@geonosis/doctor 2.12.0 → 2.13.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @geonosis/doctor
 
+## 2.13.0
+
+### Patch Changes
+
+- Updated dependencies [f422aea]
+- Updated dependencies [f422aea]
+- Updated dependencies [f422aea]
+- Updated dependencies [f422aea]
+- Updated dependencies [ae995df]
+  - @geonosis/ratchet@2.13.0
+  - @geonosis/release@2.13.0
+  - @geonosis/lint-parity@2.13.0
+
 ## 2.12.0
 
 ### Patch Changes

package/bin/geonosis-doctor.mjs

@@ -1,196 +1,11 @@
 #!/usr/bin/env node
-// Every packages/*/bin shim is packages/cli/bin/geonosis.mjs with its own name and entry: edit that
-// one, then `pnpm generate:shims`. Committed so `pnpm install` can link the bin on a fresh clone,
-// before `pnpm build` has made dist/. In the repo `src/` sits beside `dist/`, and a dist older
-// than src answered for a fix it did not carry once (#62); the published package ships no src, so
-// there the check is skipped.
-import { createHash } from 'node:crypto'
-import {
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  realpathSync,
-  statSync,
-  writeFileSync
-} from 'node:fs'
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
+// Generated by pnpm generate:shims. In the kit's own tree src/ sits beside dist/, and a dist older
+// than src once answered for a fix it did not carry (#62); a published package ships no src/.
+import { existsSync } from 'node:fs'
 
-const here = dirname(fileURLToPath(import.meta.url))
-const own = join(here, '..')
-// tsup never reads a test file, so one counting as source made every bin refuse a build that had
-// not gone stale (#399).
-const NOT_SOURCE = (name) =>
-  name.endsWith('.test.ts') ||
-  name.endsWith('.test.tsx') ||
-  name === '__tests__' ||
-  name === '__fixtures__'
-const newest = (dir, skip) =>
-  existsSync(dir)
-    ? readdirSync(dir, { withFileTypes: true }).reduce((most, entry) => {
-        if (skip !== undefined && skip(entry.name)) return most
-        const at = join(dir, entry.name)
-        return Math.max(most, entry.isDirectory() ? newest(at, skip) : statSync(at).mtimeMs)
-      }, 0)
-    : 0
-const digestOf = (dir, hash) => {
-  for (const name of readdirSync(dir).toSorted()) {
-    if (NOT_SOURCE(name)) continue
-    const at = join(dir, name)
-    if (statSync(at).isDirectory()) {
-      digestOf(at, hash)
-      continue
-    }
-    hash.update(name).update('\0').update(readFileSync(at)).update('\0')
-  }
-  return hash
-}
-const digest = (...dirs) => {
-  const hash = createHash('sha256')
-  for (const dir of dirs) if (existsSync(dir)) digestOf(dir, hash)
-  return hash.digest('hex')
-}
-// mtime says a source file was WRITTEN, not that it CHANGED. A checkout rewrites it with the same
-// content, and the next `pnpm build` is a cache hit that leaves the current dist exactly as it
-// was — so every bin refused with "run pnpm build", the action that had just changed nothing and
-// would change nothing again. So a digest of the sources is kept from the last run that found
-// dist current: the same digest later is the same sources, whatever their timestamps say, and a
-// different one is the staleness this guard exists for. The newest mtime is kept beside it so a
-// run over untouched sources need not hash them again. The second line is the same record for
-// the dists of the workspace dependencies this build read (row 584, below).
-const recordOf = (pkg) => join(pkg, '.turbo', 'geonosis-src-digest')
-const recorded = (pkg) => {
-  try {
-    const [first = '', second = ''] = readFileSync(recordOf(pkg), 'utf8').split('\n')
-    const [seen = '', sum = ''] = first.trim().split(' ')
-    const [depsSeen = '', depsSum = ''] = second.trim().split(' ')
-    return { depsSeen: Number(depsSeen), depsSum, seen: Number(seen), sum }
-  } catch {
-    return { depsSeen: 0, depsSum: '', seen: 0, sum: '' }
-  }
-}
-const remember = (pkg, known) => {
-  try {
-    mkdirSync(dirname(recordOf(pkg)), { recursive: true })
-    writeFileSync(recordOf(pkg), `${known.seen} ${known.sum}\n${known.depsSeen} ${known.depsSum}\n`)
-  } catch {
-    // A record nothing could write costs one more hash next time, never a wrong answer.
-  }
-}
-// The refusal names a package for turbo's --filter. A manifest that cannot be read costs the
-// name, never the decision: the first digest shim threw here — exit 1 and a node:fs frame — over a
-// tree with no package.json, and a guard that throws neither answers nor refuses.
-const manifestOf = (pkg) => {
-  try {
-    return JSON.parse(readFileSync(join(pkg, 'package.json'), 'utf8'))
-  } catch {
-    return {}
-  }
-}
-const refuse = (sentence) => {
-  process.stderr.write(`geonosis-doctor: ${sentence}\n`)
-  process.exit(2)
-}
-// Whether one package's dist reflects its src: 'unbuilt', 'stale' or 'current'. The same reading
-// for this package and for each workspace dependency, off that package's own record.
-const standing = (pkg) => {
-  const src = join(pkg, 'src')
-  const dist = join(pkg, 'dist')
-  if (!existsSync(src)) return 'current'
-  const built = newest(dist)
-  if (built === 0) return 'unbuilt'
-  const written = newest(src, NOT_SOURCE)
-  const known = recorded(pkg)
-  if (written > built) {
-    const sum = known.seen === written ? known.sum : digest(src)
-    if (sum !== known.sum) return 'stale'
-    if (known.seen !== written) remember(pkg, { ...known, seen: written, sum })
-  } else if (known.seen !== written) {
-    remember(pkg, { ...known, seen: written, sum: digest(src) })
-  }
-  return 'current'
-}
-// Row 584: a dist current against its own src can still have been built against an OLDER
-// dependency's dist — literally, when tsup inlined a workspace devDependency into it — and a
-// dependency whose src has moved past its dist is read by this dist stale, inlined or imported.
-// So every workspace dependency this manifest names (`workspace:`, resolved through the link pnpm
-// made, transitively) is held to the same reading as this package, and this dist must not be
-// older than any of theirs — by content: a dependency rebuilt to the same bytes is the same build,
-// so the `--force --filter` escape below cannot poison the tree it was run in.
-const workspaceDependencies = (pkg, found = new Map()) => {
-  const manifest = manifestOf(pkg)
-  for (const block of [
-    manifest.dependencies,
-    manifest.devDependencies,
-    manifest.optionalDependencies,
-    manifest.peerDependencies
-  ]) {
-    for (const [name, range] of Object.entries(block ?? {})) {
-      if (typeof range !== 'string' || !range.startsWith('workspace:')) continue
-      let dir
-      try {
-        dir = realpathSync(join(pkg, 'node_modules', name))
-      } catch {
-        continue // Not linked: the import will say so far more loudly than this guard can.
-      }
-      if (found.has(dir)) continue
-      found.set(dir, name)
-      workspaceDependencies(dir, found)
-    }
-  }
-  return found
-}
-// `newest` answers 0 for a directory that is NOT THERE and for one that is merely old, so the
-// two conditions were one comparison and one sentence — and the staleness sentence was printed
-// over trees that had never been built at all, blocking a turn in a fresh git worktree, which
-// has no dist because dist is not committed (#357). Only the second is evidence of a mistake.
-if (existsSync(join(own, 'src'))) {
-  const built = newest(join(own, 'dist'))
-  if (built === 0) {
-    refuse(
-      'this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.'
-    )
-  }
-  const name = manifestOf(own).name ?? '<this package>'
-  if (standing(own) === 'stale') {
-    refuse(
-      `dist is older than src — run pnpm build before trusting this bin. If that build just said FULL TURBO, the cache hit left a current dist with its old timestamp and this bin had not yet recorded the sources it was current for: pnpm build --force --filter=${name} rebuilds this one package and clears it.`
-    )
-  }
-  const dependencies = workspaceDependencies(own)
-  const dists = new Map()
-  for (const [dir, dependency] of dependencies) {
-    const state = standing(dir)
-    if (state === 'unbuilt') {
-      refuse(
-        `${dependency}, which this dist reads, has never been built — run pnpm build. No dist there at all; nothing is stale.`
-      )
-    }
-    if (state === 'stale') {
-      refuse(
-        `${dependency}'s dist is older than its src, and this dist reads that dist — run pnpm build before trusting this bin. If that build just said FULL TURBO, the cache hit left that dist current with its old timestamp and nothing had yet recorded the sources it was current for: pnpm build --force --filter=${dependency} rebuilds that one package and clears it.`
-      )
-    }
-    dists.set(join(dir, 'dist'), dependency)
-  }
-  if (dists.size > 0) {
-    const known = recorded(own)
-    const theirs = [...dists.keys()].toSorted()
-    const depsNewest = theirs.reduce((most, dist) => Math.max(most, newest(dist)), 0)
-    if (depsNewest > built) {
-      const depsSum = known.depsSeen === depsNewest ? known.depsSum : digest(...theirs)
-      if (depsSum !== known.depsSum) {
-        const newer = theirs.filter((dist) => newest(dist) > built).map((dist) => dists.get(dist))
-        refuse(
-          `dist was built before the current dist of ${newer.join(', ')}, which it reads — run pnpm build before trusting this bin. If that build just said FULL TURBO, the dependency was rebuilt alone and this bin had not yet recorded the build it was current against: pnpm build --force --filter=${name} rebuilds this one package against it.`
-        )
-      }
-      if (known.depsSeen !== depsNewest) remember(own, { ...known, depsSeen: depsNewest, depsSum })
-    } else if (known.depsSeen !== depsNewest) {
-      remember(own, { ...known, depsSeen: depsNewest, depsSum: digest(...theirs) })
-    }
-  }
+if (existsSync(new URL('../src', import.meta.url))) {
+  const { guardBuild } = await import('../../../tooling/bin-guard.mjs')
+  guardBuild(new URL('..', import.meta.url), 'geonosis-doctor')
 }
 
 await import('../dist/doctor-cli.js')

package/dist/{chunk-VWMNCBDP.js → chunk-IJXJ2EF4.js}

@@ -253,153 +253,58 @@ var checkBaseline = ({ ref, root }) => {
 };
 
 // src/deployed.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync2 } from "fs";
 import { join as join4 } from "path";
-var DEPLOYED_FILE = ".geonosis/deployed.json";
-var NOT_WRITTEN = "no .geonosis/deployed.json \u2014 it is written by the pipeline after promote, and its absence is not a pass";
+import { DEPLOYED_FILE, NOTHING_SAYS, runDeployed } from "@geonosis/release";
+var finding2 = findingMaker("deployed");
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var listOf = (found) => Array.isArray(found) ? found.filter((one) => typeof one === "string") : [];
-var make = findingMaker("deployed");
-var finding2 = (verdict, subject, message) => make(subject, verdict, message);
-var parseJsonc = (source) => {
-  let out = "";
-  for (let index = 0; index < source.length; index += 1) {
-    const char = source[index] ?? "";
-    if (char === '"') {
-      const start = index;
-      index += 1;
-      for (; index < source.length; index += 1) {
-        if (source[index] === "\\") {
-          index += 1;
-          continue;
-        }
-        if (source[index] === '"') break;
-      }
-      out += source.slice(start, index + 1);
-      continue;
-    }
-    if (char === "/" && source[index + 1] === "/") {
-      const end = source.indexOf("\n", index);
-      index = end === -1 ? source.length : end - 1;
-      continue;
-    }
-    if (char === "/" && source[index + 1] === "*") {
-      const end = source.indexOf("*/", index + 2);
-      index = end === -1 ? source.length : end + 1;
-      continue;
-    }
-    out += char;
-  }
-  return JSON.parse(out.replaceAll(/,(\s*[\]}])/g, "$1"));
-};
-var BINDING_LISTS = [
-  "ai",
-  "analytics_engine_datasets",
-  "browser",
-  "d1_databases",
-  "dispatch_namespaces",
-  "durable_objects",
-  "hyperdrive",
-  "kv_namespaces",
-  "mtls_certificates",
-  "queues",
-  "r2_buckets",
-  "send_email",
-  "services",
-  "vectorize",
-  "version_metadata",
-  "workflows"
-];
-var bindingsOf = (found) => {
-  if (Array.isArray(found)) return found.flatMap(bindingsOf);
-  if (!isRecord(found)) return [];
-  const named2 = found["binding"] ?? found["name"];
-  return [
-    ...typeof named2 === "string" ? [named2] : [],
-    ...Object.entries(found).filter(([key]) => key === "bindings" || key === "producers" || key === "consumers").flatMap(([, one]) => bindingsOf(one))
-  ];
-};
-var declaredIn = (config) => {
-  const triggers = config["triggers"];
-  const one = config["route"];
-  const listed = [
-    ...Array.isArray(config["routes"]) ? config["routes"] : [],
-    ...typeof one === "string" ? [one] : []
-  ];
-  return {
-    bindings: BINDING_LISTS.flatMap((key) => bindingsOf(config[key])),
-    crons: isRecord(triggers) ? listOf(triggers["crons"]) : [],
-    routes: listed.map((route) => isRecord(route) ? route["pattern"] : route).filter((pattern) => typeof pattern === "string")
-  };
-};
-var differences = (kind, declared, deployed) => {
-  const missing = declared.filter((name) => !deployed.includes(name));
-  const extra = deployed.filter((name) => !declared.includes(name));
-  return [
-    ...missing.length === 0 ? [] : [`declared but not deployed ${kind}: ${missing.join(", ")}`],
-    ...extra.length === 0 ? [] : [`deployed but not declared ${kind}: ${extra.join(", ")}`]
-  ];
-};
+var declaresNothing = (release) => !isRecord(release) || ["wrangler", "secrets"].every((key) => {
+  const listed = release[key];
+  return !Array.isArray(listed) || listed.length === 0;
+});
 var checkDeployed = ({ root }) => {
   const read = readGeonosisFile(root);
   if (read.kind === "absent") return [];
   if (read.kind === "unreadable") return [unreadableGeonosis("deployed", read.error)];
-  const release = isRecord(read.config["release"]) ? read.config["release"] : {};
-  const configs = listOf(release["wrangler"]);
-  const secrets = listOf(release["secrets"]);
-  if (configs.length === 0 && secrets.length === 0) {
+  if (declaresNothing(read.config["release"])) {
     return [
       finding2(
-        "SKIP",
         "geonosis.json",
+        "SKIP",
         "release.wrangler and release.secrets are both empty \u2014 this repo has declared nothing a deployment is supposed to carry"
       )
     ];
   }
-  const env = typeof release["wranglerEnv"] === "string" ? release["wranglerEnv"] : void 0;
-  const declared = { bindings: [], crons: [], routes: [] };
-  for (const relative of configs) {
-    let parsed;
-    try {
-      parsed = parseJsonc(readFileSync3(join4(root, relative), "utf8"));
-    } catch (error) {
-      return [finding2("FAIL", relative, `could not be read: ${error.message}`)];
-    }
-    if (!isRecord(parsed)) return [finding2("FAIL", relative, "is not a wrangler configuration")];
-    const environments = parsed["env"];
-    const block = env !== void 0 && isRecord(environments) && isRecord(environments[env]) ? environments[env] : parsed;
-    const one = declaredIn(block);
-    declared.bindings.push(...one.bindings);
-    declared.crons.push(...one.crons);
-    declared.routes.push(...one.routes);
-  }
-  const path = join4(root, DEPLOYED_FILE);
-  if (!existsSync2(path)) return [finding2("SKIP", DEPLOYED_FILE, NOT_WRITTEN)];
-  let reported;
+  if (!existsSync2(join4(root, DEPLOYED_FILE))) return [finding2(DEPLOYED_FILE, "SKIP", NOTHING_SAYS)];
+  let report;
   try {
-    reported = JSON.parse(readFileSync3(path, "utf8"));
+    report = runDeployed({ root });
   } catch (error) {
-    return [finding2("FAIL", DEPLOYED_FILE, `is not readable JSON: ${error.message}`)];
-  }
-  if (!isRecord(reported)) return [finding2("FAIL", DEPLOYED_FILE, "is not an object")];
-  const triggers = isRecord(reported["triggers"]) ? reported["triggers"] : {};
-  const drift = [
-    ...differences("crons", declared.crons, listOf(triggers["crons"])),
-    ...differences("routes", declared.routes, listOf(triggers["routes"])),
-    ...differences("bindings", declared.bindings, listOf(reported["bindings"])),
-    ...differences("secrets", secrets, listOf(reported["secrets"]))
-  ];
+    return [finding2(DEPLOYED_FILE, "FAIL", error instanceof Error ? error.message : String(error))];
+  }
+  if (report.ok) {
+    return [
+      finding2(
+        DEPLOYED_FILE,
+        "OK",
+        `what the tree declares is what the pipeline reported${report.at === void 0 ? "" : ` at ${report.at}`}`
+      )
+    ];
+  }
   return [
-    drift.length === 0 ? finding2(
-      "OK",
+    finding2(
       DEPLOYED_FILE,
-      `what the tree declares is what the pipeline reported${typeof reported["at"] === "string" ? ` at ${reported["at"]}` : ""}`
-    ) : finding2("FAIL", DEPLOYED_FILE, drift.join("; "))
+      "FAIL",
+      report.drift.flatMap(({ extra, kind, missing }) => [
+        ...missing.length === 0 ? [] : [`declared but not deployed ${kind}: ${missing.join(", ")}`],
+        ...extra.length === 0 ? [] : [`deployed but not declared ${kind}: ${extra.join(", ")}`]
+      ]).join("; ")
+    )
   ];
 };
 
 // src/resolve.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync as realpathSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync as realpathSync2 } from "fs";
 import { createRequire } from "module";
 import { dirname, join as join5 } from "path";
 import { pathToFileURL } from "url";
@@ -460,7 +365,7 @@ var packageDirOf = (entry, name) => {
     const manifest = join5(dir, "package.json");
     if (existsSync3(manifest)) {
       try {
-        const parsed = JSON.parse(readFileSync4(manifest, "utf8"));
+        const parsed = JSON.parse(readFileSync3(manifest, "utf8"));
         if (parsed.name === name) return dir;
       } catch {
       }
@@ -544,17 +449,17 @@ var real2 = (path) => {
 var relativeToRoot = (root, path) => relativePath(real2(root), real2(path));
 
 // src/group.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { join as join8 } from "path";
 
 // src/callers.ts
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
 import { join as join6, resolve } from "path";
 var WORKFLOWS = ".github/workflows";
 var A_WORKFLOW = (name) => name.endsWith(".yml") || name.endsWith(".yaml");
 var readOr = (path) => {
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync4(path, "utf8");
   } catch {
     return "";
   }
@@ -617,7 +522,7 @@ var scriptFilesNamedBy = (root, lines) => {
 };
 
 // src/hooks.ts
-import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
 import { join as join7 } from "path";
 var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
 var HOOK_DIRS = [".husky", ".githooks"];
@@ -627,7 +532,7 @@ var hookLines = (root) => {
   const found = [];
   const read = (path) => {
     const at = relativePath(root, path);
-    for (const line of readFileSync6(path, "utf8").split("\n")) {
+    for (const line of readFileSync5(path, "utf8").split("\n")) {
       if (line.trim() !== "") found.push({ at, line });
     }
   };
@@ -708,7 +613,7 @@ var versionOf = (dir, name, root) => {
   }
   try {
     const manifest = JSON.parse(
-      readFileSync7(join8(packageDirOf(entry, name), "package.json"), "utf8")
+      readFileSync6(join8(packageDirOf(entry, name), "package.json"), "utf8")
     );
     return typeof manifest.version === "string" ? { kind: "read", version: manifest.version } : { kind: "unreadable", why: "its package.json declares no version" };
   } catch (error) {
@@ -740,7 +645,7 @@ var DOORS = ["@geonosis/cli", "geonosis"];
 var manifestOf = (root, name) => {
   try {
     return JSON.parse(
-      readFileSync7(join8(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
+      readFileSync6(join8(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
     );
   } catch {
     return void 0;
@@ -750,7 +655,7 @@ var binNamesOf = (manifest, name) => {
   const declared = manifest?.bin;
   return typeof declared === "string" ? [name.replace(/^@[^/]+\//, "")] : Object.keys(declared ?? {});
 };
-var declaredIn2 = (manifest) => [...dependencyNamesOf(manifest)];
+var declaredIn = (manifest) => [...dependencyNamesOf(manifest)];
 var calls = (lines, bin) => new RegExp(`(?:^|[\\s;&|(/'"\`])${bin}(?:[\\s;&|)'"\`,\\]]|$)`).test(lines);
 var workspaceCaller = (workspaces, bins) => {
   for (const workspace of workspaces) {
@@ -764,7 +669,7 @@ var workspaceCaller = (workspaces, bins) => {
 var rootDeclarations = (root, workspaces) => {
   const here = workspaces.find((one) => one.relative === "");
   if (here === void 0) return [];
-  const declared = declaredIn2(here.manifest);
+  const declared = declaredIn(here.manifest);
   const door = DOORS.find((name) => declared.includes(name));
   if (door === void 0) return [];
   const owned = new Set(
@@ -893,7 +798,7 @@ var checkGroup = ({
 };
 
 // src/drift.ts
-import { closeSync, existsSync as existsSync6, openSync, readdirSync as readdirSync4, readFileSync as readFileSync8, readSync } from "fs";
+import { closeSync, existsSync as existsSync6, openSync, readdirSync as readdirSync4, readFileSync as readFileSync7, readSync } from "fs";
 import { homedir } from "os";
 import { join as join9, sep as sep3 } from "path";
 
@@ -976,7 +881,7 @@ var ci = (root) => {
   }
   return filesUnder(dir, (name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((path) => {
     const at = relativePath(root, path);
-    return SWITCHED_OFF.test(readFileSync8(path, "utf8")) ? finding4(
+    return SWITCHED_OFF.test(readFileSync7(path, "utf8")) ? finding4(
       at,
       "FAIL",
       "a job or step here is switched off by a condition that can never be true \u2014 every gate downstream of it reports green having run nothing"
@@ -1170,7 +1075,7 @@ var law = (root, config) => {
   if (!existsSync6(path)) {
     return [finding4(file, "SKIP", "there is no law file here to measure")];
   }
-  const source = readFileSync8(path, "utf8");
+  const source = readFileSync7(path, "utf8");
   const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
   if (typeof declared.maxLines !== "number") {
     return [
@@ -1194,7 +1099,7 @@ var KIT_PLUGIN = "geonosis";
 var enablesKit = (path) => {
   if (!existsSync6(path)) return false;
   try {
-    const parsed = JSON.parse(readFileSync8(path, "utf8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
     const enabled = parsed.enabledPlugins;
     if (typeof enabled !== "object" || enabled === null) return false;
     return Object.entries(enabled).some(
@@ -1230,7 +1135,7 @@ var ALLOW_BUILDS_KEY = "allowBuilds";
 var allowedBuilds = (root) => {
   const path = join9(root, WORKSPACE_YAML);
   if (!existsSync6(path)) return void 0;
-  const lines = readFileSync8(path, "utf8").split("\n");
+  const lines = readFileSync7(path, "utf8").split("\n");
   const at = lines.findIndex((line) => new RegExp(`^${ALLOW_BUILDS_KEY}\\s*:`).test(line));
   if (at < 0) return void 0;
   const names = [];
@@ -1387,7 +1292,7 @@ var composedHere = (root, workspaces) => {
   for (const path of filesUnder(root, (name) => SOURCE_FILE.test(name))) {
     let body;
     try {
-      body = readFileSync8(path, "utf8");
+      body = readFileSync7(path, "utf8");
     } catch {
       continue;
     }
@@ -1422,7 +1327,7 @@ var doorBringing = (root, name, declared) => DOORS.filter((door) => declared.has
 var dependenciesOf = (root, name) => {
   try {
     return JSON.parse(
-      readFileSync8(
+      readFileSync7(
         join9(packageDirOf(resolveFrom(root, name, root), name), "package.json"),
         "utf8"
       )
@@ -1567,7 +1472,7 @@ var pluginDirs = (root) => {
       const governs = layerOver(layers, root, relative);
       if (governs === void 0) continue;
       const key = governs.registry.join(", ");
-      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync8(join9(root, half), "utf8")).join("\n");
+      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync7(join9(root, half), "utf8")).join("\n");
       source.set(key, registry);
       const hasManifest = governs.manifests.some((name) => existsSync6(join9(at, entry.name, name)));
       if (!hasManifest || registry.includes(entry.name)) continue;
@@ -1597,7 +1502,7 @@ var pnpmMajorOf = (manifest) => {
 var pnpmBlock = (root) => {
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync8(join9(root, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync7(join9(root, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -1635,7 +1540,7 @@ var HOIST_REPAIR = "rm -rf node_modules/.modules.yaml node_modules/.pnpm-workspa
 var hoistPatterns = (root) => {
   const path = join9(root, WORKSPACE_YAML);
   if (!existsSync6(path)) return void 0;
-  const lines = readFileSync8(path, "utf8").split("\n");
+  const lines = readFileSync7(path, "utf8").split("\n");
   const at = lines.findIndex((line) => new RegExp(`^${HOIST_KEY}\\s*:`).test(line));
   if (at < 0) return void 0;
   const patterns = [];
@@ -1759,7 +1664,7 @@ import {
   existsSync as existsSync7,
   mkdirSync,
   mkdtempSync,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync8,
   rmSync,
   writeFileSync
 } from "fs";
@@ -1938,7 +1843,7 @@ var throughProbes = ({
         refused.set(rule, String(error.message));
       }
     }
-    const probeConfig = JSON.parse(readFileSync9(config.path, "utf8"));
+    const probeConfig = JSON.parse(readFileSync8(config.path, "utf8"));
     const configDir = dirname2(config.path);
     probeConfig.jsPlugins = (probeConfig.jsPlugins ?? []).map(
       (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve2(configDir, spec) : packageDirOf(resolveFrom(configDir, spec, root), spec)
@@ -2098,15 +2003,16 @@ var checkExercised = async ({
 };
 
 // src/envelope.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync5, readFileSync as readFileSync9 } from "fs";
 import { join as join11 } from "path";
-var ENVELOPES_DIR = ".geonosis/envelopes";
+import { ENVELOPES_DIR } from "@geonosis/ratchet";
+import { ENVELOPES_DIR as ENVELOPES_DIR2 } from "@geonosis/ratchet";
 var THIS_TOOL = "doctor";
 var OWN = `${THIS_TOOL}.json`;
 var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one (this run\u2019s own doctor.json is not one of them: it is written after these checks, and balanced at write time)";
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var make2 = findingMaker("envelope");
-var finding6 = (verdict, subject, message) => make2(subject, verdict, message);
+var make = findingMaker("envelope");
+var finding6 = (verdict, subject, message) => make(subject, verdict, message);
 var lengthOf = (value) => Array.isArray(value) ? value.length : void 0;
 var NEXT = "Next: re-run the tool that wrote it and read the numbers it prints \u2014 a run that has lost count of its own inputs is a bug in that tool, not in this tree";
 var judge = (subject, name, parsed) => {
@@ -2164,7 +2070,7 @@ var checkEnvelopes = ({ root }) => {
     const subject = `${ENVELOPES_DIR}/${name}`;
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync10(join11(dir, name), "utf8"));
+      parsed = JSON.parse(readFileSync9(join11(dir, name), "utf8"));
     } catch (error) {
       return finding6("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
     }
@@ -2173,7 +2079,7 @@ var checkEnvelopes = ({ root }) => {
 };
 
 // src/exams.ts
-import { existsSync as existsSync9, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
 import { dirname as dirname3, join as join12 } from "path";
 var SCOPE = "@geonosis/";
 var EXAM = /(?:^|[^$\w])([$\w]*Conformance)\b/g;
@@ -2200,7 +2106,7 @@ var declaredBy = (workspaces) => {
 var declarationsOf = (dir) => {
   const at = join12(dir, "package.json");
   if (!existsSync9(at)) return "";
-  const manifest = JSON.parse(readFileSync11(at, "utf8"));
+  const manifest = JSON.parse(readFileSync10(at, "utf8"));
   const entries = [];
   const walk2 = (value) => {
     if (typeof value === "string" && value.endsWith(".d.ts")) entries.push(value);
@@ -2211,7 +2117,7 @@ var declarationsOf = (dir) => {
   walk2({ exports: manifest["exports"], types: manifest["types"] });
   return [...new Set(entries)].map((entry) => {
     try {
-      return readFileSync11(join12(dir, entry), "utf8");
+      return readFileSync10(join12(dir, entry), "utf8");
     } catch {
       return "";
     }
@@ -2237,7 +2143,7 @@ var checkExams = ({
   root,
   workspaces
 }) => {
-  const tests = testFilesUnder(root).map((path) => ({ path, source: readFileSync11(path, "utf8") }));
+  const tests = testFilesUnder(root).map((path) => ({ path, source: readFileSync10(path, "utf8") }));
   const found = [];
   for (const { from, name } of declaredBy(workspaces)) {
     const exams = examsShippedBy(from, name, root);
@@ -2263,7 +2169,7 @@ var checkExams = ({
 };
 
 // src/claude-plugin.ts
-import { existsSync as existsSync10, readFileSync as readFileSync12, realpathSync as realpathSync3 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join13, resolve as resolve3 } from "path";
 var INSTALLED_PLUGINS = ".claude/plugins/installed_plugins.json";
@@ -2274,7 +2180,7 @@ var installedPlugins = (home, name) => {
   if (!existsSync10(at)) return [];
   let record;
   try {
-    record = JSON.parse(readFileSync12(at, "utf8"));
+    record = JSON.parse(readFileSync11(at, "utf8"));
   } catch {
     return [];
   }
@@ -2380,7 +2286,7 @@ var checkClaudePlugin = ({
 };
 
 // src/loaded.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { join as join14, sep as sep4 } from "path";
 var SCOPE2 = "@geonosis/";
 var NOT_THE_SCOPE_DIRECTORY = "Deleting only the scope directory inside that node_modules is a repair no pnpm install undoes \u2014 the tree is then missing the package and every install stays green.";
@@ -2529,7 +2435,7 @@ var shipperOf = (root, bin) => {
   const name = bin === "geonosis" ? "@geonosis/cli" : `@geonosis/${bin.replace(/^geonosis-/, "")}`;
   try {
     const manifest = JSON.parse(
-      readFileSync13(join14(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
+      readFileSync12(join14(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
     );
     const declared = manifest.bin;
     return typeof declared === "object" && !Object.hasOwn(declared, bin) ? "" : name;
@@ -2637,13 +2543,13 @@ var trainVersion = async (root, specifiers) => {
 };
 
 // src/observability.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { join as join15 } from "path";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
-var make3 = findingMaker("observability");
-var finding9 = (verdict, subject, message) => make3(subject, verdict, message);
+var make2 = findingMaker("observability");
+var finding9 = (verdict, subject, message) => make2(subject, verdict, message);
 var readGeonosis = (root) => {
   const read = readGeonosisFile(root);
   if (read.kind === "unreadable") return { error: read.error, present: false };
@@ -2721,7 +2627,7 @@ var ageFinding = (config, root, now) => {
   const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
   let record;
   try {
-    record = JSON.parse(readFileSync14(join15(root, file), "utf8"));
+    record = JSON.parse(readFileSync13(join15(root, file), "utf8"));
   } catch (error) {
     return finding9(
       "FAIL",
@@ -2865,7 +2771,7 @@ var checkRequiredOptions = async ({
 };
 
 // src/runner.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { resolve as resolve4 } from "path";
 var TEST_FAILURES = "testFailures";
 var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
@@ -2875,7 +2781,7 @@ var wrapperNamedBy = (script, dir) => {
   for (const token of script.split(/[\s'"]+/)) {
     if (!A_SCRIPT_FILE.test(token)) continue;
     try {
-      return { source: readFileSync15(resolve4(dir, token), "utf8"), where: token };
+      return { source: readFileSync14(resolve4(dir, token), "utf8"), where: token };
     } catch {
       continue;
     }
@@ -3145,7 +3051,7 @@ var checkPathGrants = ({
 };
 
 // src/rails.ts
-import { existsSync as existsSync12, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
 import { join as join18 } from "path";
 var PROJECT = ".claude/settings.json";
 var LOCAL = ".claude/settings.local.json";
@@ -3169,7 +3075,7 @@ var sourceAt = (path, label) => {
   if (!existsSync12(path)) return { network: void 0, path: label, unreadable: false };
   try {
     return {
-      network: networkIn(JSON.parse(readFileSync16(path, "utf8"))),
+      network: networkIn(JSON.parse(readFileSync15(path, "utf8"))),
       path: label,
       unreadable: false
     };
@@ -3198,7 +3104,7 @@ var deniedEgress = (root) => {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync16(at, "utf8"));
+    parsed = JSON.parse(readFileSync15(at, "utf8"));
   } catch (error) {
     return [
       finding12(
@@ -3533,7 +3439,6 @@ export {
   defaultRef,
   checkBaseline,
   DEPLOYED_FILE,
-  NOT_WRITTEN,
   checkDeployed,
   resolveFrom,
   packageDirOf,
@@ -3551,9 +3456,9 @@ export {
   missingOptionOf,
   enabledRulesOf,
   checkExercised,
-  ENVELOPES_DIR,
   NO_ENVELOPES,
   checkEnvelopes,
+  ENVELOPES_DIR2 as ENVELOPES_DIR,
   checkExams,
   INSTALLED_PLUGINS,
   PLUGIN_NAME,

package/dist/doctor-cli.js

@@ -4,82 +4,15 @@ import {
   formatDoctor,
   formatJson,
   runDoctor
-} from "./chunk-VWMNCBDP.js";
+} from "./chunk-IJXJ2EF4.js";
 
 // src/doctor-cli.ts
 import { fstatSync, statSync } from "fs";
-import { resolve as resolve2 } from "path";
+import { resolve } from "path";
 
 // src/envelope-write.ts
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join, resolve } from "path";
-import { fileURLToPath } from "url";
-var envelopePath = (root, tool) => join(root, ENVELOPES_DIR, `${tool}.json`);
-var UnbalancedEnvelope = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "UnbalancedEnvelope";
-  }
-};
-var isCount = (value) => Number.isSafeInteger(value) && value >= 0;
-var unbalancedMessage = (envelope, next) => `${envelope.tool}: considered ${envelope.considered} but accounts for ${envelope.read + envelope.refused.length + envelope.excused.length} \u2014 ${envelope.read} read + ${envelope.refused.length} refused + ${envelope.excused.length} excused. A run that has lost count of its own inputs cannot say what it measured, so no verdict was rendered and no envelope was written. Next: ${next}`;
-var FORBIDDEN_ROOT = "GEONOSIS_ENVELOPES_FORBIDDEN_ROOT";
-var refuseForbiddenRoot = (root) => {
-  const forbidden = process.env[FORBIDDEN_ROOT];
-  if (forbidden === void 0 || resolve(forbidden) !== resolve(root)) return;
-  throw new UnbalancedEnvelope(
-    `${root} is off limits to envelope writers in this process (${FORBIDDEN_ROOT}) \u2014 a run that writes one into a shared root races every other run reading it, and leaves a file the next one takes for real. Point this at a scratch root of its own: tooling/scratch-dir.ts.`
-  );
-};
-var writeEnvelope = ({
-  envelope,
-  next,
-  root
-}) => {
-  if (envelope.tool.trim() === "") {
-    throw new UnbalancedEnvelope(
-      `an envelope with no tool name cannot be filed or reported against. Next: ${next}`
-    );
-  }
-  if (envelope.version.trim() === "") {
-    throw new UnbalancedEnvelope(
-      `${envelope.tool}: an envelope that cannot name the build that wrote it dates nothing, and a stale one reads exactly like a fresh one. Next: ${next}`
-    );
-  }
-  if (!isCount(envelope.considered) || !isCount(envelope.read)) {
-    throw new UnbalancedEnvelope(
-      `${envelope.tool}: considered ${envelope.considered} and read ${envelope.read} \u2014 a census is a whole number of things, and arithmetic over anything else balances by accident. Next: ${next}`
-    );
-  }
-  if (envelope.considered !== envelope.read + envelope.refused.length + envelope.excused.length) {
-    throw new UnbalancedEnvelope(unbalancedMessage(envelope, next));
-  }
-  refuseForbiddenRoot(root);
-  const at = envelopePath(root, envelope.tool);
-  mkdirSync(dirname(at), { recursive: true });
-  writeFileSync(at, `${JSON.stringify(envelope, void 0, 2)}
-`);
-  return at;
-};
-var UNKNOWN = "unknown";
-var versionIn = (dir) => {
-  try {
-    const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-    return typeof manifest.version === "string" ? manifest.version : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var versionOf = (moduleUrl) => {
-  let dir = dirname(fileURLToPath(moduleUrl));
-  for (; ; ) {
-    const found = versionIn(dir);
-    if (found !== void 0) return found;
-    const up = dirname(dir);
-    if (up === dir) return UNKNOWN;
-    dir = up;
-  }
-};
+import { versionOf } from "@geonosis/ratchet";
+import { envelopePath, UnbalancedEnvelope, versionOf as versionOf2, writeEnvelope } from "@geonosis/ratchet";
 var DOCTOR_TOOL = "doctor";
 var DOCTOR_NEXT = "geonosis-doctor --json and count the checks it printed \u2014 this run considered every question the tool has, and a check nobody asked for is excused by name rather than left out of the denominator";
 var doctorEnvelope = ({
@@ -247,8 +180,8 @@ var parseDoctorArgs = (argv, cwd) => {
     ...baseline === void 0 ? {} : { baseline },
     json,
     ...only === void 0 || only.length === 0 ? {} : { only },
-    ...read["--oxlint"] === void 0 ? {} : { oxlint: resolve2(cwd, read["--oxlint"]) },
-    root: resolve2(cwd, read["--root"] ?? cwd),
+    ...read["--oxlint"] === void 0 ? {} : { oxlint: resolve(cwd, read["--oxlint"]) },
+    root: resolve(cwd, read["--root"] ?? cwd),
     strict
   };
 };

package/dist/index.d.ts

@@ -1,3 +1,6 @@
+export { DEPLOYED_FILE } from '@geonosis/release';
+export { ENVELOPES_DIR } from '@geonosis/ratchet';
+
 type Overrides = {
     files: readonly string[];
     rules: Record<string, unknown>;
@@ -135,20 +138,6 @@ declare const checkBaseline: ({ ref, root }: {
     root: string;
 }) => Finding[];
 
-/**
- * The `loaded` lie one layer out: what a pipeline SAID it deployed, against what the tree declares.
- *
- * `wrangler versions upload` applies no triggers, so a cron or a route edited in the config is
- * silently ignored in production for ever, with a green pipeline; `wrangler secret put` creates and
- * deploys a version outside the gate entirely. Nothing in either consumer measured any of it.
- *
- * This reads the FILE the consumer's pipeline writes after promote — `.geonosis/deployed.json` —
- * and imports nothing of `@geonosis/release`, the same discipline `observability` follows: a check
- * that needed the package it checks cannot run in the tree where that package is missing. The
- * comparison is duplicated on purpose; it is set differences over four lists.
- */
-declare const DEPLOYED_FILE = ".geonosis/deployed.json";
-declare const NOT_WRITTEN = "no .geonosis/deployed.json \u2014 it is written by the pipeline after promote, and its absence is not a pass";
 declare const checkDeployed: ({ root }: {
     root: string;
 }) => Finding[];
@@ -200,22 +189,6 @@ declare const checkDrift: ({ readers, root, userSettings, workspaces }: {
     workspaces: Workspace[];
 }) => Finding[];
 
-/**
- * The one line that catches a denominator bug: for every envelope a tool wrote,
- * `considered === read + refused + excused`.
- *
- * Four of them landed in one day, all green — a migrations run that reported on three of four
- * files, a plan check that printed `PASS — 0 plan(s)` over a directory of twenty-one, a parity run
- * over a tree the second config had ignored, a validator that walked a list it had already
- * filtered. Every one published a numerator and no denominator, so nothing could be wrong.
- *
- * This READS the files and imports nothing of the tools that wrote them — the same discipline
- * `deployed` and `observability` follow. A check that needed the package it checks cannot run in
- * the tree where that package is missing, which is the first case it exists to find; and this one
- * has to work over a consumer's `.geonosis/` with no kit installed at all. The arithmetic is
- * duplicated here on purpose: it is one comparison over three numbers, and it is the check.
- */
-declare const ENVELOPES_DIR = ".geonosis/envelopes";
 declare const NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one (this run\u2019s own doctor.json is not one of them: it is written after these checks, and balanced at write time)";
 declare const checkEnvelopes: ({ root }: {
     root: string;
@@ -519,4 +492,4 @@ declare const checkRunner: ({ ratchet, root, workspaces }: {
     workspaces: Workspace[];
 }) => Finding[];
 
-export { APPARATUS_KEY, CHECKS, COMPOSITION_ROOT, CONFIG_FILE, type CheckName, DEPLOYED_FILE, type DiscoveredConfig, DoctorError, type DoctorOptions, type DoctorReport, ENVELOPES_DIR, FIXED_GROUP, FLOOR_PACKAGES, type Finding, GEONOSIS_FILE, type HeldTogether, INSTALLED_PLUGINS, type InstalledPlugin, KIT_GROUP, type LastEventRecord, MANIFEST_FILE, type Manifest, NOT_WRITTEN, NO_ENVELOPES, type ObservabilityConfig, PLUGIN_NAME, RATCHET_FILE, READERS, type RatchetConfig, SCOPE, type Verdict, type Workspace, checkBaseline, checkClaudePlugin, checkDeployed, checkDrift, checkEnvelopes, checkExams, checkExercised, checkGroup, checkLoaded, checkObservability, checkRequiredOptions, checkRunner, corpusOfPlugin, declaredApparatusOf, declaredFor, declaredGroupsOf, defaultRef, discoverConfigs, discoverWorkspaces, enabledRulesOf, evidenceHolding, formatDoctor, formatJson, installedPluginVersions, installedPlugins, loadedAt, missingOptionOf, packageDirOf, pluginVersionOf, readConfig, readRatchet, relativePath, relativeToRoot, repoCorpusOf, resolveFrom, runDoctor, satisfies };
+export { APPARATUS_KEY, CHECKS, COMPOSITION_ROOT, CONFIG_FILE, type CheckName, type DiscoveredConfig, DoctorError, type DoctorOptions, type DoctorReport, FIXED_GROUP, FLOOR_PACKAGES, type Finding, GEONOSIS_FILE, type HeldTogether, INSTALLED_PLUGINS, type InstalledPlugin, KIT_GROUP, type LastEventRecord, MANIFEST_FILE, type Manifest, NO_ENVELOPES, type ObservabilityConfig, PLUGIN_NAME, RATCHET_FILE, READERS, type RatchetConfig, SCOPE, type Verdict, type Workspace, checkBaseline, checkClaudePlugin, checkDeployed, checkDrift, checkEnvelopes, checkExams, checkExercised, checkGroup, checkLoaded, checkObservability, checkRequiredOptions, checkRunner, corpusOfPlugin, declaredApparatusOf, declaredFor, declaredGroupsOf, defaultRef, discoverConfigs, discoverWorkspaces, enabledRulesOf, evidenceHolding, formatDoctor, formatJson, installedPluginVersions, installedPlugins, loadedAt, missingOptionOf, packageDirOf, pluginVersionOf, readConfig, readRatchet, relativePath, relativeToRoot, repoCorpusOf, resolveFrom, runDoctor, satisfies };

package/dist/index.js

@@ -12,7 +12,6 @@ import {
   INSTALLED_PLUGINS,
   KIT_GROUP,
   MANIFEST_FILE,
-  NOT_WRITTEN,
   NO_ENVELOPES,
   PLUGIN_NAME,
   RATCHET_FILE,
@@ -55,7 +54,7 @@ import {
   resolveFrom,
   runDoctor,
   satisfies
-} from "./chunk-VWMNCBDP.js";
+} from "./chunk-IJXJ2EF4.js";
 export {
   APPARATUS_KEY,
   CHECKS,
@@ -70,7 +69,6 @@ export {
   INSTALLED_PLUGINS,
   KIT_GROUP,
   MANIFEST_FILE,
-  NOT_WRITTEN,
   NO_ENVELOPES,
   PLUGIN_NAME,
   RATCHET_FILE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/doctor",
-  "version": "2.12.0",
+  "version": "2.13.0",
   "types": "./dist/index.d.ts",
   "description": "The adoption doctor — declared ≠ loaded, enabled ≠ exercised, a baseline that grew, a runner whose exit code is the only verdict.",
   "keywords": [
@@ -36,10 +36,9 @@
     "dist"
   ],
   "dependencies": {
-    "@geonosis/lint-parity": "2.12.0"
-  },
-  "devDependencies": {
-    "@geonosis/ratchet": "2.12.0"
+    "@geonosis/lint-parity": "2.13.0",
+    "@geonosis/ratchet": "2.13.0",
+    "@geonosis/release": "2.13.0"
   },
   "peerDependencies": {
     "oxlint": ">=1.77"