@geonosis/ratchet 0.4.0 → 1.0.0

package/dist/{chunk-QVORWCUD.js → chunk-LSYVFUP4.js}

@@ -1,4 +1,131 @@
-// src/types.ts
+// src/core/lock.ts
+import { randomUUID } from "crypto";
+import { linkSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var heavyLockPath = () => process.env.GEONOSIS_HEAVY_LOCK ?? join(homedir(), ".cache", "geonosis", "heavy.lock");
+var sleep = (ms) => new Promise((done) => setTimeout(done, ms));
+var holderOf = (path) => {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return typeof parsed.pid === "number" ? {
+      cwd: parsed.cwd ?? "somewhere",
+      pid: parsed.pid,
+      startedAt: parsed.startedAt ?? "unknown"
+    } : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var heldFor = (holder) => {
+  const since = Date.parse(holder.startedAt);
+  if (Number.isNaN(since)) return "an unknown time";
+  return `${Math.round((Date.now() - since) / 1e3)}s`;
+};
+var write = (path) => {
+  mkdirSync(dirname(path), { recursive: true });
+  const mine = {
+    cwd: process.cwd(),
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const staging = `${path}.${process.pid}.${randomUUID()}`;
+  try {
+    writeFileSync(staging, JSON.stringify(mine));
+    linkSync(staging, path);
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    throw error;
+  } finally {
+    rmSync(staging, { force: true });
+  }
+};
+var acquireExclusive = async ({
+  noticeMs = 15e3,
+  path = heavyLockPath(),
+  pollMs = 250,
+  say = (line) => process.stderr.write(`${line}
+`),
+  timeoutSeconds = 1800
+} = {}) => {
+  const until = Date.now() + timeoutSeconds * 1e3;
+  let told = 0;
+  const release = () => {
+    if (holderOf(path)?.pid === process.pid) rmSync(path, { force: true });
+  };
+  for (; ; ) {
+    if (write(path)) return release;
+    const holder = holderOf(path);
+    if (holder === void 0 || !alive(holder.pid)) {
+      say(
+        `geonosis-ratchet: taking over a stale heavy lock (pid ${holder?.pid ?? "unreadable"} is gone)`
+      );
+      rmSync(path, { force: true });
+      continue;
+    }
+    if (Date.now() >= until) {
+      throw new Error(
+        `waited ${timeoutSeconds}s for the heavy lock held by pid ${holder.pid} in ${holder.cwd} (${heldFor(holder)}) \u2014 give it longer with --exclusive-timeout, or stop that run`
+      );
+    }
+    const now = Date.now();
+    if (now - told >= noticeMs) {
+      told = now;
+      say(
+        `geonosis-ratchet: waiting for the heavy lock \u2014 pid ${holder.pid} in ${holder.cwd}, held for ${heldFor(holder)}`
+      );
+    }
+    await sleep(pollMs);
+  }
+};
+
+// src/core/config.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { resolve } from "path";
+var CONFIG_FILE = "geonosis.ratchet.json";
+var keyOf = (entry) => entry.key ?? entry.counter;
+var loadConfig = (cwd) => {
+  const path = resolve(cwd, CONFIG_FILE);
+  if (!existsSync(path)) {
+    throw new Error(`no ${CONFIG_FILE} in ${cwd} \u2014 the ratchet has nothing to count`);
+  }
+  const parsed = JSON.parse(readFileSync2(path, "utf8"));
+  if (!Array.isArray(parsed.counters)) {
+    throw new Error(`${CONFIG_FILE} has no "counters" array`);
+  }
+  for (const entry of parsed.counters) {
+    if (typeof entry.counter !== "string") {
+      throw new Error(`${CONFIG_FILE}: every counter entry needs a "counter" id`);
+    }
+    if (entry.tiers !== void 0) {
+      const named = Array.isArray(entry.tiers) && entry.tiers.length > 0 && entry.tiers.every((tier) => typeof tier === "string" && tier.length > 0);
+      if (!named) {
+        throw new Error(
+          `${CONFIG_FILE}: "${keyOf(entry)}" has "tiers" that is not a non-empty list of tier names`
+        );
+      }
+    }
+  }
+  const keys = parsed.counters.map(keyOf);
+  const duplicate = keys.find((key, at) => keys.indexOf(key) !== at);
+  if (duplicate !== void 0) {
+    throw new Error(
+      `${CONFIG_FILE}: two counters both write "${duplicate}" \u2014 give one of them a distinct "key"`
+    );
+  }
+  return { baseline: parsed.baseline ?? "gate-baseline.json", counters: parsed.counters };
+};
+
+// src/core/types.ts
 var CounterError = class extends Error {
   constructor(counter, message) {
     super(`${counter}: ${message}`);
@@ -8,6 +135,294 @@ var CounterError = class extends Error {
   counter;
 };
 
+// src/core/shell.ts
+import { execSync } from "child_process";
+var ANSI = /\[[0-9;]*m/g;
+var runCommand = (cwd, counterId, env) => (command) => {
+  try {
+    const output = execSync(`(
+${command}
+) 2>&1`, {
+      cwd,
+      encoding: "utf8",
+      env,
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return { code: 0, output: output.replaceAll(ANSI, "") };
+  } catch (error) {
+    const failed = error;
+    const output = `${failed.stdout ?? ""}${failed.stderr ?? ""}`.replaceAll(ANSI, "");
+    const code = failed.status ?? -1;
+    if (code === 126 || code === 127 || code === -1) {
+      throw new CounterError(
+        counterId,
+        `command did not run (exit ${code}): ${command}
+${output.trim()}`
+      );
+    }
+    return { code, output };
+  }
+};
+
+// src/core/prove.ts
+import { existsSync as existsSync2, mkdtempSync, rmSync as rmSync2 } from "fs";
+import { tmpdir } from "os";
+import { delimiter, dirname as dirname3, join as join2, resolve as resolve3 } from "path";
+
+// src/core/exclusive.ts
+import { spawn } from "child_process";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+var MARK = /^exclusive-hold (start|end) (\d+)$/gm;
+var KEY = "exclusive";
+var spanOf = (output) => {
+  const marks = [...output.matchAll(MARK)];
+  const start = marks.find((one) => one[1] === "start")?.[2];
+  const end = marks.find((one) => one[1] === "end")?.[2];
+  if (start === void 0 || end === void 0) return void 0;
+  return { end: Number(end), start: Number(start) };
+};
+var hold = (cli, holdMs, lockPath) => new Promise((done) => {
+  const child = spawn(
+    process.execPath,
+    [cli, "--exclusive", "--exclusive-timeout", "60", "--hold", String(holdMs)],
+    {
+      cwd: dirname2(resolve2(cli)),
+      env: { ...process.env, GEONOSIS_HEAVY_LOCK: lockPath },
+      stdio: ["ignore", "pipe", "pipe"]
+    }
+  );
+  let output = "";
+  child.stdout.on("data", (chunk) => {
+    output += chunk.toString();
+  });
+  child.stderr.on("data", (chunk) => {
+    output += chunk.toString();
+  });
+  child.on("close", (code) => done({ code, output }));
+});
+var proveExclusive = async ({
+  cli,
+  holdMs = 400,
+  lockPath
+}) => {
+  const runs = await Promise.all([hold(cli, holdMs, lockPath), hold(cli, holdMs, lockPath)]);
+  const spans = runs.map((one) => spanOf(one.output));
+  const [first, second] = spans;
+  if (first === void 0 || second === void 0) {
+    return {
+      counter: KEY,
+      key: KEY,
+      reason: `a run under --exclusive printed no start/end to compare:
+${runs.map((one) => `exit ${String(one.code)}: ${one.output.trim().slice(-300)}`).join("\n")}`,
+      verdict: "cannot-measure"
+    };
+  }
+  const [early, late] = first.start <= second.start ? [first, second] : [second, first];
+  const gap = late.start - early.end;
+  if (gap < 0) {
+    return {
+      key: KEY,
+      reason: `the second run started ${-gap}ms BEFORE the first finished \u2014 two runs, one lock, both holding it`,
+      verdict: "interleaved"
+    };
+  }
+  return {
+    key: KEY,
+    reason: `two runs of ${holdMs}ms serialised, the second starting ${gap}ms after the first finished`,
+    verdict: "serialised"
+  };
+};
+
+// src/core/prove.ts
+var toolPath = (cwd) => {
+  const dirs = [];
+  let dir = resolve3(cwd);
+  for (; ; ) {
+    const bin = join2(dir, "node_modules", ".bin");
+    if (existsSync2(bin)) dirs.push(bin);
+    const parent = dirname3(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return [...dirs, process.env.PATH ?? ""].join(delimiter);
+};
+var NO_PROBE = "no probe \u2014 a counter nobody has seen read a planted finding has not been shown to measure";
+var oneProofOf = async (counter, key, path, probe) => {
+  const dir = mkdtempSync(join2(tmpdir(), "geonosis-prove-"));
+  try {
+    probe.input(dir);
+    const command = probe.command?.(dir);
+    const reading = await counter.run({
+      cwd: dir,
+      key,
+      params: { ...probe.params, ...command === void 0 ? {} : { command } },
+      run: runCommand(dir, counter.id, { ...process.env, PATH: path })
+    });
+    if (reading === 0) return { counter: counter.id, key, reading, verdict: "cannot-fail" };
+    if (reading < probe.expect) {
+      return { counter: counter.id, expected: probe.expect, key, reading, verdict: "misread" };
+    }
+    return { counter: counter.id, key, reading, verdict: "proven" };
+  } catch (error) {
+    return { counter: counter.id, key, reason: error.message, verdict: "cannot-measure" };
+  } finally {
+    rmSync2(dir, { force: true, recursive: true });
+  }
+};
+var probesOf = (counter) => {
+  if (counter.probe === void 0) return [];
+  return Array.isArray(counter.probe) ? counter.probe : [counter.probe];
+};
+var proofOf = async (counter, key, path) => {
+  const probes = probesOf(counter);
+  if (probes.length === 0) {
+    return [{ counter: counter.id, key, reason: NO_PROBE, verdict: "cannot-measure" }];
+  }
+  const proofs = [];
+  for (const probe of probes) {
+    const named = probe.name === void 0 ? key : `${key} (${probe.name})`;
+    const proof = await oneProofOf(counter, named, path, probe);
+    proofs.push(proof);
+    if (proof.verdict !== "proven") break;
+  }
+  return proofs;
+};
+var outsideTier = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
+var runProve = async ({
+  counters,
+  cwd,
+  exclusiveVia,
+  tier
+}) => {
+  const config = loadConfig(cwd);
+  const byId = new Map(counters.map((one) => [one.id, one]));
+  const path = toolPath(cwd);
+  const proofs = [];
+  for (const entry of config.counters) {
+    const counter = byId.get(entry.counter);
+    if (counter === void 0) {
+      throw new Error(
+        `no counter implements "${entry.counter}" \u2014 known ids: ${[...byId.keys()].toSorted().join(", ")}`
+      );
+    }
+    const key = keyOf(entry);
+    if (tier !== void 0 && outsideTier(entry, tier)) {
+      proofs.push({ key, tier, verdict: "skipped" });
+      continue;
+    }
+    const taken = await proofOf(counter, key, path);
+    proofs.push(...taken);
+    if (taken.some((one) => one.verdict !== "proven" && one.verdict !== "skipped")) {
+      return { proofs, proven: false };
+    }
+  }
+  if (exclusiveVia !== void 0) {
+    const dir = mkdtempSync(join2(tmpdir(), "geonosis-lock-"));
+    try {
+      const proof = await proveExclusive({ cli: exclusiveVia, lockPath: join2(dir, "heavy.lock") });
+      proofs.push(proof);
+      if (proof.verdict !== "serialised") return { proofs, proven: false };
+    } finally {
+      rmSync2(dir, { force: true, recursive: true });
+    }
+  }
+  return { proofs, proven: true };
+};
+
+// src/core/ratchet.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve4 } from "path";
+var EVIDENCE_LINES = 10;
+var recorded = (run) => {
+  let output = "";
+  return {
+    last: () => output.split("\n").map((line) => line.trimEnd()).filter((line) => line !== "").slice(-EVIDENCE_LINES),
+    run: (command) => {
+      const result = run(command);
+      output = result.output;
+      return result;
+    }
+  };
+};
+var verdictOf = (now, baseline, tolerance) => {
+  if (now > baseline * (1 + tolerance)) return "grew";
+  if (now < baseline) return "shrank";
+  return "held";
+};
+var toleranceOf = (entry, key, counter) => {
+  const declared = entry.tolerance;
+  if (declared === void 0) return 0;
+  if (counter.tolerates !== true) {
+    throw new Error(
+      `"${key}" does not accept a tolerance \u2014 only a counter that measures a quantity declares one`
+    );
+  }
+  if (typeof declared !== "number" || !Number.isFinite(declared) || declared < 0) {
+    throw new Error(
+      `"${key}" has a "tolerance" that is not a non-negative number: ${JSON.stringify(declared)}`
+    );
+  }
+  return declared;
+};
+var outsideTier2 = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
+var runRatchet = async ({
+  counters,
+  cwd,
+  tier
+}) => {
+  const config = loadConfig(cwd);
+  const baselinePath = resolve4(cwd, config.baseline);
+  if (!existsSync3(baselinePath)) {
+    throw new Error(`no ${config.baseline} in ${cwd} \u2014 nothing to ratchet against`);
+  }
+  const baseline = JSON.parse(readFileSync3(baselinePath, "utf8"));
+  const byId = new Map(counters.map((one) => [one.id, one]));
+  const measurements = [];
+  for (const entry of config.counters) {
+    const counter = byId.get(entry.counter);
+    if (counter === void 0) {
+      throw new Error(
+        `no counter implements "${entry.counter}" \u2014 known ids: ${[...byId.keys()].toSorted().join(", ")}`
+      );
+    }
+    const key = keyOf(entry);
+    if (tier !== void 0 && outsideTier2(entry, tier)) {
+      measurements.push({ key, tier, verdict: "skipped" });
+      continue;
+    }
+    const limit = baseline[key];
+    if (typeof limit !== "number") {
+      throw new Error(
+        `${config.baseline} has no number for "${key}" \u2014 add it before enabling the counter`
+      );
+    }
+    const tolerance = toleranceOf(entry, key, counter);
+    const recorder = recorded(runCommand(cwd, entry.counter));
+    const now = await counter.run({ cwd, key, params: entry, run: recorder.run });
+    const verdict = verdictOf(now, limit, tolerance);
+    measurements.push({
+      baseline: limit,
+      evidence: verdict === "grew" ? recorder.last() : [],
+      key,
+      now,
+      verdict
+    });
+  }
+  const grew = measurements.some((one) => one.verdict === "grew");
+  const shrank = measurements.some((one) => one.verdict === "shrank");
+  if (shrank && !grew) {
+    const next = { ...baseline };
+    for (const one of measurements) {
+      if (one.verdict === "shrank") next[one.key] = one.now;
+    }
+    writeFileSync2(baselinePath, `${JSON.stringify(next, null, 2)}
+`);
+    return { measurements, rewritten: true };
+  }
+  return { measurements, rewritten: false };
+};
+
 // src/counters/params.ts
 var stringParam = (counter, params, name, fallback) => {
   const value = params[name];
@@ -24,12 +439,12 @@ var countMatches = (text, pattern) => text.match(new RegExp(pattern.source, `${p
 var escapeForRegex = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 // src/counters/plant.ts
-import { mkdirSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4, join as join3 } from "path";
 var plant = (dir, relative, contents) => {
-  const path = join(dir, relative);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, contents);
+  const path = join3(dir, relative);
+  mkdirSync2(dirname4(path), { recursive: true });
+  writeFileSync3(path, contents);
 };
 var captured = (sample) => ({
   command: () => "cat sample.txt",
@@ -37,13 +452,120 @@ var captured = (sample) => ({
 });
 
 // src/counters/arch.ts
+var refuse = (command, { code, output }) => {
+  const tail = output.trim().split("\n").slice(-10).join("\n");
+  throw new CounterError(
+    "archViolations",
+    `\`${command}\` exited ${code} and printed no findings \u2014 a scan that could not run is not a clean scan:
+${tail === "" ? "(it printed nothing at all)" : tail}`
+  );
+};
+var scannerProbe = {
+  command: () => "node scanner.mjs",
+  input: (dir) => {
+    plant(
+      dir,
+      "scanner.mjs",
+      [
+        "process.stdout.write('\\u2717 packages/a/src/cells/one.tsx cell imports cell\\n')",
+        "process.stdout.write('\\u2717 packages/a/src/tissues/two.tsx tissue holds state\\n')",
+        "process.exit(1)",
+        ""
+      ].join("\n")
+    );
+  }
+};
 var archViolations = {
   id: "archViolations",
-  probe: { ...captured("\u2717 cell imports cell\nok\n"), expect: 1 },
+  probe: { ...scannerProbe, expect: 2 },
   run: async ({ params, run }) => {
     const command = stringParam("archViolations", params, "command");
     const match = new RegExp(stringParam("archViolations", params, "match", "^\u2717"));
-    return run(command).output.split("\n").filter((line) => match.test(line)).length;
+    const result = run(command);
+    const found = result.output.split("\n").filter((line) => match.test(line)).length;
+    if (found === 0 && result.code !== 0) refuse(command, result);
+    return found;
+  }
+};
+
+// src/counters/bundle.ts
+var INTEGER = /\d[\d,_]*/g;
+var asBytes = (digits) => Number(digits.replaceAll(/[,_]/g, ""));
+var bundleBytes = {
+  id: "bundleBytes",
+  tolerates: true,
+  probe: { ...captured("dist/index.js\n  minified 4096\n"), expect: 4096 },
+  run: async ({ params, run }) => {
+    const command = stringParam("bundleBytes", params, "command");
+    const output = run(command).output;
+    const pattern = params.match;
+    if (pattern !== void 0) {
+      if (typeof pattern !== "string") {
+        throw new CounterError("bundleBytes", `"match" must be a regular expression source`);
+      }
+      const found = new RegExp(pattern).exec(output);
+      if (found === null) {
+        throw new CounterError(
+          "bundleBytes",
+          `nothing matched /${pattern}/ in what \`${command}\` printed`
+        );
+      }
+      const digits = found[1] ?? found[0];
+      const value = asBytes(digits);
+      if (!Number.isFinite(value)) {
+        throw new CounterError(
+          "bundleBytes",
+          `/${pattern}/ matched "${digits}", which is no number`
+        );
+      }
+      return value;
+    }
+    const integers = output.match(INTEGER);
+    if (integers === null || integers.length === 0) {
+      throw new CounterError("bundleBytes", `\`${command}\` printed no number to read as bytes`);
+    }
+    return asBytes(integers[integers.length - 1] ?? "");
+  }
+};
+
+// src/counters/ci.ts
+import { readdirSync, readFileSync as readFileSync4 } from "fs";
+import { join as join4, resolve as resolve5 } from "path";
+var DISABLED = /\bif:[ \t]*false\b/;
+var WORKFLOW = /\.ya?ml$/;
+var disabledCiJobs = {
+  id: "disabledCiJobs",
+  probe: {
+    expect: 1,
+    input: (dir) => plant(
+      dir,
+      ".github/workflows/ci.yml",
+      ["jobs:", "  build:", "    if: false", "    steps: []", ""].join("\n")
+    )
+  },
+  run: async ({ cwd, params }) => {
+    const relative = stringParam("disabledCiJobs", params, "dir", ".github/workflows");
+    const dir = resolve5(cwd, relative);
+    let files;
+    try {
+      files = readdirSync(dir, { withFileTypes: true }).filter((entry) => WORKFLOW.test(entry.name)).map((entry) => join4(dir, entry.name));
+    } catch {
+      return 0;
+    }
+    let disabled = 0;
+    for (const file of files) {
+      let contents;
+      try {
+        contents = readFileSync4(file, "utf8");
+      } catch (error) {
+        throw new CounterError(
+          "disabledCiJobs",
+          `could not read ${relative}/${file.split("/").pop() ?? file}: ${error.message}`
+        );
+      }
+      disabled += contents.split("\n").filter((line) => DISABLED.test(line)).length;
+    }
+    return disabled;
   }
 };
 
@@ -93,8 +615,8 @@ var boundaryIssues = {
 };
 
 // src/counters/format.ts
-import { existsSync } from "fs";
-import { resolve } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { resolve as resolve6 } from "path";
 var unformattedFiles = {
   id: "unformattedFiles",
   probe: {
@@ -109,13 +631,67 @@ var unformattedFiles = {
       "command",
       "npx oxfmt --config .oxfmtrc.json --list-different ."
     );
-    return run(command).output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && existsSync(resolve(cwd, line))).length;
+    return run(command).output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && existsSync4(resolve6(cwd, line))).length;
+  }
+};
+
+// src/counters/gate-report.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve7 } from "path";
+var DEFAULT_REPORT = ".geonosis/gate-report.json";
+var fastTierMs = {
+  id: "fastTierMs",
+  tolerates: true,
+  probe: {
+    expect: 4500,
+    input: (dir) => plant(
+      dir,
+      DEFAULT_REPORT,
+      JSON.stringify({
+        finishedAt: "2026-08-30T10:00:04.500Z",
+        ok: true,
+        startedAt: "2026-08-30T10:00:00.000Z",
+        steps: [],
+        tier: "fast"
+      })
+    )
+  },
+  run: async ({ cwd, params }) => {
+    const relative = stringParam("fastTierMs", params, "report", DEFAULT_REPORT);
+    const wanted = stringParam("fastTierMs", params, "tier", "fast");
+    const path = resolve7(cwd, relative);
+    if (!existsSync5(path)) {
+      throw new CounterError(
+        "fastTierMs",
+        `no gate report at ${relative} \u2014 run \`geonosis-verify ${wanted}\` before measuring it`
+      );
+    }
+    let report;
+    try {
+      report = JSON.parse(readFileSync5(path, "utf8"));
+    } catch (error) {
+      throw new CounterError(
+        "fastTierMs",
+        `${relative} does not parse: ${error.message}`
+      );
+    }
+    if (report.tier !== wanted) {
+      throw new CounterError(
+        "fastTierMs",
+        `${relative} is a report of tier "${String(report.tier)}", not "${wanted}"`
+      );
+    }
+    const spent = Date.parse(String(report.finishedAt)) - Date.parse(String(report.startedAt));
+    if (!Number.isFinite(spent)) {
+      throw new CounterError("fastTierMs", `${relative} has no timestamps a reader can subtract`);
+    }
+    return spent;
   }
 };
 
 // src/counters/law.ts
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve8 } from "path";
 var lawLineCount = {
   id: "lawLineCount",
   probe: {
@@ -125,15 +701,15 @@ var lawLineCount = {
   },
   run: async ({ cwd, params }) => {
     const relative = stringParam("lawLineCount", params, "path", "CLAUDE.md");
-    const path = resolve2(cwd, relative);
-    if (!existsSync2(path)) throw new CounterError("lawLineCount", `no law file at ${relative}`);
-    return readFileSync(path, "utf8").replace(/\n$/, "").split("\n").length;
+    const path = resolve8(cwd, relative);
+    if (!existsSync6(path)) throw new CounterError("lawLineCount", `no law file at ${relative}`);
+    return readFileSync6(path, "utf8").replace(/\n$/, "").split("\n").length;
   }
 };
 
 // src/counters/oxlint.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve3 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve9 } from "path";
 var DEFAULT_COMMAND = "npx oxlint --format=unix --config .oxlintrc.json .";
 var PROBE_COMMAND = "oxlint --format=unix --config .oxlintrc.json .";
 var oxlintProbe = (severity, rule, source) => ({
@@ -187,21 +763,21 @@ var readFindings = (counter, { code, output }, expect) => {
   const agent = countFindings(output, AGENT_FINDING, "error");
   const problems = UNIX_SUMMARY.exec(output);
   const found = DEFAULT_SUMMARY.exec(output);
-  const refuse = (why) => {
+  const refuse2 = (why) => {
     throw new CounterError(counter, `${why} \u2014 oxlint's output changed:
 ${output.trim()}`);
   };
   if (total(unix) > 0 || problems !== null) {
-    if (problems?.[1] === void 0) return refuse('unix findings with no "N problems" summary');
+    if (problems?.[1] === void 0) return refuse2('unix findings with no "N problems" summary');
     if (Number(problems[1]) !== total(unix)) {
-      return refuse(`the summary says ${problems[1]} problems, the lines say ${total(unix)}`);
+      return refuse2(`the summary says ${problems[1]} problems, the lines say ${total(unix)}`);
     }
     return unix;
   }
   if (found?.[1] !== void 0 && found[2] !== void 0) {
     const summary = { errors: Number(found[2]), warnings: Number(found[1]) };
     if (total(agent) > 0 && (agent.errors !== summary.errors || agent.warnings !== summary.warnings)) {
-      return refuse(
+      return refuse2(
         `the summary says ${summary.errors} errors and ${summary.warnings} warnings, the lines say ${agent.errors} and ${agent.warnings}`
       );
     }
@@ -210,11 +786,11 @@ ${output.trim()}`);
   if (total(agent) > 0) return agent;
   if (code === 0) {
     if (expect !== void 0 && spokenByTheTool(output) !== "") {
-      return refuse(`asked for --format=${expect} and got output in no shape this counter reads`);
+      return refuse2(`asked for --format=${expect} and got output in no shape this counter reads`);
     }
     return { errors: 0, warnings: 0 };
   }
-  return refuse(`the tool exited ${code} and printed no findings and no summary`);
+  return refuse2(`the tool exited ${code} and printed no findings and no summary`);
 };
 var oxlintErrors = {
   id: "oxlintErrors",
@@ -272,18 +848,18 @@ var oxlintRule = {
     const config = typeof params.config === "string" ? params.config : "";
     const expect = expectedFormat("oxlintRule", params);
     if (config === "") return countRule(run(command), rule, expect);
-    const source = resolve3(cwd, config);
-    if (!existsSync3(source)) throw new CounterError("oxlintRule", `no config at ${config}`);
+    const source = resolve9(cwd, config);
+    if (!existsSync7(source)) throw new CounterError("oxlintRule", `no config at ${config}`);
     const strictName = `.oxlintrc.ratchet-${key}.json`;
-    const strict = readFileSync2(source, "utf8").replace(
+    const strict = readFileSync7(source, "utf8").replace(
       new RegExp(`("[^"]*${escapeForRegex(rule)}"\\s*:\\s*\\[?\\s*)"(warn|off)"`),
       '$1"error"'
     );
-    writeFileSync2(resolve3(cwd, strictName), strict);
+    writeFileSync4(resolve9(cwd, strictName), strict);
     try {
       return countRule(run(command.replace("{config}", strictName)), rule, expect);
     } finally {
-      rmSync(resolve3(cwd, strictName), { force: true });
+      rmSync3(resolve9(cwd, strictName), { force: true });
     }
   }
 };
@@ -311,44 +887,17 @@ var runtimeCodeShipped = {
   }
 };
 
-// src/counters/sum-of-counts.ts
-var sumOfCounts = {
-  id: "sumOfCounts",
-  probe: { ...captured("src/a.ts:1\nsrc/b.ts:0\n"), expect: 1 },
-  run: async ({ params, run }) => {
-    const command = stringParam("sumOfCounts", params, "command");
-    const match = new RegExp(stringParam("sumOfCounts", params, "match", ":(\\d+)$"), "gm");
-    return [...run(command).output.matchAll(match)].map(([, digits]) => Number(digits ?? 0)).filter((count) => Number.isFinite(count)).reduce((sum, count) => sum + count, 0);
-  }
-};
-
-// src/counters/tests.ts
-var FAILED = /(\d+)\s+fail(?:ed|ing|s)?\b/;
-var PASSED = /(\d+)\s+pass(?:ed|ing|es)?\b/;
-var testFailures = {
-  id: "testFailures",
-  probe: { ...captured("  Tests  1 failed | 0 passed (1)\n"), expect: 1 },
-  run: async ({ params, run }) => {
-    const command = stringParam("testFailures", params, "command", "npx vitest run");
-    const output = run(command).output;
-    const failed = output.match(FAILED)?.[1];
-    if (failed !== void 0) return Number(failed);
-    if (PASSED.test(output)) return 0;
-    throw new CounterError(
-      "testFailures",
-      `no pass/fail summary in the runner output:
-${output.trim().slice(-500)}`
-    );
-  }
-};
+// src/counters/scripts.ts
+import { readdirSync as readdirSync3 } from "fs";
+import { join as join6 } from "path";
 
 // src/counters/workspace.ts
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync3 } from "fs";
-import { join as join2, resolve as resolve4 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync8 } from "fs";
+import { join as join5, resolve as resolve10 } from "path";
 var SKIP = /^(node_modules|\.)/;
 var childDirs = (dir) => {
   try {
-    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !SKIP.test(entry.name)).map((entry) => join2(dir, entry.name));
+    return readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !SKIP.test(entry.name)).map((entry) => join5(dir, entry.name));
   } catch {
     return [];
   }
@@ -358,14 +907,14 @@ var expand = (root, pattern) => {
   const segments = pattern.split("/").filter((one) => one !== "" && one !== ".");
   let dirs = [root];
   for (const segment of segments) {
-    dirs = segment === "*" ? dirs.flatMap((dir) => childDirs(dir)) : segment === "**" ? dirs.flatMap((dir) => descendants(dir, 3)) : dirs.map((dir) => join2(dir, segment)).filter((dir) => existsSync4(dir));
+    dirs = segment === "*" ? dirs.flatMap((dir) => childDirs(dir)) : segment === "**" ? dirs.flatMap((dir) => descendants(dir, 3)) : dirs.map((dir) => join5(dir, segment)).filter((dir) => existsSync8(dir));
   }
   return dirs;
 };
 var QUOTED = /^['"]|['"]$/g;
 var cleaned = (value) => value.replace(/#.*$/, "").trim().replaceAll(QUOTED, "");
 var pnpmPatterns = (path) => {
-  const lines = readFileSync3(path, "utf8").split("\n");
+  const lines = readFileSync8(path, "utf8").split("\n");
   const at = lines.findIndex((line) => line.startsWith("packages:"));
   if (at === -1) return [];
   const inline = lines[at]?.slice("packages:".length).trim() ?? "";
@@ -384,410 +933,378 @@ var pnpmPatterns = (path) => {
   return patterns;
 };
 var npmPatterns = (path) => {
-  const parsed = JSON.parse(readFileSync3(path, "utf8"));
+  const parsed = JSON.parse(readFileSync8(path, "utf8"));
   const declared = Array.isArray(parsed.workspaces) ? parsed.workspaces : parsed.workspaces?.packages ?? [];
   return declared.filter((one) => typeof one === "string");
 };
 var nameOf = (dir) => {
-  const manifest = join2(dir, "package.json");
-  if (!existsSync4(manifest)) return void 0;
+  const manifest = join5(dir, "package.json");
+  if (!existsSync8(manifest)) return void 0;
   try {
-    const { name } = JSON.parse(readFileSync3(manifest, "utf8"));
+    const { name } = JSON.parse(readFileSync8(manifest, "utf8"));
     return typeof name === "string" && name !== "" ? name : void 0;
   } catch {
     return void 0;
   }
 };
-var workspacePackageNames = (cwd) => {
-  const root = resolve4(cwd);
-  const pnpm = join2(root, "pnpm-workspace.yaml");
-  const manifest = join2(root, "package.json");
-  const patterns = existsSync4(pnpm) ? pnpmPatterns(pnpm) : existsSync4(manifest) ? npmPatterns(manifest) : [];
-  const names = patterns.filter((pattern) => !pattern.startsWith("!")).flatMap((pattern) => expand(root, pattern)).map((dir) => nameOf(dir)).filter((name) => name !== void 0);
-  return [...new Set(names)];
-};
-
-// src/counters/typecheck.ts
-var UNRESOLVED = /error TS(?:2305|2307): ([^\n]*)/g;
-var SPECIFIER = /'([^']+)'/g;
-var specifiersIn = (message) => [...message.matchAll(SPECIFIER)].map(([, quoted]) => (quoted ?? "").replaceAll('"', ""));
-var unbuiltIn = (cwd, output) => {
-  const messages = [...output.matchAll(UNRESOLVED)].map(([, message]) => message ?? "");
-  if (messages.length === 0) return [];
-  const packages = workspacePackageNames(cwd);
-  const named = messages.flatMap((message) => specifiersIn(message)).flatMap(
-    (specifier) => packages.filter((name) => specifier === name || specifier.startsWith(`${name}/`))
-  );
-  return [...new Set(named)].toSorted();
-};
-var typecheckErrors = {
-  id: "typecheckErrors",
-  probe: {
-    command: () => "tsc --noEmit a.ts",
-    expect: 1,
-    input: (dir) => plant(dir, "a.ts", "export const n: number = 'not a number'\n")
-  },
-  run: async ({ cwd, params, run }) => {
-    const command = stringParam("typecheckErrors", params, "command", "npx tsc --noEmit");
-    const output = run(command).output;
-    const unbuilt = unbuiltIn(cwd, output);
-    if (unbuilt.length > 0) {
-      throw new CounterError(
-        "typecheckErrors",
-        `workspace packages not built: ${unbuilt.join(", ")} \u2014 build them before measuring typecheckErrors`
-      );
-    }
-    return countMatches(output, /error TS/);
-  }
-};
-
-// src/counters/index.ts
-var COUNTERS = [
-  archViolations,
-  boundaryIssues,
-  cloneCount,
-  knipIssues,
-  lawLineCount,
-  oxlintErrors,
-  oxlintRule,
-  oxlintWarnings,
-  runtimeCodeShipped,
-  sumOfCounts,
-  testFailures,
-  typecheckErrors,
-  unformattedFiles
-];
-var counterById = (id) => {
-  const counter = COUNTERS.find((one) => one.id === id);
-  if (counter === void 0) {
-    throw new Error(
-      `no counter implements "${id}" \u2014 known ids: ${COUNTERS.map((one) => one.id).join(", ")}`
-    );
-  }
-  return counter;
+var workspaceDirs = (cwd) => {
+  const root = resolve10(cwd);
+  const pnpm = join5(root, "pnpm-workspace.yaml");
+  const manifest = join5(root, "package.json");
+  const patterns = existsSync8(pnpm) ? pnpmPatterns(pnpm) : existsSync8(manifest) ? npmPatterns(manifest) : [];
+  const dirs = patterns.filter((pattern) => !pattern.startsWith("!")).flatMap((pattern) => expand(root, pattern)).filter((dir) => existsSync8(join5(dir, "package.json")));
+  return [...new Set(dirs)];
 };
-
-// src/lock.ts
-import { randomUUID } from "crypto";
-import { linkSync, mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { homedir } from "os";
-import { dirname as dirname2, join as join3 } from "path";
-var heavyLockPath = () => process.env.GEONOSIS_HEAVY_LOCK ?? join3(homedir(), ".cache", "geonosis", "heavy.lock");
-var sleep = (ms) => new Promise((done) => setTimeout(done, ms));
-var holderOf = (path) => {
+var manifestOf = (dir) => {
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
-    return typeof parsed.pid === "number" ? {
-      cwd: parsed.cwd ?? "somewhere",
-      pid: parsed.pid,
-      startedAt: parsed.startedAt ?? "unknown"
-    } : void 0;
+    const parsed = JSON.parse(readFileSync8(join5(dir, "package.json"), "utf8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
   } catch {
     return void 0;
   }
 };
-var alive = (pid) => {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
+var scriptsOf = (dir) => {
+  const scripts = manifestOf(dir)?.scripts;
+  return typeof scripts === "object" && scripts !== null ? Object.keys(scripts) : [];
 };
-var heldFor = (holder) => {
-  const since = Date.parse(holder.startedAt);
-  if (Number.isNaN(since)) return "an unknown time";
-  return `${Math.round((Date.now() - since) / 1e3)}s`;
+var workspacePackageNames = (cwd) => {
+  const names = workspaceDirs(cwd).map((dir) => nameOf(dir)).filter((name) => name !== void 0);
+  return [...new Set(names)];
 };
-var write = (path) => {
-  mkdirSync2(dirname2(path), { recursive: true });
-  const mine = {
-    cwd: process.cwd(),
-    pid: process.pid,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const staging = `${path}.${process.pid}.${randomUUID()}`;
+
+// src/counters/scripts.ts
+var TEST_FILE = /(\.test\.|\.spec\.)/;
+var TEST_DIR = "__tests__";
+var SKIP2 = /^(node_modules|dist|\.)/;
+var holdsTests = (dir, depth = 6) => {
+  let entries;
   try {
-    writeFileSync3(staging, JSON.stringify(mine));
-    linkSync(staging, path);
-    return true;
-  } catch (error) {
-    if (error.code === "EEXIST") return false;
-    throw error;
-  } finally {
-    rmSync2(staging, { force: true });
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return false;
   }
-};
-var acquireExclusive = async ({
-  noticeMs = 15e3,
-  path = heavyLockPath(),
-  pollMs = 250,
-  say = (line) => process.stderr.write(`${line}
-`),
-  timeoutSeconds = 1800
-} = {}) => {
-  const until = Date.now() + timeoutSeconds * 1e3;
-  let told = 0;
-  const release = () => {
-    if (holderOf(path)?.pid === process.pid) rmSync2(path, { force: true });
-  };
-  for (; ; ) {
-    if (write(path)) return release;
-    const holder = holderOf(path);
-    if (holder === void 0 || !alive(holder.pid)) {
-      say(
-        `geonosis-ratchet: taking over a stale heavy lock (pid ${holder?.pid ?? "unreadable"} is gone)`
-      );
-      rmSync2(path, { force: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (entry.name === TEST_DIR) return true;
+      if (SKIP2.test(entry.name) || depth === 0) continue;
+      if (holdsTests(join6(dir, entry.name), depth - 1)) return true;
       continue;
     }
-    if (Date.now() >= until) {
-      throw new Error(
-        `waited ${timeoutSeconds}s for the heavy lock held by pid ${holder.pid} in ${holder.cwd} (${heldFor(holder)}) \u2014 give it longer with --exclusive-timeout, or stop that run`
-      );
-    }
-    const now = Date.now();
-    if (now - told >= noticeMs) {
-      told = now;
-      say(
-        `geonosis-ratchet: waiting for the heavy lock \u2014 pid ${holder.pid} in ${holder.cwd}, held for ${heldFor(holder)}`
-      );
-    }
-    await sleep(pollMs);
+    if (TEST_FILE.test(entry.name)) return true;
   }
+  return false;
 };
-
-// src/config.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve5 } from "path";
-var CONFIG_FILE = "geonosis.ratchet.json";
-var keyOf = (entry) => entry.key ?? entry.counter;
-var loadConfig = (cwd) => {
-  const path = resolve5(cwd, CONFIG_FILE);
-  if (!existsSync5(path)) {
-    throw new Error(`no ${CONFIG_FILE} in ${cwd} \u2014 the ratchet has nothing to count`);
-  }
-  const parsed = JSON.parse(readFileSync5(path, "utf8"));
-  if (!Array.isArray(parsed.counters)) {
-    throw new Error(`${CONFIG_FILE} has no "counters" array`);
-  }
-  for (const entry of parsed.counters) {
-    if (typeof entry.counter !== "string") {
-      throw new Error(`${CONFIG_FILE}: every counter entry needs a "counter" id`);
-    }
-    if (entry.tiers !== void 0) {
-      const named = Array.isArray(entry.tiers) && entry.tiers.length > 0 && entry.tiers.every((tier) => typeof tier === "string" && tier.length > 0);
-      if (!named) {
-        throw new Error(
-          `${CONFIG_FILE}: "${keyOf(entry)}" has "tiers" that is not a non-empty list of tier names`
-        );
-      }
+var testsWithoutRunner = {
+  id: "testsWithoutRunner",
+  probe: {
+    expect: 1,
+    input: (dir) => {
+      plant(dir, "pnpm-workspace.yaml", "packages:\n  - packages/*\n");
+      plant(dir, "packages/lonely/package.json", '{"name":"lonely","scripts":{"build":"tsup"}}');
+      plant(dir, "packages/lonely/src/thing.test.ts", 'test("x", () => {})\n');
     }
+  },
+  run: async ({ cwd, params }) => {
+    const script = stringParam("testsWithoutRunner", params, "script", "test");
+    return workspaceDirs(cwd).filter((dir) => holdsTests(dir) && !scriptsOf(dir).includes(script)).length;
   }
-  const keys = parsed.counters.map(keyOf);
-  const duplicate = keys.find((key, at) => keys.indexOf(key) !== at);
-  if (duplicate !== void 0) {
-    throw new Error(
-      `${CONFIG_FILE}: two counters both write "${duplicate}" \u2014 give one of them a distinct "key"`
-    );
-  }
-  return { baseline: parsed.baseline ?? "gate-baseline.json", counters: parsed.counters };
 };
-
-// src/shell.ts
-import { execSync } from "child_process";
-var ANSI = /\[[0-9;]*m/g;
-var runCommand = (cwd, counterId, env) => (command) => {
-  try {
-    const output = execSync(`${command} 2>&1`, {
-      cwd,
-      encoding: "utf8",
-      env,
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    return { code: 0, output: output.replaceAll(ANSI, "") };
-  } catch (error) {
-    const failed = error;
-    const output = `${failed.stdout ?? ""}${failed.stderr ?? ""}`.replaceAll(ANSI, "");
-    const code = failed.status ?? -1;
-    if (code === 126 || code === 127 || code === -1) {
-      throw new CounterError(
-        counterId,
-        `command did not run (exit ${code}): ${command}
-${output.trim()}`
-      );
+var packagesWithoutTypecheck = {
+  id: "packagesWithoutTypecheck",
+  probe: {
+    expect: 1,
+    input: (dir) => {
+      plant(dir, "pnpm-workspace.yaml", "packages:\n  - packages/*\n");
+      plant(dir, "packages/untyped/package.json", '{"name":"untyped","scripts":{"build":"tsup"}}');
     }
-    return { code, output };
+  },
+  run: async ({ cwd, params }) => {
+    const script = stringParam("packagesWithoutTypecheck", params, "script", "typecheck");
+    return workspaceDirs(cwd).filter((dir) => !scriptsOf(dir).includes(script)).length;
   }
 };
 
-// src/prove.ts
-import { existsSync as existsSync6, mkdtempSync, rmSync as rmSync3 } from "fs";
-import { tmpdir } from "os";
-import { delimiter, dirname as dirname3, join as join4, resolve as resolve6 } from "path";
-var toolPath = (cwd) => {
-  const dirs = [];
-  let dir = resolve6(cwd);
-  for (; ; ) {
-    const bin = join4(dir, "node_modules", ".bin");
-    if (existsSync6(bin)) dirs.push(bin);
-    const parent = dirname3(dir);
-    if (parent === dir) break;
-    dir = parent;
+// src/counters/sum-of-counts.ts
+var sumOfCounts = {
+  id: "sumOfCounts",
+  probe: { ...captured("src/a.ts:1\nsrc/b.ts:0\n"), expect: 1 },
+  run: async ({ params, run }) => {
+    const command = stringParam("sumOfCounts", params, "command");
+    const match = new RegExp(stringParam("sumOfCounts", params, "match", ":(\\d+)$"), "gm");
+    return [...run(command).output.matchAll(match)].map(([, digits]) => Number(digits ?? 0)).filter((count) => Number.isFinite(count)).reduce((sum, count) => sum + count, 0);
   }
-  return [...dirs, process.env.PATH ?? ""].join(delimiter);
 };
-var NO_PROBE = "no probe \u2014 a counter nobody has seen read a planted finding has not been shown to measure";
-var proofOf = async (counter, key, path) => {
-  const probe = counter.probe;
-  if (probe === void 0)
-    return { counter: counter.id, key, reason: NO_PROBE, verdict: "cannot-measure" };
-  const dir = mkdtempSync(join4(tmpdir(), "geonosis-prove-"));
-  try {
-    probe.input(dir);
-    const command = probe.command?.(dir);
-    const reading = await counter.run({
-      cwd: dir,
-      key,
-      params: { ...probe.params, ...command === void 0 ? {} : { command } },
-      run: runCommand(dir, counter.id, { ...process.env, PATH: path })
-    });
-    if (reading === 0) return { counter: counter.id, key, reading, verdict: "cannot-fail" };
-    if (reading < probe.expect) {
-      return { counter: counter.id, expected: probe.expect, key, reading, verdict: "misread" };
+
+// src/counters/tests.ts
+import { existsSync as existsSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, rmSync as rmSync4 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join7, resolve as resolve11 } from "path";
+var COUNTER = "testFailures";
+var VITEST_LINE = /^\s*Tests {2,}(.+?)\s*$/;
+var VITEST_TOTAL = /\(\d+\)$/;
+var BUN_LINE = /^\s*(\d+) fail\s*$/;
+var FAILED_IN = /(\d+) failed\b/;
+var DIALECTS = 'vitest ("Tests  N failed | M passed (T)") and bun ("N fail")';
+var VITEST_JSON = "vitest-json";
+var PLACEHOLDER = "{report}";
+var summaries = (output) => {
+  const found = [];
+  for (const line of output.split("\n")) {
+    const vitest = VITEST_LINE.exec(line)?.[1];
+    if (vitest !== void 0 && VITEST_TOTAL.test(vitest)) {
+      found.push(Number(FAILED_IN.exec(vitest)?.[1] ?? 0));
+      continue;
     }
-    return { counter: counter.id, key, reading, verdict: "proven" };
+    const bun = BUN_LINE.exec(line)?.[1];
+    if (bun !== void 0) found.push(Number(bun));
+  }
+  return found;
+};
+var fromSummary = (output) => {
+  const found = summaries(output);
+  if (found.length > 0) return found.reduce((total2, one) => total2 + one, 0);
+  throw new CounterError(
+    COUNTER,
+    `no runner summary line in the output \u2014 this reads ${DIALECTS}:
+${output.trim().slice(-500)}`
+  );
+};
+var fromReport = (path) => {
+  if (!existsSync9(path)) {
+    throw new CounterError(
+      COUNTER,
+      `the runner wrote no report at ${path} \u2014 a crash before the reporter is not a pass`
+    );
+  }
+  let report;
+  try {
+    report = JSON.parse(readFileSync9(path, "utf8"));
   } catch (error) {
-    return { counter: counter.id, key, reason: error.message, verdict: "cannot-measure" };
-  } finally {
-    rmSync3(dir, { force: true, recursive: true });
+    throw new CounterError(
+      COUNTER,
+      `the report at ${path} is not JSON: ${error.message}`
+    );
+  }
+  const failed = report.numFailedTests;
+  if (typeof failed !== "number") {
+    throw new CounterError(
+      COUNTER,
+      `the report at ${path} has no "numFailedTests" \u2014 it is not a vitest JSON report`
+    );
   }
+  if (report.success === false && failed === 0) {
+    throw new CounterError(
+      COUNTER,
+      `the report at ${path} says success: false and names 0 failing tests \u2014 the run did not finish, so there is no number to bank`
+    );
+  }
+  return failed;
 };
-var outsideTier = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
-var runProve = async ({
-  counters,
-  cwd,
-  tier
-}) => {
-  const config = loadConfig(cwd);
-  const byId = new Map(counters.map((one) => [one.id, one]));
-  const path = toolPath(cwd);
-  const proofs = [];
-  for (const entry of config.counters) {
-    const counter = byId.get(entry.counter);
-    if (counter === void 0) {
-      throw new Error(
-        `no counter implements "${entry.counter}" \u2014 known ids: ${[...byId.keys()].toSorted().join(", ")}`
-      );
+var reportPathFor = (cwd, params, command) => {
+  const named = params.reportPath;
+  if (typeof named === "string" && named !== "") return { own: false, path: resolve11(cwd, named) };
+  if (!command.includes(PLACEHOLDER)) {
+    throw new CounterError(
+      COUNTER,
+      `report: "${VITEST_JSON}" needs somewhere to put the report \u2014 write ${PLACEHOLDER} into the command (--outputFile=${PLACEHOLDER}) or give the entry a "reportPath"`
+    );
+  }
+  return { own: true, path: join7(mkdtempSync2(join7(tmpdir2(), "geonosis-report-")), "report.json") };
+};
+var testFailures = {
+  id: COUNTER,
+  probe: [
+    {
+      ...captured("  Tests  1 failed | 0 passed (1)\n"),
+      expect: 1,
+      name: "summary (vitest)"
+    },
+    {
+      // Captured from bun 1.4.0 over one failing test of two, its per-test line included: the
+      // summary is two lines below one that also says "fail", and only one of them is the count.
+      ...captured(
+        "(fail) one [11.71ms]\n\n 1 pass\n 1 fail\n 2 expect() calls\nRan 2 tests across 1 file. [16.00ms]\n"
+      ),
+      expect: 1,
+      name: "summary (bun)"
+    },
+    {
+      // `cat` stands in for the runner: the placeholder is substituted into it, so a counter that
+      // stopped substituting would hand `cat` the literal token and read nothing.
+      command: () => `cat ${PLACEHOLDER}`,
+      expect: 1,
+      input: (dir) => plant(
+        dir,
+        "planted-report.json",
+        `${JSON.stringify({ numFailedTests: 1, numTotalTests: 1, success: false })}
+`
+      ),
+      name: VITEST_JSON,
+      params: { report: VITEST_JSON, reportPath: "planted-report.json" }
     }
-    const key = keyOf(entry);
-    if (tier !== void 0 && outsideTier(entry, tier)) {
-      proofs.push({ key, tier, verdict: "skipped" });
-      continue;
+  ],
+  run: async ({ cwd, params, run }) => {
+    const command = stringParam(COUNTER, params, "command", "npx vitest run");
+    const mode = params.report;
+    if (mode === void 0) return fromSummary(run(command).output);
+    if (mode !== VITEST_JSON) {
+      throw new CounterError(
+        COUNTER,
+        `does not know the report format "${String(mode)}" \u2014 the one it reads is "${VITEST_JSON}"`
+      );
     }
-    const proof = await proofOf(counter, key, path);
-    proofs.push(proof);
-    if (proof.verdict !== "proven" && proof.verdict !== "skipped") {
-      return { proofs, proven: false };
+    const { own, path } = reportPathFor(cwd, params, command);
+    try {
+      run(command.replaceAll(PLACEHOLDER, path));
+      return fromReport(path);
+    } finally {
+      if (own) rmSync4(join7(path, ".."), { force: true, recursive: true });
     }
   }
-  return { proofs, proven: true };
 };
-var formatProve = ({ proofs, proven }) => {
-  const lines = proofs.map((one) => {
-    if (one.verdict === "skipped") return `  SKIP ${one.key}: not measured by --tier ${one.tier}`;
-    if (one.verdict === "cannot-measure") return `  CANNOT MEASURE ${one.key}: ${one.reason}`;
-    if (one.verdict === "cannot-fail") return `  CANNOT FAIL ${one.key}: read 0`;
-    if (one.verdict === "misread") {
-      return `  MISREAD ${one.key}: read ${one.reading} where its probe planted ${one.expected}`;
-    }
-    return `  PROVEN ${one.key}: reads ${one.reading} on a planted finding`;
-  });
-  lines.push(
-    "",
-    proven ? "prove PASS \u2014 every counter read the finding its probe planted." : "prove FAIL \u2014 a gate that has never been seen red has not been shown to measure."
+
+// src/counters/typecheck.ts
+var UNRESOLVED = /error TS(?:2305|2307): ([^\n]*)/g;
+var SPECIFIER = /'([^']+)'/g;
+var specifiersIn = (message) => [...message.matchAll(SPECIFIER)].map(([, quoted]) => (quoted ?? "").replaceAll('"', ""));
+var unbuiltIn = (cwd, output) => {
+  const messages = [...output.matchAll(UNRESOLVED)].map(([, message]) => message ?? "");
+  if (messages.length === 0) return [];
+  const packages = workspacePackageNames(cwd);
+  const named = messages.flatMap((message) => specifiersIn(message)).flatMap(
+    (specifier) => packages.filter((name) => specifier === name || specifier.startsWith(`${name}/`))
   );
-  return `${lines.join("\n")}
-`;
+  return [...new Set(named)].toSorted();
 };
-
-// src/ratchet.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve7 } from "path";
-var EVIDENCE_LINES = 10;
-var recorded = (run) => {
-  let output = "";
-  return {
-    last: () => output.split("\n").map((line) => line.trimEnd()).filter((line) => line !== "").slice(-EVIDENCE_LINES),
-    run: (command) => {
-      const result = run(command);
-      output = result.output;
-      return result;
+var typecheckErrors = {
+  id: "typecheckErrors",
+  probe: {
+    command: () => "tsc --noEmit a.ts",
+    expect: 1,
+    input: (dir) => plant(dir, "a.ts", "export const n: number = 'not a number'\n")
+  },
+  run: async ({ cwd, params, run }) => {
+    const command = stringParam("typecheckErrors", params, "command", "npx tsc --noEmit");
+    const output = run(command).output;
+    const unbuilt = unbuiltIn(cwd, output);
+    if (unbuilt.length > 0) {
+      throw new CounterError(
+        "typecheckErrors",
+        `workspace packages not built: ${unbuilt.join(", ")} \u2014 build them before measuring typecheckErrors`
+      );
     }
-  };
-};
-var verdictOf = (now, baseline) => {
-  if (now > baseline) return "grew";
-  if (now < baseline) return "shrank";
-  return "held";
-};
-var outsideTier2 = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
-var runRatchet = async ({
-  counters,
-  cwd,
-  tier
-}) => {
-  const config = loadConfig(cwd);
-  const baselinePath = resolve7(cwd, config.baseline);
-  if (!existsSync7(baselinePath)) {
-    throw new Error(`no ${config.baseline} in ${cwd} \u2014 nothing to ratchet against`);
+    return countMatches(output, /error TS/);
   }
-  const baseline = JSON.parse(readFileSync6(baselinePath, "utf8"));
-  const byId = new Map(counters.map((one) => [one.id, one]));
-  const measurements = [];
-  for (const entry of config.counters) {
-    const counter = byId.get(entry.counter);
-    if (counter === void 0) {
-      throw new Error(
-        `no counter implements "${entry.counter}" \u2014 known ids: ${[...byId.keys()].toSorted().join(", ")}`
+};
+
+// src/counters/walk.ts
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve12 } from "path";
+var DEFAULT_REPORT2 = ".geonosis/walk-report.json";
+var CLASSES = /* @__PURE__ */ new Set([
+  "buy-box-above-fold",
+  "error-page-status",
+  "fabricated-claim",
+  "fake-session",
+  "light-on-light",
+  "link-integrity",
+  "ops-leakage",
+  "placeholder-asset",
+  "stub-only-entity"
+]);
+var walkFindings = {
+  id: "walkFindings",
+  probe: {
+    expect: 1,
+    input: (dir) => plant(
+      dir,
+      DEFAULT_REPORT2,
+      JSON.stringify({
+        counts: { "fabricated-claim": 1 },
+        finishedAt: "2026-08-30T10:00:01.000Z",
+        pages: [
+          {
+            findings: [
+              {
+                class: "fabricated-claim",
+                evidence: '"4.9/5" is on the page',
+                severity: "blocking",
+                url: "http://localhost:3000/"
+              }
+            ],
+            url: "http://localhost:3000/"
+          }
+        ],
+        probes: ["fabricated-claim"],
+        startedAt: "2026-08-30T10:00:00.000Z",
+        viewport: { height: 900, width: 1440 }
+      })
+    )
+  },
+  run: async ({ cwd, params }) => {
+    const relative = stringParam("walkFindings", params, "report", DEFAULT_REPORT2);
+    const path = resolve12(cwd, relative);
+    if (!existsSync10(path)) {
+      throw new CounterError(
+        "walkFindings",
+        `no walk report at ${relative} \u2014 run \`geonosis-walk\` before measuring it`
       );
     }
-    const key = keyOf(entry);
-    if (tier !== void 0 && outsideTier2(entry, tier)) {
-      measurements.push({ key, tier, verdict: "skipped" });
-      continue;
-    }
-    const limit = baseline[key];
-    if (typeof limit !== "number") {
-      throw new Error(
-        `${config.baseline} has no number for "${key}" \u2014 add it before enabling the counter`
+    let report;
+    try {
+      report = JSON.parse(readFileSync10(path, "utf8"));
+    } catch (error) {
+      throw new CounterError(
+        "walkFindings",
+        `${relative} does not parse: ${error.message}`
       );
     }
-    const recorder = recorded(runCommand(cwd, entry.counter));
-    const now = await counter.run({ cwd, key, params: entry, run: recorder.run });
-    const verdict = verdictOf(now, limit);
-    measurements.push({
-      baseline: limit,
-      evidence: verdict === "grew" ? recorder.last() : [],
-      key,
-      now,
-      verdict
-    });
-  }
-  const grew = measurements.some((one) => one.verdict === "grew");
-  const shrank = measurements.some((one) => one.verdict === "shrank");
-  if (shrank && !grew) {
-    const next = { ...baseline };
-    for (const one of measurements) {
-      if (one.verdict !== "skipped") next[one.key] = one.now;
+    if (!Array.isArray(report.pages)) {
+      throw new CounterError("walkFindings", `${relative} has no pages \u2014 it is not a walk report`);
     }
-    writeFileSync4(baselinePath, `${JSON.stringify(next, null, 2)}
-`);
-    return { measurements, rewritten: true };
+    const wanted = stringsParam(params, "classes", []);
+    for (const one of wanted) {
+      if (!CLASSES.has(one)) {
+        throw new CounterError("walkFindings", `"${one}" is not one of the walk's defect classes`);
+      }
+    }
+    return report.pages.flatMap((page) => page.findings ?? []).filter((finding) => wanted.length === 0 || wanted.includes(String(finding.class))).length;
   }
-  return { measurements, rewritten: false };
 };
+
+// src/counters/index.ts
+var COUNTERS = [
+  archViolations,
+  boundaryIssues,
+  bundleBytes,
+  cloneCount,
+  disabledCiJobs,
+  fastTierMs,
+  knipIssues,
+  lawLineCount,
+  oxlintErrors,
+  oxlintRule,
+  oxlintWarnings,
+  packagesWithoutTypecheck,
+  runtimeCodeShipped,
+  sumOfCounts,
+  testFailures,
+  testsWithoutRunner,
+  typecheckErrors,
+  unformattedFiles,
+  walkFindings
+];
+var counterById = (id) => {
+  const counter = COUNTERS.find((one) => one.id === id);
+  if (counter === void 0) {
+    throw new Error(
+      `no counter implements "${id}" \u2014 known ids: ${COUNTERS.map((one) => one.id).join(", ")}`
+    );
+  }
+  return counter;
+};
+
+// src/report.ts
 var WIDTH = 28;
 var formatReport = ({ measurements, rewritten }) => {
   const lines = measurements.map((one) => {
@@ -816,19 +1333,40 @@ var formatReport = ({ measurements, rewritten }) => {
   return `${lines.join("\n")}
 `;
 };
+var formatProve = ({ proofs, proven }) => {
+  const lines = proofs.map((one) => {
+    if (one.verdict === "skipped") return `  SKIP ${one.key}: not measured by --tier ${one.tier}`;
+    if (one.verdict === "serialised") return `  PROVEN ${one.key}: ${one.reason}`;
+    if (one.verdict === "interleaved") {
+      return `  CANNOT FAIL ${one.key}: interleaved \u2014 ${one.reason}`;
+    }
+    if (one.verdict === "cannot-measure") return `  CANNOT MEASURE ${one.key}: ${one.reason}`;
+    if (one.verdict === "cannot-fail") return `  CANNOT FAIL ${one.key}: read 0`;
+    if (one.verdict === "misread") {
+      return `  MISREAD ${one.key}: read ${one.reading} where its probe planted ${one.expected}`;
+    }
+    return `  PROVEN ${one.key}: reads ${one.reading} on a planted finding`;
+  });
+  lines.push(
+    "",
+    proven ? "prove PASS \u2014 every counter read the finding its probe planted." : "prove FAIL \u2014 a gate that has never been seen red has not been shown to measure."
+  );
+  return `${lines.join("\n")}
+`;
+};
 
 export {
-  CounterError,
-  COUNTERS,
-  counterById,
   heavyLockPath,
   acquireExclusive,
   CONFIG_FILE,
   keyOf,
   loadConfig,
+  CounterError,
   runCommand,
   runProve,
-  formatProve,
   runRatchet,
-  formatReport
+  COUNTERS,
+  counterById,
+  formatReport,
+  formatProve
 };