vibecodedshit 0.0.0-stage → 0.3.0

package/dist/scripts/expand.js

@@ -0,0 +1,300 @@
+import path from 'node:path';
+import { ciCommands } from './ci.js';
+import { entryPointKind } from './entry-points/index.js';
+const SKIPPED_WORDS = new Set(['sudo', 'time', 'exec', 'env', 'command', 'nohup']);
+export const RUNNER_PREFIXES = [
+    ['pnpm', 'exec'], ['pnpm', 'dlx'], ['yarn', 'exec'], ['yarn', 'dlx'], ['uv', 'run'], ['poetry', 'run'], ['pdm', 'run'],
+    ['hatch', 'run'], ['pipx', 'run'], ['python', '-m'], ['python3', '-m'], ['npx'], ['bunx'], ['yarn'], ['pnpm'],
+];
+/** Split on newline, `&&`, `||`, `;` and `|` outside quotes. */
+export function splitSimple(text) {
+    const out = [];
+    let current = '';
+    let quote = null;
+    for (let i = 0; i < text.length; i += 1) {
+        const ch = text[i];
+        if (quote !== null) {
+            if (ch === quote)
+                quote = null;
+            current += ch;
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+            current += ch;
+        }
+        else if (ch === '\\' && text[i + 1] === '\n') {
+            i += 1;
+        }
+        else if ((ch === '&' && text[i + 1] === '&') || (ch === '|' && text[i + 1] === '|')) {
+            out.push({ text: current, sep: ch + ch });
+            current = '';
+            i += 1;
+        }
+        else if (ch === ';' || ch === '|' || ch === '\n') {
+            out.push({ text: current, sep: ch });
+            current = '';
+        }
+        else
+            current += ch;
+    }
+    out.push({ text: current, sep: '' });
+    return out.filter((s) => s.text.trim() !== '');
+}
+export function tokenize(text) {
+    const tokens = [];
+    const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    for (let m = re.exec(text); m !== null; m = re.exec(text))
+        tokens.push(m[1] ?? m[2] ?? m[3] ?? '');
+    return tokens;
+}
+function stripWrappers(tokens) {
+    let rest = tokens;
+    for (;;) {
+        const first = rest[0];
+        if (first === undefined)
+            return rest;
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(first) || SKIPPED_WORDS.has(first)) {
+            rest = rest.slice(1);
+            continue;
+        }
+        return rest;
+    }
+}
+function stripRunners(tokens) {
+    let rest = tokens;
+    for (;;) {
+        const prefix = RUNNER_PREFIXES.find((p) => p.every((word, i) => rest[i] === word));
+        if (!prefix)
+            return rest;
+        rest = rest.slice(prefix.length);
+        while (rest[0]?.startsWith('-'))
+            rest = rest.slice(1);
+    }
+}
+/** Flags that take a value, for the runners whose first plain argument is the script or target name. */
+const VALUE_FLAGS = new Set(['--prefix', '-C', '--cwd', '--filter', '-F', '--workspace', '--directory']);
+function joinDir(dir, next) {
+    return next === undefined ? dir : path.posix.normalize(path.posix.join(dir, next));
+}
+function detectPackageManager(base, tokens, dir) {
+    let callDir = dir;
+    const args = [];
+    for (let i = 1; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (token === '--prefix' || token === '-C' || token === '--cwd') {
+            callDir = joinDir(dir, tokens[i + 1]);
+            i += 1;
+        }
+        else if (token.startsWith('--prefix='))
+            callDir = joinDir(dir, token.slice(9));
+        else if (VALUE_FLAGS.has(token))
+            i += 1;
+        else if (token.startsWith('-'))
+            continue;
+        else
+            args.push(token);
+    }
+    let name;
+    let fallback = false;
+    if (base === 'npm') {
+        if (args[0] === 'run' || args[0] === 'run-script')
+            name = args[1];
+        else if (args[0] === 'test' || args[0] === 'start')
+            name = args[0];
+    }
+    else if (base === 'bun') {
+        if (args[0] === 'run')
+            name = args[1];
+    }
+    else if (args[0] === 'run')
+        name = args[1];
+    else if (args[0] !== undefined && !(base === 'pnpm' && (args[0] === 'exec' || args[0] === 'dlx')) && !(base === 'yarn' && (args[0] === 'exec' || args[0] === 'dlx'))) {
+        name = args[0];
+        fallback = true;
+    }
+    if (name === undefined)
+        return undefined;
+    return { runner: base, kind: 'package-json', names: [name], dir: callDir, prePost: base === 'npm' || base === 'yarn', fallback };
+}
+function detectMake(base, tokens, dir) {
+    let callDir = dir;
+    const targets = [];
+    for (let i = 1; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (token === '-C' || token === '--directory') {
+            callDir = joinDir(dir, tokens[i + 1]);
+            i += 1;
+        }
+        else if (token === '-f' || token === '--file')
+            i += 1;
+        else if (token.startsWith('-') || token.includes('='))
+            continue;
+        else
+            targets.push(token);
+    }
+    if (targets.length === 0)
+        return undefined;
+    return { runner: base, kind: 'makefile', names: targets, dir: callDir, prePost: false, fallback: false };
+}
+function detectJust(tokens, dir) {
+    let callDir = dir;
+    const names = [];
+    for (let i = 1; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (token === '-d' || token === '--working-directory') {
+            callDir = joinDir(dir, tokens[i + 1]);
+            i += 1;
+        }
+        else if (token === '-f' || token === '--justfile')
+            i += 1;
+        else if (token.startsWith('--justfile=') || token.startsWith('--working-directory='))
+            continue;
+        else if (token.startsWith('-') || token.includes('='))
+            continue;
+        else
+            names.push(token);
+    }
+    return { runner: 'just', kind: 'justfile', names: names.length === 0 ? ['@default'] : names, dir: callDir, prePost: false, fallback: false };
+}
+function detectTox(tokens, dir) {
+    const names = [];
+    for (let i = 1; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (token === '--')
+            break;
+        if (token === '-e') {
+            names.push(...(tokens[i + 1] ?? '').split(','));
+            i += 1;
+        }
+        else if (token.startsWith('-e') && token.length > 2)
+            names.push(...token.slice(2).split(','));
+    }
+    return { runner: 'tox', kind: 'tox', names: names.length === 0 ? ['@default'] : names.filter((n) => n !== ''), dir, prePost: false, fallback: false };
+}
+function detectNox(tokens, dir) {
+    const names = [];
+    for (let i = 1; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (token === '--')
+            break;
+        if (token === '-s' || token === '--session' || token === '-e' || token === '--sessions') {
+            while (tokens[i + 1] !== undefined && !tokens[i + 1].startsWith('-')) {
+                names.push(...tokens[i + 1].split(','));
+                i += 1;
+            }
+        }
+    }
+    return { runner: 'nox', kind: 'nox', names: names.length === 0 ? ['@all'] : names.filter((n) => n !== ''), dir, prePost: false, fallback: false };
+}
+/** `uv run <n>`, `poetry run <n>`, `pdm run <n>`, `hatch run [<env>:]<n>`, `rye run <n>`, `poe <n>` and `task <n>` name a script of a pyproject table. */
+function detectPyproject(tokens, dir) {
+    const [first, second] = tokens;
+    const rest = (from) => tokens.slice(from).find((t) => !t.startsWith('-'));
+    const make = (runner, key, name, fallback) => name === undefined ? undefined : { runner, kind: 'pyproject', names: [key(name)], dir, prePost: false, fallback };
+    if ((first === 'uv' || first === 'poetry') && second === 'run')
+        return make(first, (n) => `scripts:${n}`, rest(2), true);
+    if (first === 'pdm' && second === 'run')
+        return make(first, (n) => `pdm:${n}`, rest(2), true);
+    if (first === 'hatch' && second === 'run')
+        return make(first, (n) => (n.includes(':') ? `hatch:${n}` : `hatch:default:${n}`), rest(2), true);
+    if (first === 'rye' && second === 'run')
+        return make(first, (n) => `rye:${n}`, rest(2), false);
+    if (first === 'poe')
+        return make(first, (n) => `poe:${n}`, rest(1), false);
+    if (first === 'task')
+        return make(first, (n) => `taskipy:${n}`, rest(1), false);
+    return undefined;
+}
+function detectCall(tokens, dir) {
+    const first = tokens[0];
+    if (first === undefined)
+        return undefined;
+    const base = path.posix.basename(first);
+    if (base === 'npm' || base === 'yarn' || base === 'pnpm' || base === 'bun')
+        return detectPackageManager(base, tokens, dir);
+    if (base === 'make' || first === '$(MAKE)' || first === '${MAKE}')
+        return detectMake('make', tokens, dir);
+    if (base === 'just')
+        return detectJust(tokens, dir);
+    if (base === 'tox')
+        return detectTox(tokens, dir);
+    if (base === 'nox')
+        return detectNox(tokens, dir);
+    return detectPyproject(tokens, dir);
+}
+function expandText(repoPath, text, frame, maxDepth, out) {
+    let dir = frame.dir;
+    for (const simple of splitSimple(text)) {
+        const tokens = stripWrappers(tokenize(simple.text));
+        if (tokens.length === 0)
+            continue;
+        if (tokens[0] === 'cd' && tokens[1] !== undefined && !/[$`*?]/.test(tokens[1])) {
+            if (simple.sep === '&&')
+                dir = path.posix.normalize(path.posix.join(dir, tokens[1]));
+            continue;
+        }
+        const call = detectCall(tokens, dir);
+        if (call && follow(repoPath, call, tokens, frame, maxDepth, out))
+            continue;
+        const stripped = stripRunners(tokens);
+        const [tool, ...argv] = stripped;
+        out.push({ tool: tool === undefined ? null : path.posix.basename(tool), argv, file: frame.file, chain: frame.chain, depth: frame.chain.length });
+    }
+}
+/** Replace a call by what it runs. False when the caller should read the command another way (runner prefix removed). */
+function follow(repoPath, call, tokens, frame, maxDepth, out) {
+    const kind = entryPointKind(call.kind);
+    const plain = () => {
+        if (call.fallback && frame.chain.length < maxDepth)
+            return false;
+        const readable = kind?.fileFor === undefined ? undefined : kind.fileFor(repoPath, call.dir) !== undefined;
+        out.push({
+            tool: call.runner,
+            argv: tokens.slice(1),
+            file: frame.file,
+            chain: frame.chain,
+            depth: frame.chain.length,
+            ...(readable === undefined ? {} : { readable }),
+        });
+        return true;
+    };
+    if (!kind || frame.chain.length >= maxDepth)
+        return plain();
+    let followed = false;
+    for (const name of call.names) {
+        const variants = call.prePost ? [`pre${name}`, name, `post${name}`] : [name];
+        for (const variant of variants) {
+            const found = kind.lookup(repoPath, call.dir, variant);
+            const key = found ? `${found.file}:${variant}` : '';
+            if (!found || frame.seen.has(key))
+                continue;
+            followed = true;
+            const next = {
+                dir: path.posix.dirname(found.file),
+                file: found.file,
+                chain: [...frame.chain, key],
+                seen: new Set([...frame.seen, key]),
+            };
+            for (const body of found.bodies)
+                expandText(repoPath, body, next, maxDepth, out);
+        }
+    }
+    return followed || plain();
+}
+/** The commands a text runs, calls to scripts and make targets replaced by what they run (up to `maxDepth` bodies deep, default 3). */
+export function expandCommand(repoPath, text, from, opts = {}) {
+    const out = [];
+    expandText(repoPath, text, { dir: from.dir, file: from.file, chain: [], seen: new Set() }, opts.maxDepth ?? 3, out);
+    return out;
+}
+/** Every CI command whose expansion reaches one of `tools`. */
+export function ciInvokes(repoPath, tools, opts = {}) {
+    const hits = [];
+    for (const command of ciCommands(repoPath, opts.warnings)) {
+        const resolved = expandCommand(repoPath, command.command, { dir: command.dir, file: command.file }, opts);
+        const match = resolved.find((r) => r.tool !== null && tools.includes(r.tool));
+        if (match)
+            hits.push({ file: command.file, job: command.job, chain: match.chain });
+    }
+    return hits;
+}

package/dist/scripts/triggers.js

@@ -0,0 +1,151 @@
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+const isObj = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const list = (value) => (typeof value === 'string' ? [value] : Array.isArray(value) ? value.filter((v) => typeof v === 'string') : []);
+const defaultCache = new Map();
+/** The target of `origin/HEAD` with `origin/` removed (when present), plus `main` and `master`. */
+function defaultBranchNames(repoPath) {
+    const key = path.resolve(repoPath);
+    const cached = defaultCache.get(key);
+    if (cached)
+        return cached;
+    const result = spawnSync('git', ['-C', key, 'symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], { encoding: 'utf8' });
+    const head = result.error || result.status !== 0 ? '' : result.stdout.trim().replace(/^origin\//, '');
+    const names = [...new Set([...(head === '' ? [] : [head]), 'main', 'master'])];
+    defaultCache.set(key, names);
+    return names;
+}
+export function resetDefaultBranchCache() {
+    defaultCache.clear();
+}
+const yes = (why) => ({ qualifies: true, why });
+const no = (why) => ({ qualifies: false, why });
+function github(doc, defaults) {
+    const on = doc.on ?? doc.true;
+    const events = new Map();
+    if (typeof on === 'string')
+        events.set(on, null);
+    else if (Array.isArray(on))
+        for (const e of list(on))
+            events.set(e, null);
+    else if (isObj(on))
+        for (const [event, value] of Object.entries(on))
+            events.set(event, value);
+    for (const event of ['pull_request', 'pull_request_target'])
+        if (events.has(event))
+            return yes(event);
+    if (events.has('push')) {
+        const push = events.get('push');
+        return pushFilter(isObj(push) ? push : {}, defaults);
+    }
+    return no(events.size === 0 ? 'no triggers' : `only ${[...events.keys()].join(', ')}`);
+}
+function pushFilter(push, defaults) {
+    if (push['branches-ignore'] !== undefined)
+        return yes('push, branches-ignore');
+    if (push.branches !== undefined) {
+        const branches = list(push.branches);
+        return branches.length === 0 || branches.some((b) => !defaults.includes(b)) ? yes('push to non-default branches') : no('push limited to the default branch');
+    }
+    if (push.tags !== undefined || push['tags-ignore'] !== undefined)
+        return no('push of tags only');
+    return yes('push, no filter');
+}
+function limitedToDefault(expression, defaults) {
+    if (/merge_request_event|CI_MERGE_REQUEST/.test(expression))
+        return false;
+    const names = defaults.map((d) => d.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+    return new RegExp(`^\\s*\\$CI_(?:COMMIT_BRANCH|COMMIT_REF_NAME)\\s*==\\s*(["']?)(?:\\$CI_DEFAULT_BRANCH|${names})\\1\\s*$`).test(expression);
+}
+function gitlab(doc, jobName, defaults) {
+    const job = doc[jobName];
+    if (!isObj(job))
+        return yes('not a job table');
+    if (Array.isArray(job.rules)) {
+        for (const rule of job.rules) {
+            if (!isObj(rule))
+                continue;
+            if (typeof rule.if === 'string') {
+                if (rule.when === 'never')
+                    continue;
+                if (!limitedToDefault(rule.if, defaults))
+                    return yes('rule not limited to the default branch');
+            }
+            else if (rule.when !== 'never')
+                return yes('rule without a condition');
+        }
+        return no('rules limited to the default branch');
+    }
+    const only = job.only;
+    if (only !== undefined) {
+        const refs = isObj(only) ? list(only.refs) : list(only);
+        if (refs.some((r) => r === 'merge_requests' || r === 'branches'))
+            return yes('only merge_requests or branches');
+        return refs.length === 0 || refs.some((r) => !defaults.includes(r)) ? yes('only other refs') : no('only the default branch');
+    }
+    return yes('no rules or only: every branch push');
+}
+function circleci(doc, jobName, defaults) {
+    if (!isObj(doc.workflows))
+        return yes('no workflows key');
+    for (const [name, workflow] of Object.entries(doc.workflows)) {
+        if (!isObj(workflow))
+            continue;
+        const triggers = Array.isArray(workflow.triggers) ? workflow.triggers : [];
+        if (triggers.some((t) => isObj(t) && t.schedule !== undefined))
+            continue;
+        for (const entry of Array.isArray(workflow.jobs) ? workflow.jobs : []) {
+            const [key, value] = typeof entry === 'string' ? [entry, null] : isObj(entry) ? (Object.entries(entry)[0] ?? ['', null]) : ['', null];
+            const alias = isObj(value) && typeof value.name === 'string' ? value.name : key;
+            if (key !== jobName && alias !== jobName)
+                continue;
+            const only = isObj(value) && isObj(value.filters) && isObj(value.filters.branches) ? list(value.filters.branches.only) : [];
+            if (only.length === 0 || only.some((b) => !defaults.includes(b)))
+                return yes(`workflow ${name}`);
+        }
+    }
+    return no('in no qualifying workflow');
+}
+function bitbucket(section, doc, defaults) {
+    if (section === 'default' || section === 'pull-requests')
+        return yes(section);
+    if (section === 'branches') {
+        const pipelines = isObj(doc.pipelines) ? doc.pipelines : {};
+        const keys = isObj(pipelines.branches) ? Object.keys(pipelines.branches) : [];
+        return keys.length === 0 || keys.some((k) => !defaults.includes(k)) ? yes('branches other than the default') : no('branches limited to the default branch');
+    }
+    return no(`${section} pipelines`);
+}
+function azure(doc, defaults) {
+    const pr = doc.pr;
+    if (pr !== undefined && pr !== 'none' && pr !== null)
+        return yes('pr trigger');
+    const trigger = doc.trigger;
+    if (trigger === undefined)
+        return yes('no trigger: CI on all branches');
+    if (trigger === 'none')
+        return no('trigger: none');
+    const include = isObj(trigger) ? (isObj(trigger.branches) ? list(trigger.branches.include) : list(trigger.include)) : list(trigger);
+    return include.length === 0 || include.some((b) => !defaults.includes(b)) ? yes('trigger on other branches') : no('trigger limited to the default branch');
+}
+/**
+ * Whether a CI job runs on pull requests, merge requests or non-default pushes. A job is excluded only when it is positively
+ * identified as not triggered that way; a filter that cannot be read statically qualifies.
+ */
+export function triggersFor(format, doc, jobName, repoPath) {
+    if (!isObj(doc))
+        return yes('unreadable');
+    const defaults = defaultBranchNames(repoPath);
+    switch (format) {
+        case 'github':
+            return github(doc, defaults);
+        case 'gitlab':
+            return gitlab(doc, jobName, [...defaults, '$CI_DEFAULT_BRANCH']);
+        case 'circleci':
+            return circleci(doc, jobName, defaults);
+        case 'bitbucket':
+            return bitbucket(jobName, doc, defaults);
+        case 'azure':
+            return azure(doc, defaults);
+    }
+}

package/dist/scripts/types.js

@@ -0,0 +1 @@
+export {};

package/dist/submit/constants.js

@@ -0,0 +1,10 @@
+export const SUBMIT_URL = 'https://app.vibecodedshit.com/api/submissions';
+export const PRIVACY_URL = 'https://app.vibecodedshit.com/privacy';
+export const QUOTE_URL = 'https://app.vibecodedshit.com/api/quote-requests';
+/** The server rejects larger bodies. */
+export const MAX_PAYLOAD_BYTES = 65536;
+/** The server rejects longer summaries. */
+export const MAX_SUMMARY_CHARS = 4000;
+export const SEND_TIMEOUT_MS = 15000;
+export const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+export const MAX_EMAIL_CHARS = 254;

package/dist/submit/payload.js

@@ -0,0 +1,42 @@
+export class PayloadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PayloadError';
+    }
+}
+/**
+ * Build the payload from an allowlist of run.json fields, never by spreading the run.
+ * `units`, `breakdown`, `repo`, `warnings`, reasons, `scope` and `ignoreSet` hold paths or local information and are left out.
+ * Values are copied unchanged; nothing is computed or rounded.
+ */
+export function buildPayload({ run, repoHash, repoName, summary, email, newsletter }) {
+    const digest = run.tools.image?.digest;
+    if (!run.health)
+        throw new PayloadError('run.json has no health score.');
+    if (!digest)
+        throw new PayloadError('run.json has no execution image digest (tools.image.digest).');
+    const dimensions = run.dimensions.map((d) => {
+        if (d.score === null)
+            throw new PayloadError(`dimension ${d.id} has no score.`);
+        return { id: d.id, score: d.score };
+    });
+    return {
+        repoHash,
+        ...(repoName === undefined ? {} : { repoName }),
+        methodologyVersion: run.methodology.version,
+        imageDigest: digest,
+        asOf: run.asOf,
+        health: run.health.displayed,
+        band: run.health.band,
+        dimensions,
+        parameters: run.parameters.map((p) => ({
+            id: p.id,
+            status: p.status,
+            ...(p.raw === undefined || p.raw === null ? {} : { raw: p.raw }),
+            ...(p.score === undefined ? {} : { score: p.score }),
+        })),
+        ...(summary === undefined ? {} : { summary }),
+        email,
+        ...(newsletter ? { newsletter: true } : {}),
+    };
+}

package/dist/submit/repo-identity.js

@@ -0,0 +1,46 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+export class RepoIdentityError extends Error {
+    constructor() {
+        super('cannot determine the repository identity (run.json repo.path is missing or not a git repository)');
+        this.name = 'RepoIdentityError';
+    }
+}
+/**
+ * Reduce a remote URL to `host/owner/repo`: no scheme, credentials, port, `.git` suffix or trailing slash, lowercase.
+ * The SSH and HTTPS forms of one remote give the same string.
+ */
+export function normalizeRemote(url) {
+    const trimmed = url.trim();
+    const schemed = /^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]*@)?([^/:]+)(?::\d+)?\/(.+)$/i.exec(trimmed);
+    const scp = /^(?:[^@/:]+@)?([^:/]+):(.+)$/.exec(trimmed);
+    const match = schemed ?? scp;
+    const joined = match ? `${match[1]}/${match[2]}` : trimmed;
+    return joined.replace(/\/+$/, '').replace(/\.git$/i, '').replace(/\/+$/, '').toLowerCase();
+}
+const sha256 = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+export async function repoIdentity(repoPath, git) {
+    if (!repoPath)
+        throw new RepoIdentityError();
+    const remotes = await git(repoPath, ['remote']);
+    if (remotes === null)
+        throw new RepoIdentityError();
+    const names = remotes.split('\n').map((n) => n.trim()).filter(Boolean);
+    const remote = names.includes('origin') ? 'origin' : names[0];
+    if (remote !== undefined) {
+        const url = (await git(repoPath, ['remote', 'get-url', remote]))?.trim();
+        if (url) {
+            const normalised = normalizeRemote(url);
+            return { hash: sha256(normalised), name: normalised.split('/').slice(1).join('/') || normalised };
+        }
+    }
+    const roots = await git(repoPath, ['rev-list', '--max-parents=0', 'HEAD']);
+    const root = roots
+        ?.split('\n')
+        .map((l) => l.trim().toLowerCase())
+        .filter(Boolean)
+        .sort()[0];
+    if (!root)
+        throw new RepoIdentityError();
+    return { hash: sha256(root), name: path.basename(repoPath) };
+}

package/dist/submit/send.js

@@ -0,0 +1,29 @@
+import { SEND_TIMEOUT_MS, SUBMIT_URL } from './constants.js';
+function readRank(body) {
+    try {
+        const data = JSON.parse(body);
+        if (typeof data.rank !== 'number' || typeof data.total !== 'number')
+            return undefined;
+        return { rank: data.rank, total: data.total, top10Threshold: typeof data.top10Threshold === 'number' ? data.top10Threshold : null };
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function sendPayload(payload, fetchImpl) {
+    try {
+        const response = await fetchImpl(SUBMIT_URL, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+        });
+        const body = await response.text();
+        if (response.ok)
+            return { ok: true, rank: readRank(body) };
+        return { ok: false, message: `Server answered ${response.status}: ${body.slice(0, 300)}` };
+    }
+    catch (err) {
+        return { ok: false, message: `Could not send: ${err instanceof Error ? err.message : String(err)}` };
+    }
+}

package/dist/tools/catalog.js

@@ -0,0 +1,46 @@
+export const catalog = {
+    jscpd: { kind: 'npm', pkg: 'jscpd', install: 'npm install (jscpd is a dependency of health)' },
+    knip: { kind: 'npm', pkg: 'knip', install: 'npm install (knip is a dependency of health)' },
+    complexipy: {
+        kind: 'path',
+        bin: 'complexipy',
+        versionArgs: ['--version'],
+        versionPattern: /(\d+\.\d+\.\d+\S*)/,
+        install: 'pipx install complexipy (or uv tool install complexipy)',
+    },
+    vulture: {
+        kind: 'path',
+        bin: 'vulture',
+        versionArgs: ['--version'],
+        versionPattern: /(\d+\.\d+\S*)/,
+        install: 'pipx install vulture (or uv tool install vulture)',
+    },
+    deptry: {
+        kind: 'path',
+        bin: 'deptry',
+        versionArgs: ['--version'],
+        versionPattern: /(\d+\.\d+\.\d+\S*)/,
+        install: 'pipx install deptry (or uv tool install deptry)',
+    },
+    'osv-scanner': {
+        kind: 'path',
+        bin: 'osv-scanner',
+        versionArgs: ['--version'],
+        versionPattern: /(\d+\.\d+\.\d+\S*)/,
+        install: 'brew install osv-scanner, or https://github.com/google/osv-scanner/releases',
+    },
+    gitleaks: {
+        kind: 'path',
+        bin: 'gitleaks',
+        versionArgs: ['version'],
+        versionPattern: /(\d+\.\d+\.\d+\S*)/,
+        install: 'brew install gitleaks, or https://github.com/gitleaks/gitleaks/releases',
+    },
+    'import-linter': {
+        kind: 'path',
+        bin: 'lint-imports',
+        versionArgs: ['--version'],
+        versionPattern: /import-linter (\d+(?:\.\d+)+)/,
+        install: 'pipx install import-linter (or uv tool install import-linter)',
+    },
+};