@geonosis/ratchet 0.4.0 → 0.5.0

package/README.md

@@ -196,6 +196,37 @@ failures, they are unmeasured — and unmeasured reads exactly like green.
 `examples/during-day.ratchet.json` is four test entries for that reason: `apps/web` plus the three
 workerd packages that were previously outside every gate.
 
+### …or the runner's JSON report, which is stronger
+
+`report: "vitest-json"` reads the runner's own machine-readable answer instead of its prose:
+
+```jsonc
+{
+  "counter": "testFailures",
+  "key": "testFailuresApi",
+  "command": "cd apps/api && bunx vitest run --reporter=json --outputFile={report}",
+  "report": "vitest-json"
+}
+```
+
+`{report}` is replaced with a path in a temp directory the counter makes and removes; give the entry
+a `reportPath` instead when the report belongs somewhere your CI already collects. A command in this
+mode with neither is refused, naming what is missing — a run whose report goes nowhere is a run
+nobody can read.
+
+The counter then reads `numFailedTests`, and **refuses** rather than returning a number when:
+
+- the file is not there — a crash before the reporter wrote is not a pass, and it prints no summary
+  line either, so the summary parser had nothing to refuse on;
+- the file is not JSON, or has no `numFailedTests` in it;
+- the report says `success: false` and names **0** failing tests — the shape a pool that dies
+  mid-run writes. The run did not finish, so there is no number to bank.
+
+The summary mode stays the default; nothing changes for an entry that does not ask for a report.
+`--prove` proves BOTH: `testFailures` ships one probe per reading mode and prints them by name
+(`PROVEN testFailuresApi (vitest-json)`), because proving the mode nobody configured says nothing
+about the mode they did.
+
 ### `oxlintRule` counts a warned rule twice, on purpose
 
 A rule parked at `"warn"` as ratcheted debt appears in two numbers: once inside `oxlintWarnings`,
@@ -206,6 +237,25 @@ That is not double-counting the total; the second key exists so the debt is visi
 of hidden inside a lump sum that a different rule's warning could mask. dielime today: `oxlintWarnings`
 12 → 135 when `no-raw-html-atoms` was armed, with its own key at 123.
 
+### `--prove` also proves the lock
+
+`--exclusive` is a claim about the machine, so it is measured on the machine, every `--prove`:
+
+```
+PROVEN exclusive: two runs of 400ms serialised, the second starting 161ms after the first finished
+```
+
+The self-test runs two children of this CLI over `--hold <ms>` — an instrument that takes the lock,
+says when it started, waits, says when it finished, and gives the lock back — and requires the second
+to have started after the first finished. Anything else prints `CANNOT FAIL exclusive: interleaved`
+and exits 2. It uses a lock file of its own in a temp directory, so proving the lock never takes the
+real one out from under the runs it exists to serialise.
+
+It is here because the lock did not work for two releases and every gate was green throughout:
+`openSync(path, 'wx')` is atomic about the NAME and not about the holder, and a run polling in that
+window read an unparsable lock, called it stale, and took it. A lock nobody has watched fail has not
+been shown to work — and this one guards the running time of every other gate.
+
 ## Running it where it will actually run
 
 - **Counters run in the caller's environment.** They inherit the shell the ratchet was started in,
@@ -266,7 +316,7 @@ Every counter takes its `command` from the config, so the toolchain stays the re
 | `oxlintErrors` / `oxlintWarnings` | findings under any shape oxlint prints — `--format=unix`, the compact `agent` format, the graphical `default` — cross-checked against the tool's own summary | `command`, `expectFormat` |
 | `oxlintRule` | one named rule's findings, counted only on lines the run reported as findings and refused when none of them attributes itself readably; with `config`, after forcing the rule to `error` in a temp copy — `"warn"`, `"off"` and the `["off", { … }]` array form alike — so debt cannot grow behind a downgrade | `rule`, `config`, `command`, `expectFormat` |
 | `typecheckErrors` | `error TS` occurrences, refusing when TS2305/TS2307 name a workspace package of this repo — an unbuilt sibling is a missing build, not debt | `command` |
-| `testFailures` | the runner's own failure summary; throws when neither a pass nor a fail count is readable | `command` |
+| `testFailures` | the runner's own failure summary — or, with `report: "vitest-json"`, `numFailedTests` out of the JSON report the command wrote; throws when nothing is readable, when the report is absent, and when the report failed with nothing failing | `command`, `report`, `reportPath` |
 | `unformattedFiles` | paths `--list-different` names that exist on disk | `command` |
 | `cloneCount` | jscpd's `Found N clones` | `command` |
 | `knipIssues` | the totals under knip's unused-* headings | `command`, `headings` |

package/dist/{chunk-QVORWCUD.js → chunk-FM5I6PRT.js}

@@ -1,4 +1,131 @@
-// src/types.ts
+// src/core/lock.ts
+import { randomUUID } from "crypto";
+import { linkSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var heavyLockPath = () => process.env.GEONOSIS_HEAVY_LOCK ?? join(homedir(), ".cache", "geonosis", "heavy.lock");
+var sleep = (ms) => new Promise((done) => setTimeout(done, ms));
+var holderOf = (path) => {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return typeof parsed.pid === "number" ? {
+      cwd: parsed.cwd ?? "somewhere",
+      pid: parsed.pid,
+      startedAt: parsed.startedAt ?? "unknown"
+    } : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var heldFor = (holder) => {
+  const since = Date.parse(holder.startedAt);
+  if (Number.isNaN(since)) return "an unknown time";
+  return `${Math.round((Date.now() - since) / 1e3)}s`;
+};
+var write = (path) => {
+  mkdirSync(dirname(path), { recursive: true });
+  const mine = {
+    cwd: process.cwd(),
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const staging = `${path}.${process.pid}.${randomUUID()}`;
+  try {
+    writeFileSync(staging, JSON.stringify(mine));
+    linkSync(staging, path);
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    throw error;
+  } finally {
+    rmSync(staging, { force: true });
+  }
+};
+var acquireExclusive = async ({
+  noticeMs = 15e3,
+  path = heavyLockPath(),
+  pollMs = 250,
+  say = (line) => process.stderr.write(`${line}
+`),
+  timeoutSeconds = 1800
+} = {}) => {
+  const until = Date.now() + timeoutSeconds * 1e3;
+  let told = 0;
+  const release = () => {
+    if (holderOf(path)?.pid === process.pid) rmSync(path, { force: true });
+  };
+  for (; ; ) {
+    if (write(path)) return release;
+    const holder = holderOf(path);
+    if (holder === void 0 || !alive(holder.pid)) {
+      say(
+        `geonosis-ratchet: taking over a stale heavy lock (pid ${holder?.pid ?? "unreadable"} is gone)`
+      );
+      rmSync(path, { force: true });
+      continue;
+    }
+    if (Date.now() >= until) {
+      throw new Error(
+        `waited ${timeoutSeconds}s for the heavy lock held by pid ${holder.pid} in ${holder.cwd} (${heldFor(holder)}) \u2014 give it longer with --exclusive-timeout, or stop that run`
+      );
+    }
+    const now = Date.now();
+    if (now - told >= noticeMs) {
+      told = now;
+      say(
+        `geonosis-ratchet: waiting for the heavy lock \u2014 pid ${holder.pid} in ${holder.cwd}, held for ${heldFor(holder)}`
+      );
+    }
+    await sleep(pollMs);
+  }
+};
+
+// src/core/config.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { resolve } from "path";
+var CONFIG_FILE = "geonosis.ratchet.json";
+var keyOf = (entry) => entry.key ?? entry.counter;
+var loadConfig = (cwd) => {
+  const path = resolve(cwd, CONFIG_FILE);
+  if (!existsSync(path)) {
+    throw new Error(`no ${CONFIG_FILE} in ${cwd} \u2014 the ratchet has nothing to count`);
+  }
+  const parsed = JSON.parse(readFileSync2(path, "utf8"));
+  if (!Array.isArray(parsed.counters)) {
+    throw new Error(`${CONFIG_FILE} has no "counters" array`);
+  }
+  for (const entry of parsed.counters) {
+    if (typeof entry.counter !== "string") {
+      throw new Error(`${CONFIG_FILE}: every counter entry needs a "counter" id`);
+    }
+    if (entry.tiers !== void 0) {
+      const named = Array.isArray(entry.tiers) && entry.tiers.length > 0 && entry.tiers.every((tier) => typeof tier === "string" && tier.length > 0);
+      if (!named) {
+        throw new Error(
+          `${CONFIG_FILE}: "${keyOf(entry)}" has "tiers" that is not a non-empty list of tier names`
+        );
+      }
+    }
+  }
+  const keys = parsed.counters.map(keyOf);
+  const duplicate = keys.find((key, at) => keys.indexOf(key) !== at);
+  if (duplicate !== void 0) {
+    throw new Error(
+      `${CONFIG_FILE}: two counters both write "${duplicate}" \u2014 give one of them a distinct "key"`
+    );
+  }
+  return { baseline: parsed.baseline ?? "gate-baseline.json", counters: parsed.counters };
+};
+
+// src/core/types.ts
 var CounterError = class extends Error {
   constructor(counter, message) {
     super(`${counter}: ${message}`);
@@ -8,6 +135,276 @@ var CounterError = class extends Error {
   counter;
 };
 
+// src/core/shell.ts
+import { execSync } from "child_process";
+var ANSI = /\[[0-9;]*m/g;
+var runCommand = (cwd, counterId, env) => (command) => {
+  try {
+    const output = execSync(`${command} 2>&1`, {
+      cwd,
+      encoding: "utf8",
+      env,
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return { code: 0, output: output.replaceAll(ANSI, "") };
+  } catch (error) {
+    const failed = error;
+    const output = `${failed.stdout ?? ""}${failed.stderr ?? ""}`.replaceAll(ANSI, "");
+    const code = failed.status ?? -1;
+    if (code === 126 || code === 127 || code === -1) {
+      throw new CounterError(
+        counterId,
+        `command did not run (exit ${code}): ${command}
+${output.trim()}`
+      );
+    }
+    return { code, output };
+  }
+};
+
+// src/core/prove.ts
+import { existsSync as existsSync2, mkdtempSync, rmSync as rmSync2 } from "fs";
+import { tmpdir } from "os";
+import { delimiter, dirname as dirname3, join as join2, resolve as resolve3 } from "path";
+
+// src/core/exclusive.ts
+import { spawn } from "child_process";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+var MARK = /^exclusive-hold (start|end) (\d+)$/gm;
+var KEY = "exclusive";
+var spanOf = (output) => {
+  const marks = [...output.matchAll(MARK)];
+  const start = marks.find((one) => one[1] === "start")?.[2];
+  const end = marks.find((one) => one[1] === "end")?.[2];
+  if (start === void 0 || end === void 0) return void 0;
+  return { end: Number(end), start: Number(start) };
+};
+var hold = (cli, holdMs, lockPath) => new Promise((done) => {
+  const child = spawn(
+    process.execPath,
+    [cli, "--exclusive", "--exclusive-timeout", "60", "--hold", String(holdMs)],
+    {
+      cwd: dirname2(resolve2(cli)),
+      env: { ...process.env, GEONOSIS_HEAVY_LOCK: lockPath },
+      stdio: ["ignore", "pipe", "pipe"]
+    }
+  );
+  let output = "";
+  child.stdout.on("data", (chunk) => {
+    output += chunk.toString();
+  });
+  child.stderr.on("data", (chunk) => {
+    output += chunk.toString();
+  });
+  child.on("close", (code) => done({ code, output }));
+});
+var proveExclusive = async ({
+  cli,
+  holdMs = 400,
+  lockPath
+}) => {
+  const runs = await Promise.all([hold(cli, holdMs, lockPath), hold(cli, holdMs, lockPath)]);
+  const spans = runs.map((one) => spanOf(one.output));
+  const [first, second] = spans;
+  if (first === void 0 || second === void 0) {
+    return {
+      counter: KEY,
+      key: KEY,
+      reason: `a run under --exclusive printed no start/end to compare:
+${runs.map((one) => `exit ${String(one.code)}: ${one.output.trim().slice(-300)}`).join("\n")}`,
+      verdict: "cannot-measure"
+    };
+  }
+  const [early, late] = first.start <= second.start ? [first, second] : [second, first];
+  const gap = late.start - early.end;
+  if (gap < 0) {
+    return {
+      key: KEY,
+      reason: `the second run started ${-gap}ms BEFORE the first finished \u2014 two runs, one lock, both holding it`,
+      verdict: "interleaved"
+    };
+  }
+  return {
+    key: KEY,
+    reason: `two runs of ${holdMs}ms serialised, the second starting ${gap}ms after the first finished`,
+    verdict: "serialised"
+  };
+};
+
+// src/core/prove.ts
+var toolPath = (cwd) => {
+  const dirs = [];
+  let dir = resolve3(cwd);
+  for (; ; ) {
+    const bin = join2(dir, "node_modules", ".bin");
+    if (existsSync2(bin)) dirs.push(bin);
+    const parent = dirname3(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return [...dirs, process.env.PATH ?? ""].join(delimiter);
+};
+var NO_PROBE = "no probe \u2014 a counter nobody has seen read a planted finding has not been shown to measure";
+var oneProofOf = async (counter, key, path, probe) => {
+  const dir = mkdtempSync(join2(tmpdir(), "geonosis-prove-"));
+  try {
+    probe.input(dir);
+    const command = probe.command?.(dir);
+    const reading = await counter.run({
+      cwd: dir,
+      key,
+      params: { ...probe.params, ...command === void 0 ? {} : { command } },
+      run: runCommand(dir, counter.id, { ...process.env, PATH: path })
+    });
+    if (reading === 0) return { counter: counter.id, key, reading, verdict: "cannot-fail" };
+    if (reading < probe.expect) {
+      return { counter: counter.id, expected: probe.expect, key, reading, verdict: "misread" };
+    }
+    return { counter: counter.id, key, reading, verdict: "proven" };
+  } catch (error) {
+    return { counter: counter.id, key, reason: error.message, verdict: "cannot-measure" };
+  } finally {
+    rmSync2(dir, { force: true, recursive: true });
+  }
+};
+var probesOf = (counter) => {
+  if (counter.probe === void 0) return [];
+  return Array.isArray(counter.probe) ? counter.probe : [counter.probe];
+};
+var proofOf = async (counter, key, path) => {
+  const probes = probesOf(counter);
+  if (probes.length === 0) {
+    return [{ counter: counter.id, key, reason: NO_PROBE, verdict: "cannot-measure" }];
+  }
+  const proofs = [];
+  for (const probe of probes) {
+    const named = probe.name === void 0 ? key : `${key} (${probe.name})`;
+    const proof = await oneProofOf(counter, named, path, probe);
+    proofs.push(proof);
+    if (proof.verdict !== "proven") break;
+  }
+  return proofs;
+};
+var outsideTier = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
+var runProve = async ({
+  counters,
+  cwd,
+  exclusiveVia,
+  tier
+}) => {
+  const config = loadConfig(cwd);
+  const byId = new Map(counters.map((one) => [one.id, one]));
+  const path = toolPath(cwd);
+  const proofs = [];
+  for (const entry of config.counters) {
+    const counter = byId.get(entry.counter);
+    if (counter === void 0) {
+      throw new Error(
+        `no counter implements "${entry.counter}" \u2014 known ids: ${[...byId.keys()].toSorted().join(", ")}`
+      );
+    }
+    const key = keyOf(entry);
+    if (tier !== void 0 && outsideTier(entry, tier)) {
+      proofs.push({ key, tier, verdict: "skipped" });
+      continue;
+    }
+    const taken = await proofOf(counter, key, path);
+    proofs.push(...taken);
+    if (taken.some((one) => one.verdict !== "proven" && one.verdict !== "skipped")) {
+      return { proofs, proven: false };
+    }
+  }
+  if (exclusiveVia !== void 0) {
+    const dir = mkdtempSync(join2(tmpdir(), "geonosis-lock-"));
+    try {
+      const proof = await proveExclusive({ cli: exclusiveVia, lockPath: join2(dir, "heavy.lock") });
+      proofs.push(proof);
+      if (proof.verdict !== "serialised") return { proofs, proven: false };
+    } finally {
+      rmSync2(dir, { force: true, recursive: true });
+    }
+  }
+  return { proofs, proven: true };
+};
+
+// src/core/ratchet.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve4 } from "path";
+var EVIDENCE_LINES = 10;
+var recorded = (run) => {
+  let output = "";
+  return {
+    last: () => output.split("\n").map((line) => line.trimEnd()).filter((line) => line !== "").slice(-EVIDENCE_LINES),
+    run: (command) => {
+      const result = run(command);
+      output = result.output;
+      return result;
+    }
+  };
+};
+var verdictOf = (now, baseline) => {
+  if (now > baseline) return "grew";
+  if (now < baseline) return "shrank";
+  return "held";
+};
+var outsideTier2 = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
+var runRatchet = async ({
+  counters,
+  cwd,
+  tier
+}) => {
+  const config = loadConfig(cwd);
+  const baselinePath = resolve4(cwd, config.baseline);
+  if (!existsSync3(baselinePath)) {
+    throw new Error(`no ${config.baseline} in ${cwd} \u2014 nothing to ratchet against`);
+  }
+  const baseline = JSON.parse(readFileSync3(baselinePath, "utf8"));
+  const byId = new Map(counters.map((one) => [one.id, one]));
+  const measurements = [];
+  for (const entry of config.counters) {
+    const counter = byId.get(entry.counter);
+    if (counter === void 0) {
+      throw new Error(
+        `no counter implements "${entry.counter}" \u2014 known ids: ${[...byId.keys()].toSorted().join(", ")}`
+      );
+    }
+    const key = keyOf(entry);
+    if (tier !== void 0 && outsideTier2(entry, tier)) {
+      measurements.push({ key, tier, verdict: "skipped" });
+      continue;
+    }
+    const limit = baseline[key];
+    if (typeof limit !== "number") {
+      throw new Error(
+        `${config.baseline} has no number for "${key}" \u2014 add it before enabling the counter`
+      );
+    }
+    const recorder = recorded(runCommand(cwd, entry.counter));
+    const now = await counter.run({ cwd, key, params: entry, run: recorder.run });
+    const verdict = verdictOf(now, limit);
+    measurements.push({
+      baseline: limit,
+      evidence: verdict === "grew" ? recorder.last() : [],
+      key,
+      now,
+      verdict
+    });
+  }
+  const grew = measurements.some((one) => one.verdict === "grew");
+  const shrank = measurements.some((one) => one.verdict === "shrank");
+  if (shrank && !grew) {
+    const next = { ...baseline };
+    for (const one of measurements) {
+      if (one.verdict !== "skipped") next[one.key] = one.now;
+    }
+    writeFileSync2(baselinePath, `${JSON.stringify(next, null, 2)}
+`);
+    return { measurements, rewritten: true };
+  }
+  return { measurements, rewritten: false };
+};
+
 // src/counters/params.ts
 var stringParam = (counter, params, name, fallback) => {
   const value = params[name];
@@ -24,12 +421,12 @@ var countMatches = (text, pattern) => text.match(new RegExp(pattern.source, `${p
 var escapeForRegex = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/counters/plant.ts
-import { mkdirSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4, join as join3 } from "path";
 var plant = (dir, relative, contents) => {
-  const path = join(dir, relative);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, contents);
+  const path = join3(dir, relative);
+  mkdirSync2(dirname4(path), { recursive: true });
+  writeFileSync3(path, contents);
 };
 var captured = (sample) => ({
   command: () => "cat sample.txt",
@@ -93,8 +490,8 @@ var boundaryIssues = {
 };
 
 // src/counters/format.ts
-import { existsSync } from "fs";
-import { resolve } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { resolve as resolve5 } from "path";
 var unformattedFiles = {
   id: "unformattedFiles",
   probe: {
@@ -109,13 +506,13 @@ var unformattedFiles = {
       "command",
       "npx oxfmt --config .oxfmtrc.json --list-different ."
     );
-    return run(command).output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && existsSync(resolve(cwd, line))).length;
+    return run(command).output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && existsSync4(resolve5(cwd, line))).length;
   }
 };
 
 // src/counters/law.ts
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve6 } from "path";
 var lawLineCount = {
   id: "lawLineCount",
   probe: {
@@ -125,15 +522,15 @@ var lawLineCount = {
   },
   run: async ({ cwd, params }) => {
     const relative = stringParam("lawLineCount", params, "path", "CLAUDE.md");
-    const path = resolve2(cwd, relative);
-    if (!existsSync2(path)) throw new CounterError("lawLineCount", `no law file at ${relative}`);
-    return readFileSync(path, "utf8").replace(/\n$/, "").split("\n").length;
+    const path = resolve6(cwd, relative);
+    if (!existsSync5(path)) throw new CounterError("lawLineCount", `no law file at ${relative}`);
+    return readFileSync4(path, "utf8").replace(/\n$/, "").split("\n").length;
   }
 };
 
 // src/counters/oxlint.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve3 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve7 } from "path";
 var DEFAULT_COMMAND = "npx oxlint --format=unix --config .oxlintrc.json .";
 var PROBE_COMMAND = "oxlint --format=unix --config .oxlintrc.json .";
 var oxlintProbe = (severity, rule, source) => ({
@@ -272,18 +669,18 @@ var oxlintRule = {
     const config = typeof params.config === "string" ? params.config : "";
     const expect = expectedFormat("oxlintRule", params);
     if (config === "") return countRule(run(command), rule, expect);
-    const source = resolve3(cwd, config);
-    if (!existsSync3(source)) throw new CounterError("oxlintRule", `no config at ${config}`);
+    const source = resolve7(cwd, config);
+    if (!existsSync6(source)) throw new CounterError("oxlintRule", `no config at ${config}`);
     const strictName = `.oxlintrc.ratchet-${key}.json`;
-    const strict = readFileSync2(source, "utf8").replace(
+    const strict = readFileSync5(source, "utf8").replace(
       new RegExp(`("[^"]*${escapeForRegex(rule)}"\\s*:\\s*\\[?\\s*)"(warn|off)"`),
       '$1"error"'
     );
-    writeFileSync2(resolve3(cwd, strictName), strict);
+    writeFileSync4(resolve7(cwd, strictName), strict);
     try {
       return countRule(run(command.replace("{config}", strictName)), rule, expect);
     } finally {
-      rmSync(resolve3(cwd, strictName), { force: true });
+      rmSync3(resolve7(cwd, strictName), { force: true });
     }
   }
 };
@@ -323,471 +720,231 @@ var sumOfCounts = {
 };
 
 // src/counters/tests.ts
+import { existsSync as existsSync7, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync4 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4, resolve as resolve8 } from "path";
 var FAILED = /(\d+)\s+fail(?:ed|ing|s)?\b/;
 var PASSED = /(\d+)\s+pass(?:ed|ing|es)?\b/;
-var testFailures = {
-  id: "testFailures",
-  probe: { ...captured("  Tests  1 failed | 0 passed (1)\n"), expect: 1 },
-  run: async ({ params, run }) => {
-    const command = stringParam("testFailures", params, "command", "npx vitest run");
-    const output = run(command).output;
-    const failed = output.match(FAILED)?.[1];
-    if (failed !== void 0) return Number(failed);
-    if (PASSED.test(output)) return 0;
-    throw new CounterError(
-      "testFailures",
-      `no pass/fail summary in the runner output:
+var COUNTER = "testFailures";
+var VITEST_JSON = "vitest-json";
+var PLACEHOLDER = "{report}";
+var fromSummary = (output) => {
+  const failed = output.match(FAILED)?.[1];
+  if (failed !== void 0) return Number(failed);
+  if (PASSED.test(output)) return 0;
+  throw new CounterError(
+    COUNTER,
+    `no pass/fail summary in the runner output:
 ${output.trim().slice(-500)}`
-    );
-  }
-};
-
-// src/counters/workspace.ts
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync3 } from "fs";
-import { join as join2, resolve as resolve4 } from "path";
-var SKIP = /^(node_modules|\.)/;
-var childDirs = (dir) => {
-  try {
-    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !SKIP.test(entry.name)).map((entry) => join2(dir, entry.name));
-  } catch {
-    return [];
-  }
-};
-var descendants = (dir, depth) => depth === 0 ? [dir] : [dir, ...childDirs(dir).flatMap((child) => descendants(child, depth - 1))];
-var expand = (root, pattern) => {
-  const segments = pattern.split("/").filter((one) => one !== "" && one !== ".");
-  let dirs = [root];
-  for (const segment of segments) {
-    dirs = segment === "*" ? dirs.flatMap((dir) => childDirs(dir)) : segment === "**" ? dirs.flatMap((dir) => descendants(dir, 3)) : dirs.map((dir) => join2(dir, segment)).filter((dir) => existsSync4(dir));
-  }
-  return dirs;
-};
-var QUOTED = /^['"]|['"]$/g;
-var cleaned = (value) => value.replace(/#.*$/, "").trim().replaceAll(QUOTED, "");
-var pnpmPatterns = (path) => {
-  const lines = readFileSync3(path, "utf8").split("\n");
-  const at = lines.findIndex((line) => line.startsWith("packages:"));
-  if (at === -1) return [];
-  const inline = lines[at]?.slice("packages:".length).trim() ?? "";
-  if (inline.startsWith("[")) {
-    return inline.replace(/^\[|\]$/g, "").split(",").map(cleaned).filter((one) => one !== "");
-  }
-  const patterns = [];
-  for (const line of lines.slice(at + 1)) {
-    const item = /^\s*-\s*(.+)$/.exec(line);
-    if (item?.[1] !== void 0) {
-      patterns.push(cleaned(item[1]));
-      continue;
-    }
-    if (line.trim() !== "") break;
-  }
-  return patterns;
-};
-var npmPatterns = (path) => {
-  const parsed = JSON.parse(readFileSync3(path, "utf8"));
-  const declared = Array.isArray(parsed.workspaces) ? parsed.workspaces : parsed.workspaces?.packages ?? [];
-  return declared.filter((one) => typeof one === "string");
-};
-var nameOf = (dir) => {
-  const manifest = join2(dir, "package.json");
-  if (!existsSync4(manifest)) return void 0;
-  try {
-    const { name } = JSON.parse(readFileSync3(manifest, "utf8"));
-    return typeof name === "string" && name !== "" ? name : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var workspacePackageNames = (cwd) => {
-  const root = resolve4(cwd);
-  const pnpm = join2(root, "pnpm-workspace.yaml");
-  const manifest = join2(root, "package.json");
-  const patterns = existsSync4(pnpm) ? pnpmPatterns(pnpm) : existsSync4(manifest) ? npmPatterns(manifest) : [];
-  const names = patterns.filter((pattern) => !pattern.startsWith("!")).flatMap((pattern) => expand(root, pattern)).map((dir) => nameOf(dir)).filter((name) => name !== void 0);
-  return [...new Set(names)];
-};
-
-// src/counters/typecheck.ts
-var UNRESOLVED = /error TS(?:2305|2307): ([^\n]*)/g;
-var SPECIFIER = /'([^']+)'/g;
-var specifiersIn = (message) => [...message.matchAll(SPECIFIER)].map(([, quoted]) => (quoted ?? "").replaceAll('"', ""));
-var unbuiltIn = (cwd, output) => {
-  const messages = [...output.matchAll(UNRESOLVED)].map(([, message]) => message ?? "");
-  if (messages.length === 0) return [];
-  const packages = workspacePackageNames(cwd);
-  const named = messages.flatMap((message) => specifiersIn(message)).flatMap(
-    (specifier) => packages.filter((name) => specifier === name || specifier.startsWith(`${name}/`))
   );
-  return [...new Set(named)].toSorted();
-};
-var typecheckErrors = {
-  id: "typecheckErrors",
-  probe: {
-    command: () => "tsc --noEmit a.ts",
-    expect: 1,
-    input: (dir) => plant(dir, "a.ts", "export const n: number = 'not a number'\n")
-  },
-  run: async ({ cwd, params, run }) => {
-    const command = stringParam("typecheckErrors", params, "command", "npx tsc --noEmit");
-    const output = run(command).output;
-    const unbuilt = unbuiltIn(cwd, output);
-    if (unbuilt.length > 0) {
-      throw new CounterError(
-        "typecheckErrors",
-        `workspace packages not built: ${unbuilt.join(", ")} \u2014 build them before measuring typecheckErrors`
-      );
-    }
-    return countMatches(output, /error TS/);
-  }
 };
-
-// src/counters/index.ts
-var COUNTERS = [
-  archViolations,
-  boundaryIssues,
-  cloneCount,
-  knipIssues,
-  lawLineCount,
-  oxlintErrors,
-  oxlintRule,
-  oxlintWarnings,
-  runtimeCodeShipped,
-  sumOfCounts,
-  testFailures,
-  typecheckErrors,
-  unformattedFiles
-];
-var counterById = (id) => {
-  const counter = COUNTERS.find((one) => one.id === id);
-  if (counter === void 0) {
-    throw new Error(
-      `no counter implements "${id}" \u2014 known ids: ${COUNTERS.map((one) => one.id).join(", ")}`
+var fromReport = (path) => {
+  if (!existsSync7(path)) {
+    throw new CounterError(
+      COUNTER,
+      `the runner wrote no report at ${path} \u2014 a crash before the reporter is not a pass`
     );
   }
-  return counter;
-};
-
-// src/lock.ts
-import { randomUUID } from "crypto";
-import { linkSync, mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir } from "os";
-import { dirname as dirname2, join as join3 } from "path";
-var heavyLockPath = () => process.env.GEONOSIS_HEAVY_LOCK ?? join3(homedir(), ".cache", "geonosis", "heavy.lock");
-var sleep = (ms) => new Promise((done) => setTimeout(done, ms));
-var holderOf = (path) => {
-  try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
-    return typeof parsed.pid === "number" ? {
-      cwd: parsed.cwd ?? "somewhere",
-      pid: parsed.pid,
-      startedAt: parsed.startedAt ?? "unknown"
-    } : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var alive = (pid) => {
+  let report;
   try {
-    process.kill(pid, 0);
-    return true;
+    report = JSON.parse(readFileSync6(path, "utf8"));
   } catch (error) {
-    return error.code === "EPERM";
+    throw new CounterError(
+      COUNTER,
+      `the report at ${path} is not JSON: ${error.message}`
+    );
   }
-};
-var heldFor = (holder) => {
-  const since = Date.parse(holder.startedAt);
-  if (Number.isNaN(since)) return "an unknown time";
-  return `${Math.round((Date.now() - since) / 1e3)}s`;
-};
-var write = (path) => {
-  mkdirSync2(dirname2(path), { recursive: true });
-  const mine = {
-    cwd: process.cwd(),
-    pid: process.pid,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const staging = `${path}.${process.pid}.${randomUUID()}`;
-  try {
-    writeFileSync3(staging, JSON.stringify(mine));
-    linkSync(staging, path);
-    return true;
-  } catch (error) {
-    if (error.code === "EEXIST") return false;
-    throw error;
-  } finally {
-    rmSync2(staging, { force: true });
+  const failed = report.numFailedTests;
+  if (typeof failed !== "number") {
+    throw new CounterError(
+      COUNTER,
+      `the report at ${path} has no "numFailedTests" \u2014 it is not a vitest JSON report`
+    );
   }
-};
-var acquireExclusive = async ({
-  noticeMs = 15e3,
-  path = heavyLockPath(),
-  pollMs = 250,
-  say = (line) => process.stderr.write(`${line}
-`),
-  timeoutSeconds = 1800
-} = {}) => {
-  const until = Date.now() + timeoutSeconds * 1e3;
-  let told = 0;
-  const release = () => {
-    if (holderOf(path)?.pid === process.pid) rmSync2(path, { force: true });
-  };
-  for (; ; ) {
-    if (write(path)) return release;
-    const holder = holderOf(path);
-    if (holder === void 0 || !alive(holder.pid)) {
-      say(
-        `geonosis-ratchet: taking over a stale heavy lock (pid ${holder?.pid ?? "unreadable"} is gone)`
-      );
-      rmSync2(path, { force: true });
-      continue;
-    }
-    if (Date.now() >= until) {
-      throw new Error(
-        `waited ${timeoutSeconds}s for the heavy lock held by pid ${holder.pid} in ${holder.cwd} (${heldFor(holder)}) \u2014 give it longer with --exclusive-timeout, or stop that run`
-      );
-    }
-    const now = Date.now();
-    if (now - told >= noticeMs) {
-      told = now;
-      say(
-        `geonosis-ratchet: waiting for the heavy lock \u2014 pid ${holder.pid} in ${holder.cwd}, held for ${heldFor(holder)}`
-      );
-    }
-    await sleep(pollMs);
+  if (report.success === false && failed === 0) {
+    throw new CounterError(
+      COUNTER,
+      `the report at ${path} says success: false and names 0 failing tests \u2014 the run did not finish, so there is no number to bank`
+    );
   }
+  return failed;
 };
-
-// src/config.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve5 } from "path";
-var CONFIG_FILE = "geonosis.ratchet.json";
-var keyOf = (entry) => entry.key ?? entry.counter;
-var loadConfig = (cwd) => {
-  const path = resolve5(cwd, CONFIG_FILE);
-  if (!existsSync5(path)) {
-    throw new Error(`no ${CONFIG_FILE} in ${cwd} \u2014 the ratchet has nothing to count`);
-  }
-  const parsed = JSON.parse(readFileSync5(path, "utf8"));
-  if (!Array.isArray(parsed.counters)) {
-    throw new Error(`${CONFIG_FILE} has no "counters" array`);
-  }
-  for (const entry of parsed.counters) {
-    if (typeof entry.counter !== "string") {
-      throw new Error(`${CONFIG_FILE}: every counter entry needs a "counter" id`);
-    }
-    if (entry.tiers !== void 0) {
-      const named = Array.isArray(entry.tiers) && entry.tiers.length > 0 && entry.tiers.every((tier) => typeof tier === "string" && tier.length > 0);
-      if (!named) {
-        throw new Error(
-          `${CONFIG_FILE}: "${keyOf(entry)}" has "tiers" that is not a non-empty list of tier names`
-        );
-      }
-    }
-  }
-  const keys = parsed.counters.map(keyOf);
-  const duplicate = keys.find((key, at) => keys.indexOf(key) !== at);
-  if (duplicate !== void 0) {
-    throw new Error(
-      `${CONFIG_FILE}: two counters both write "${duplicate}" \u2014 give one of them a distinct "key"`
+var reportPathFor = (cwd, params, command) => {
+  const named = params.reportPath;
+  if (typeof named === "string" && named !== "") return { own: false, path: resolve8(cwd, named) };
+  if (!command.includes(PLACEHOLDER)) {
+    throw new CounterError(
+      COUNTER,
+      `report: "${VITEST_JSON}" needs somewhere to put the report \u2014 write ${PLACEHOLDER} into the command (--outputFile=${PLACEHOLDER}) or give the entry a "reportPath"`
     );
   }
-  return { baseline: parsed.baseline ?? "gate-baseline.json", counters: parsed.counters };
+  return { own: true, path: join4(mkdtempSync2(join4(tmpdir2(), "geonosis-report-")), "report.json") };
 };
-
-// src/shell.ts
-import { execSync } from "child_process";
-var ANSI = /\[[0-9;]*m/g;
-var runCommand = (cwd, counterId, env) => (command) => {
-  try {
-    const output = execSync(`${command} 2>&1`, {
-      cwd,
-      encoding: "utf8",
-      env,
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    return { code: 0, output: output.replaceAll(ANSI, "") };
-  } catch (error) {
-    const failed = error;
-    const output = `${failed.stdout ?? ""}${failed.stderr ?? ""}`.replaceAll(ANSI, "");
-    const code = failed.status ?? -1;
-    if (code === 126 || code === 127 || code === -1) {
-      throw new CounterError(
-        counterId,
-        `command did not run (exit ${code}): ${command}
-${output.trim()}`
+var testFailures = {
+  id: COUNTER,
+  probe: [
+    { ...captured("  Tests  1 failed | 0 passed (1)\n"), expect: 1, name: "summary" },
+    {
+      // `cat` stands in for the runner: the placeholder is substituted into it, so a counter that
+      // stopped substituting would hand `cat` the literal token and read nothing.
+      command: () => `cat ${PLACEHOLDER}`,
+      expect: 1,
+      input: (dir) => plant(
+        dir,
+        "planted-report.json",
+        `${JSON.stringify({ numFailedTests: 1, numTotalTests: 1, success: false })}
+`
+      ),
+      name: VITEST_JSON,
+      params: { report: VITEST_JSON, reportPath: "planted-report.json" }
+    }
+  ],
+  run: async ({ cwd, params, run }) => {
+    const command = stringParam(COUNTER, params, "command", "npx vitest run");
+    const mode = params.report;
+    if (mode === void 0) return fromSummary(run(command).output);
+    if (mode !== VITEST_JSON) {
+      throw new CounterError(
+        COUNTER,
+        `does not know the report format "${String(mode)}" \u2014 the one it reads is "${VITEST_JSON}"`
       );
     }
-    return { code, output };
+    const { own, path } = reportPathFor(cwd, params, command);
+    try {
+      run(command.replaceAll(PLACEHOLDER, path));
+      return fromReport(path);
+    } finally {
+      if (own) rmSync4(join4(path, ".."), { force: true, recursive: true });
+    }
   }
 };
 
-// src/prove.ts
-import { existsSync as existsSync6, mkdtempSync, rmSync as rmSync3 } from "fs";
-import { tmpdir } from "os";
-import { delimiter, dirname as dirname3, join as join4, resolve as resolve6 } from "path";
-var toolPath = (cwd) => {
-  const dirs = [];
-  let dir = resolve6(cwd);
-  for (; ; ) {
-    const bin = join4(dir, "node_modules", ".bin");
-    if (existsSync6(bin)) dirs.push(bin);
-    const parent = dirname3(dir);
-    if (parent === dir) break;
-    dir = parent;
+// src/counters/workspace.ts
+import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync7 } from "fs";
+import { join as join5, resolve as resolve9 } from "path";
+var SKIP = /^(node_modules|\.)/;
+var childDirs = (dir) => {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !SKIP.test(entry.name)).map((entry) => join5(dir, entry.name));
+  } catch {
+    return [];
   }
-  return [...dirs, process.env.PATH ?? ""].join(delimiter);
 };
-var NO_PROBE = "no probe \u2014 a counter nobody has seen read a planted finding has not been shown to measure";
-var proofOf = async (counter, key, path) => {
-  const probe = counter.probe;
-  if (probe === void 0)
-    return { counter: counter.id, key, reason: NO_PROBE, verdict: "cannot-measure" };
-  const dir = mkdtempSync(join4(tmpdir(), "geonosis-prove-"));
-  try {
-    probe.input(dir);
-    const command = probe.command?.(dir);
-    const reading = await counter.run({
-      cwd: dir,
-      key,
-      params: { ...probe.params, ...command === void 0 ? {} : { command } },
-      run: runCommand(dir, counter.id, { ...process.env, PATH: path })
-    });
-    if (reading === 0) return { counter: counter.id, key, reading, verdict: "cannot-fail" };
-    if (reading < probe.expect) {
-      return { counter: counter.id, expected: probe.expect, key, reading, verdict: "misread" };
-    }
-    return { counter: counter.id, key, reading, verdict: "proven" };
-  } catch (error) {
-    return { counter: counter.id, key, reason: error.message, verdict: "cannot-measure" };
-  } finally {
-    rmSync3(dir, { force: true, recursive: true });
+var descendants = (dir, depth) => depth === 0 ? [dir] : [dir, ...childDirs(dir).flatMap((child) => descendants(child, depth - 1))];
+var expand = (root, pattern) => {
+  const segments = pattern.split("/").filter((one) => one !== "" && one !== ".");
+  let dirs = [root];
+  for (const segment of segments) {
+    dirs = segment === "*" ? dirs.flatMap((dir) => childDirs(dir)) : segment === "**" ? dirs.flatMap((dir) => descendants(dir, 3)) : dirs.map((dir) => join5(dir, segment)).filter((dir) => existsSync8(dir));
   }
+  return dirs;
 };
-var outsideTier = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
-var runProve = async ({
-  counters,
-  cwd,
-  tier
-}) => {
-  const config = loadConfig(cwd);
-  const byId = new Map(counters.map((one) => [one.id, one]));
-  const path = toolPath(cwd);
-  const proofs = [];
-  for (const entry of config.counters) {
-    const counter = byId.get(entry.counter);
-    if (counter === void 0) {
-      throw new Error(
-        `no counter implements "${entry.counter}" \u2014 known ids: ${[...byId.keys()].toSorted().join(", ")}`
-      );
-    }
-    const key = keyOf(entry);
-    if (tier !== void 0 && outsideTier(entry, tier)) {
-      proofs.push({ key, tier, verdict: "skipped" });
+var QUOTED = /^['"]|['"]$/g;
+var cleaned = (value) => value.replace(/#.*$/, "").trim().replaceAll(QUOTED, "");
+var pnpmPatterns = (path) => {
+  const lines = readFileSync7(path, "utf8").split("\n");
+  const at = lines.findIndex((line) => line.startsWith("packages:"));
+  if (at === -1) return [];
+  const inline = lines[at]?.slice("packages:".length).trim() ?? "";
+  if (inline.startsWith("[")) {
+    return inline.replace(/^\[|\]$/g, "").split(",").map(cleaned).filter((one) => one !== "");
+  }
+  const patterns = [];
+  for (const line of lines.slice(at + 1)) {
+    const item = /^\s*-\s*(.+)$/.exec(line);
+    if (item?.[1] !== void 0) {
+      patterns.push(cleaned(item[1]));
       continue;
     }
-    const proof = await proofOf(counter, key, path);
-    proofs.push(proof);
-    if (proof.verdict !== "proven" && proof.verdict !== "skipped") {
-      return { proofs, proven: false };
-    }
+    if (line.trim() !== "") break;
   }
-  return { proofs, proven: true };
+  return patterns;
 };
-var formatProve = ({ proofs, proven }) => {
-  const lines = proofs.map((one) => {
-    if (one.verdict === "skipped") return `  SKIP ${one.key}: not measured by --tier ${one.tier}`;
-    if (one.verdict === "cannot-measure") return `  CANNOT MEASURE ${one.key}: ${one.reason}`;
-    if (one.verdict === "cannot-fail") return `  CANNOT FAIL ${one.key}: read 0`;
-    if (one.verdict === "misread") {
-      return `  MISREAD ${one.key}: read ${one.reading} where its probe planted ${one.expected}`;
-    }
-    return `  PROVEN ${one.key}: reads ${one.reading} on a planted finding`;
-  });
-  lines.push(
-    "",
-    proven ? "prove PASS \u2014 every counter read the finding its probe planted." : "prove FAIL \u2014 a gate that has never been seen red has not been shown to measure."
-  );
-  return `${lines.join("\n")}
-`;
+var npmPatterns = (path) => {
+  const parsed = JSON.parse(readFileSync7(path, "utf8"));
+  const declared = Array.isArray(parsed.workspaces) ? parsed.workspaces : parsed.workspaces?.packages ?? [];
+  return declared.filter((one) => typeof one === "string");
 };
-
-// src/ratchet.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve7 } from "path";
-var EVIDENCE_LINES = 10;
-var recorded = (run) => {
-  let output = "";
-  return {
-    last: () => output.split("\n").map((line) => line.trimEnd()).filter((line) => line !== "").slice(-EVIDENCE_LINES),
-    run: (command) => {
-      const result = run(command);
-      output = result.output;
-      return result;
-    }
-  };
+var nameOf = (dir) => {
+  const manifest = join5(dir, "package.json");
+  if (!existsSync8(manifest)) return void 0;
+  try {
+    const { name } = JSON.parse(readFileSync7(manifest, "utf8"));
+    return typeof name === "string" && name !== "" ? name : void 0;
+  } catch {
+    return void 0;
+  }
 };
-var verdictOf = (now, baseline) => {
-  if (now > baseline) return "grew";
-  if (now < baseline) return "shrank";
-  return "held";
+var workspacePackageNames = (cwd) => {
+  const root = resolve9(cwd);
+  const pnpm = join5(root, "pnpm-workspace.yaml");
+  const manifest = join5(root, "package.json");
+  const patterns = existsSync8(pnpm) ? pnpmPatterns(pnpm) : existsSync8(manifest) ? npmPatterns(manifest) : [];
+  const names = patterns.filter((pattern) => !pattern.startsWith("!")).flatMap((pattern) => expand(root, pattern)).map((dir) => nameOf(dir)).filter((name) => name !== void 0);
+  return [...new Set(names)];
 };
-var outsideTier2 = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
-var runRatchet = async ({
-  counters,
-  cwd,
-  tier
-}) => {
-  const config = loadConfig(cwd);
-  const baselinePath = resolve7(cwd, config.baseline);
-  if (!existsSync7(baselinePath)) {
-    throw new Error(`no ${config.baseline} in ${cwd} \u2014 nothing to ratchet against`);
-  }
-  const baseline = JSON.parse(readFileSync6(baselinePath, "utf8"));
-  const byId = new Map(counters.map((one) => [one.id, one]));
-  const measurements = [];
-  for (const entry of config.counters) {
-    const counter = byId.get(entry.counter);
-    if (counter === void 0) {
-      throw new Error(
-        `no counter implements "${entry.counter}" \u2014 known ids: ${[...byId.keys()].toSorted().join(", ")}`
-      );
-    }
-    const key = keyOf(entry);
-    if (tier !== void 0 && outsideTier2(entry, tier)) {
-      measurements.push({ key, tier, verdict: "skipped" });
-      continue;
-    }
-    const limit = baseline[key];
-    if (typeof limit !== "number") {
-      throw new Error(
-        `${config.baseline} has no number for "${key}" \u2014 add it before enabling the counter`
+
+// src/counters/typecheck.ts
+var UNRESOLVED = /error TS(?:2305|2307): ([^\n]*)/g;
+var SPECIFIER = /'([^']+)'/g;
+var specifiersIn = (message) => [...message.matchAll(SPECIFIER)].map(([, quoted]) => (quoted ?? "").replaceAll('"', ""));
+var unbuiltIn = (cwd, output) => {
+  const messages = [...output.matchAll(UNRESOLVED)].map(([, message]) => message ?? "");
+  if (messages.length === 0) return [];
+  const packages = workspacePackageNames(cwd);
+  const named = messages.flatMap((message) => specifiersIn(message)).flatMap(
+    (specifier) => packages.filter((name) => specifier === name || specifier.startsWith(`${name}/`))
+  );
+  return [...new Set(named)].toSorted();
+};
+var typecheckErrors = {
+  id: "typecheckErrors",
+  probe: {
+    command: () => "tsc --noEmit a.ts",
+    expect: 1,
+    input: (dir) => plant(dir, "a.ts", "export const n: number = 'not a number'\n")
+  },
+  run: async ({ cwd, params, run }) => {
+    const command = stringParam("typecheckErrors", params, "command", "npx tsc --noEmit");
+    const output = run(command).output;
+    const unbuilt = unbuiltIn(cwd, output);
+    if (unbuilt.length > 0) {
+      throw new CounterError(
+        "typecheckErrors",
+        `workspace packages not built: ${unbuilt.join(", ")} \u2014 build them before measuring typecheckErrors`
       );
     }
-    const recorder = recorded(runCommand(cwd, entry.counter));
-    const now = await counter.run({ cwd, key, params: entry, run: recorder.run });
-    const verdict = verdictOf(now, limit);
-    measurements.push({
-      baseline: limit,
-      evidence: verdict === "grew" ? recorder.last() : [],
-      key,
-      now,
-      verdict
-    });
+    return countMatches(output, /error TS/);
   }
-  const grew = measurements.some((one) => one.verdict === "grew");
-  const shrank = measurements.some((one) => one.verdict === "shrank");
-  if (shrank && !grew) {
-    const next = { ...baseline };
-    for (const one of measurements) {
-      if (one.verdict !== "skipped") next[one.key] = one.now;
-    }
-    writeFileSync4(baselinePath, `${JSON.stringify(next, null, 2)}
-`);
-    return { measurements, rewritten: true };
+};
+
+// src/counters/index.ts
+var COUNTERS = [
+  archViolations,
+  boundaryIssues,
+  cloneCount,
+  knipIssues,
+  lawLineCount,
+  oxlintErrors,
+  oxlintRule,
+  oxlintWarnings,
+  runtimeCodeShipped,
+  sumOfCounts,
+  testFailures,
+  typecheckErrors,
+  unformattedFiles
+];
+var counterById = (id) => {
+  const counter = COUNTERS.find((one) => one.id === id);
+  if (counter === void 0) {
+    throw new Error(
+      `no counter implements "${id}" \u2014 known ids: ${COUNTERS.map((one) => one.id).join(", ")}`
+    );
   }
-  return { measurements, rewritten: false };
+  return counter;
 };
+
+// src/report.ts
 var WIDTH = 28;
 var formatReport = ({ measurements, rewritten }) => {
   const lines = measurements.map((one) => {
@@ -816,19 +973,40 @@ var formatReport = ({ measurements, rewritten }) => {
   return `${lines.join("\n")}
 `;
 };
+var formatProve = ({ proofs, proven }) => {
+  const lines = proofs.map((one) => {
+    if (one.verdict === "skipped") return `  SKIP ${one.key}: not measured by --tier ${one.tier}`;
+    if (one.verdict === "serialised") return `  PROVEN ${one.key}: ${one.reason}`;
+    if (one.verdict === "interleaved") {
+      return `  CANNOT FAIL ${one.key}: interleaved \u2014 ${one.reason}`;
+    }
+    if (one.verdict === "cannot-measure") return `  CANNOT MEASURE ${one.key}: ${one.reason}`;
+    if (one.verdict === "cannot-fail") return `  CANNOT FAIL ${one.key}: read 0`;
+    if (one.verdict === "misread") {
+      return `  MISREAD ${one.key}: read ${one.reading} where its probe planted ${one.expected}`;
+    }
+    return `  PROVEN ${one.key}: reads ${one.reading} on a planted finding`;
+  });
+  lines.push(
+    "",
+    proven ? "prove PASS \u2014 every counter read the finding its probe planted." : "prove FAIL \u2014 a gate that has never been seen red has not been shown to measure."
+  );
+  return `${lines.join("\n")}
+`;
+};
 
 export {
-  CounterError,
-  COUNTERS,
-  counterById,
   heavyLockPath,
   acquireExclusive,
   CONFIG_FILE,
   keyOf,
   loadConfig,
+  CounterError,
   runCommand,
   runProve,
-  formatProve,
   runRatchet,
-  formatReport
+  COUNTERS,
+  counterById,
+  formatReport,
+  formatProve
 };

package/dist/cli.js

@@ -5,9 +5,13 @@ import {
   formatReport,
   runProve,
   runRatchet
-} from "./chunk-QVORWCUD.js";
+} from "./chunk-FM5I6PRT.js";
 
 // src/cli.ts
+var numberAfter = (flag) => {
+  const at = process.argv.indexOf(flag);
+  return at === -1 ? void 0 : Number(process.argv[at + 1] ?? Number.NaN);
+};
 var cwdFlag = process.argv.indexOf("--cwd");
 var cwd = cwdFlag === -1 ? process.cwd() : process.argv[cwdFlag + 1] ?? process.cwd();
 var tierFlag = process.argv.indexOf("--tier");
@@ -16,9 +20,24 @@ var proving = process.argv.includes("--prove");
 var exclusive = process.argv.includes("--exclusive");
 var timeoutFlag = process.argv.indexOf("--exclusive-timeout");
 var timeoutSeconds = timeoutFlag === -1 ? void 0 : Number(process.argv[timeoutFlag + 1] ?? Number.NaN);
+var holdMs = numberAfter("--hold");
+var holdTheLock = async (ms) => {
+  process.stdout.write(`exclusive-hold start ${Date.now()}
+`);
+  await new Promise((done) => setTimeout(done, ms));
+  process.stdout.write(`exclusive-hold end ${Date.now()}
+`);
+  return 0;
+};
 var measure = async () => {
+  if (holdMs !== void 0) return holdTheLock(holdMs);
   if (proving) {
-    const proof = await runProve({ counters: COUNTERS, cwd, tier });
+    const proof = await runProve({
+      counters: COUNTERS,
+      cwd,
+      exclusiveVia: process.argv[1],
+      tier
+    });
     process.stdout.write(formatProve(proof));
     return proof.proven ? 0 : 2;
   }
@@ -33,6 +52,9 @@ try {
   if (timeoutSeconds !== void 0 && !(timeoutSeconds > 0)) {
     throw new Error("--exclusive-timeout needs a number of seconds");
   }
+  if (holdMs !== void 0 && !(holdMs > 0)) {
+    throw new Error("--hold needs a number of milliseconds");
+  }
   const release = exclusive ? await acquireExclusive({ timeoutSeconds }) : () => void 0;
   const giveBack = () => {
     release();

package/dist/index.js

@@ -12,7 +12,7 @@ import {
   runCommand,
   runProve,
   runRatchet
-} from "./chunk-QVORWCUD.js";
+} from "./chunk-FM5I6PRT.js";
 export {
   CONFIG_FILE,
   COUNTERS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/ratchet",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Debt as a number that may only shrink — one ratchet, pluggable counters.",
   "keywords": [
     "ratchet",