vibecodedshit 0.0.0-stage → 0.3.0

package/dist/measure/p5-4.js

@@ -0,0 +1,161 @@
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { packageOf } from '../scope/packages.js';
+import { trackedPaths } from '../scope/tracked.js';
+import { failureReason, unavailable } from '../tools/outcome.js';
+import { createWorkCopy } from '../tools/workcopy.js';
+import { scopeUnits } from './deps/units.js';
+function parseFindings(text) {
+    if (text.trim() === '' || text.trim() === 'null')
+        return [];
+    try {
+        const json = JSON.parse(text);
+        return Array.isArray(json) ? json : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function relative(file, root) {
+    const posix = file.split(path.sep).join('/');
+    const rootPosix = root.split(path.sep).join('/');
+    const rel = posix.startsWith(`${rootPosix}/`) ? posix.slice(rootPosix.length + 1) : posix;
+    return path.posix.normalize(rel).replace(/^\.\//, '');
+}
+const JWT = /eyJ[\w-]+\.(eyJ[\w-]+)\.[\w-]+/;
+/**
+ * Report only: the Supabase role a finding's line carries, or null. gitleaks runs with --redact, so the token is read
+ * from the work copy, only the role claim is kept, and neither the token nor the line is ever stored.
+ */
+export function supabaseRoleOf(line) {
+    if (/\bsb_secret_[\w-]+/.test(line))
+        return 'service_role';
+    if (/\bsb_publishable_[\w-]+/.test(line))
+        return 'anon';
+    const payload = JWT.exec(line)?.[1];
+    if (!payload)
+        return null;
+    try {
+        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        if (typeof claims !== 'object' || claims === null)
+            return null;
+        const { iss, role } = claims;
+        return typeof iss === 'string' && iss.includes('supabase') && typeof role === 'string' ? role : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function supabaseRole(dir, finding) {
+    if (typeof finding.File !== 'string' || typeof finding.StartLine !== 'number')
+        return null;
+    try {
+        const lines = (await readFile(path.join(dir, finding.File), 'utf8')).split('\n');
+        return supabaseRoleOf(lines[finding.StartLine - 1] ?? '');
+    }
+    catch {
+        return null;
+    }
+}
+async function scanWorkingTree(ctx, outDir, config) {
+    const tool = await ctx.tools.resolve('gitleaks');
+    if (!tool)
+        return unavailable(ctx.tools.notFoundReason('gitleaks'));
+    const copy = await createWorkCopy(ctx.repoPath, trackedPaths(ctx.repoPath));
+    try {
+        const report = path.join(outDir, 'tree.json');
+        // --exit-code 0: any non-zero exit means gitleaks itself failed.
+        const result = await ctx.tools.run(tool, ['dir', '.', '--config', config, '--report-format', 'json', '--report-path', report, '--exit-code', '0', '--redact', '--no-banner'], { cwd: copy.dir });
+        const failure = failureReason(tool, result, [0]);
+        if (failure)
+            return unavailable(failure);
+        let text;
+        try {
+            text = await readFile(report, 'utf8');
+        }
+        catch {
+            return unavailable('gitleaks wrote no report');
+        }
+        const findings = parseFindings(text);
+        if (!findings)
+            return unavailable('gitleaks printed no parseable JSON report');
+        const relativeFindings = findings.map((f) => ({ ...f, File: typeof f.File === 'string' ? relative(f.File, copy.dir) : f.File }));
+        return Promise.all(relativeFindings.map(async (f) => ({ ...f, SupabaseRole: await supabaseRole(copy.dir, f) })));
+    }
+    finally {
+        await copy.cleanup();
+    }
+}
+/** Report only: a failure is a warning and never makes the parameter not_measured. */
+async function scanHistory(ctx, outDir, config) {
+    const tool = await ctx.tools.resolve('gitleaks');
+    if (!tool)
+        return null;
+    const report = path.join(outDir, 'history.json');
+    const result = await ctx.tools.run(tool, ['git', path.resolve(ctx.repoPath), '--config', config, '--report-format', 'json', '--report-path', report, '--exit-code', '0', '--redact', '--no-banner'], { cwd: outDir });
+    if (failureReason(tool, result, [0]) !== null)
+        return null;
+    let findings;
+    try {
+        findings = parseFindings(await readFile(report, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (!findings)
+        return null;
+    return {
+        count: findings.length,
+        findings: findings.map((f) => ({ ruleId: f.RuleID, file: f.File, commit: f.Commit, line: f.StartLine })),
+    };
+}
+export const p54 = {
+    id: '5.4',
+    layer: 'static',
+    async measure(ctx) {
+        const outDir = await mkdtemp(path.join(tmpdir(), 'health-gitleaks-'));
+        try {
+            // An explicit config: the pinned default ruleset applies and no .gitleaks.toml is read.
+            const config = path.join(outDir, 'gitleaks.toml');
+            await writeFile(config, '[extend]\nuseDefault = true\n');
+            const findings = await scanWorkingTree(ctx, outDir, config);
+            if (!Array.isArray(findings))
+                return findings;
+            const units = scopeUnits(ctx);
+            const counts = new Map(units.map((u) => [`${u.package}\0${u.group}`, 0]));
+            for (const finding of findings) {
+                if (typeof finding.File !== 'string')
+                    continue;
+                const owner = packageOf(finding.File, ctx.scope.packages);
+                const owned = units.filter((u) => u.package === owner);
+                for (const unit of owned.length > 0 ? owned : units) {
+                    const key = `${unit.package}\0${unit.group}`;
+                    counts.set(key, (counts.get(key) ?? 0) + 1);
+                }
+            }
+            const warnings = [];
+            const history = await scanHistory(ctx, outDir, config);
+            if (history === null)
+                warnings.push('5.4: git history scan failed');
+            const result = units.map((u) => ({
+                package: u.package,
+                group: u.group,
+                weight: u.weight,
+                raw: { kind: 'number', value: counts.get(`${u.package}\0${u.group}`) ?? 0 },
+            }));
+            return {
+                status: 'measured',
+                units: result,
+                warnings,
+                reportOnly: {
+                    secretsInTree: findings.map((f) => ({ ruleId: f.RuleID, file: f.File, line: f.StartLine, supabaseRole: f.SupabaseRole ?? null })),
+                    ...(history === null ? {} : { secretsInHistory: history }),
+                },
+            };
+        }
+        finally {
+            await rm(outDir, { recursive: true, force: true });
+        }
+    },
+};

package/dist/measure/p5-5.js

@@ -0,0 +1,158 @@
+import { mkdtemp, rm, writeFile, readFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { stringify } from 'smol-toml';
+import { packageOf } from '../scope/packages.js';
+import { isOutcome, knipFailed, runKnip } from '../tools/knip.js';
+import { failureReason, unavailable } from '../tools/outcome.js';
+import { createWorkCopy } from '../tools/workcopy.js';
+import { readToml } from '../util/toml.js';
+import { requirementFiles } from './deps/declared.js';
+import { joinRel, trackedSet } from './deps/files.js';
+import { unitDeps } from './deps/resolved.js';
+import { scopeUnits } from './deps/units.js';
+function knipCounts(ctx, knip, pkg) {
+    const names = new Set();
+    const manifest = joinRel(pkg, 'package.json');
+    for (const [file, issues] of knip.files) {
+        if (file === manifest) {
+            for (const name of [...issues.dependencies, ...issues.devDependencies])
+                names.add(name);
+        }
+        if (packageOf(file, ctx.scope.packages) === pkg) {
+            for (const name of issues.unlisted)
+                names.add(`unlisted\0${name}`);
+        }
+    }
+    return names.size;
+}
+const DEPTRY_CODES = new Set(['DEP001', 'DEP002', 'DEP003']);
+/** deptry found no section or file it reads dependencies from (a pyproject.toml without [project], poetry or pdm tables, and no requirements.txt). */
+const NO_SPEC = 'no-spec';
+/** deptry on a work copy of the unit with the repository's [tool.deptry] settings removed. */
+async function deptryCount(ctx, tools, pkg) {
+    const tool = await tools.resolve('deptry');
+    if (!tool)
+        return unavailable(tools.notFoundReason('deptry'));
+    const dir = pkg === '.' ? '' : pkg;
+    const pythonFiles = [...trackedSet(ctx.repoPath)].filter((f) => f.endsWith('.py') && (dir === '' || f.startsWith(`${dir}/`)) && packageOf(f, ctx.scope.packages) === pkg);
+    const extra = [...requirementFiles(ctx.repoPath, pkg)];
+    const pipfile = joinRel(dir, 'Pipfile');
+    if (trackedSet(ctx.repoPath).has(pipfile))
+        extra.push(pipfile);
+    const copy = await createWorkCopy(ctx.repoPath, [...pythonFiles, ...extra]);
+    const outDir = await mkdtemp(path.join(tmpdir(), 'health-deptry-'));
+    try {
+        const pyprojectRel = joinRel(dir, 'pyproject.toml');
+        if (trackedSet(ctx.repoPath).has(pyprojectRel)) {
+            const doc = readToml(path.join(ctx.repoPath, pyprojectRel));
+            if (doc) {
+                const toolTable = doc.tool;
+                if (toolTable !== null && typeof toolTable === 'object' && !Array.isArray(toolTable)) {
+                    delete toolTable.deptry;
+                }
+                await writeFile(path.join(copy.dir, pyprojectRel), stringify(doc));
+            }
+        }
+        const report = path.join(outDir, 'deptry.json');
+        const result = await tools.run(tool, ['.', '--json-output', report, '--no-ansi'], { cwd: path.join(copy.dir, dir) });
+        const failure = failureReason(tool, result, [0, 1]);
+        if (failure)
+            return unavailable(failure);
+        let text = '[]';
+        try {
+            text = await readFile(report, 'utf8');
+        }
+        catch {
+            if (result.exitCode === 1 && `${result.stdout}${result.stderr}`.includes('DependencySpecificationNotFoundError'))
+                return NO_SPEC;
+            if (result.exitCode === 1)
+                return unavailable('deptry wrote no report');
+        }
+        let violations;
+        try {
+            violations = JSON.parse(text.trim() === '' ? '[]' : text);
+        }
+        catch {
+            return unavailable('deptry printed no parseable JSON report');
+        }
+        if (!Array.isArray(violations))
+            return unavailable('deptry report has an unexpected shape');
+        const pairs = new Set();
+        for (const entry of violations) {
+            const code = entry.error?.code;
+            if (typeof code === 'string' && DEPTRY_CODES.has(code))
+                pairs.add(`${code}\0${String(entry.module)}`);
+        }
+        return pairs.size;
+    }
+    finally {
+        await copy.cleanup();
+        await rm(outDir, { recursive: true, force: true });
+    }
+}
+export const p55 = {
+    id: '5.5',
+    layer: 'static',
+    async measure(ctx) {
+        const units = scopeUnits(ctx);
+        const warnings = [];
+        const counts = new Map();
+        const failed = new Set();
+        if (units.some((u) => u.group === 'typescript_javascript')) {
+            const knip = await runKnip(ctx);
+            if (!isOutcome(knip))
+                return knip;
+            warnings.push(...knip.warnings.map((w) => `5.5: ${w}`));
+            for (const unit of units.filter((u) => u.group === 'typescript_javascript')) {
+                const unitFiles = ctx.scope.files.filter((f) => f.role === 'logic' && f.group === unit.group && f.package === unit.package);
+                if (knipFailed(knip, unit.package) || unitFiles.some((f) => knipFailed(knip, f.path))) {
+                    failed.add(`${unit.package}\0${unit.group}`);
+                    continue;
+                }
+                const deps = await unitDeps(ctx, unit.package, unit.group);
+                if (!deps.manifest) {
+                    warnings.push(`5.5: ${unit.package} has no package.json`);
+                    counts.set(`${unit.package}\0${unit.group}`, { numerator: 0, denominator: 0 });
+                    continue;
+                }
+                const denominator = deps.manifest.deps.filter((d) => d.optional !== true).length;
+                counts.set(`${unit.package}\0${unit.group}`, { numerator: knipCounts(ctx, knip, unit.package), denominator });
+            }
+        }
+        for (const unit of units.filter((u) => u.group === 'python')) {
+            const deps = await unitDeps(ctx, unit.package, unit.group);
+            // deptry exits 1 with no report when there is nothing to read dependencies from, so it is not run.
+            if (!deps.manifest) {
+                warnings.push(`5.5: ${unit.package} has no Python dependency manifest`);
+                counts.set(`${unit.package}\0${unit.group}`, { numerator: 0, denominator: 0 });
+                continue;
+            }
+            const denominator = new Set((deps.manifest?.deps ?? []).map((d) => d.name)).size;
+            if (denominator === 0)
+                warnings.push(`5.5: ${unit.package} declares no dependencies`);
+            const numerator = await deptryCount(ctx, ctx.tools, unit.package);
+            if (numerator === NO_SPEC) {
+                // Nothing declared and nothing deptry can read: the same 0/0 as a unit with no manifest.
+                if (denominator > 0)
+                    return unavailable(`deptry cannot read the dependencies declared in ${deps.manifest.file}`);
+                warnings.push(`5.5: deptry found no dependency specification in ${unit.package}`);
+                counts.set(`${unit.package}\0${unit.group}`, { numerator: 0, denominator: 0 });
+                continue;
+            }
+            if (typeof numerator !== 'number')
+                return numerator;
+            counts.set(`${unit.package}\0${unit.group}`, { numerator, denominator });
+        }
+        return {
+            status: 'measured',
+            units: units.map((u) => {
+                if (failed.has(`${u.package}\0${u.group}`))
+                    return { package: u.package, group: u.group, weight: u.weight, raw: { kind: 'failed' } };
+                const c = counts.get(`${u.package}\0${u.group}`) ?? { numerator: 0, denominator: 0 };
+                return { package: u.package, group: u.group, weight: u.weight, raw: { kind: 'ratio', numerator: c.numerator, denominator: c.denominator, scale: 100 } };
+            }),
+            warnings,
+        };
+    },
+};

package/dist/measure/p6-1.js

@@ -0,0 +1,20 @@
+/** install_fails when the install did not work; build_fails when it did and the build did not; works otherwise (no build step counts as works). */
+function installLevel(root) {
+    if (root.install && root.install.status !== 'ok')
+        return 'install_fails';
+    if (root.build && root.build.status !== 'ok')
+        return 'build_fails';
+    return 'works';
+}
+export const p61 = {
+    id: '6.1',
+    layer: 'execution',
+    async measure({ exec }) {
+        if (!exec)
+            return { status: 'not_measured', reason: 'execution layer did not run' };
+        return {
+            status: 'measured',
+            units: exec.roots.map((root) => ({ package: root.dir, group: root.group, weight: root.weight, raw: { kind: 'level', level: installLevel(root) } })),
+        };
+    },
+};

package/dist/measure/p6-2.js

@@ -0,0 +1,20 @@
+import { EntryPointChecks } from './ops/entry-points.js';
+import { logicUnits } from './units.js';
+export const p62 = {
+    id: '6.2',
+    layer: 'static',
+    async measure({ scope, repoPath, methodology }) {
+        const checks = new EntryPointChecks(repoPath, methodology.d6);
+        const findings = new Set();
+        const units = logicUnits(scope).map((unit) => {
+            const candidates = checks.forUnit(unit.dir);
+            for (const entry of candidates) {
+                if (entry.unrecognised.length > 0)
+                    findings.add(`6.2: ${entry.name} calls ${entry.unrecognised.join(', ')}, which is not a recognised tool`);
+            }
+            const level = Math.max(0, ...candidates.map((c) => c.kinds.size));
+            return { package: unit.package, group: unit.group, weight: unit.weight, raw: { kind: 'level', level: String(level) } };
+        });
+        return { status: 'measured', units, ...(findings.size === 0 ? {} : { warnings: [...findings].sort() }) };
+    },
+};

package/dist/measure/p6-3.js

@@ -0,0 +1,40 @@
+import { failure as checkFailure } from '../exec/findings.js';
+import { withFailedUnits } from '../exec/roots.js';
+import { testFailure, totalCases } from '../exec/tests.js';
+import { emptyTallies } from './units.js';
+const seconds = (outcomes) => outcomes.reduce((sum, outcome) => sum + outcome.durationMs, 0) / 1000;
+/** The three step durations in seconds, full precision, and their sum. Steps that did not run count 0. The coverage provider install is not one of the three. */
+export function feedbackLoop(exec) {
+    const typecheckSeconds = seconds(exec.typecheck.map((r) => r.outcome));
+    const lintSeconds = seconds(exec.lint.map((r) => r.outcome));
+    const testSeconds = seconds(exec.test.invocations.map((r) => r.outcome));
+    return { typecheckSeconds, lintSeconds, testSeconds, totalSeconds: typecheckSeconds + lintSeconds + testSeconds };
+}
+/**
+ * Summed wall-clock seconds of every typecheck, lint and test step. Every (package, group) unit carries the
+ * same sum, weighted by logic lines, so the pooled score is the repository's. Failed unless typecheck, lint
+ * and the test run all worked and some install root installed (`requires` in the YAML); units beneath a root
+ * whose install failed score 0.
+ */
+export const p63 = {
+    id: '6.3',
+    layer: 'execution',
+    async measure(ctx) {
+        const exec = ctx.exec;
+        if (!exec)
+            return { status: 'not_measured', reason: 'execution layer did not run' };
+        const stopped = testFailure(exec) ?? [...exec.typecheck, ...exec.lint].map(checkFailure).find((reason) => reason !== null) ?? null;
+        if (stopped !== null)
+            return { status: 'failed', reason: stopped };
+        if (exec.test.invocations.length === 0)
+            return { status: 'failed', reason: 'no supported test runner was found' };
+        if (totalCases(exec) === 0)
+            return { status: 'failed', reason: 'the test runner ran no test case' };
+        const value = feedbackLoop(exec).totalSeconds;
+        const logic = ctx.scope.files.filter((f) => f.role === 'logic');
+        const units = [...emptyTallies(logic).values()]
+            .sort((a, b) => a.package.localeCompare(b.package) || a.group.localeCompare(b.group))
+            .map((t) => ({ package: t.package, group: t.group, weight: t.weight, raw: { kind: 'number', value } }));
+        return { status: 'measured', units: withFailedUnits(exec, ctx.scope, units) };
+    },
+};

package/dist/measure/p6-4.js

@@ -0,0 +1,31 @@
+import { checkKinds } from '../scripts/checks.js';
+import { ciCommands } from '../scripts/ci.js';
+import { expandCommand } from '../scripts/expand.js';
+import { dirsUpward } from './ops/entry-points.js';
+import { logicUnits } from './units.js';
+export const p64 = {
+    id: '6.4',
+    layer: 'static',
+    async measure({ scope, repoPath, methodology }) {
+        const warnings = [];
+        const commands = ciCommands(repoPath, warnings).filter((c) => c.triggers?.qualifies === true);
+        // A command counts for the units at or below its working directory; expand each once.
+        const byDir = new Map();
+        for (const command of commands) {
+            const kinds = byDir.get(command.dir) ?? new Set();
+            for (const resolved of expandCommand(repoPath, command.command, { dir: command.dir, file: command.file }, { maxDepth: 3 })) {
+                for (const kind of checkKinds(resolved, methodology.d6))
+                    kinds.add(kind);
+            }
+            byDir.set(command.dir, kinds);
+        }
+        const units = logicUnits(scope).map((unit) => {
+            const kinds = new Set();
+            for (const dir of dirsUpward(unit.dir))
+                for (const kind of byDir.get(dir) ?? [])
+                    kinds.add(kind);
+            return { package: unit.package, group: unit.group, weight: unit.weight, raw: { kind: 'level', level: String(kinds.size) } };
+        });
+        return { status: 'measured', units, ...(warnings.length === 0 ? {} : { warnings: warnings.map((w) => `6.4: ${w}`) }) };
+    },
+};

package/dist/measure/p6-5.js

@@ -0,0 +1,60 @@
+import path from 'node:path';
+import { pythonEnvReads } from '../python/env.js';
+import { readTracked } from '../scope/tracked.js';
+import { dirsUpward } from './ops/entry-points.js';
+import { parseEnvExample } from './ops/env-example.js';
+import { isExcludedEnvName, tsEnvReads } from './ops/env-reads.js';
+import { runtimePinned } from './ops/runtime.js';
+import { logicUnits } from './units.js';
+export const p65 = {
+    id: '6.5',
+    layer: 'static',
+    async measure({ scope, repoPath, methodology }) {
+        const lists = methodology.d6;
+        const warnings = [];
+        const pyFiles = scope.files.filter((f) => f.group === 'python' && f.role === 'logic').map((f) => f.path);
+        const pyReads = pyFiles.length === 0 ? {} : pythonEnvReads(repoPath, pyFiles);
+        const units = logicUnits(scope).map((unit) => {
+            const read = new Set();
+            for (const file of unit.files) {
+                if (unit.group === 'python') {
+                    const found = pyReads[file.path];
+                    if (found?.ok)
+                        for (const name of found.names)
+                            read.add(name);
+                    else
+                        warnings.push(`6.5: ${file.path}: syntax error, its environment reads are not counted`);
+                }
+                else
+                    for (const name of tsEnvReads(scope.getTsSourceFile(file.path)))
+                        read.add(name);
+            }
+            const names = [...read].filter((name) => !isExcludedEnvName(name, lists));
+            let documented = new Set();
+            search: for (const dir of dirsUpward(unit.dir)) {
+                for (const name of lists.envExampleFiles) {
+                    const text = readTracked(repoPath, path.posix.join(dir, name));
+                    if (text !== null) {
+                        documented = new Set(Object.keys(parseEnvExample(text)));
+                        break search;
+                    }
+                }
+            }
+            const numerator = names.filter((name) => documented.has(name)).length;
+            const pinned = runtimePinned(repoPath, unit.dir, unit.group, lists.runtimePinFiles, warnings);
+            return {
+                package: unit.package,
+                group: unit.group,
+                weight: unit.weight,
+                raw: {
+                    kind: 'components',
+                    components: {
+                        runtime_pinned: { kind: 'level', level: pinned ? 'yes' : 'no' },
+                        env_documented: { kind: 'ratio', numerator, denominator: names.length, scale: 100, ...(names.length === 0 ? { emptyScore: 100 } : {}) },
+                    },
+                },
+            };
+        });
+        return { status: 'measured', units, ...(warnings.length === 0 ? {} : { warnings: [...new Set(warnings)] }) };
+    },
+};

package/dist/measure/p6-6.js

@@ -0,0 +1,54 @@
+import path from 'node:path';
+import { readTracked, trackedPaths } from '../scope/tracked.js';
+import { extractCommands } from './ops/docs-commands.js';
+import { DocResolver } from './ops/docs-resolve.js';
+import { logicUnits } from './units.js';
+const AGENT_FILES = ['agents.md', 'claude.md'];
+const README_NAMES = ['readme.md', 'readme', 'readme.rst', 'readme.txt'];
+/** The tracked file of `dir` whose name matches one of `names` case-insensitively, in the order of `names`. */
+function findCi(tracked, dir, names) {
+    const inDir = tracked.filter((f) => path.posix.dirname(f) === dir);
+    for (const name of names) {
+        const found = inDir.find((f) => path.posix.basename(f).toLowerCase() === name);
+        if (found)
+            return found;
+    }
+    return undefined;
+}
+export const p66 = {
+    id: '6.6',
+    layer: 'static',
+    async measure({ scope, repoPath, methodology }) {
+        const lists = methodology.d6;
+        const tracked = trackedPaths(repoPath);
+        const words = {
+            commandWords: new Set([
+                ...lists.docPackageManagers,
+                ...[...lists.typecheckers, ...lists.linters, ...lists.testRunners].map((t) => (t === 'node --test' ? 'node' : t.replace(/^python3? -m /, ''))),
+            ]),
+        };
+        const resolver = new DocResolver(repoPath, lists);
+        const commandsOf = (file) => {
+            const text = file === undefined ? null : readTracked(repoPath, file);
+            return text === null ? [] : extractCommands(text, words);
+        };
+        const agentFiles = AGENT_FILES.flatMap((name) => findCi(tracked, '.', [name]) ?? []);
+        const agent = agentFiles.flatMap((file) => commandsOf(file).map((command) => ({ file, command })));
+        const unresolved = agent.filter(({ command }) => !resolver.resolves(command, '.'));
+        const warnings = unresolved.slice(0, 5).map(({ file, command }) => `6.6: ${file}:${command.line}: \`${command.text}\` does not resolve`);
+        const rootReadme = findCi(tracked, '.', README_NAMES);
+        const rootReadmeHasCommands = commandsOf(rootReadme).length > 0;
+        const units = logicUnits(scope).map((unit) => {
+            let level;
+            if (agent.length > 0)
+                level = unresolved.length === 0 ? 'agent_file' : 'readme';
+            else {
+                const own = unit.dir === '.' ? undefined : findCi(tracked, unit.dir, README_NAMES);
+                const hasCommands = own !== undefined && commandsOf(own).length > 0 ? true : rootReadmeHasCommands;
+                level = hasCommands ? 'readme' : 'none';
+            }
+            return { package: unit.package, group: unit.group, weight: unit.weight, raw: { kind: 'level', level } };
+        });
+        return { status: 'measured', units, ...(warnings.length === 0 ? {} : { warnings }) };
+    },
+};

package/dist/measure/py/typecheck-config.js

@@ -0,0 +1,95 @@
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import ts from 'typescript';
+import { parseIni } from '../../util/ini.js';
+import { readToml } from '../../util/toml.js';
+function asRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function truthy(value) {
+    if (typeof value === 'boolean')
+        return value;
+    return typeof value === 'string' && ['true', '1', 'yes', 'on'].includes(value.trim().toLowerCase());
+}
+function pyrightLevel(mode, unsetMeans, basedpyright) {
+    if (typeof mode !== 'string')
+        return unsetMeans;
+    switch (mode) {
+        case 'off':
+            return 'none';
+        case 'basic':
+            return 'basic';
+        case 'standard':
+            return 'standard';
+        case 'strict':
+            return 'strict';
+        case 'recommended':
+        case 'all':
+            return basedpyright ? 'strict' : unsetMeans;
+        default:
+            return unsetMeans;
+    }
+}
+function mypyLevel(section) {
+    if (truthy(section.strict))
+        return 'strict';
+    if (truthy(section.disallow_untyped_defs) && truthy(section.check_untyped_defs))
+        return 'standard';
+    return 'basic';
+}
+function readText(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The level one directory declares, or undefined when it holds no pyright or mypy config. pyright wins over mypy. */
+function levelInDirectory(dir, relDir, warnings) {
+    const rel = (name) => (relDir === '' ? name : `${relDir}/${name}`);
+    const pyproject = existsSync(path.join(dir, 'pyproject.toml')) ? readToml(path.join(dir, 'pyproject.toml')) : undefined;
+    if (existsSync(path.join(dir, 'pyproject.toml')) && pyproject === undefined) {
+        warnings.push(`2.2: ${rel('pyproject.toml')}: invalid TOML, ignored`);
+    }
+    const tool = asRecord(pyproject?.tool);
+    const pyrightJson = readText(path.join(dir, 'pyrightconfig.json'));
+    if (pyrightJson !== undefined) {
+        const parsed = ts.parseConfigFileTextToJson('pyrightconfig.json', pyrightJson);
+        if (parsed.error)
+            warnings.push(`2.2: ${rel('pyrightconfig.json')}: invalid JSON, ignored`);
+        else
+            return pyrightLevel(asRecord(parsed.config)?.typeCheckingMode, 'standard', false);
+    }
+    const pyright = asRecord(tool?.pyright);
+    if (pyright)
+        return pyrightLevel(pyright.typeCheckingMode, 'standard', false);
+    const basedpyright = asRecord(tool?.basedpyright);
+    if (basedpyright)
+        return pyrightLevel(basedpyright.typeCheckingMode, 'strict', true);
+    for (const name of ['mypy.ini', '.mypy.ini']) {
+        const text = readText(path.join(dir, name));
+        const section = text === undefined ? undefined : parseIni(text).mypy;
+        if (section)
+            return mypyLevel(section);
+    }
+    const mypyToml = asRecord(tool?.mypy);
+    if (mypyToml)
+        return mypyLevel(mypyToml);
+    const setupCfg = readText(path.join(dir, 'setup.cfg'));
+    const cfgSection = setupCfg === undefined ? undefined : parseIni(setupCfg).mypy;
+    if (cfgSection)
+        return mypyLevel(cfgSection);
+    return undefined;
+}
+/** Search from the unit's package directory up to the repository root; the first directory with a config decides. */
+export function pythonLevel(repoPath, packageDir, warnings) {
+    const parts = packageDir === '.' ? [] : packageDir.split('/');
+    for (let depth = parts.length; depth >= 0; depth -= 1) {
+        const relDir = parts.slice(0, depth).join('/');
+        const level = levelInDirectory(path.join(repoPath, relDir), relDir, warnings);
+        if (level !== undefined)
+            return level;
+    }
+    return 'none';
+}