
+      configured.registry,
+      "OK",
+      "every directory under the declared roots is named by it"
+    ) : finding2(
+      configured.registry,
+      "FAIL",
+      `${unreachable.length} directory(ies) it never names: ${unreachable.join(", ")}`
+    )
+  ];
+};
+var checkDrift = ({
+  readers = READERS,
+  root,
+  workspaces
+}) => {
+  const config = readGeonosis(root);
+  return [
+    ...ci(root),
+    ...orphanTests(root, workspaces),
+    ...pluginDirs(root),
+    ...law(root, config),
+    ...hooks(root),
+    ...blocks(root, config, readers)
+  ];
+};
+
+// src/exercised.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync3, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join as join4 } from "path";
+import { corpusOf, readManifest } from "@geonosis/lint-parity";
+var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
+var severityOf = (level) => Array.isArray(level) ? level[0] : level;
+var enabledRulesOf = (rules, plugin) => Object.keys(rules).filter((id) => id.startsWith(`${plugin}/`) && !OFF.has(severityOf(rules[id]))).toSorted();
+var finding3 = (subject, verdict, message) => ({
+  check: "exercised",
+  message,
+  subject,
+  verdict
+});
+var LIMIT = 800;
+var refusal = (error) => {
+  const said = String(error.message).trim();
+  return said.length > LIMIT ? `${said.slice(0, LIMIT)}\u2026` : said;
+};
+var reasonFrom = (config, oxlint) => {
+  const dir = mkdtempSync(join4(tmpdir(), "geonosis-doctor-why-"));
+  try {
+    const probe = join4(dir, "probe.tsx");
+    writeFileSync(probe, "export const probe = 1\n");
+    const run = spawnSync2(
+      oxlint,
+      ["--no-ignore", "--disable-nested-config", "--config", config, probe],
+      { encoding: "utf8", env: { ...process.env, NO_COLOR: "1" }, maxBuffer: 8 * 1024 * 1024 }
+    );
+    const said = `${run.stdout ?? ""}${run.stderr ?? ""}`;
+    return /Error:\s*([^]+?)(?=\s+at\s+\S+\s+\(|\n|$)/.exec(said)?.[1];
+  } catch {
+    return void 0;
+  } finally {
+    rmSync(dir, { force: true, recursive: true });
+  }
+};
+var named = (rules) => rules.join(", ");
+var countOf = (rules, verb) => rules.length === 1 ? `1 enabled rule ${verb}s` : `${rules.length} enabled rules ${verb}`;
+var ownReach = ({
+  config,
+  oxlint,
+  repoCorpus
+}) => {
+  const manifest = readManifest(repoCorpus);
+  const reach = corpusOf({
+    configA: config.path,
+    configB: config.path,
+    corpus: repoCorpus,
+    oxlint
+  }).reach;
+  return {
+    claimed: manifest.rules,
+    fired: new Set(reach.filter((one) => one.firedInA).map((one) => one.rule))
+  };
+};
+var checkExercised = ({
+  config,
+  corpus,
+  oxlint,
+  repoCorpus,
+  root
+}) => {
+  const said = (verdict, message) => finding3(config.relative, verdict, message);
+  if (repoCorpus !== void 0 && !existsSync3(repoCorpus)) {
+    return said(
+      "FAIL",
+      `geonosis.json declares a reach corpus at ${relativeToRoot(root, repoCorpus)} and there is nothing there \u2014 a corpus that cannot be read is a claim, not evidence`
+    );
+  }
+  if (!existsSync3(corpus)) {
+    return said(
+      "SKIP",
+      `the plugin loaded from here ships no corpus at ${relativeToRoot(root, corpus)} \u2014 nothing declares which rules it can be evidence about`
+    );
+  }
+  let manifest;
+  try {
+    manifest = readManifest(corpus);
+  } catch (error) {
+    return said("SKIP", refusal(error));
+  }
+  const enabled = enabledRulesOf(config.rules, manifest.plugin);
+  if (enabled.length === 0) return said("SKIP", `no ${manifest.plugin} rule is enabled here`);
+  let reach;
+  try {
+    reach = corpusOf({ configA: config.path, configB: config.path, corpus, oxlint }).reach;
+  } catch (error) {
+    return said(
+      "FAIL",
+      `oxlint refused to run this config over the corpus, so nothing here fired at all \u2014 ${reasonFrom(config.path, oxlint) ?? refusal(error)}`
+    );
+  }
+  const fired = new Set(reach.filter((one) => one.firedInA).map((one) => one.rule));
+  const unknown = enabled.filter((rule) => !manifest.rules.includes(rule));
+  if (unknown.length > 0) {
+    return said(
+      "FAIL",
+      `${countOf(unknown, "name")} the loaded plugin does not export: ${named(unknown)}`
+    );
+  }
+  let own = { claimed: [], fired: /* @__PURE__ */ new Set() };
+  if (repoCorpus !== void 0) {
+    try {
+      own = ownReach({ config, oxlint, repoCorpus });
+    } catch (error) {
+      return said("FAIL", `this repo's own corpus could not be run \u2014 ${refusal(error)}`);
+    }
+  }
+  const empty = own.claimed.filter((rule) => !own.fired.has(rule));
+  if (empty.length > 0) {
+    return said(
+      "FAIL",
+      `${countOf(empty, "fire")} nowhere in this repo's own corpus, which names them: ${named(empty)}`
+    );
+  }
+  const silent = enabled.filter((rule) => !fired.has(rule) && !own.fired.has(rule));
+  const where = own.claimed.length === 0 ? "" : ` (${own.fired.size} by this repo's own corpus)`;
+  return silent.length === 0 ? said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where}`) : said("FAIL", `${countOf(silent, "fire")} nowhere in the corpus: ${named(silent)}`);
+};
+
+// src/loaded.ts
+import { sep as sep3 } from "path";
+var SCOPE = "@geonosis/";
+var BLOCKS = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies"
+];
+var RELEASE = /^v?(\d+)\.(\d+)\.(\d+)$/;
+var PINNED = /^[=v]?(\d+\.\d+\.\d+(?:[-+][\w.-]+)?)$/;
+var RANGE = /^(\^|~|>=)\s*v?(\d+)\.(\d+)\.(\d+)$/;
+var LINKED = /^(?:file|link|portal|workspace):/;
+var ANY = /* @__PURE__ */ new Set(["", "*", "latest", "x"]);
+var versionOf = (found, at) => Number(found[at] ?? Number.NaN);
+var parts = (found) => [
+  versionOf(found, 1),
+  versionOf(found, 2),
+  versionOf(found, 3)
+];
+var below = (here, bound) => {
+  for (const [at, one] of here.entries()) {
+    const other = bound[at] ?? 0;
+    if (one !== other) return one < other;
+  }
+  return false;
+};
+var satisfies = (version, spec) => {
+  const wanted = spec.trim();
+  if (LINKED.test(wanted) || ANY.has(wanted)) return true;
+  const range = RANGE.exec(wanted);
+  if (range === null) {
+    const pinned = PINNED.exec(wanted);
+    return pinned === null ? void 0 : pinned[1] === version.replace(/^v/, "");
+  }
+  const here = RELEASE.exec(version);
+  if (here === null) return void 0;
+  const at = parts(here);
+  const bound = [
+    versionOf(range, 2),
+    versionOf(range, 3),
+    versionOf(range, 4)
+  ];
+  if (below(at, bound)) return false;
+  if (range[1] === ">=") return true;
+  if (range[1] === "~") return at[0] === bound[0] && at[1] === bound[1];
+  if (bound[0] > 0) return at[0] === bound[0];
+  if (bound[1] > 0) return at[0] === 0 && at[1] === bound[1];
+  return at[0] === 0 && at[1] === 0 && at[2] === bound[2];
+};
+var specIn = (manifest, specifier) => {
+  for (const block of BLOCKS) {
+    const spec = manifest[block]?.[specifier];
+    if (typeof spec === "string") return spec;
+  }
+  return void 0;
+};
+var holds2 = (parent, child) => child === parent || child.startsWith(`${parent}${sep3}`);
+var manifestNameOf = (workspace) => workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
+var declaredFor = ({
+  dir,
+  specifier,
+  workspaces
+}) => {
+  const upwards = workspaces.filter((one) => holds2(one.dir, dir)).toSorted((a, b) => b.dir.length - a.dir.length);
+  for (const workspace of upwards) {
+    const spec = specIn(workspace.manifest, specifier);
+    if (spec !== void 0) return { at: manifestNameOf(workspace), spec };
+  }
+  return void 0;
+};
+var finding4 = (subject, verdict, message) => ({
+  check: "loaded",
+  message,
+  subject,
+  verdict
+});
+var firstLine = (error) => String(error.message).split("\n")[0] ?? "";
+var versionAt = async (entry, specifier, root) => ({
+  at: relativeToRoot(root, packageDirOf(entry, specifier)),
+  version: await pluginVersionOf(entry)
+});
+var oneConfig = async ({
+  config,
+  root,
+  specifier,
+  workspaces
+}) => {
+  const said = (verdict, message) => finding4(config.relative, verdict, `${specifier}: ${message}`);
+  let loaded;
+  try {
+    loaded = await versionAt(resolveFrom(config.dir, specifier), specifier, root);
+  } catch (error) {
+    return said(
+      "FAIL",
+      `could not resolve it from this config's directory, and oxlint resolves it from exactly there \u2014 ${firstLine(error)}`
+    );
+  }
+  const declared = declaredFor({ dir: config.dir, specifier, workspaces });
+  if (declared === void 0) {
+    return said(
+      "FAIL",
+      `loaded ${loaded.version} from ${loaded.at}, and no package.json from here up to the root declares it \u2014 nothing says which version this was meant to be`
+    );
+  }
+  const held = satisfies(loaded.version, declared.spec);
+  if (held === void 0) {
+    return said(
+      "FAIL",
+      `loaded ${loaded.version}, and ${declared.at} declares "${declared.spec}" \u2014 a range this check cannot read, so it will not call the version right`
+    );
+  }
+  return held ? said("OK", `loaded ${loaded.version} = declared ${declared.spec} (${declared.at})`) : said(
+    "FAIL",
+    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}`
+  );
+};
+var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
+var copiesOf = async ({
+  root,
+  specifier,
+  workspaces
+}) => {
+  const found = /* @__PURE__ */ new Map();
+  for (const workspace of workspaces) {
+    let entry;
+    try {
+      entry = resolveFrom(workspace.dir, specifier);
+    } catch {
+      continue;
+    }
+    const at = relativeToRoot(root, packageDirOf(entry, specifier));
+    const already = found.get(at);
+    if (already !== void 0) {
+      already.from.push(labelOf(workspace));
+      continue;
+    }
+    found.set(at, { from: [labelOf(workspace)], version: await pluginVersionOf(entry) });
+  }
+  if (found.size === 0) {
+    return finding4(specifier, "FAIL", "no workspace in this tree can resolve it at all");
+  }
+  const listed = [...found.entries()].map(([at, one]) => `${at} ${one.version} (${one.from.join(", ")})`).join("; ");
+  return found.size === 1 ? finding4(specifier, "OK", `1 copy \u2014 ${listed}`) : finding4(
+    specifier,
+    "WARN",
+    `${found.size} copies \u2014 ${listed}. Which one oxlint runs depends on which directory its config sits in.`
+  );
+};
+var checkLoaded = async ({
+  configs,
+  root,
+  workspaces
+}) => {
+  const findings = [];
+  const specifiers = /* @__PURE__ */ new Set();
+  for (const config of configs) {
+    if (config.error !== void 0) {
+      findings.push(finding4(config.relative, "FAIL", config.error));
+      continue;
+    }
+    for (const specifier of config.jsPlugins.filter((name) => name.startsWith(SCOPE))) {
+      specifiers.add(specifier);
+      findings.push(await oneConfig({ config, root, specifier, workspaces }));
+    }
+  }
+  for (const specifier of [...specifiers].toSorted()) {
+    findings.push(await copiesOf({ root, specifier, workspaces }));
+  }
+  return findings;
+};
+
+// src/observability.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+var GEONOSIS_FILE = "geonosis.json";
+var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
+var DEFAULT_MAX_AGE_SECONDS = 3600;
+var HEAD_TIMEOUT_MS = 3e3;
+var finding5 = (verdict, subject, message) => ({
+  check: "observability",
+  message,
+  subject,
+  verdict
+});
+var readGeonosis2 = (root) => {
+  let text;
+  try {
+    text = readFileSync4(join5(root, GEONOSIS_FILE), "utf8");
+  } catch {
+    return { present: false };
+  }
+  try {
+    const parsed = JSON.parse(text);
+    const block = parsed.observability;
+    if (typeof block !== "object" || block === null || Array.isArray(block)) {
+      return { present: false };
+    }
+    return { config: block, present: true };
+  } catch (error) {
+    return { error: error.message, present: false };
+  }
+};
+var exporterFinding = (config) => {
+  const sink = config.sink;
+  if (typeof sink !== "string" || sink.trim() === "") {
+    return finding5(
+      "FAIL",
+      GEONOSIS_FILE,
+      "observability.sink is not set, so nothing here says where errors are supposed to go \u2014 and a repo that cannot name its exporter has not got one"
+    );
+  }
+  if (REACHES_NOTHING.has(sink.toLowerCase())) {
+    return finding5(
+      "WARN",
+      GEONOSIS_FILE,
+      `the configured sink is "${sink}", which answers ok and reaches nothing. Correct in a dev tree; in a deployed one it is the instrument that cannot fail.`
+    );
+  }
+  return finding5("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
+};
+var reachableFinding = async (config) => {
+  const endpoint = config.endpoint;
+  if (typeof endpoint !== "string" || endpoint.trim() === "") {
+    return finding5(
+      "SKIP",
+      GEONOSIS_FILE,
+      "no observability.endpoint was named, so whether the exporter is reachable was not asked"
+    );
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), HEAD_TIMEOUT_MS);
+  try {
+    const response = await fetch(endpoint, { method: "HEAD", signal: controller.signal });
+    return finding5(
+      "OK",
+      GEONOSIS_FILE,
+      `${endpoint} is reachable \u2014 it answered ${response.status} to a HEAD`
+    );
+  } catch (error) {
+    return finding5(
+      "FAIL",
+      GEONOSIS_FILE,
+      `${endpoint} is not reachable from here: ${error.message}. Every report this repo sends is going into that.`
+    );
+  } finally {
+    clearTimeout(timer);
+  }
+};
+var ageFinding = (config, root, now) => {
+  const file = config.lastEventFile;
+  if (typeof file !== "string" || file.trim() === "") {
+    return finding5(
+      "SKIP",
+      GEONOSIS_FILE,
+      "no observability.lastEventFile was configured, so when the last event arrived is not a question anything here can answer. Have the sink write { at, id, sink } on every capture and name the file."
+    );
+  }
+  const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
+  let record;
+  try {
+    record = JSON.parse(readFileSync4(join5(root, file), "utf8"));
+  } catch (error) {
+    return finding5(
+      "FAIL",
+      file,
+      `the last event file could not be read: ${error.message}. A sink that has never written one has never captured anything.`
+    );
+  }
+  if (typeof record.at !== "number" || !Number.isFinite(record.at)) {
+    return finding5(
+      "FAIL",
+      file,
+      'the last event record has no numeric "at", so its age cannot be read \u2014 and an age nobody can read is not an age inside the window'
+    );
+  }
+  const ageSeconds = Math.round((now - record.at) / 1e3);
+  return ageSeconds > maxAgeSeconds ? finding5(
+    "FAIL",
+    file,
+    `the last event arrived ${ageSeconds}s ago, past the ${maxAgeSeconds}s window. An exporter that stopped, a key that was rotated and a sink that has been dropping since Tuesday all look exactly like this, and all of them leave a green build.`
+  ) : finding5(
+    "OK",
+    file,
+    `the last event arrived ${ageSeconds}s ago, inside the ${maxAgeSeconds}s window`
+  );
+};
+var probeFinding = (config) => {
+  const probe = config.probe;
+  if (typeof probe === "string" && probe.trim() !== "") {
+    return finding5("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
+  }
+  if (typeof config.lastEventFile === "string" && config.lastEventFile.trim() !== "") {
+    return finding5(
+      "OK",
+      GEONOSIS_FILE,
+      "no probe command, but a last event file is read above, so something does look at this exporter"
+    );
+  }
+  return finding5(
+    "WARN",
+    GEONOSIS_FILE,
+    "neither observability.probe nor observability.lastEventFile is configured, so nothing in this repo has ever established that a report reaches the sink. Name a probe command \u2014 the doctor reports it, your gate runs it."
+  );
+};
+var checkObservability = async ({
+  now,
+  root
+}) => {
+  const read = readGeonosis2(root);
+  if (read.error !== void 0) {
+    return [
+      finding5(
+        "FAIL",
+        GEONOSIS_FILE,
+        `${GEONOSIS_FILE} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
+      )
+    ];
+  }
+  if (!read.present || read.config === void 0) {
+    return [
+      finding5(
+        "SKIP",
+        GEONOSIS_FILE,
+        `no observability block in ${GEONOSIS_FILE}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
+      )
+    ];
+  }
+  const config = read.config;
+  return [
+    exporterFinding(config),
+    await reachableFinding(config),
+    ageFinding(config, root, now),
+    probeFinding(config)
+  ];
+};
+
+// src/repo-corpus.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
+var GEONOSIS_FILE2 = "geonosis.json";
+var repoCorpusOf = (root) => {
+  const path = join6(root, GEONOSIS_FILE2);
+  if (!existsSync4(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    const declared = parsed.doctor?.corpus;
+    return typeof declared === "string" && declared !== "" ? join6(root, declared) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+
+// src/runner.ts
+var TEST_FAILURES = "testFailures";
+var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
+var WRITES_A_REPORT = /--reporter[= ]\S*json|--outputFile/i;
+var finding6 = (subject, verdict, message) => ({
+  check: "runner",
+  message,
+  subject,
+  verdict
+});
+var stringOf = (value) => typeof value === "string" ? value : "";
+var namesOf = (workspace) => [workspace.relative, stringOf(workspace.manifest.name)].filter((one) => one !== "");
+var covers = (command, workspace, workspaces) => {
+  if (workspace.relative !== "") return namesOf(workspace).some((one) => command.includes(one));
+  return !workspaces.some(
+    (other) => other.relative !== "" && namesOf(other).some((one) => command.includes(one))
+  );
+};
+var reportingCounters = (ratchet) => (ratchet?.counters ?? []).filter(
+  (entry) => entry.counter === TEST_FAILURES && stringOf(entry.report) !== ""
+);
+var keyOf = (entry) => stringOf(entry.key) === "" ? TEST_FAILURES : stringOf(entry.key);
+var checkRunner = ({
+  ratchet,
+  workspaces
+}) => {
+  const reading = reportingCounters(ratchet);
+  return workspaces.flatMap((workspace) => {
+    const script = stringOf(workspace.manifest.scripts?.test);
+    if (script === "") return [];
+    const subject = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
+    const said = (verdict, message) => [
+      finding6(subject, verdict, message)
+    ];
+    if (!RUNS_A_RUNNER.test(script)) {
+      return said(
+        "OK",
+        `"${script}" runs neither vitest nor bun test \u2014 this check has nothing to say about it`
+      );
+    }
+    if (WRITES_A_REPORT.test(script)) {
+      return said("OK", "the script asks the runner for its own JSON report, not for a status code");
+    }
+    const counter = reading.find((entry) => covers(stringOf(entry.command), workspace, workspaces));
+    if (counter !== void 0) {
+      return said("OK", `read by the ratchet's "${keyOf(counter)}" counter in report mode`);
+    }
+    return said(
+      "WARN",
+      `"${script}" \u2014 the test runner's exit code is the only verdict here; vitest-pool-workers exited 0 on failing tests for weeks in a consumer. Give the ratchet a ${TEST_FAILURES} counter in report mode covering this workspace, or have the script write a JSON report.`
+    );
+  });
+};
+
+// src/doctor.ts
+import { resolveOxlint } from "@geonosis/lint-parity";
+var exercisedOf = ({
+  configs,
+  oxlint,
+  repoCorpus,
+  root
+}) => configs.flatMap(
+  (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map((specifier) => {
+    let corpus;
+    try {
+      corpus = corpusOfPlugin(config.dir, specifier);
+    } catch (error) {
+      return {
+        check: "exercised",
+        message: `${specifier}: ${String(error.message)}`,
+        subject: config.relative,
+        verdict: "SKIP"
+      };
+    }
+    const own = repoCorpus !== void 0 && config.relative === CONFIG_FILE ? repoCorpus : void 0;
+    return checkExercised({
+      config,
+      corpus,
+      oxlint,
+      ...own === void 0 ? {} : { repoCorpus: own },
+      root
+    });
+  })
+);
+var skip = (message) => [
+  { check: "baseline", message, subject: RATCHET_FILE, verdict: "SKIP" }
+];
+var baselineOf = ({
+  baseline,
+  root
+}) => {
+  if (baseline === void 0) {
+    return skip(
+      "not requested \u2014 pass --baseline-against [ref] to compare this baseline against another ref (it is the one check that runs git)"
+    );
+  }
+  const ref = baseline.ref ?? defaultRef(root);
+  return ref === void 0 ? skip("no ref was named and this repo has no origin/main to fall back on") : checkBaseline({ ref, root });
+};
+var ordered = (findings) => CHECKS.flatMap((check) => findings.filter((one) => one.check === check));
+var EMPTY = { FAIL: 0, OK: 0, SKIP: 0, WARN: 0 };
+var countsOf = (findings) => findings.reduce((counts, one) => ({ ...counts, [one.verdict]: counts[one.verdict] + 1 }), {
+  ...EMPTY
+});
+var runDoctor = async ({
+  baseline,
+  oxlint,
+  root,
+  strict = false
+}) => {
+  const configs = discoverConfigs(root);
+  const workspaces = discoverWorkspaces(root);
+  const binary = oxlint ?? resolveOxlint(root);
+  const repoCorpus = repoCorpusOf(root);
+  const found = ordered([
+    ...await checkLoaded({ configs, root, workspaces }),
+    ...exercisedOf({
+      configs,
+      oxlint: binary,
+      ...repoCorpus === void 0 ? {} : { repoCorpus },
+      root
+    }),
+    ...baselineOf({ baseline, root }),
+    ...checkRunner({ ratchet: readRatchet(root), workspaces }),
+    ...await checkObservability({ now: Date.now(), root }),
+    ...checkDrift({ root, workspaces })
+  ]);
+  const findings = strict ? found.map((one) => one.verdict === "WARN" ? { ...one, verdict: "FAIL" } : one) : found;
+  return {
+    counts: countsOf(findings),
+    findings,
+    ok: !findings.some((one) => one.verdict === "FAIL"),
+    root
+  };
+};
+
+// src/report.ts
+var ABOUT = {
+  baseline: "a number that may only shrink, against another ref",
+  drift: "the gates that were set up and are no longer running",
+  exercised: "every enabled rule fires on at least one corpus file",
+  loaded: "the plugin oxlint would load is the one the manifest pins",
+  observability: "an exporter is configured, reachable, and something arrived through it lately",
+  runner: "something reads the test runner\u2019s own report, not its exit code"
+};
+var WIDTH = 4;
+var lineOf = (one) => `  ${one.verdict.padEnd(WIDTH)} ${one.subject}: ${one.message}`;
+var sectionOf = (check, findings) => {
+  const mine = findings.filter((one) => one.check === check);
+  return [
+    `${check} \u2014 ${ABOUT[check]}`,
+    ...mine.length === 0 ? ["  ---- nothing in this tree to check"] : mine.map(lineOf),
+    ""
+  ];
+};
+var formatDoctor = ({ counts, findings, ok, root }) => [
+  `geonosis-doctor \u2014 ${root}`,
+  "",
+  ...CHECKS.flatMap((check) => sectionOf(check, findings)),
+  `${CHECKS.length} checks, ${findings.length} lines: ${counts.OK} ok, ${counts.WARN} warned, ${counts.SKIP} skipped, ${counts.FAIL} failed`,
+  ok ? "doctor PASS \u2014 nothing here says the gates are measuring something other than what they claim." : "doctor FAIL \u2014 a line above is a gate reporting on something other than what it names.",
+  ""
+].join("\n");
+var formatJson = (report) => `${JSON.stringify(report, null, 2)}
+`;
+
+export {
+  CONFIG_FILE,
+  MANIFEST_FILE,
+  RATCHET_FILE,
+  relativePath,
+  readConfig,
+  discoverConfigs,
+  discoverWorkspaces,
+  readRatchet,
+  defaultRef,
+  checkBaseline,
+  CHECKS,
+  DoctorError,
+  resolveFrom,
+  packageDirOf,
+  pluginVersionOf,
+  corpusOfPlugin,
+  relativeToRoot,
+  READERS,
+  checkDrift,
+  enabledRulesOf,
+  checkExercised,
+  SCOPE,
+  satisfies,
+  declaredFor,
+  checkLoaded,
+  checkObservability,
+  GEONOSIS_FILE2 as GEONOSIS_FILE,
+  repoCorpusOf,
+  checkRunner,
+  runDoctor,
+  formatDoctor,
+  formatJson
+};