vibecodedshit 0.0.0-stage → 0.3.0

package/dist/measure/deps/registry.js

@@ -0,0 +1,142 @@
+import semver from 'semver';
+import { compareVersions, isStable, normalizeName, parseVersion } from '../../util/pep440.js';
+import { endOfDay } from './osv.js';
+/** Anything but a 404: the registry could not be read. */
+export class RegistryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RegistryError';
+    }
+}
+const TIMEOUT_MS = 20_000;
+export const CONCURRENCY = 8;
+async function getJson(ctx, url) {
+    let lastError = 'unknown error';
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const response = await ctx.tools.fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+            if (response.status === 404)
+                return 'not_found';
+            if (!response.ok) {
+                lastError = `HTTP ${response.status}`;
+                continue;
+            }
+            return (await response.json());
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err.message : String(err);
+        }
+    }
+    throw new RegistryError(`registry request ${url} failed: ${lastError}`);
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function npmVersions(doc) {
+    const time = record(doc.time) ?? {};
+    const found = [];
+    for (const version of Object.keys(record(doc.versions) ?? {})) {
+        const published = typeof time[version] === 'string' ? Date.parse(time[version]) : Number.NaN;
+        if (!Number.isNaN(published))
+            found.push({ version, time: published, yanked: false });
+    }
+    return found;
+}
+function pypiVersions(doc) {
+    const found = [];
+    for (const [version, files] of Object.entries(record(doc.releases) ?? {})) {
+        if (!Array.isArray(files) || files.length === 0)
+            continue;
+        const entries = files.map((f) => record(f)).filter((f) => f !== undefined);
+        const times = entries
+            .map((f) => (typeof f.upload_time_iso_8601 === 'string' ? Date.parse(f.upload_time_iso_8601) : Number.NaN))
+            .filter((t) => !Number.isNaN(t));
+        if (times.length === 0)
+            continue;
+        found.push({ version, time: Math.min(...times), yanked: entries.every((f) => f.yanked === true) });
+    }
+    return found;
+}
+/** Registry data for one package, memoized per scan. `null` when the registry has no such package (404). */
+export function fetchRegistry(ctx, group, name) {
+    const key = group === 'python' ? `pypi:${normalizeName(name)}` : `npm:${name}`;
+    return ctx.tools.memo(key, async () => {
+        const url = group === 'python'
+            ? `https://pypi.org/pypi/${encodeURIComponent(normalizeName(name))}/json`
+            : `https://registry.npmjs.org/${name.startsWith('@') ? name.replace('/', '%2F') : encodeURIComponent(name)}`;
+        const doc = await getJson(ctx, url);
+        if (doc === 'not_found')
+            return null;
+        if (!doc)
+            throw new RegistryError(`registry request ${url} returned no document`);
+        return { versions: group === 'python' ? pypiVersions(doc) : npmVersions(doc) };
+    });
+}
+/** Highest stable, non-yanked version published at or before the end of the as-of day. */
+export function latestStable(data, group, asOf) {
+    const limit = endOfDay(asOf);
+    const candidates = data.versions.filter((v) => !v.yanked && v.time <= limit);
+    if (group === 'python') {
+        let top;
+        for (const { version } of candidates) {
+            const parsed = parseVersion(version);
+            if (!parsed || !isStable(parsed))
+                continue;
+            if (!top || compareVersions(parsed, top.parsed) > 0)
+                top = { text: version, parsed };
+        }
+        return top?.text;
+    }
+    return candidates
+        .map((v) => v.version)
+        .filter((v) => semver.valid(v) !== null && semver.prerelease(v) === null)
+        .sort(semver.compare)
+        .pop();
+}
+function parts(version, group) {
+    if (group === 'python') {
+        const parsed = parseVersion(version);
+        if (!parsed)
+            return undefined;
+        return {
+            release: parsed.release,
+            cmp: (other) => {
+                const o = parseVersion(other);
+                return o ? compareVersions(parsed, o) : 0;
+            },
+        };
+    }
+    const parsed = semver.parse(version);
+    if (!parsed)
+        return undefined;
+    return { release: [parsed.major, parsed.minor, parsed.patch], cmp: (other) => semver.compare(version, other) };
+}
+/** At least one major behind; for 0.x a minor bump counts as a major. A resolved version newer than latest is not behind. */
+export function isMajorBehind(resolved, latest, group) {
+    const r = parts(resolved, group);
+    const l = parts(latest, group);
+    if (!r || !l)
+        return false;
+    if (r.cmp(latest) >= 0)
+        return false;
+    const [rMajor = 0, rMinor = 0] = r.release;
+    const [lMajor = 0, lMinor = 0] = l.release;
+    if (lMajor > rMajor)
+        return true;
+    return rMajor === 0 && lMajor === 0 && lMinor > rMinor;
+}
+/** Population and behind count of `direct` against one registry snapshot. Keys of `registryData`: `<group>:<name>`. */
+export function majorsBehind(direct, registryData, asOf) {
+    let numerator = 0;
+    let denominator = 0;
+    for (const dep of direct) {
+        const data = registryData.get(`${dep.group}:${dep.group === 'python' ? normalizeName(dep.name) : dep.name}`);
+        if (!data)
+            continue;
+        denominator += 1;
+        const latest = latestStable(data, dep.group, asOf);
+        if (latest !== undefined && isMajorBehind(dep.version, latest, dep.group))
+            numerator += 1;
+    }
+    return { numerator, denominator };
+}

package/dist/measure/deps/resolved.js

@@ -0,0 +1,78 @@
+import path from 'node:path';
+import semver from 'semver';
+import { compareVersions, parseVersion, satisfies as pySatisfies } from '../../util/pep440.js';
+import { readManifest } from './declared.js';
+import { trackedIn } from './files.js';
+import { chooseJsLockfile, entrySatisfies, findLockfiles, jsLockfiles, readLockfile } from './lockfiles.js';
+/** Manifest and lockfiles of one unit, read once per scan. */
+export function unitDeps(ctx, pkg, group) {
+    return ctx.tools.memo(`deps:${pkg}\0${group}`, async () => {
+        const manifest = readManifest(ctx.repoPath, pkg, group);
+        const found = manifest ? findLockfiles(ctx.repoPath, pkg, group) : [];
+        const { refs, warnings } = group === 'typescript_javascript' ? installedLockfile(ctx.repoPath, found) : { refs: found, warnings: [] };
+        const lockfiles = refs.map((ref) => ({ ref, reader: readLockfile(ctx.repoPath, ref) }));
+        return { package: pkg, group, manifest, lockfiles, warnings };
+    });
+}
+/**
+ * With several JS lockfiles in the lockfile directory, keep only the one the install step uses
+ * (`chooseJsLockfile`) and warn. A binary `bun.lockb` cannot be read, so then every readable candidate stays.
+ */
+function installedLockfile(repoPath, refs) {
+    const dir = refs[0]?.dir;
+    if (dir === undefined)
+        return { refs, warnings: [] };
+    const names = jsLockfiles(trackedIn(repoPath, dir).map((file) => path.posix.basename(file)));
+    if (names.length < 2)
+        return { refs, warnings: [] };
+    const chosen = chooseJsLockfile(names);
+    const where = dir === '' ? 'the repository root' : dir;
+    const picked = refs.filter((ref) => path.posix.basename(ref.path) === chosen);
+    if (picked.length === 0) {
+        return { refs, warnings: [`5.3: ${where} has several JS lockfiles (${names.join(', ')}); install uses ${chosen}, which is binary, so 5.3 checks ${refs.map((r) => path.posix.basename(r.path)).join(', ')}`] };
+    }
+    return { refs: picked, warnings: [`5.3: ${where} has several JS lockfiles (${names.join(', ')}); install and 5.3 use ${chosen}`] };
+}
+/** The unit's package directory relative to a lockfile's directory ('' when they are the same). */
+function relToLock(pkg, lockDir) {
+    const dir = pkg === '.' ? '' : pkg;
+    if (lockDir === '')
+        return dir;
+    return dir === lockDir ? '' : path.posix.relative(lockDir, dir);
+}
+export function lockLevel(unit) {
+    if (!unit.manifest || unit.lockfiles.length === 0)
+        return 'none';
+    const inSync = unit.lockfiles.some(({ ref, reader }) => {
+        if (!reader)
+            return false;
+        const rel = relToLock(unit.package, ref.dir);
+        return (unit.manifest?.deps ?? []).every((dep) => entrySatisfies(dep, reader.lookup(dep, rel), unit.group));
+    });
+    return inSync ? 'in_sync' : 'out_of_sync';
+}
+function best(versions, dep, group) {
+    const fits = versions.filter((v) => group === 'python' ? pySatisfies(v, dep.spec) : semver.satisfies(v, dep.spec, { includePrerelease: true }));
+    const pool = fits.length > 0 ? fits : versions;
+    if (group === 'python') {
+        return [...pool].sort((a, b) => {
+            const pa = parseVersion(a);
+            const pb = parseVersion(b);
+            return pa && pb ? compareVersions(pb, pa) : 0;
+        })[0];
+    }
+    return pool[0];
+}
+/** Declared direct dependencies with the version the first lockfile holding them resolves. */
+export function resolveDirect(unit) {
+    return (unit.manifest?.deps ?? []).map((dep) => {
+        for (const { ref, reader } of unit.lockfiles) {
+            if (!reader)
+                continue;
+            const entry = reader.lookup(dep, relToLock(unit.package, ref.dir));
+            if (entry.present)
+                return { name: dep.name, version: best(entry.versions, dep, unit.group), dev: dep.dev, registry: dep.registry };
+        }
+        return { name: dep.name, version: undefined, dev: dep.dev, registry: dep.registry };
+    });
+}

package/dist/measure/deps/units.js

@@ -0,0 +1,5 @@
+import { emptyTallies, logicFiles } from '../units.js';
+/** Scope units: every (package, language group) with logic files, weight = its logic lines. */
+export function scopeUnits(ctx) {
+    return [...emptyTallies([...logicFiles(ctx.scope, 'typescript_javascript'), ...logicFiles(ctx.scope, 'python')]).values()].sort((a, b) => a.package.localeCompare(b.package) || a.group.localeCompare(b.group));
+}

package/dist/measure/eslint/health-plugin.js

@@ -0,0 +1,19 @@
+/**
+ * Reports once for every function node (declarations, expressions, arrows, methods).
+ * `sonarjs/cognitive-complexity` registers on the same `:function` selector, so this is the
+ * denominator for 4.1: all functions as enumerated by the tool.
+ */
+const functionRule = {
+    meta: { type: 'problem', schema: [], messages: { fn: 'function' } },
+    create(context) {
+        return {
+            ':function'(node) {
+                context.report({ node, messageId: 'fn' });
+            },
+        };
+    },
+};
+export const healthPlugin = {
+    meta: { name: 'health' },
+    rules: { function: functionRule },
+};

package/dist/measure/ops/docs-commands.js

@@ -0,0 +1,73 @@
+import { splitSimple, tokenize } from '../../scripts/expand.js';
+const ALIASES = { bunx: ['npx'], uvx: ['uv', 'run'], pip3: ['pip'], python3: ['python'] };
+const SKIPPED = new Set(['sudo']);
+/** First word of a simple command after `VAR=value` words and `sudo`; aliases (`bunx`, `uvx`, `pip3`, `python3`) map to their base word. */
+function leadWord(tokens) {
+    let rest = tokens;
+    while (rest[0] !== undefined && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(rest[0]) || SKIPPED.has(rest[0])))
+        rest = rest.slice(1);
+    const first = rest[0];
+    if (first === undefined)
+        return undefined;
+    const alias = ALIASES[first];
+    if (alias)
+        rest = [...alias, ...rest.slice(1)];
+    return { word: rest[0], rest };
+}
+/** Candidates from fenced blocks (every line) and inline code spans (one per span), before splitting into simple commands. */
+function candidates(text) {
+    const out = [];
+    const lines = text.replace(/\r\n?/g, '\n').split('\n');
+    let fence;
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i] ?? '';
+        const marker = /^\s*(```+|~~~+)/.exec(line)?.[1];
+        if (marker !== undefined) {
+            fence = fence === undefined ? marker[0] : fence === marker[0] ? undefined : fence;
+            continue;
+        }
+        if (fence === undefined) {
+            for (const span of line.matchAll(/`+([^`\n]+)`+/g))
+                out.push({ line: i + 1, text: (span[1] ?? '').trim(), inline: true });
+            continue;
+        }
+        let candidate = line.trim();
+        const start = i + 1;
+        while (candidate.endsWith('\\') && i + 1 < lines.length) {
+            i += 1;
+            candidate = `${candidate.slice(0, -1).trimEnd()} ${(lines[i] ?? '').trim()}`;
+        }
+        candidate = candidate.replace(/^[$>]\s+/, '');
+        if (candidate === '' || candidate.startsWith('#'))
+            continue;
+        out.push({ line: start, text: candidate, inline: false });
+    }
+    return out;
+}
+/**
+ * The documented commands of a file. A command is a simple command whose first word is a package manager or recognised tool.
+ * An inline span is a candidate only when it has a space (`npm` alone is not a command; `package.json` and `src/index.ts` are not).
+ */
+export function extractCommands(text, words) {
+    const out = [];
+    for (const candidate of candidates(text)) {
+        if (candidate.inline && !/\s/.test(candidate.text))
+            continue;
+        let cd = '.';
+        for (const simple of splitSimple(candidate.text)) {
+            const tokens = tokenize(simple.text);
+            const lead = leadWord(tokens);
+            if (!lead)
+                continue;
+            if (lead.word === 'cd' && lead.rest[1] !== undefined && !/[$`*?]/.test(lead.rest[1])) {
+                if (simple.sep === '&&')
+                    cd = cd === '.' ? lead.rest[1].replace(/^\.\//, '') : `${cd}/${lead.rest[1]}`;
+                continue;
+            }
+            if (!words.commandWords.has(lead.word))
+                continue;
+            out.push({ line: candidate.line, text: simple.text.trim(), cd, tokens: [lead.word, ...lead.rest.slice(1)] });
+        }
+    }
+    return out;
+}

package/dist/measure/ops/docs-resolve.js

@@ -0,0 +1,217 @@
+import path from 'node:path';
+import { readPackageJson } from '../../manifest/package-json.js';
+import { pythonDeclaredDeps } from '../../manifest/python.js';
+import { trackedPaths } from '../../scope/tracked.js';
+import { findFile } from '../../scripts/entry-points/find.js';
+import { justfileEntryPoints } from '../../scripts/entry-points/justfile.js';
+import { makefileEntryPoints } from '../../scripts/entry-points/makefile.js';
+import { noxEntryPoints } from '../../scripts/entry-points/nox.js';
+import { packageJsonEntryPoints } from '../../scripts/entry-points/package-json.js';
+import { pyprojectEntryPoints } from '../../scripts/entry-points/pyproject.js';
+import { toxEntryPoints } from '../../scripts/entry-points/tox.js';
+import { dirsUpward } from './entry-points.js';
+const NODE_BUILTINS = new Set([
+    'install', 'i', 'ci', 'add', 'remove', 'update', 'up', 'link', 'init', 'dlx', 'audit', 'outdated', 'publish', 'pack', 'version', 'config',
+    'cache', 'rebuild', 'prune', 'dedupe', 'why', 'ls', 'list', 'x',
+]);
+const UV_BUILTINS = new Set(['sync', 'lock', 'add', 'remove', 'venv', 'pip', 'python', 'tool', 'init', 'build', 'publish']);
+const POETRY_BUILTINS = new Set(['install', 'add', 'remove', 'lock', 'shell', 'build', 'publish', 'init', 'update', 'show', 'env', 'config']);
+const PDM_BUILTINS = new Set(['install', 'add', 'remove', 'lock', 'sync', 'build', 'publish', 'init']);
+const PYTHON_STDLIB = new Set(['venv', 'pip', 'http.server', 'json.tool', 'unittest', 'pytest', 'ensurepip', 'build', 'compileall', 'timeit', 'zipapp', 'http', 'site', 'sysconfig']);
+const WORKSPACE_FLAGS = new Set(['-w', '--workspace', '--workspaces', '--filter', '-F', '-r', '--recursive', '--cwd']);
+const VALUE_FLAGS = new Set(['--prefix', '-C', '--cwd', '--filter', '-F', '--workspace', '--directory']);
+const MAKEFILES = ['Makefile', 'makefile', 'GNUmakefile'];
+const join = (dir, next) => (next === undefined ? dir : path.posix.normalize(path.posix.join(dir, next)));
+export class DocResolver {
+    repoPath;
+    tracked;
+    manifests;
+    toolNames;
+    constructor(repoPath, lists) {
+        this.repoPath = repoPath;
+        this.tracked = new Set(trackedPaths(repoPath));
+        this.toolNames = new Set([...lists.typecheckers, ...lists.linters, ...lists.testRunners].map((t) => (t === 'node --test' ? 'node' : t.replace(/^python3? -m /, ''))));
+    }
+    allManifests() {
+        this.manifests ??= [...this.tracked]
+            .filter((f) => path.posix.basename(f) === 'package.json')
+            .map((f) => {
+            const dir = path.posix.dirname(f);
+            const pkg = readPackageJson(this.repoPath, dir);
+            return { dir, deps: new Set(Object.keys(pkg?.dependencies ?? {})), scripts: new Set(Object.keys(pkg?.scripts ?? {})) };
+        });
+        return this.manifests;
+    }
+    hasScript(dir, name) {
+        return packageJsonEntryPoints.lookup(this.repoPath, dir, name) !== undefined;
+    }
+    declaredPython(dir, name) {
+        const wanted = name.toLowerCase().replace(/[-_.]+/g, '-');
+        return dirsUpward(dir).some((d) => pythonDeclaredDeps(this.repoPath, d).has(wanted));
+    }
+    firstPartyModule(dir, name) {
+        const top = name.split('.').join('/');
+        return [dir, 'src'].some((base) => [`${top}.py`, `${top}/__init__.py`, `${top}/__main__.py`].some((f) => this.tracked.has(path.posix.normalize(path.posix.join(base, f)))));
+    }
+    /** `npx <t>`, `uv run <t>`, `python -m <t>` and a bare recognised tool: resolves for a script, a recognised tool, a declared dependency, a stdlib or first-party module. */
+    toolRef(tool, dir, runner) {
+        if (tool === undefined)
+            return true;
+        if (runner === 'python -m' && (PYTHON_STDLIB.has(tool) || this.firstPartyModule(dir, tool)))
+            return true;
+        if ((runner === 'uv run' || runner === 'poetry run') && pyprojectEntryPoints.lookup(this.repoPath, dir, `scripts:${tool}`) !== undefined)
+            return true;
+        if (runner === 'pdm run' && pyprojectEntryPoints.lookup(this.repoPath, dir, `pdm:${tool}`) !== undefined)
+            return true;
+        if (this.toolNames.has(tool))
+            return true;
+        if (this.allManifests().some((m) => m.deps.has(tool)))
+            return true;
+        return this.declaredPython(dir, tool);
+    }
+    nodeCommand(runner, tokens, baseDir) {
+        let dir = baseDir;
+        let workspace = false;
+        const args = [];
+        for (let i = 1; i < tokens.length; i += 1) {
+            const token = tokens[i];
+            if (token === '--')
+                break;
+            if (WORKSPACE_FLAGS.has(token))
+                workspace = true;
+            if (token === '--prefix' || token === '-C' || token === '--cwd') {
+                dir = join(baseDir, tokens[i + 1]);
+                i += 1;
+            }
+            else if (VALUE_FLAGS.has(token))
+                i += 1;
+            else if (token.startsWith('--prefix='))
+                dir = join(baseDir, token.slice(9));
+            else if (!token.startsWith('-'))
+                args.push(token);
+        }
+        const sub = args[0];
+        if (sub === undefined || NODE_BUILTINS.has(sub))
+            return true;
+        if (sub === 'exec' || (runner === 'bun' && sub === 'x'))
+            return this.toolRef(args[1], dir, runner === 'pnpm' ? 'pnpm exec' : runner);
+        let name;
+        let toolFallback = false;
+        if (sub === 'workspace')
+            name = args[2];
+        else if (sub === 'run' || sub === 'run-script')
+            name = args[1];
+        else if (['test', 'start', 'stop', 'restart'].includes(sub))
+            name = sub;
+        else if (runner === 'yarn' || runner === 'pnpm') {
+            name = sub;
+            toolFallback = true;
+        }
+        else
+            return true;
+        if (name === undefined)
+            return true;
+        if (workspace || sub === 'workspace' ? this.allManifests().some((m) => m.scripts.has(name)) : this.hasScript(dir, name))
+            return true;
+        if (name === 'start' && runner === 'npm' && this.tracked.has(path.posix.join(dir, 'server.js')))
+            return true;
+        return toolFallback && this.toolRef(name, dir, runner);
+    }
+    makeCommand(tokens, baseDir) {
+        let dir = baseDir;
+        const targets = [];
+        for (let i = 1; i < tokens.length; i += 1) {
+            const token = tokens[i];
+            if (token === '-C' || token === '--directory') {
+                dir = join(baseDir, tokens[i + 1]);
+                i += 1;
+            }
+            else if (token === '-f' || token === '--file')
+                i += 1;
+            else if (!token.startsWith('-') && !token.includes('='))
+                targets.push(token);
+        }
+        const names = new Set(makefileEntryPoints.list(this.repoPath, dir).map((e) => e.name));
+        const exists = MAKEFILES.some((m) => this.tracked.has(path.posix.join(dir, m)));
+        return targets.length === 0 ? exists : targets.every((t) => names.has(t));
+    }
+    justCommand(tokens, baseDir) {
+        let dir = baseDir;
+        const recipes = [];
+        for (let i = 1; i < tokens.length; i += 1) {
+            const token = tokens[i];
+            if (token === '-d' || token === '--working-directory') {
+                dir = join(baseDir, tokens[i + 1]);
+                i += 1;
+            }
+            else if (token === '-f' || token === '--justfile')
+                i += 1;
+            else if (!token.startsWith('-') && !token.includes('='))
+                recipes.push(token);
+        }
+        if (recipes.length === 0)
+            return findFile(this.repoPath, dir, ['justfile', 'Justfile', '.justfile'], true) !== undefined;
+        return recipes.every((r) => justfileEntryPoints.lookup(this.repoPath, dir, r) !== undefined);
+    }
+    /** Whether one documented command resolves. `dir` is the document's directory with the command's `cd` already applied. */
+    resolves(command, docDir) {
+        const dir = join(docDir, command.cd === '.' ? undefined : command.cd);
+        const tokens = command.tokens;
+        const first = tokens[0];
+        switch (first) {
+            case 'npm':
+            case 'pnpm':
+            case 'yarn':
+            case 'bun':
+                return this.nodeCommand(first, tokens, dir);
+            case 'npx': {
+                const tool = tokens.slice(1).find((t) => !t.startsWith('-'));
+                return this.toolRef(tool, dir, 'npx');
+            }
+            case 'make':
+                return this.makeCommand(tokens, dir);
+            case 'just':
+                return this.justCommand(tokens, dir);
+            case 'pip':
+            case 'pipenv':
+                return true;
+            case 'uv':
+            case 'poetry':
+            case 'pdm': {
+                const builtins = first === 'uv' ? UV_BUILTINS : first === 'poetry' ? POETRY_BUILTINS : PDM_BUILTINS;
+                const sub = tokens[1];
+                if (sub === undefined || builtins.has(sub))
+                    return true;
+                if (sub !== 'run')
+                    return first === 'uv';
+                const tool = tokens.slice(2).find((t) => !t.startsWith('-'));
+                if (tool === 'python' || tool === 'python3')
+                    return this.pythonCommand(tokens.slice(tokens.indexOf(tool)), dir);
+                return this.toolRef(tool, dir, `${first} run`);
+            }
+            case 'python':
+                return this.pythonCommand(tokens, dir);
+            case 'tox': {
+                const envs = tokens.flatMap((t, i) => (tokens[i - 1] === '-e' ? t.split(',') : []));
+                return envs.length === 0 ? toxEntryPoints.fileFor?.(this.repoPath, dir) !== undefined : envs.every((e) => toxEntryPoints.lookup(this.repoPath, dir, e) !== undefined);
+            }
+            case 'nox': {
+                const sessions = tokens.flatMap((t, i) => (['-s', '--session', '-e', '--sessions'].includes(tokens[i - 1] ?? '') ? t.split(',') : []));
+                return sessions.length === 0 ? noxEntryPoints.fileFor?.(this.repoPath, dir) !== undefined : sessions.every((s) => noxEntryPoints.lookup(this.repoPath, dir, s) !== undefined);
+            }
+            default:
+                return this.toolRef(first, dir, 'bare');
+        }
+    }
+    pythonCommand(tokens, dir) {
+        const arg = tokens[1];
+        if (arg === undefined || arg === '-c' || arg === '-' || arg === '-m') {
+            if (arg === '-m')
+                return this.toolRef(tokens[2], dir, 'python -m');
+            return true;
+        }
+        if (arg.startsWith('-'))
+            return true;
+        return this.tracked.has(path.posix.normalize(path.posix.join(dir, arg)));
+    }
+}

package/dist/measure/ops/entry-points.js

@@ -0,0 +1,49 @@
+import path from 'node:path';
+import { checkKinds, UNRECOGNISED_RUNNERS } from '../../scripts/checks.js';
+import { entryPointKinds } from '../../scripts/entry-points/index.js';
+import { expandCommand } from '../../scripts/expand.js';
+/** The directory itself and each ancestor up to the repository root ("."). */
+export function dirsUpward(dir) {
+    const out = [];
+    for (let current = path.posix.normalize(dir === '' ? '.' : dir);; current = path.posix.dirname(current)) {
+        out.push(current);
+        if (current === '.' || current === '' || current.startsWith('..'))
+            return out;
+    }
+}
+/** Entry points defined in exactly `dir`, expanded up to 3 levels, with the checks each one runs. Memoized per scan. */
+export class EntryPointChecks {
+    repoPath;
+    rec;
+    cache = new Map();
+    constructor(repoPath, rec) {
+        this.repoPath = repoPath;
+        this.rec = rec;
+    }
+    inDir(dir) {
+        const cached = this.cache.get(dir);
+        if (cached)
+            return cached;
+        const results = [];
+        for (const kind of entryPointKinds) {
+            for (const entry of kind.list(this.repoPath, dir)) {
+                const commands = expandCommand(this.repoPath, entry.invoke, { dir, file: dir }, { maxDepth: 3 });
+                const kinds = new Set();
+                const unrecognised = new Set();
+                for (const command of commands) {
+                    for (const found of checkKinds(command, this.rec))
+                        kinds.add(found);
+                    if (command.tool !== null && UNRECOGNISED_RUNNERS.has(command.tool))
+                        unrecognised.add(command.tool);
+                }
+                results.push({ name: `${path.posix.join(dir, kind.id)}:${entry.name}`, kinds, unrecognised: [...unrecognised] });
+            }
+        }
+        this.cache.set(dir, results);
+        return results;
+    }
+    /** Candidate entry points for a unit: those of its package directory and of every ancestor (a root `verify` covers every package). */
+    forUnit(dir) {
+        return dirsUpward(dir).flatMap((d) => this.inDir(d));
+    }
+}

package/dist/measure/ops/env-example.js

@@ -0,0 +1,20 @@
+/** `KEY=value`, `export KEY=value`, blank lines, `#` comment lines and quoted values. A commented-out `# KEY=` line does not count. */
+export function parseEnvExample(text) {
+    const out = {};
+    for (const raw of text.replace(/\r\n?/g, '\n').split('\n')) {
+        const line = raw.trim();
+        if (line === '' || line.startsWith('#'))
+            continue;
+        const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_.]*)\s*=\s*(.*)$/.exec(line);
+        if (!match?.[1])
+            continue;
+        let value = (match[2] ?? '').trim();
+        const quote = value[0];
+        if ((quote === '"' || quote === "'") && value.lastIndexOf(quote) > 0)
+            value = value.slice(1, value.lastIndexOf(quote));
+        else
+            value = value.replace(/\s+#.*$/, '');
+        out[match[1]] = value;
+    }
+    return out;
+}

package/dist/measure/ops/env-reads.js

@@ -0,0 +1,46 @@
+import ts from 'typescript';
+const isName = (node, text) => ts.isIdentifier(node) && node.text === text;
+/** `process.env` */
+function isProcessEnv(node) {
+    return ts.isPropertyAccessExpression(node) && isName(node.expression, 'process') && node.name.text === 'env';
+}
+/** `import.meta.env` */
+function isImportMetaEnv(node) {
+    return (ts.isPropertyAccessExpression(node) &&
+        node.name.text === 'env' &&
+        ts.isMetaProperty(node.expression) &&
+        node.expression.keywordToken === ts.SyntaxKind.ImportKeyword &&
+        node.expression.name.text === 'meta');
+}
+/**
+ * Names read through `process.env.X`, `process.env["X"]`, destructuring from `process.env` (a rest element or computed key is skipped),
+ * `import.meta.env.X` and `import.meta.env["X"]`. An alias (`const env = process.env`) and a non-literal key are not counted.
+ */
+export function tsEnvReads(sf) {
+    const names = new Set();
+    const visit = (node) => {
+        if (ts.isPropertyAccessExpression(node) && (isProcessEnv(node.expression) || isImportMetaEnv(node.expression)))
+            names.add(node.name.text);
+        else if (ts.isElementAccessExpression(node) && (isProcessEnv(node.expression) || isImportMetaEnv(node.expression)) && ts.isStringLiteralLike(node.argumentExpression)) {
+            names.add(node.argumentExpression.text);
+        }
+        else if (ts.isVariableDeclaration(node) && ts.isObjectBindingPattern(node.name) && node.initializer && isProcessEnv(node.initializer)) {
+            for (const element of node.name.elements) {
+                if (element.dotDotDotToken)
+                    continue;
+                const key = element.propertyName ?? element.name;
+                if (ts.isIdentifier(key))
+                    names.add(key.text);
+                else if (ts.isStringLiteralLike(key))
+                    names.add(key.text);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sf);
+    return names;
+}
+/** True when a name is excluded from 6.5: one of the YAML names, or starting with one of the YAML prefixes. */
+export function isExcludedEnvName(name, lists) {
+    return lists.envExcludedNames.includes(name) || lists.envExcludedPrefixes.some((prefix) => name.startsWith(prefix));
+}