@attalabs/vinaya 0.1.0

package/dist/index.js

@@ -0,0 +1,3253 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+import { dirname as dirname7, join as join12 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+
+// src/commands/check.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+
+// src/checks/contract.ts
+var CHECK_SCHEMA_VERSION = 1;
+function emitCheckError(error) {
+  process.stderr.write(`${JSON.stringify(error)}
+`);
+}
+
+// src/checks/registry.ts
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+var CLI_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+var BIN_DIR = join(CLI_ROOT, "src", "checks", "bin");
+function coreCheckRegistry() {
+  return [
+    {
+      name: "brief-shape",
+      run: join(BIN_DIR, "check-brief-shape.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "doc-coverage",
+      run: join(BIN_DIR, "check-doc-coverage.ts"),
+      scope: "diff",
+      timeoutMs: 15000
+    },
+    {
+      name: "coherence",
+      run: join(BIN_DIR, "check-coherence.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "dispatch-readiness",
+      run: join(BIN_DIR, "check-dispatch-readiness.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    },
+    {
+      name: "reader-resolvable-prose",
+      run: join(BIN_DIR, "check-reader-resolvable-prose.ts"),
+      scope: "full",
+      timeoutMs: 30000
+    }
+  ];
+}
+
+// src/checks/runner.ts
+import { spawn } from "node:child_process";
+import { cpus } from "node:os";
+// ../../../packages/aeg-core/src/anchored-region.ts
+function maskCode(body) {
+  const fill = (line) => " ".repeat(line.length);
+  return maskIndentedCode(maskFencedCode(body, fill), fill).replace(/(`+)[^\n]*?\1/g, (m) => " ".repeat(m.length));
+}
+function stripCode(body, options = {}) {
+  const normalised = body.replace(/\r\n?/g, `
+`);
+  const blank = () => "";
+  const blocksStripped = maskIndentedCode(maskFencedCode(normalised, blank), blank);
+  if (options.inlineSpans === "keep")
+    return blocksStripped;
+  return blocksStripped.replace(/(`+)[^\n]*?\1/g, "");
+}
+var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})([^\r\n]*)\r?$/;
+var FENCE_CLOSE = /^ {0,3}(`+|~+)[ \t]*\r?$/;
+function maskFencedCode(body, fill) {
+  let fenceChar = null;
+  let fenceLen = 0;
+  return body.split(`
+`).map((line) => {
+    if (fenceChar === null) {
+      const open = line.match(FENCE_OPEN);
+      if (!open)
+        return line;
+      const marker = open[1];
+      if (marker[0] === "`" && open[2].includes("`"))
+        return line;
+      fenceChar = marker[0];
+      fenceLen = marker.length;
+      return fill(line);
+    }
+    const close = line.match(FENCE_CLOSE);
+    if (close && close[1][0] === fenceChar && close[1].length >= fenceLen) {
+      fenceChar = null;
+      fenceLen = 0;
+    }
+    return fill(line);
+  }).join(`
+`);
+}
+var LIST_MARKER = /^ {0,3}(?:[-*+]|\d{1,9}[.)])(?:\s|$)/;
+function indentWidth(line) {
+  let width = 0;
+  for (const ch of line) {
+    if (ch === " ")
+      width += 1;
+    else if (ch === "\t")
+      width += 4;
+    else
+      break;
+  }
+  return width;
+}
+function maskIndentedCode(body, fill) {
+  const lines = body.split(`
+`);
+  let inList = false;
+  let inCode = false;
+  let prevBlank = true;
+  const out = lines.map((line) => {
+    if (line.trim() === "") {
+      prevBlank = true;
+      return line;
+    }
+    const indent = indentWidth(line);
+    if (indent >= 4 && (inCode || prevBlank && !inList)) {
+      inCode = true;
+      prevBlank = false;
+      return fill(line);
+    }
+    inCode = false;
+    if (indent < 4 && LIST_MARKER.test(line))
+      inList = true;
+    else if (indent === 0)
+      inList = false;
+    prevBlank = false;
+    return line;
+  });
+  return out.join(`
+`);
+}
+function anchoredRegion(body, field) {
+  const masked = maskCode(body);
+  const start = new RegExp(`<!--\\s*AEG:${field}:START\\s*-->`).exec(masked);
+  if (!start)
+    return null;
+  const afterStart = start.index + start[0].length;
+  const end = new RegExp(`<!--\\s*AEG:${field}:END\\s*-->`).exec(masked.slice(afterStart));
+  if (!end)
+    return null;
+  return body.slice(afterStart, afterStart + end.index);
+}
+// ../../../packages/aeg-forge-state/src/gh.ts
+import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var systemEnv = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+
+// ../../../packages/aeg-forge-state/src/labels.ts
+var LABELS = [
+  {
+    key: "blocked",
+    id: "vinaya/blocked",
+    category: "state",
+    form: "literal",
+    carries: "Execution is halted pending an external unblock; wins over every other derived status."
+  },
+  {
+    key: "tier-0",
+    id: "vinaya/tier:0",
+    category: "tier",
+    form: "literal",
+    carries: "Lowest governance weight — typecheck, lint, tests, and a conforming PR body."
+  },
+  {
+    key: "tier-1",
+    id: "vinaya/tier:1",
+    category: "tier",
+    form: "literal",
+    carries: "Tier 0 plus spec/skill coverage and a passing verify-docs run."
+  },
+  {
+    key: "tier-3",
+    id: "vinaya/tier:3",
+    category: "tier",
+    form: "literal",
+    carries: "Tier 1 plus the reasoning for the change, stated in the pull request that makes it."
+  },
+  {
+    key: "tranche",
+    id: "vinaya/tranche:",
+    category: "tranche",
+    form: "prefix",
+    carries: "The tranche slug this task Issue belongs to — the forge's grouping key, matched by prefix."
+  },
+  {
+    key: "needs-execution-input",
+    id: "vinaya/needs:execution-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on a missing execution detail — a flag, a dependency, a value the brief did not carry."
+  },
+  {
+    key: "needs-strategy-input",
+    id: "vinaya/needs:strategy-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on a strategy call — the brief assumes an approach the codebase has moved away from."
+  },
+  {
+    key: "needs-principal-input",
+    id: "vinaya/needs:principal-input",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on the Principal — a product-level call no agent may make."
+  },
+  {
+    key: "needs-brief-correction",
+    id: "vinaya/needs:brief-correction",
+    category: "needs",
+    form: "literal",
+    carries: "Waiting on the Brief Author — the brief contradicts the surface it describes."
+  },
+  {
+    key: "waiver-docs",
+    id: "vinaya/waiver:docs",
+    category: "waiver",
+    form: "literal",
+    carries: "Doc-coverage gate excused for this PR — honored only when a principal applied it."
+  },
+  {
+    key: "waiver-review",
+    id: "vinaya/waiver:review",
+    category: "waiver",
+    form: "literal",
+    carries: "Review gate excused for this PR — honored only when a principal applied it."
+  },
+  {
+    key: "override-docs",
+    id: "vinaya/override:docs",
+    category: "waiver",
+    form: "literal",
+    carries: "The whole verify-docs gate suppressed for this PR — a Principal-only blunt override, wider than a waiver."
+  },
+  {
+    key: "incoherent",
+    id: "vinaya/incoherent",
+    category: "flag",
+    form: "literal",
+    carries: "Closed COMPLETED with no merged-PR link — done-but-unprovable, surfaced for a human."
+  },
+  {
+    key: "direct-main-push",
+    id: "vinaya/direct-main-push",
+    category: "flag",
+    form: "literal",
+    carries: "A commit reached main with no associated merged PR — ring-2 detection, never a mutation."
+  },
+  {
+    key: "dead-branch-push",
+    id: "vinaya/dead-branch-push",
+    category: "flag",
+    form: "literal",
+    carries: "Commits landed on a branch after its PR had already resolved — daily-drift detection."
+  },
+  {
+    key: "state-object",
+    id: "vinaya/state-object",
+    category: "kind",
+    form: "literal",
+    carries: "A permanent forge-native storage object, never actionable work — excluded from every backlog."
+  }
+];
+var BY_KEY = new Map(LABELS.map((l) => [l.key, l]));
+function entry(key) {
+  const found = BY_KEY.get(key);
+  if (!found)
+    throw new Error(`labels.ts: no LABELS entry for key '${key}'`);
+  return found;
+}
+function label(key) {
+  return entry(key).id;
+}
+function matchesLabel(key, name) {
+  const l = entry(key);
+  if (l.form === "prefix")
+    return name.startsWith(l.id);
+  return name === l.id;
+}
+function hasLabel(key, names) {
+  return names.some((n) => matchesLabel(key, n));
+}
+// ../../../packages/aeg-forge-state/src/github-token.ts
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync2 = promisify2(execFile2);
+var systemEnv2 = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+// ../../../packages/aeg-forge-state/src/resolve-repo.ts
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+var execFileAsync3 = promisify3(execFile3);
+var systemEnv3 = {
+  ...process.env,
+  PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
+};
+// ../../../packages/aeg-core/src/state-machine-model.ts
+var FORGE_FACT_INPUTS = [
+  {
+    fact: "issueState",
+    readsFrom: "Issue.state (OPEN | CLOSED)",
+    meaning: "Whether the task Issue is still open — the anchor for the honest terminal statuses."
+  },
+  {
+    fact: "assigned",
+    readsFrom: "Issue.assignees (count > 0)",
+    meaning: "An assignee exists. No longer affects derivation: assigned and unassigned are both todo."
+  },
+  {
+    fact: "branchExists",
+    readsFrom: "Ref refs/heads/task/<tranche>/<id>",
+    meaning: "A task branch has been published — the todo → in-flight transition, written by git push, not by hand."
+  },
+  {
+    fact: "prState",
+    readsFrom: "PullRequest.state (OPEN | CLOSED | MERGED)",
+    meaning: "Whether work is proposed or landed. CLOSED-without-merge collapses to none — AEG models open/merged/none."
+  },
+  {
+    fact: "reviewDecision",
+    readsFrom: "PullRequest.reviewDecision",
+    meaning: "Only 'changes_requested' flips status; approved-but-unmerged stays in-review."
+  },
+  {
+    fact: "blockedLabel",
+    readsFrom: `Issue.labels contains '${label("blocked")}'`,
+    meaning: "Execution halted pending an external unblock. Wins over every other rule."
+  },
+  {
+    fact: "stateReason",
+    readsFrom: "Issue.stateReason (COMPLETED | NOT_PLANNED | REOPENED | null)",
+    meaning: "Separates a legitimate drop from an incoherent close on a closed, never-merged Issue."
+  },
+  {
+    fact: "closedAt",
+    readsFrom: "Issue.closedAt",
+    meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  },
+  {
+    fact: "mergedAt",
+    readsFrom: "PullRequest.mergedAt",
+    meaning: "Timestamp for the coherence oracle grandfather cutoff. No derivation rule reads it."
+  }
+];
+var DERIVED_STATUSES = [
+  "backlog",
+  "todo",
+  "in-flight",
+  "in-review",
+  "changes-requested",
+  "merged",
+  "blocked",
+  "dropped",
+  "incoherent"
+];
+var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../../packages/aeg-core/src/file-classify.ts
+var FROZEN_ARCHIVES = new Set([
+  "docs/decisions-legacy.md",
+  "apps/herald-ai/docs/herald-decisions-legacy.md",
+  "apps/vada-ai/docs/vada-decisions-legacy.md"
+]);
+// ../../../packages/aeg-core/src/waiver-label.ts
+var WAIVER_LABEL = label("waiver-docs");
+var WAIVER_LABEL_REVIEW = label("waiver-review");
+
+// ../../../packages/aeg-core/src/doc-owners.ts
+function globToRegex(pat) {
+  let re = "^";
+  let i = 0;
+  while (i < pat.length) {
+    const c = pat[i];
+    if (c === "*") {
+      if (pat[i + 1] === "*") {
+        re += ".*";
+        i += 2;
+      } else {
+        re += "[^/]*";
+        i += 1;
+      }
+    } else if (/[.+^$|(){}[\]\\?]/.test(c)) {
+      re += `\\${c}`;
+      i += 1;
+    } else {
+      re += c;
+      i += 1;
+    }
+  }
+  re += "$";
+  return new RegExp(re);
+}
+var SEPARATOR = /(?:[ \t]*[—–][ \t]*|[ \t]+-[ \t]+)/.source;
+// ../../../packages/aeg-core/src/pr-tier.ts
+function readTierFromPrBody(prBody) {
+  const searchIn = anchoredRegion(prBody, "TIER") ?? prBody;
+  const m = searchIn.match(/(\*\*)?\s*Tier\s*(\*\*)?\s*:\s*(\*\*)?\s*([013])\b/i);
+  if (!m)
+    return null;
+  const t = Number(m[4]);
+  return t === 0 || t === 1 || t === 3 ? t : null;
+}
+var OVERRIDE_BODY_TOKEN = `[${label("override-docs")}]`;
+// ../../../packages/aeg-core/src/premise-check.ts
+var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
+function isPremiseHeader(line) {
+  const stripped = line.replace(/[*#]/g, "").trim();
+  return /^premise\s*:?$/i.test(stripped);
+}
+var PREMISE_LINE = /^[-*]\s*(\S+)\s+(contains|absent|sha256)\s*:\s*(.+)$/i;
+function parsePremiseBlock(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  const assertions = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!inBlock) {
+      if (isPremiseHeader(line))
+        inBlock = true;
+      continue;
+    }
+    if (line === "")
+      break;
+    const m = line.match(PREMISE_LINE);
+    if (!m)
+      break;
+    const [, path, kindRaw, value] = m;
+    const kind = kindRaw.toLowerCase();
+    if (!ASSERTION_KINDS.has(kind))
+      continue;
+    assertions.push({ kind, path, value: value.trim() });
+  }
+  return assertions;
+}
+
+// ../../../packages/aeg-core/src/brief-validation.ts
+function headerRegion(prBody) {
+  const m = prBody.match(/^##\s/m);
+  return m?.index !== undefined ? prBody.slice(0, m.index) : prBody;
+}
+function headerField(prBody, labelPattern, anchor) {
+  const anchored = anchor !== undefined ? anchoredRegion(prBody, anchor) : null;
+  const region = anchored ?? headerRegion(prBody);
+  const re = new RegExp(`^(?:\\*\\*)?\\s*${labelPattern}\\s*(?:\\*\\*)?\\s*:\\s*(?:\\*\\*)?\\s*([^\\n·]+)`, "im");
+  const m = region.match(re);
+  if (!m)
+    return null;
+  const value = m[1].trim();
+  return value.length > 0 ? value : null;
+}
+function normalize(text) {
+  return text.replace(/[*_]/g, "").replace(/\s+/g, " ");
+}
+function headingCheck(prBody, keywordPattern, sectionName) {
+  const re = new RegExp(`^#{1,4}\\s*(?:\\*\\*)?(?:\\d+[a-z]?\\.\\s*)?[^\\n]*${keywordPattern}`, "im");
+  if (re.test(prBody))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [`brief-validation ${sectionName}: no "${sectionName}" section found in the PR body.`]
+  };
+}
+function checkTierField(prBody, readTier) {
+  if (readTier(prBody) !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation tier: no `Tier:` field found in the PR body (expected `Tier: 0|1|3` or `**Tier:** 0|1|3`)."
+    ]
+  };
+}
+var TEST_PLAN_UNIT_TESTS_ONLY_RE = /(?:\*\*)?Test Plan(?:\*\*)?\s*:\s*(?:\*\*)?\s*unit-tests-only/i;
+function checkTestPlan(prBody) {
+  if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+    return { status: "pass", errors: [] };
+  if (/\*\*\[(?:agent|principal)\]\*\*/.test(prBody))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation Test Plan: no Test Plan section found — expected `Test Plan: unit-tests-only`, or at least one `**[agent]**`/`**[principal]**`-tagged checklist item."
+    ]
+  };
+}
+function checkTestPlanExclusivity(prBody) {
+  if (!TEST_PLAN_UNIT_TESTS_ONLY_RE.test(prBody))
+    return { status: "pass", errors: [] };
+  if (/^-\s*\[[ xX]\]\s*\*{2}\[(?:agent|principal)\]\*{2}/im.test(prBody)) {
+    return {
+      status: "fail",
+      errors: [
+        "brief-validation Test Plan shape: `Test Plan: unit-tests-only` and a `- [ ]`/`- [x]` tagged checkbox item are mutually exclusive (brief-authoring §9) — declare one form, not both."
+      ]
+    };
+  }
+  return { status: "pass", errors: [] };
+}
+function checkPrincipalPlaceholder(prBody) {
+  const lineRe = /^-\s*\[[ xX]\]\s*\*{2}\[principal\]\*{2}(.*)$/gim;
+  for (const m of prBody.matchAll(lineRe)) {
+    const content = m[1] ?? "";
+    if (/^\s*None\b/i.test(content)) {
+      return {
+        status: "fail",
+        errors: [
+          'brief-validation Test Plan shape: a `**[principal]**` checkbox item is a "None" placeholder — if there is no principal-runnable surface, omit the item entirely; an untickable placeholder box blocks the merge gate forever.'
+        ]
+      };
+    }
+  }
+  return { status: "pass", errors: [] };
+}
+function checkPremiseCoverage(prBody, surfaceFiles) {
+  if (surfaceFiles.length === 0)
+    return { status: "pass", errors: [] };
+  const assertions = parsePremiseBlock(prBody);
+  if (assertions.some((a) => surfaceFiles.includes(a.path)))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation Premise: no `Premise:` assertion found whose path matches a file in the surface map — a brief with a real code surface must pin at least one premise (aeg-governance-hardening task 11)."
+    ]
+  };
+}
+function checkSurfaceMap(prBody) {
+  return headingCheck(prBody, "(?:technical\\s+)?surface map", "Technical surface map");
+}
+function checkDocUpdateList(prBody) {
+  return headingCheck(prBody, "(?:documentation|doc)[- ]update(?:\\s+list)?", "Documentation-update list");
+}
+function checkWorktreeStep0(prBody) {
+  if (/git worktree add/.test(prBody))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: ["brief-validation worktree Step 0: no `git worktree add` command found in the PR body."]
+  };
+}
+function checkStopConditions(prBody) {
+  return headingCheck(prBody, "stop conditions", "Stop conditions");
+}
+function checkAutonomyClause(prBody) {
+  const normalized = normalize(prBody).toLowerCase();
+  if (/do not stop to ask clarifying questions/.test(normalized))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      'brief-validation autonomy clause: the standing autonomy clause ("Do not stop to ask clarifying questions...") was not found in the PR body.'
+    ]
+  };
+}
+function checkProjectField(prBody) {
+  if (headerField(prBody, "Project(?:\\(s\\))?", "PROJECT") !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation Project: no `Project:` field found in the PR body header block (before the first `##` heading). Required per the brief-developer contract — expected `Project: <name>[, <name>]` or `**Project:** …`."
+    ]
+  };
+}
+function checkForField(prBody) {
+  if (headerField(prBody, "For") !== null)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation For: no `For:` field found in the PR body header block (before the first `##` heading). Required per the brief-authoring skill — expected `For: <model + environment>` or `**For:** …`."
+    ]
+  };
+}
+function checkClosesN(prBody) {
+  const closesPattern = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s{0,8}:?\s{0,8}#\d+/i;
+  if (closesPattern.test(stripCode(prBody))) {
+    return { status: "pass", errors: [] };
+  }
+  if (closesPattern.test(prBody)) {
+    return {
+      status: "fail",
+      errors: [
+        "brief-validation Closes #N: `Closes #N` found only inside a code span — GitHub won't auto-close it. Put a bare `Closes #N` on its own line inside the `AEG:CLOSES` anchor."
+      ]
+    };
+  }
+  return {
+    status: "fail",
+    errors: ["brief-validation Closes #N: no `Closes #<N>` (or Fixes/Resolves) reference found in the PR body."]
+  };
+}
+function checkForgeTitle(title) {
+  const commitStyle = /^(Build|Chore|Docs|Feat|Fix|Perf|Plan|Refactor|Revert|Style|Test)(\([a-z0-9-]+\))?: \S/;
+  const taskStyle = /^\[[a-z0-9._-]+\] \S+ — \S/;
+  if (commitStyle.test(title) || taskStyle.test(title))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `brief-validation title: "${title}" matches neither title grammar — expected \`Type: description\` / \`Type(scope): description\` (commitlint types + Plan) or \`[tranche] id — description\` (task form).`
+    ]
+  };
+}
+// ../../../packages/aeg-core/src/issue-validation.ts
+function hasRationaleField(body, labelPattern) {
+  const re = new RegExp(`(?:\\*\\*|^#{1,4}\\s+)\\s*${labelPattern}`, "im");
+  return re.test(body);
+}
+var RATIONALE_FIELDS = [
+  { name: "Boundary", pattern: "Boundary" },
+  { name: "Sizing", pattern: "Sizing" },
+  { name: "Project(s) + blast radius", pattern: "Project\\(s\\)|Project(?:s)?\\s*\\+|blast radius" },
+  { name: "Dependency rationale", pattern: "Dependency rationale|Depends[- ]on" },
+  { name: "Traps to avoid", pattern: "Traps" },
+  { name: "Suggested agent-class", pattern: "(?:Suggested\\s+)?agent-class" },
+  { name: "Stop-and-escalate", pattern: "Stop-and-escalate" },
+  { name: "Docs to keep coherent", pattern: "Docs to keep coherent|§7" }
+];
+function checkIssueRationale(body) {
+  const errors = RATIONALE_FIELDS.filter((f) => !hasRationaleField(body, f.pattern)).map((f) => `issue-validation ${f.name}: rationale field not found in the Issue body — every task Issue carries the full Planner's rationale (aeg-root/contracts/planner-brief.md).`);
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
+function isTaskIssueLabelSet(labels) {
+  return hasLabel("tranche", labels);
+}
+
+// ../../../packages/aeg-core/src/coherence-checks.ts
+var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
+// ../../../packages/aeg-core/src/diagram-model.ts
+import matter from "gray-matter";
+// ../../../packages/aeg-core/src/reader-resolvable-prose.ts
+var SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
+// src/checks/runner.ts
+function defaultParallelism() {
+  return Math.max(1, cpus().length);
+}
+function isCheckError(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v = value;
+  return v.schema === CHECK_SCHEMA_VERSION && typeof v.check === "string" && (v.severity === "error" || v.severity === "warning") && typeof v.message === "string" && typeof v.agent_recovery_prompt === "string";
+}
+function shouldSkip(spec, opts) {
+  if (spec.scope !== "diff")
+    return false;
+  if (!opts.diffOnly)
+    return false;
+  if (opts.changedFiles === null)
+    return false;
+  if (!spec.include || spec.include.length === 0)
+    return false;
+  const regexes = spec.include.map(globToRegex);
+  return !opts.changedFiles.some((f) => regexes.some((re) => re.test(f)));
+}
+var KILL_GRACE_MS = 2000;
+async function runOne(spec, timeoutMs) {
+  const start = performance.now();
+  const proc = spawn(spec.run, spec.args ?? [], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let timedOut = false;
+  let killTimer;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    proc.kill("SIGTERM");
+    killTimer = setTimeout(() => proc.kill("SIGKILL"), KILL_GRACE_MS);
+  }, timeoutMs);
+  let stderrText = "";
+  proc.stderr.setEncoding("utf-8");
+  proc.stderr.on("data", (chunk) => {
+    stderrText += chunk;
+  });
+  proc.stdout.resume();
+  let spawnError;
+  const exitCode = await new Promise((resolve) => {
+    proc.on("close", (code) => resolve(code));
+    proc.on("error", (err) => {
+      spawnError = err;
+      resolve(null);
+    });
+  });
+  clearTimeout(timer);
+  clearTimeout(killTimer);
+  const durationMs = performance.now() - start;
+  if (timedOut) {
+    return { name: spec.name, status: "timeout", exitCode: null, errors: [], durationMs };
+  }
+  if (spawnError) {
+    const code = spawnError.code;
+    return {
+      name: spec.name,
+      status: "error",
+      exitCode: null,
+      errors: [
+        {
+          schema: 1,
+          check: spec.name,
+          severity: "error",
+          message: code === "ENOENT" ? `Could not run check "${spec.name}": executable \`${spec.run}\` was not found on PATH.` : `Could not run check "${spec.name}": ${spawnError.message}`,
+          agent_recovery_prompt: code === "ENOENT" ? `Install \`${spec.run}\` or correct the \`run\` field for check "${spec.name}" in vinaya.config.json, then re-run.` : `Inspect the \`run\` and \`args\` fields for check "${spec.name}" in vinaya.config.json, then re-run.`
+        }
+      ],
+      durationMs
+    };
+  }
+  const lines = stderrText.split(`
+`).map((l) => l.trim()).filter(Boolean);
+  const errors = [];
+  let malformed = false;
+  for (const line of lines) {
+    try {
+      const parsed = JSON.parse(line);
+      if (isCheckError(parsed)) {
+        errors.push(parsed);
+      } else {
+        malformed = true;
+      }
+    } catch {
+      malformed = true;
+    }
+  }
+  let status;
+  if (malformed) {
+    status = "error";
+  } else if (exitCode === 0) {
+    status = "pass";
+  } else if (exitCode === 1) {
+    status = "fail";
+  } else {
+    status = "error";
+  }
+  return { name: spec.name, status, exitCode, errors, durationMs };
+}
+async function runChecks(specs, opts) {
+  const results = new Array(specs.length);
+  const toRun = [];
+  for (let i = 0;i < specs.length; i++) {
+    const spec = specs[i];
+    if (shouldSkip(spec, opts)) {
+      results[i] = { name: spec.name, status: "skipped", exitCode: null, errors: [], durationMs: 0 };
+    } else {
+      toRun.push(i);
+    }
+  }
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < toRun.length) {
+      const idx = toRun[cursor];
+      cursor += 1;
+      const spec = specs[idx];
+      results[idx] = await runOne(spec, spec.timeoutMs ?? opts.defaultTimeoutMs);
+    }
+  };
+  const workerCount = Math.max(1, Math.min(opts.parallel, toRun.length));
+  await Promise.all(Array.from({ length: workerCount }, worker));
+  return results;
+}
+
+// src/lib/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname as dirname2, join as join2 } from "node:path";
+import { z } from "zod";
+var CheckEntrySchema = z.object({
+  run: z.string(),
+  scope: z.enum(["diff", "full"]),
+  include: z.array(z.string()).optional(),
+  args: z.array(z.string()).optional(),
+  timeoutMs: z.number().optional()
+});
+var BRIEF_BUILTINS = [
+  "tier",
+  "testPlan",
+  "testPlanExclusivity",
+  "principalPlaceholder",
+  "surfaceMap",
+  "docUpdateList",
+  "worktreeStep0",
+  "stopConditions",
+  "autonomyClause",
+  "project",
+  "for",
+  "closesN",
+  "premiseCoverage",
+  "issueRationale"
+];
+var BriefSectionSchema = z.union([
+  z.object({ builtin: z.enum(BRIEF_BUILTINS) }),
+  z.object({ heading: z.string().min(1), name: z.string().optional() }),
+  z.object({ field: z.string().min(1), name: z.string().optional() }),
+  z.object({ phrase: z.string().min(1), name: z.string().optional() })
+]);
+var BriefSchemaSchema = z.object({
+  pr: z.object({ sections: z.array(BriefSectionSchema) }).optional(),
+  issue: z.object({ sections: z.array(BriefSectionSchema) }).optional()
+});
+var MANAGED_MANIFEST_VERSION = 1;
+function isSafeRepoRelPath(p) {
+  if (p.length === 0)
+    return false;
+  if (p.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(p))
+    return false;
+  return p.split(/[\\/]/).every((seg) => seg !== ".." && seg !== "");
+}
+var SafeRepoRelPath = z.string().refine(isSafeRepoRelPath, {
+  message: "must be a repo-root-relative path with no `..` segment or absolute root"
+});
+var ManagedBlockRecordSchema = z.object({
+  path: SafeRepoRelPath,
+  marker: z.string(),
+  comment: z.enum(["hash", "html"])
+});
+var ManagedManifestSchema = z.object({
+  version: z.number().int().positive(),
+  files: z.array(SafeRepoRelPath),
+  blocks: z.array(ManagedBlockRecordSchema),
+  labels: z.array(z.string())
+});
+var VinayaConfigSchema = z.object({
+  rings: z.object({
+    ring1_forgeWriteInterception: z.boolean(),
+    ring2_asyncAudits: z.boolean()
+  }).optional(),
+  checks: z.record(z.string(), CheckEntrySchema).optional(),
+  briefSchema: BriefSchemaSchema.optional(),
+  managed: ManagedManifestSchema.optional()
+});
+var GLOBAL_VINAYA_HOME = join2(homedir(), ".vinaya");
+var GLOBAL_CONFIG_PATH = join2(GLOBAL_VINAYA_HOME, "config.json");
+var LOCAL_CONFIG_FILENAME = "vinaya.config.json";
+function findLocalConfig() {
+  let dir = process.cwd();
+  while (true) {
+    const candidate = join2(dir, LOCAL_CONFIG_FILENAME);
+    if (existsSync(candidate))
+      return candidate;
+    const parent = dirname2(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function configPath() {
+  const local = findLocalConfig();
+  if (local)
+    return local;
+  if (existsSync(GLOBAL_CONFIG_PATH))
+    return GLOBAL_CONFIG_PATH;
+  return null;
+}
+function loadConfigChecked() {
+  const path = configPath();
+  if (!path)
+    return { ok: true, config: null };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf-8"));
+  } catch (err) {
+    return { ok: false, path, error: `invalid JSON: ${err.message}` };
+  }
+  const parsed = VinayaConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+    return { ok: false, path, error: detail };
+  }
+  return { ok: true, config: parsed.data };
+}
+
+// src/lib/envelope.ts
+var ENVELOPE_SCHEMA_VERSION = 1;
+function toEnvelope(data) {
+  return { schema: ENVELOPE_SCHEMA_VERSION, data };
+}
+function printJson(data) {
+  process.stdout.write(`${JSON.stringify(toEnvelope(data), null, 2)}
+`);
+}
+
+// src/commands/check.ts
+function git(args) {
+  try {
+    return execFileSync2("git", args, { encoding: "utf8" }).trim();
+  } catch {
+    return "";
+  }
+}
+function changedFiles() {
+  const base = process.env.BASE_SHA || "origin/main";
+  let out = git(["diff", "--name-only", `${base}...HEAD`]);
+  if (!out)
+    out = git(["diff", "--name-only", "main...HEAD"]);
+  return out.split(`
+`).map((s) => s.trim()).filter(Boolean);
+}
+function parseParallel(args) {
+  for (const a of args) {
+    const m = a.match(/^--parallel(?:=(\d+))?$/);
+    if (m)
+      return m[1] ? Number(m[1]) : defaultParallelism();
+  }
+  return;
+}
+function configErrorOutcome(path, error) {
+  const finding = {
+    schema: 1,
+    check: "config",
+    severity: "error",
+    message: `${path}: invalid \`checks\` registration — ${error}`,
+    agent_recovery_prompt: `Fix the invalid key/value named above in ${path}, then re-run \`vinaya check\`.`
+  };
+  return { name: "config", status: "error", exitCode: null, errors: [finding], durationMs: 0 };
+}
+function customSpecsFromConfig() {
+  const result = loadConfigChecked();
+  if (!result.ok)
+    return { specs: [], errorOutcome: configErrorOutcome(result.path, result.error) };
+  const checks = result.config?.checks;
+  if (!checks)
+    return { specs: [], errorOutcome: null };
+  const specs = Object.entries(checks).map(([name, entry2]) => ({ name, ...entry2 }));
+  return { specs, errorOutcome: null };
+}
+async function checkCommand(args) {
+  const jsonOutput = args.includes("--json");
+  const diffOnly = args.includes("--diff-only");
+  const requestedParallel = parseParallel(args);
+  const allRequested = args.includes("--all");
+  const positional = args.filter((a) => !a.startsWith("--"));
+  const requestedName = positional[0];
+  if (!allRequested && !requestedName) {
+    console.error("Usage: vinaya check <name> | --all [--json] [--diff-only] [--parallel[=n]]");
+    process.exit(2);
+  }
+  const { specs: customSpecs, errorOutcome } = customSpecsFromConfig();
+  const allSpecs = [...coreCheckRegistry(), ...customSpecs];
+  const specsToRun = allRequested ? allSpecs : allSpecs.filter((s) => s.name === requestedName);
+  if (!allRequested && specsToRun.length === 0) {
+    console.error(`Unknown check: ${requestedName}`);
+    process.exit(2);
+  }
+  const changed = diffOnly ? changedFiles() : null;
+  const outcomes = specsToRun.length > 0 ? await runChecks(specsToRun, {
+    parallel: requestedParallel ?? defaultParallelism(),
+    diffOnly,
+    changedFiles: changed,
+    defaultTimeoutMs: 30000
+  }) : [];
+  const allOutcomes = errorOutcome ? [...outcomes, errorOutcome] : outcomes;
+  for (const o of allOutcomes) {
+    for (const e of o.errors)
+      emitCheckError(e);
+  }
+  if (jsonOutput) {
+    printJson({ checks: allOutcomes });
+  } else {
+    for (const o of allOutcomes) {
+      const symbol = o.status === "pass" ? "✓" : o.status === "skipped" ? "·" : "✗";
+      process.stdout.write(`${symbol} ${o.name}: ${o.status} (${Math.round(o.durationMs)}ms)
+`);
+      for (const e of o.errors)
+        process.stdout.write(`    ${e.severity}: ${e.message}
+`);
+    }
+  }
+  const failed = allOutcomes.some((o) => o.status === "fail" || o.status === "error" || o.status === "timeout");
+  process.exit(failed ? 1 : 0);
+}
+
+// src/commands/doctor.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, statSync } from "node:fs";
+import { dirname as dirname4, join as join5 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/lib/artifacts.ts
+var CONFIG_PATH = "vinaya.config.json";
+var DOCTRINE_POINTER_PATH = "VINAYA.md";
+var CHECKS_WORKFLOW_PATH = ".github/workflows/vinaya-checks.yml";
+var REVIEW_WORKFLOW_PATH = ".github/workflows/vinaya-review.yml";
+var MANAGED_NOTE = "Managed by Vinaya — created by `vinaya init`. `vinaya upgrade` regenerates it; `vinaya eject` removes it.";
+function starterConfig() {
+  return {
+    rings: { ring1_forgeWriteInterception: false, ring2_asyncAudits: false },
+    checks: {},
+    briefSchema: {
+      pr: {
+        sections: [
+          { builtin: "tier" },
+          { builtin: "testPlan" },
+          { builtin: "testPlanExclusivity" },
+          { builtin: "closesN" },
+          { builtin: "project" }
+        ]
+      },
+      issue: {
+        sections: [{ builtin: "issueRationale" }, { builtin: "project" }]
+      }
+    }
+  };
+}
+function checksWorkflow() {
+  return `# ${MANAGED_NOTE}
+#
+# The deterministic gate suite. Runs every registered vinaya check over the
+# pull request's diff. This is the guarantee: a PR cannot merge red.
+name: Vinaya Checks
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  vinaya-checks:
+    name: vinaya check --all --diff-only
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Run checks
+        run: npx --yes vinaya check --all --diff-only
+`;
+}
+function reviewWorkflow() {
+  return `# ${MANAGED_NOTE}
+#
+# The review gate — split from the checks suite so a verdict *comment*
+# re-triggers it. GitHub fires \`issue_comment\` for a new PR comment, a
+# different event from \`pull_request\`; the checks workflow (pull_request only)
+# structurally cannot receive it. A cheap \`contains(..., 'VERDICT')\` guard
+# runs before any checkout cost, so ordinary PR chat spends no billed minute.
+name: Vinaya Review Gate
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+  issue_comment:
+    types: [created]
+
+jobs:
+  vinaya-review:
+    name: vinaya review gate
+    if: >
+      github.event_name == 'pull_request' ||
+      (github.event.issue.pull_request != null && contains(github.event.comment.body, 'VERDICT'))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+    steps:
+      # issue_comment payloads carry no PR head SHA/branch — resolve them
+      # before checkout, and check out that exact commit (the event's default
+      # ref is the repo's default branch, not the PR head).
+      - name: Resolve PR head
+        id: pr
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ "\${{ github.event_name }}" = "pull_request" ]; then
+            NUMBER="\${{ github.event.pull_request.number }}"
+          else
+            NUMBER="\${{ github.event.issue.number }}"
+          fi
+          SHA=$(gh pr view "$NUMBER" --repo "\${{ github.repository }}" --json headRefOid -q .headRefOid)
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@v4
+        with:
+          ref: \${{ steps.pr.outputs.sha }}
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Review gate
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: npx --yes vinaya check --all
+`;
+}
+var HOOK_PREAMBLE = `#!/usr/bin/env sh
+`;
+function preCommitBody() {
+  return `# Vinaya commit-time gate. Runs the deterministic checks over your staged
+# diff before the commit lands.
+npx --no-install vinaya check --all --diff-only || exit 1`;
+}
+function prePushBody() {
+  return `# Vinaya pre-push gate. Runs branch/dispatch checks before the push leaves.
+npx --no-install vinaya check --all || exit 1`;
+}
+function doctrinePointer() {
+  return `<!-- ${MANAGED_NOTE} -->
+# Vinaya doctrine — read this first
+
+This repo is governed by Vinaya. The full, canonical doctrine (roles,
+contracts, the state machine, the ring gates) ships inside the installed
+\`vinaya\` npm package as versioned reference content and is updated cleanly by
+\`vinaya upgrade\` — there is no in-repo copy to drift.
+
+An agent working in this repo follows the governed flow by reading two things:
+
+1. **This pointer** — the tool-agnostic entry point at the conventional
+   reading-order path (repo root). It names where the doctrine lives.
+2. **\`${CONFIG_PATH}\`** — the ruleset the gates enforce: rings, custom checks,
+   and the brief schema a PR/Issue body must satisfy.
+
+Live task status is derived from the forge (Issues, labels, comments) via
+\`vinaya check\` — it is never written into a file here.
+
+To view the doctrine text: \`vinaya doctor\` reports what is installed; the
+package's own reference content is the source of truth.
+`;
+}
+function labelOps() {
+  const g = "Labels (create-if-absent; existing labels never modified)";
+  const mk = (name, color, description) => ({
+    kind: "create-label",
+    name,
+    color,
+    description,
+    group: g
+  });
+  return [
+    mk(label("tier-0"), "ededed", "Trivial / mechanical change"),
+    mk(label("tier-1"), "c5def5", "Standard task — code + tests + docs"),
+    mk(label("tier-3"), "d93f0b", "Records a decision; ratification-gated"),
+    mk(label("needs-execution-input"), "fbca04", "Blocked on a missing execution detail"),
+    mk(label("needs-strategy-input"), "fbca04", "Blocked on a strategy/approach decision"),
+    mk(label("needs-principal-input"), "b60205", "Blocked on a Principal decision")
+  ];
+}
+var BRANCH_PROTECTION_NOTE = `Recommended (run yourself — vinaya never applies branch protection):
+
+  gh api -X PUT repos/{owner}/{repo}/branches/main/protection \\
+    -F required_pull_request_reviews.required_approving_review_count=1 \\
+    -F required_status_checks.strict=true \\
+    -F 'required_status_checks.contexts[]=vinaya-checks' \\
+    -F enforce_admins=true -F restrictions=`;
+function buildInitOps(ctx) {
+  const ops = [];
+  const hookMode = 493;
+  ops.push({ kind: "create-file", path: CHECKS_WORKFLOW_PATH, content: checksWorkflow(), group: "CI workflows" });
+  ops.push({ kind: "create-file", path: REVIEW_WORKFLOW_PATH, content: reviewWorkflow(), group: "CI workflows" });
+  ops.push({
+    kind: "managed-block",
+    path: `${ctx.hookDir}/pre-commit`,
+    marker: "pre-commit",
+    body: preCommitBody(),
+    comment: "hash",
+    hostPreamble: HOOK_PREAMBLE,
+    mode: hookMode,
+    group: "Git hooks"
+  });
+  ops.push({
+    kind: "managed-block",
+    path: `${ctx.hookDir}/pre-push`,
+    marker: "pre-push",
+    body: prePushBody(),
+    comment: "hash",
+    hostPreamble: HOOK_PREAMBLE,
+    mode: hookMode,
+    group: "Git hooks"
+  });
+  ops.push({
+    kind: "create-file",
+    path: CONFIG_PATH,
+    content: `${JSON.stringify(starterConfig(), null, 2)}
+`,
+    group: "Config (starter ruleset)"
+  });
+  ops.push({
+    kind: "create-file",
+    path: DOCTRINE_POINTER_PATH,
+    content: doctrinePointer(),
+    group: "Doctrine pointer"
+  });
+  ops.push(...labelOps());
+  ops.push({ kind: "print", message: BRANCH_PROTECTION_NOTE, group: "Branch protection (printed, never applied)" });
+  return ops;
+}
+function buildInitProductOps(name) {
+  const safe = name.trim();
+  return [
+    {
+      kind: "create-label",
+      name: `project:${safe}`,
+      color: "0e8a16",
+      description: `Governed product area: ${safe}`,
+      group: `Governed product area: ${safe}`
+    }
+  ];
+}
+
+// src/lib/detect.ts
+import { execFile as execFile4 } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+import { promisify as promisify4 } from "node:util";
+var execFileAsync4 = promisify4(execFile4);
+async function detectGitRepo() {
+  try {
+    const { stdout: root } = await execFileAsync4("git", ["rev-parse", "--show-toplevel"]);
+    const repoRoot = root.trim();
+    let owner = "";
+    let repo = "";
+    try {
+      const { stdout: url } = await execFileAsync4("git", ["remote", "get-url", "origin"]);
+      const m = url.trim().match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
+      if (m) {
+        owner = m[1] ?? "";
+        repo = m[2] ?? "";
+      }
+    } catch {}
+    return { repoRoot, owner, repo };
+  } catch {
+    return null;
+  }
+}
+async function checkGhAuth() {
+  try {
+    await execFileAsync4("gh", ["auth", "status"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ghAuthStatus() {
+  try {
+    const { stderr, stdout } = await execFileAsync4("gh", ["auth", "status"]);
+    return { authenticated: true, detail: (stderr || stdout).trim() };
+  } catch (err) {
+    const stderr = err.stderr;
+    return { authenticated: false, detail: stderr?.trim() || "gh is not authenticated" };
+  }
+}
+async function branchProtectionConfigured(owner, repo) {
+  if (!owner || !repo)
+    return null;
+  try {
+    await execFileAsync4("gh", ["api", `repos/${owner}/${repo}/branches/main/protection`]);
+    return true;
+  } catch (err) {
+    const stderr = err.stderr ?? "";
+    if (/\b404\b/.test(stderr))
+      return false;
+    return null;
+  }
+}
+function resolveHookDir(repoRoot) {
+  return existsSync2(join3(repoRoot, ".husky")) ? ".husky" : ".git/hooks";
+}
+function hookDirFromManifest(manifest, fallback) {
+  const block = manifest.blocks.find((b) => b.path.startsWith(".husky/") || b.path.startsWith(".git/hooks/"));
+  if (block?.path.startsWith(".husky/"))
+    return ".husky";
+  if (block?.path.startsWith(".git/hooks/"))
+    return ".git/hooks";
+  return fallback;
+}
+async function customHooksPath(repoRoot) {
+  try {
+    const { stdout } = await execFileAsync4("git", ["-C", repoRoot, "config", "--get", "core.hooksPath"]);
+    const v = stdout.trim();
+    if (!v)
+      return null;
+    if (v === ".husky" || v === ".husky/_")
+      return null;
+    return v;
+  } catch {
+    return null;
+  }
+}
+function ghLabelGateway(repoRoot) {
+  return {
+    async exists(name) {
+      try {
+        const { stdout } = await execFileAsync4("gh", ["label", "list", "--json", "name"], { cwd: repoRoot });
+        const names = JSON.parse(stdout);
+        return names.some((l) => l.name === name);
+      } catch {
+        return false;
+      }
+    },
+    async create(name, color, description) {
+      await execFileAsync4("gh", ["label", "create", name, "--color", color, "--description", description], {
+        cwd: repoRoot
+      });
+    }
+  };
+}
+
+// src/lib/ops.ts
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join4, resolve, sep } from "node:path";
+var MARKER_NS = "vinaya:managed";
+function markerLines(marker, comment) {
+  const [open, close] = comment === "hash" ? ["#", ""] : ["<!--", " -->"];
+  return {
+    begin: `${open} >>> ${MARKER_NS}:${marker} >>>${close}`,
+    end: `${open} <<< ${MARKER_NS}:${marker} <<<${close}`
+  };
+}
+function renderBlock(op) {
+  const { begin, end } = markerLines(op.marker, op.comment);
+  return `${begin}
+${op.body}
+${end}`;
+}
+function abs(repoRoot, relPath) {
+  return join4(repoRoot, relPath);
+}
+function containedAbs(repoRoot, relPath) {
+  const root = resolve(repoRoot);
+  const target = resolve(root, relPath);
+  if (target === root)
+    return null;
+  return target === root || target.startsWith(root + sep) ? target : null;
+}
+function fileContains(repoRoot, relPath, needle) {
+  const p = abs(repoRoot, relPath);
+  if (!existsSync3(p))
+    return false;
+  return readFileSync2(p, "utf-8").includes(needle);
+}
+function planInstall(ops, repoRoot, ownedFiles = new Set) {
+  const entries = [];
+  let hasRefusals = false;
+  for (const op of ops) {
+    switch (op.kind) {
+      case "create-file": {
+        const exists = existsSync3(abs(repoRoot, op.path));
+        let action;
+        if (!exists)
+          action = "create";
+        else if (ownedFiles.has(op.path))
+          action = "skip-owned";
+        else {
+          action = "refuse-foreign";
+          hasRefusals = true;
+        }
+        entries.push({ kind: "create-file", op, action });
+        break;
+      }
+      case "managed-block": {
+        const { begin } = markerLines(op.marker, op.comment);
+        let action;
+        if (fileContains(repoRoot, op.path, begin))
+          action = "skip-present";
+        else if (existsSync3(abs(repoRoot, op.path)))
+          action = "append";
+        else
+          action = "create-host";
+        entries.push({ kind: "managed-block", op, action });
+        break;
+      }
+      case "create-label":
+        entries.push({ kind: "create-label", op });
+        break;
+      case "print":
+        entries.push({ kind: "print", op });
+        break;
+    }
+  }
+  return { entries, hasRefusals };
+}
+function indent(text, pad = "    ") {
+  return text.split(`
+`).map((l) => l.length > 0 ? pad + l : l).join(`
+`);
+}
+function renderInstallDiff(plan) {
+  const lines = [];
+  const groups = new Map;
+  for (const e of plan.entries) {
+    const g = e.op.group;
+    if (!groups.has(g))
+      groups.set(g, []);
+    groups.get(g)?.push(e);
+  }
+  for (const [group, es] of groups) {
+    lines.push(`── ${group} ─────────────────────────────`);
+    for (const e of es) {
+      switch (e.kind) {
+        case "create-file":
+          if (e.action === "create") {
+            lines.push(`  + create ${e.op.path}`);
+            lines.push(indent(e.op.content));
+          } else if (e.action === "skip-owned") {
+            lines.push(`  = keep   ${e.op.path} (already vinaya-managed)`);
+          } else {
+            lines.push(`  ✖ REFUSE ${e.op.path} — foreign content exists at this path; not overwritten`);
+          }
+          break;
+        case "managed-block":
+          if (e.action === "skip-present") {
+            lines.push(`  = keep   ${e.op.path} (vinaya block already present)`);
+          } else if (e.action === "append") {
+            lines.push(`  ~ append managed block to ${e.op.path} (existing content untouched)`);
+            lines.push(indent(renderBlock(e.op)));
+          } else {
+            lines.push(`  + create ${e.op.path} (with managed block)`);
+            lines.push(indent(`${e.op.hostPreamble ?? ""}${renderBlock(e.op)}`));
+          }
+          break;
+        case "create-label":
+          lines.push(`  + label  ${e.op.name} (created only if absent; existing labels never modified)`);
+          break;
+        case "print":
+          lines.push(`  ⓘ ${e.op.message.split(`
+`).join(`
+    `)}`);
+          break;
+      }
+    }
+    lines.push("");
+  }
+  if (plan.hasRefusals) {
+    lines.push("One or more paths hold foreign content — those artifacts will be SKIPPED, not overwritten.");
+    lines.push("Resolve them manually (or remove the conflicting file) and re-run to install the rest.");
+    lines.push("");
+  }
+  return lines.join(`
+`);
+}
+function writeFileWithDirs(target, content, mode) {
+  mkdirSync2(dirname3(target), { recursive: true });
+  writeFileSync2(target, content, "utf-8");
+  if (mode !== undefined)
+    chmodSync(target, mode);
+}
+function appendBlock(repoRoot, op) {
+  const target = abs(repoRoot, op.path);
+  const existing = readFileSync2(target, "utf-8");
+  const sep2 = existing.endsWith(`
+`) ? `
+` : `
+
+`;
+  writeFileSync2(target, `${existing}${sep2}${renderBlock(op)}
+`, "utf-8");
+  if (op.mode !== undefined)
+    chmodSync(target, op.mode);
+}
+function createHost(repoRoot, op) {
+  const target = abs(repoRoot, op.path);
+  writeFileWithDirs(target, `${op.hostPreamble ?? ""}${renderBlock(op)}
+`, op.mode);
+}
+async function applyInstall(plan, repoRoot, labels, onFilesRecorded) {
+  const files = [];
+  const blocks = [];
+  const createdLabels = [];
+  for (const e of plan.entries) {
+    switch (e.kind) {
+      case "create-file":
+        if (e.action === "create") {
+          writeFileWithDirs(abs(repoRoot, e.op.path), e.op.content, e.op.mode);
+          files.push(e.op.path);
+        } else if (e.action === "skip-owned") {
+          files.push(e.op.path);
+        }
+        break;
+      case "managed-block":
+        if (e.action === "append")
+          appendBlock(repoRoot, e.op);
+        else if (e.action === "create-host")
+          createHost(repoRoot, e.op);
+        blocks.push({ path: e.op.path, marker: e.op.marker, comment: e.op.comment });
+        break;
+      case "print":
+        process.stdout.write(`${e.op.message}
+`);
+        break;
+    }
+  }
+  const base = {
+    version: MANAGED_MANIFEST_VERSION,
+    files: dedupe(files),
+    blocks: dedupeBlocks(blocks),
+    labels: []
+  };
+  onFilesRecorded?.(base);
+  for (const e of plan.entries) {
+    if (e.kind !== "create-label")
+      continue;
+    if (!await labels.exists(e.op.name)) {
+      await labels.create(e.op.name, e.op.color, e.op.description);
+      createdLabels.push(e.op.name);
+    }
+  }
+  return { ...base, labels: dedupe(createdLabels) };
+}
+function dedupe(xs) {
+  return [...new Set(xs)];
+}
+function dedupeBlocks(bs) {
+  const seen = new Set;
+  const out = [];
+  for (const b of bs) {
+    const key = `${b.path}::${b.marker}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    out.push(b);
+  }
+  return out;
+}
+function blockStripLeavesEmpty(body) {
+  const rest = body.split(`
+`).filter((l) => l.trim().length > 0 && !l.startsWith("#!")).join("");
+  return rest.length === 0;
+}
+function stripBlockFromContent(content, marker, comment) {
+  const { begin, end } = markerLines(marker, comment);
+  const lines = content.split(`
+`);
+  const startIdx = lines.findIndex((l) => l.trim() === begin);
+  if (startIdx === -1)
+    return null;
+  const endIdx = lines.findIndex((l, i) => i >= startIdx && l.trim() === end);
+  if (endIdx === -1)
+    return null;
+  let from = startIdx;
+  if (from > 0 && lines[from - 1]?.trim() === "")
+    from -= 1;
+  lines.splice(from, endIdx - from + 1);
+  return lines.join(`
+`);
+}
+function planEject(manifest, repoRoot) {
+  const actions = [];
+  const escapes = [];
+  for (const b of manifest.blocks) {
+    const p = containedAbs(repoRoot, b.path);
+    if (p === null) {
+      escapes.push(b.path);
+      continue;
+    }
+    if (!existsSync3(p)) {
+      actions.push({
+        kind: "strip-block",
+        path: b.path,
+        marker: b.marker,
+        comment: b.comment,
+        present: false,
+        removesHost: false
+      });
+      continue;
+    }
+    const content = readFileSync2(p, "utf-8");
+    const stripped = stripBlockFromContent(content, b.marker, b.comment);
+    const removesHost = stripped !== null && blockStripLeavesEmpty(stripped);
+    actions.push({
+      kind: "strip-block",
+      path: b.path,
+      marker: b.marker,
+      comment: b.comment,
+      present: stripped !== null,
+      removesHost
+    });
+  }
+  for (const f of manifest.files) {
+    const p = containedAbs(repoRoot, f);
+    if (p === null) {
+      escapes.push(f);
+      continue;
+    }
+    actions.push({ kind: "delete-file", path: f, present: existsSync3(p) });
+  }
+  for (const name of manifest.labels) {
+    actions.push({ kind: "report-label", name });
+  }
+  return { actions, escapes };
+}
+function renderEjectDiff(plan) {
+  const lines = [];
+  for (const a of plan.actions) {
+    if (a.kind === "delete-file") {
+      lines.push(a.present ? `  - delete ${a.path}` : `  · gone   ${a.path} (already removed)`);
+    } else if (a.kind === "strip-block") {
+      if (!a.present)
+        lines.push(`  · gone   ${a.path} (managed block already removed)`);
+      else if (a.removesHost)
+        lines.push(`  - delete ${a.path} (vinaya-created host; nothing else remains)`);
+      else
+        lines.push(`  ~ strip managed block from ${a.path} (your other lines are kept)`);
+    } else {
+      lines.push(`  ⓘ label  ${a.name} — remove manually if unused (a label may be in use elsewhere; never auto-deleted)`);
+    }
+  }
+  return lines.join(`
+`);
+}
+function applyEject(plan, repoRoot) {
+  for (const a of plan.actions) {
+    if (a.kind === "strip-block") {
+      if (!a.present)
+        continue;
+      const p = containedAbs(repoRoot, a.path);
+      if (p === null)
+        continue;
+      const content = readFileSync2(p, "utf-8");
+      const stripped = stripBlockFromContent(content, a.marker, a.comment);
+      if (stripped === null)
+        continue;
+      if (blockStripLeavesEmpty(stripped))
+        rmSync(p, { force: true });
+      else
+        writeFileSync2(p, stripped.endsWith(`
+`) ? stripped : `${stripped}
+`, "utf-8");
+    } else if (a.kind === "delete-file") {
+      const p = containedAbs(repoRoot, a.path);
+      if (a.present && p !== null)
+        rmSync(p, { force: true });
+    }
+  }
+  return {
+    removedLabelsToReport: plan.actions.filter((a) => a.kind === "report-label").map((a) => a.name)
+  };
+}
+
+// src/commands/doctor.ts
+function packageRoot() {
+  let dir = dirname4(fileURLToPath2(import.meta.url));
+  while (!existsSync4(join5(dir, "package.json"))) {
+    const parent = dirname4(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return dir;
+}
+function readVersion() {
+  const pkg = JSON.parse(readFileSync3(join5(packageRoot(), "package.json"), "utf-8"));
+  return pkg.version;
+}
+function realDeps() {
+  return {
+    detectRepo: detectGitRepo,
+    ghAuthStatus,
+    branchProtectionConfigured,
+    hookDirFor: resolveHookDir,
+    nodeVersion: () => process.version,
+    bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
+    packageVersion: readVersion
+  };
+}
+var ok = (check, message) => ({ check, severity: "ok", message });
+var info = (check, message) => ({ check, severity: "info", message });
+var warn = (check, message) => ({ check, severity: "warn", message });
+var error = (check, message) => ({ check, severity: "error", message });
+function readConfig(repoRoot) {
+  const p = join5(repoRoot, CONFIG_PATH);
+  if (!existsSync4(p))
+    return { kind: "missing" };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(p, "utf-8"));
+  } catch (err) {
+    return { kind: "invalid", error: `invalid JSON: ${err.message}` };
+  }
+  const parsed = VinayaConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    return {
+      kind: "invalid",
+      error: parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")
+    };
+  }
+  return { kind: "ok", config: parsed.data };
+}
+function labelForPath(path) {
+  if (path === CONFIG_PATH)
+    return "config";
+  if (path === DOCTRINE_POINTER_PATH)
+    return "doctrine-pointer";
+  return "workflows";
+}
+function diagnoseInstall(repoRoot, ctx, manifest) {
+  const findings = [];
+  let hasDrift = false;
+  const ownedFiles = new Set(manifest.files);
+  const blockKey = (path, marker) => `${path}::${marker}`;
+  const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
+  for (const op of buildInitOps(ctx)) {
+    if (op.kind === "create-file") {
+      const check = labelForPath(op.path);
+      const abs2 = join5(repoRoot, op.path);
+      const exists = existsSync4(abs2);
+      const owned = ownedFiles.has(op.path);
+      if (!exists) {
+        findings.push(owned ? error(check, `${op.path} is recorded as vinaya-managed but missing on disk — run \`vinaya upgrade\`.`) : error(check, `${op.path} is not installed — run \`vinaya init\`.`));
+        continue;
+      }
+      const content = readFileSync3(abs2, "utf-8");
+      if (!owned) {
+        findings.push(content === op.content ? warn(check, `${op.path} has vinaya's own content but isn't recorded in the manifest.`) : info(check, `${op.path} exists but is foreign content — not vinaya-managed, left untouched.`));
+        continue;
+      }
+      if (op.path === CONFIG_PATH) {
+        findings.push(ok(check, `${op.path} present and vinaya-managed.`));
+        continue;
+      }
+      if (content === op.content) {
+        findings.push(ok(check, `${op.path} matches the installed package's generated content.`));
+      } else {
+        hasDrift = true;
+        findings.push(warn(check, `${op.path} has drifted from the installed package's generated content — run \`vinaya upgrade\`.`));
+      }
+    } else if (op.kind === "managed-block") {
+      const check = "hooks";
+      const abs2 = join5(repoRoot, op.path);
+      const owned = ownedBlocks.has(blockKey(op.path, op.marker));
+      if (!existsSync4(abs2)) {
+        findings.push(owned ? error(check, `${op.path} is missing — likely a fresh clone (raw git hooks aren't tracked by git). Run \`vinaya upgrade\` to restore it.`) : info(check, `${op.path} is not installed.`));
+        continue;
+      }
+      const content = readFileSync3(abs2, "utf-8");
+      const { begin, end } = markerLines(op.marker, op.comment);
+      const hasMarkers = content.includes(begin) && content.includes(end);
+      if (!hasMarkers) {
+        findings.push(owned ? error(check, `${op.path}'s vinaya-managed block is missing or corrupted — run \`vinaya upgrade\`.`) : info(check, `${op.path} exists with no vinaya-managed block.`));
+        continue;
+      }
+      if (!owned) {
+        findings.push(warn(check, `${op.path} has a vinaya-managed block that isn't recorded in the manifest.`));
+      } else if (content.includes(renderBlock(op))) {
+        findings.push(ok(check, `${op.path}'s managed block matches the installed package's generator.`));
+      } else {
+        hasDrift = true;
+        findings.push(warn(check, `${op.path}'s managed block has drifted from the installed package's generator — run \`vinaya upgrade\`.`));
+      }
+      if (op.mode !== undefined && (statSync(abs2).mode & 73) === 0) {
+        findings.push(error(check, `${op.path} is not executable.`));
+      }
+    }
+  }
+  return { findings, hasDrift };
+}
+function diagnoseCustomChecks(repoRoot, config) {
+  const findings = [];
+  for (const [name, entry2] of Object.entries(config.checks ?? {})) {
+    const scriptAbs = join5(repoRoot, entry2.run);
+    findings.push(existsSync4(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
+  }
+  return findings;
+}
+async function diagnoseEnvironment(deps, hasDrift) {
+  const findings = [];
+  const auth = await deps.ghAuthStatus();
+  const detail = auth.detail.replace(/\s*\n+\s*/g, "; ");
+  findings.push(auth.authenticated ? info("environment", `gh: authenticated (${detail})`) : warn("environment", `gh: ${detail}`));
+  findings.push(info("environment", `node: ${deps.nodeVersion()}`));
+  const bun = deps.bunVersion();
+  if (bun)
+    findings.push(info("environment", `bun: ${bun}`));
+  const version = deps.packageVersion();
+  findings.push(hasDrift ? warn("environment", `vinaya@${version} — installed artifacts have drifted from this version's generator. Run \`vinaya upgrade\`.`) : info("environment", `vinaya@${version} — installed artifacts match this version's generator.`));
+  return findings;
+}
+async function diagnoseBranchProtection(deps, owner, repo) {
+  const configured = await deps.branchProtectionConfigured(owner, repo);
+  if (configured === true)
+    return info("branch-protection", "main branch protection is configured.");
+  if (configured === false) {
+    return info("branch-protection", "main branch protection is not configured — vinaya never applies it; see `vinaya init`'s printed recommendation.");
+  }
+  return info("branch-protection", "main branch protection could not be determined (no gh auth, no remote, or a permission gap).");
+}
+function symbolFor(severity) {
+  switch (severity) {
+    case "ok":
+      return "✓";
+    case "info":
+      return "·";
+    case "warn":
+      return "⚠";
+    case "error":
+      return "✗";
+  }
+}
+function printReport(findings, healthy) {
+  process.stdout.write(`vinaya doctor
+
+`);
+  for (const f of findings) {
+    process.stdout.write(`${symbolFor(f.severity)} [${f.check}] ${f.message}
+`);
+  }
+  process.stdout.write(`
+${healthy ? "Healthy — no findings." : "Findings above. vinaya doctor never mutates — nothing was changed."}
+`);
+}
+async function runDoctor(args, deps) {
+  const jsonOutput = args.includes("--json");
+  const repo = await deps.detectRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya doctor` from inside your repo.");
+    return 1;
+  }
+  const configRead = readConfig(repo.repoRoot);
+  const findings = [];
+  let hasDrift = false;
+  if (configRead.kind === "invalid") {
+    findings.push(error("config", `vinaya.config.json is invalid — ${configRead.error}`));
+  } else if (configRead.kind === "missing" || !configRead.config.managed) {
+    findings.push(error("install", "vinaya is not initialized in this repo — run `vinaya init`."));
+  } else {
+    const manifest = configRead.config.managed;
+    const hookDir = hookDirFromManifest(manifest, deps.hookDirFor(repo.repoRoot));
+    const ctx = { owner: repo.owner, repo: repo.repo, hookDir };
+    const install = diagnoseInstall(repo.repoRoot, ctx, manifest);
+    findings.push(...install.findings);
+    hasDrift = install.hasDrift;
+    findings.push(...diagnoseCustomChecks(repo.repoRoot, configRead.config));
+  }
+  findings.push(...await diagnoseEnvironment(deps, hasDrift));
+  findings.push(await diagnoseBranchProtection(deps, repo.owner, repo.repo));
+  const healthy = findings.every((f) => f.severity === "ok" || f.severity === "info");
+  if (jsonOutput) {
+    printJson({ healthy, findings });
+  } else {
+    printReport(findings, healthy);
+  }
+  return healthy ? 0 : 1;
+}
+async function doctorCommand(args) {
+  process.exit(await runDoctor(args, realDeps()));
+}
+
+// src/commands/eject.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
+import { join as join6 } from "node:path";
+
+// src/lib/prompt.ts
+var stdinBuffer = "";
+var stdinEnded = false;
+var pendingResolvers = [];
+var reading = false;
+function flushLines() {
+  while (stdinBuffer.includes(`
+`) && pendingResolvers.length > 0) {
+    const idx = stdinBuffer.indexOf(`
+`);
+    const line = stdinBuffer.slice(0, idx).trim();
+    stdinBuffer = stdinBuffer.slice(idx + 1);
+    pendingResolvers.shift()?.(line);
+  }
+  if (stdinEnded && stdinBuffer.length > 0 && pendingResolvers.length > 0) {
+    const line = stdinBuffer.trim();
+    stdinBuffer = "";
+    pendingResolvers.shift()?.(line);
+  }
+  if (stdinEnded) {
+    while (pendingResolvers.length > 0)
+      pendingResolvers.shift()?.("");
+  }
+}
+function setupStdinReader() {
+  if (reading)
+    return;
+  reading = true;
+  process.stdin.setEncoding("utf-8");
+  process.stdin.on("data", (chunk) => {
+    stdinBuffer += chunk;
+    flushLines();
+  });
+  process.stdin.on("end", () => {
+    stdinEnded = true;
+    flushLines();
+  });
+  process.stdin.resume();
+}
+function prompt(question) {
+  process.stdout.write(question);
+  setupStdinReader();
+  if (stdinEnded && pendingResolvers.length === 0)
+    return Promise.resolve("");
+  return new Promise((resolve2) => {
+    pendingResolvers.push(resolve2);
+    if (stdinEnded)
+      flushLines();
+  });
+}
+async function promptYesNo(question, defaultYes = false) {
+  const hint = defaultYes ? "Y/n" : "y/N";
+  const answer = await prompt(`${question} (${hint}): `);
+  if (answer.length === 0)
+    return defaultYes;
+  return answer.toLowerCase().startsWith("y");
+}
+function closeStdin() {
+  if (reading) {
+    process.stdin.destroy();
+    reading = false;
+  }
+}
+
+// src/commands/eject.ts
+function realDeps2() {
+  return {
+    detectRepo: detectGitRepo,
+    confirm: async (q) => {
+      const yes = await promptYesNo(q, false);
+      closeStdin();
+      return yes;
+    }
+  };
+}
+function parse(args) {
+  return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
+}
+function readManifest(repoRoot) {
+  const p = join6(repoRoot, CONFIG_PATH);
+  if (!existsSync5(p))
+    return { kind: "none" };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync4(p, "utf-8"));
+  } catch (err) {
+    return { kind: "orphan", reason: `vinaya.config.json is not valid JSON: ${err.message}` };
+  }
+  const parsed = VinayaConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    return {
+      kind: "orphan",
+      reason: `vinaya.config.json failed schema validation: ${parsed.error.issues.map((i) => i.message).join("; ")}`
+    };
+  }
+  if (!parsed.data.managed) {
+    return {
+      kind: "orphan",
+      reason: "vinaya.config.json has no `managed` ownership manifest — cannot determine what to remove."
+    };
+  }
+  return { kind: "ok", manifest: parsed.data.managed };
+}
+async function runEject(args, deps) {
+  const parsed = parse(args);
+  const repo = await deps.detectRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya eject` from inside your repo.");
+    return 1;
+  }
+  const read = readManifest(repo.repoRoot);
+  if (read.kind === "none") {
+    process.stdout.write(`Nothing to eject — this repo is not Vinaya-initialized.
+`);
+    return 0;
+  }
+  if (read.kind === "orphan") {
+    console.error(`Error: ${read.reason}`);
+    console.error("Refusing to remove anything without a valid ownership record. Restore or fix vinaya.config.json, then re-run.");
+    return 1;
+  }
+  const plan = planEject(read.manifest, repo.repoRoot);
+  if (plan.escapes.length > 0) {
+    console.error("Error: the ownership manifest records paths that resolve OUTSIDE this repo:");
+    for (const p of plan.escapes)
+      console.error(`  ${p}`);
+    console.error("Refusing to remove anything. This manifest is corrupt or hand-edited — fix vinaya.config.json, then re-run.");
+    return 1;
+  }
+  process.stdout.write(`vinaya eject — the full diff of every removal:
+
+`);
+  process.stdout.write(`${renderEjectDiff(plan)}
+`);
+  if (parsed.dryRun) {
+    process.stdout.write(`
+--dry-run: nothing was removed.
+`);
+    return 0;
+  }
+  if (!parsed.yes) {
+    const ok2 = await deps.confirm("Remove these vinaya-installed artifacts?");
+    if (!ok2) {
+      process.stdout.write(`Aborted. Nothing was removed.
+`);
+      return 0;
+    }
+  }
+  const { removedLabelsToReport } = applyEject(plan, repo.repoRoot);
+  process.stdout.write(`
+Vinaya ejected.
+`);
+  if (removedLabelsToReport.length > 0) {
+    process.stdout.write(`These labels were created by vinaya and left in place — remove them manually if unused:
+`);
+    for (const name of removedLabelsToReport)
+      process.stdout.write(`  gh label delete ${name}
+`);
+  }
+  return 0;
+}
+async function ejectCommand(args) {
+  const code = await runEject(args, realDeps2());
+  process.exit(code);
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join7 } from "node:path";
+function realDeps3() {
+  return {
+    detectRepo: detectGitRepo,
+    checkGhAuth,
+    labelGateway: ghLabelGateway,
+    hookDirFor: resolveHookDir,
+    customHooksPath,
+    confirm: async (q) => {
+      const yes = await promptYesNo(q, false);
+      closeStdin();
+      return yes;
+    }
+  };
+}
+function flags(args) {
+  return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
+}
+var PRODUCT_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+function readManifest2(repoRoot) {
+  const p = join7(repoRoot, CONFIG_PATH);
+  if (!existsSync6(p))
+    return null;
+  try {
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync5(p, "utf-8"))).managed ?? null;
+  } catch {
+    return null;
+  }
+}
+function writeManifest(repoRoot, manifest) {
+  const configAbs = join7(repoRoot, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync5(configAbs, "utf-8"));
+  writeFileSync3(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
+`, "utf-8");
+}
+async function runInit(args, deps) {
+  const { dryRun, yes } = flags(args);
+  const repo = await deps.detectRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya init` from inside your repo.");
+    return 1;
+  }
+  const custom = await deps.customHooksPath(repo.repoRoot);
+  if (custom) {
+    console.error(`Error: this repo routes git hooks through a custom core.hooksPath (${custom}).`);
+    console.error("Vinaya will not guess at a non-standard hook layout. Set core.hooksPath to .husky or unset it, then re-run.");
+    return 1;
+  }
+  const noRemote = !repo.owner || !repo.repo;
+  if (noRemote) {
+    console.warn("Warning: no `origin` remote (or it is not a GitHub URL) — skipping label creation. " + "Re-run `vinaya init` after adding a GitHub remote to create the recommended labels.");
+  }
+  if (!dryRun && !noRemote) {
+    const authed = await deps.checkGhAuth();
+    if (!authed) {
+      console.error("Error: GitHub CLI is not authenticated. Run `gh auth login` first (or use --dry-run to preview).");
+      return 1;
+    }
+  }
+  const ctx = { owner: repo.owner, repo: repo.repo, hookDir: deps.hookDirFor(repo.repoRoot) };
+  const allOps = buildInitOps(ctx);
+  const ops = noRemote ? allOps.filter((op) => op.kind !== "create-label") : allOps;
+  const owned = new Set(readManifest2(repo.repoRoot)?.files ?? []);
+  const plan = planInstall(ops, repo.repoRoot, owned);
+  process.stdout.write(`vinaya init — the full diff of every intended change:
+
+`);
+  process.stdout.write(`${renderInstallDiff(plan)}
+`);
+  if (dryRun) {
+    process.stdout.write(`--dry-run: nothing was written.
+`);
+    return 0;
+  }
+  if (!yes) {
+    const ok2 = await deps.confirm("Install these changes?");
+    if (!ok2) {
+      process.stdout.write(`Aborted. Nothing was written.
+`);
+      return 0;
+    }
+  }
+  const manifest = await applyInstall(plan, repo.repoRoot, deps.labelGateway(repo.repoRoot), (m) => writeManifest(repo.repoRoot, m));
+  writeManifest(repo.repoRoot, manifest);
+  process.stdout.write("\nVinaya installed. Next: run `vinaya demo break` to see a refusal-then-fix in action.\n");
+  return 0;
+}
+async function runInitProduct(args, deps) {
+  const { dryRun, yes } = flags(args);
+  const name = args.filter((a) => !a.startsWith("--"))[0];
+  if (!name) {
+    console.error("Usage: vinaya init product <name>");
+    return 2;
+  }
+  if (!PRODUCT_NAME_RE.test(name)) {
+    console.error(`Error: invalid product name '${name}'. Use a lower-case slug: letters, digits, and hyphens (e.g. mobile, web-app).`);
+    return 2;
+  }
+  const repo = await deps.detectRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya init product` from inside your repo.");
+    return 1;
+  }
+  const existing = readManifest2(repo.repoRoot);
+  if (!existing?.files.includes(CONFIG_PATH)) {
+    console.error("Error: this repo is not Vinaya-initialized yet. Run `vinaya init` first.");
+    return 1;
+  }
+  const noRemote = !repo.owner || !repo.repo;
+  if (noRemote) {
+    console.warn("Warning: no `origin` remote (or it is not a GitHub URL) — skipping label creation. " + `Re-run 'vinaya init product ${name}' after adding a GitHub remote to create it.`);
+    process.stdout.write(`
+Nothing to scaffold for '${name}' without a GitHub remote.
+`);
+    return 0;
+  }
+  const ops = buildInitProductOps(name);
+  const plan = planInstall(ops, repo.repoRoot, new Set(existing.files));
+  process.stdout.write(`vinaya init product ${name} — the full diff:
+
+`);
+  process.stdout.write(`${renderInstallDiff(plan)}
+`);
+  if (dryRun) {
+    process.stdout.write(`--dry-run: nothing was written.
+`);
+    return 0;
+  }
+  if (!yes) {
+    const ok2 = await deps.confirm(`Scaffold governed product area '${name}'?`);
+    if (!ok2) {
+      process.stdout.write(`Aborted. Nothing was written.
+`);
+      return 0;
+    }
+  }
+  const added = await applyInstall(plan, repo.repoRoot, deps.labelGateway(repo.repoRoot));
+  const merged = {
+    version: existing.version,
+    files: [...new Set([...existing.files, ...added.files])],
+    blocks: dedupeBlocks2([...existing.blocks, ...added.blocks]),
+    labels: [...new Set([...existing.labels, ...added.labels])]
+  };
+  writeManifest(repo.repoRoot, merged);
+  process.stdout.write(`
+Governed product area '${name}' scaffolded.
+`);
+  return 0;
+}
+function dedupeBlocks2(bs) {
+  const seen = new Set;
+  return bs.filter((b) => {
+    const k = `${b.path}::${b.marker}`;
+    if (seen.has(k))
+      return false;
+    seen.add(k);
+    return true;
+  });
+}
+async function initCommand(args) {
+  process.exit(await runInit(args, realDeps3()));
+}
+async function initProductCommand(args) {
+  process.exit(await runInitProduct(args, realDeps3()));
+}
+
+// src/commands/issue.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+
+// src/lib/forge-write.ts
+import { mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join8 } from "node:path";
+class ForgeArgError extends Error {
+}
+function locateBody(args) {
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a === "--body-file" || a === "-F") {
+      const p = args[i + 1];
+      if (!p)
+        throw new ForgeArgError("`--body-file` was given with no path.");
+      return { body: readFileSync6(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
+    }
+    if (a.startsWith("--body-file=")) {
+      const p = a.slice("--body-file=".length);
+      if (!p)
+        throw new ForgeArgError("`--body-file=` was given with no path.");
+      return { body: readFileSync6(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
+    }
+    if (a === "--body" || a === "-b") {
+      const v = args[i + 1];
+      if (v === undefined)
+        throw new ForgeArgError("`--body` was given with no value.");
+      return { body: v, source: { kind: "inline" } };
+    }
+    if (a.startsWith("--body="))
+      return { body: a.slice("--body=".length), source: { kind: "inline" } };
+  }
+  return null;
+}
+function resolveShippableArgs(args, bodyResult) {
+  if (bodyResult?.source.kind !== "file") {
+    return { finalArgs: args, cleanup: () => {} };
+  }
+  const dir = mkdtempSync(join8(tmpdir(), "vinaya-forge-body-"));
+  const tempPath = join8(dir, "body.md");
+  writeFileSync4(tempPath, bodyResult.body, "utf8");
+  const finalArgs = [...args];
+  const { argIndex, inlineForm } = bodyResult.source;
+  finalArgs[argIndex] = inlineForm ? `--body-file=${tempPath}` : tempPath;
+  return { finalArgs, cleanup: () => rmSync2(dir, { recursive: true, force: true }) };
+}
+function extractTitle(args) {
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a === "--title" || a === "-t")
+      return args[i + 1] ?? null;
+    if (a.startsWith("--title="))
+      return a.slice("--title=".length);
+  }
+  return null;
+}
+function extractLabels(args) {
+  const labels = [];
+  const push = (v) => {
+    if (v) {
+      for (const s of v.split(",").map((x) => x.trim()))
+        if (s)
+          labels.push(s);
+    }
+  };
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a === "--label" || a === "-l" || a === "--add-label")
+      push(args[i + 1]);
+    else if (a.startsWith("--label="))
+      push(a.slice("--label=".length));
+    else if (a.startsWith("--add-label="))
+      push(a.slice("--add-label=".length));
+  }
+  return labels;
+}
+function makeCheckError(check, message, agentRecoveryPrompt) {
+  return {
+    schema: CHECK_SCHEMA_VERSION,
+    check,
+    severity: "error",
+    message,
+    agent_recovery_prompt: agentRecoveryPrompt
+  };
+}
+function refuse(errors) {
+  for (const e of errors)
+    emitCheckError(e);
+  process.exit(1);
+}
+function resolveSections(kind, retryCommand) {
+  const result = loadConfigChecked();
+  if (!result.ok) {
+    refuse([
+      makeCheckError("config", `${result.path}: invalid vinaya.config.json — ${result.error}`, `Fix the invalid key/value named above in ${result.path}, then re-run \`${retryCommand}\`.`)
+    ]);
+  }
+  return result.config?.briefSchema?.[kind]?.sections ?? [];
+}
+var CHECK_BRIEF_SCHEMA = "brief-schema";
+var CHECK_FORGE_TITLE = "forge-title";
+function runBuiltin(name, input) {
+  const { body, changedFiles: changedFiles2 } = input;
+  const table = {
+    tier: () => checkTierField(body, readTierFromPrBody),
+    testPlan: () => checkTestPlan(body),
+    testPlanExclusivity: () => checkTestPlanExclusivity(body),
+    principalPlaceholder: () => checkPrincipalPlaceholder(body),
+    surfaceMap: () => checkSurfaceMap(body),
+    docUpdateList: () => checkDocUpdateList(body),
+    worktreeStep0: () => checkWorktreeStep0(body),
+    stopConditions: () => checkStopConditions(body),
+    autonomyClause: () => checkAutonomyClause(body),
+    project: () => checkProjectField(body),
+    for: () => checkForField(body),
+    closesN: () => checkClosesN(body),
+    premiseCoverage: () => checkPremiseCoverage(body, changedFiles2),
+    issueRationale: () => checkIssueRationale(body)
+  };
+  return table[name]().errors;
+}
+var BUILTIN_RECOVERY = {
+  tier: "Add a `Tier: 0`, `Tier: 1`, or `Tier: 3` field to the body header block (before the first `##` heading), then re-run `{cmd}`.",
+  testPlan: "Add a Test Plan section with at least one `**[agent]**` or `**[principal]**` checklist item (or the `Test Plan: unit-tests-only` sentinel), then re-run `{cmd}`.",
+  testPlanExclusivity: "Remove either the `Test Plan: unit-tests-only` sentinel or the tagged `- [ ]` checklist items — declare one form, not both — then re-run `{cmd}`.",
+  principalPlaceholder: 'Delete the `**[principal]**` "None" placeholder checklist item entirely (an untickable box blocks the merge gate forever), then re-run `{cmd}`.',
+  surfaceMap: "Add a `## Technical surface map` section listing the files this change touches, then re-run `{cmd}`.",
+  docUpdateList: "Add a `## Documentation-update list` section, then re-run `{cmd}`.",
+  worktreeStep0: "Add the `git worktree add …` Step 0 command to the body, then re-run `{cmd}`.",
+  stopConditions: "Add a `## Stop conditions` section, then re-run `{cmd}`.",
+  autonomyClause: 'Add the standing autonomy clause ("Do not stop to ask clarifying questions…") to the body, then re-run `{cmd}`.',
+  project: "Add a `Project: <name>` field to the body header block (before the first `##` heading), then re-run `{cmd}`.",
+  for: "Add a `For: <model + environment>` field to the body header block (before the first `##` heading), then re-run `{cmd}`.",
+  closesN: "Add a `Closes #<N>` reference naming the task Issue to the body, then re-run `{cmd}`.",
+  premiseCoverage: "Add a `Premise:` assertion whose path matches a file this change touches, then re-run `{cmd}`.",
+  issueRationale: "Add the missing Planner-rationale field named above (every task Issue carries all eight fields), then re-run `{cmd}`."
+};
+function escapeRegExp(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function runCustomSection(section, body) {
+  if ("heading" in section) {
+    const re = new RegExp(`^#{1,6}\\s+.*${escapeRegExp(section.heading)}`, "im");
+    if (re.test(body))
+      return null;
+    const name2 = section.name ?? section.heading;
+    return `brief-schema ${name2}: no "${section.heading}" heading found in the body.`;
+  }
+  if ("field" in section) {
+    const re = new RegExp(`^(?:\\*\\*)?\\s*${escapeRegExp(section.field)}\\s*(?:\\*\\*)?\\s*:`, "im");
+    if (re.test(body))
+      return null;
+    const name2 = section.name ?? section.field;
+    return `brief-schema ${name2}: no "${section.field}:" field found in the body.`;
+  }
+  if (body.toLowerCase().includes(section.phrase.toLowerCase()))
+    return null;
+  const name = section.name ?? section.phrase;
+  return `brief-schema ${name}: required phrase "${section.phrase}" not found in the body.`;
+}
+function customRecovery(section, retryCommand) {
+  const cmd = `\`${retryCommand}\``;
+  if ("heading" in section) {
+    return `Add a \`## ${section.heading}\` heading (with its section) to the body, then re-run ${cmd}.`;
+  }
+  if ("field" in section) {
+    return `Add a \`${section.field}: <value>\` field to the body, then re-run ${cmd}.`;
+  }
+  return `Add the required phrase "${section.phrase}" to the body, then re-run ${cmd}.`;
+}
+function validateForgeWrite(input) {
+  const errors = [];
+  if (input.title !== null) {
+    const t = checkForgeTitle(input.title);
+    if (t.status === "fail") {
+      for (const message of t.errors) {
+        errors.push(makeCheckError(CHECK_FORGE_TITLE, message, `Rewrite the \`--title\` to match the forge-title grammar (\`Type: description\` / \`Type(scope): description\`, or \`[tranche] id — description\`), then re-run \`${input.retryCommand}\`.`));
+      }
+    }
+  }
+  for (const section of input.sections) {
+    if ("builtin" in section) {
+      const recovery = BUILTIN_RECOVERY[section.builtin].replace("{cmd}", input.retryCommand);
+      for (const message of runBuiltin(section.builtin, input)) {
+        errors.push(makeCheckError(CHECK_BRIEF_SCHEMA, message, recovery));
+      }
+    } else {
+      const message = runCustomSection(section, input.body);
+      if (message !== null) {
+        errors.push(makeCheckError(CHECK_BRIEF_SCHEMA, message, customRecovery(section, input.retryCommand)));
+      }
+    }
+  }
+  return errors;
+}
+
+// src/commands/issue.ts
+var RETRY_CREATE = "vinaya issue create --validate-only …";
+var RETRY_EDIT = "vinaya issue edit <n> --validate-only …";
+function locateBodyOrRefuse(ghArgs, retryCommand) {
+  try {
+    return locateBody(ghArgs);
+  } catch (e) {
+    if (e instanceof ForgeArgError) {
+      refuse([makeCheckError("forge-args", e.message, `Fix the invocation, then re-run \`${retryCommand}\`.`)]);
+    }
+    throw e;
+  }
+}
+function fetchForgeLabels(issueRef) {
+  let out;
+  try {
+    out = execFileSync3("gh", ["issue", "view", issueRef, "--json", "labels"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch {
+    refuse([
+      makeCheckError("forge-fetch", `Could not fetch Issue ${issueRef}'s labels from the forge (\`gh issue view\`) — the rationale gate cannot decide whether it applies.`, `Check \`gh auth status\` and network, then re-run \`${RETRY_EDIT}\`. The edit is refused rather than passed through unvalidated.`)
+    ]);
+  }
+  try {
+    return JSON.parse(out).labels.map((l) => l.name);
+  } catch {
+    refuse([
+      makeCheckError("forge-fetch", `Could not parse \`gh issue view ${issueRef} --json labels\` output.`, `Re-run \`${RETRY_EDIT}\`; the edit is refused rather than passed through unvalidated.`)
+    ]);
+  }
+}
+function reportPass(json, command) {
+  if (json) {
+    printJson({ validated: true, written: false, command });
+  } else {
+    process.stdout.write(`✓ all brief-schema gates PASS — nothing written (--validate-only).
+`);
+  }
+}
+function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
+  const { finalArgs, cleanup } = resolveShippableArgs(ghArgs, bodyResult);
+  try {
+    const out = execFileSync3("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const url = out.trim();
+    if (json)
+      printJson({ validated: true, written: true, url });
+    else if (url)
+      process.stdout.write(`${url}
+`);
+  } finally {
+    cleanup();
+  }
+}
+function validateTaskIssue(body, title, retryCommand) {
+  if (body === null) {
+    refuse([
+      makeCheckError("forge-args", "A task Issue (a `vinaya/tranche:*` label) requires a `--body-file <path>` so the rationale gate can validate it.", `Add \`--body-file <path>\`, then re-run \`${retryCommand}\`.`)
+    ]);
+  }
+  const sections = resolveSections("issue", retryCommand);
+  const errors = validateForgeWrite({
+    body,
+    title,
+    sections,
+    changedFiles: [],
+    retryCommand
+  });
+  if (errors.length > 0)
+    refuse(errors);
+}
+function issueCreateCommand(args) {
+  const json = args.includes("--json");
+  const validateOnly = args.includes("--validate-only");
+  const ghArgs = args.filter((a) => a !== "--json" && a !== "--validate-only");
+  const bodyResult = locateBodyOrRefuse(ghArgs, RETRY_CREATE);
+  const body = bodyResult?.body ?? null;
+  const title = extractTitle(ghArgs);
+  const labels = extractLabels(ghArgs);
+  if (isTaskIssueLabelSet(labels)) {
+    validateTaskIssue(body, title, RETRY_CREATE);
+  }
+  if (validateOnly) {
+    reportPass(json, "issue create");
+    return;
+  }
+  runGhWrite(["issue", "create"], ghArgs, bodyResult, json);
+}
+function issueEditCommand(args) {
+  const json = args.includes("--json");
+  const validateOnly = args.includes("--validate-only");
+  const rest = args.filter((a) => a !== "--json" && a !== "--validate-only");
+  const issueRef = rest[0];
+  if (!issueRef || issueRef.startsWith("-")) {
+    refuse([
+      makeCheckError("forge-args", "`issue edit` requires the target Issue number/URL as the first argument.", "Pass the Issue number, e.g. `vinaya issue edit 123 --body-file <path>`.")
+    ]);
+  }
+  const ghArgs = rest.slice(1);
+  const bodyResult = locateBodyOrRefuse(ghArgs, RETRY_EDIT);
+  const body = bodyResult?.body ?? null;
+  const title = extractTitle(ghArgs);
+  const labels = [...new Set([...fetchForgeLabels(issueRef), ...extractLabels(ghArgs)])];
+  if (isTaskIssueLabelSet(labels)) {
+    validateTaskIssue(body, title, RETRY_EDIT);
+  }
+  if (validateOnly) {
+    reportPass(json, "issue edit");
+    return;
+  }
+  runGhWrite(["issue", "edit", issueRef], ghArgs, bodyResult, json);
+}
+
+// src/commands/new-check.ts
+import { chmodSync as chmodSync2, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname5, join as join9 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+function packageRoot2() {
+  let dir = dirname5(fileURLToPath3(import.meta.url));
+  while (!existsSync7(join9(dir, "package.json"))) {
+    const parent = dirname5(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return dir;
+}
+var TEMPLATE_PATH = join9(packageRoot2(), "templates", "custom-check.template.ts");
+var CHECKS_DIR = join9("scripts", "vinaya-checks");
+var VALID_NAME = /^[a-z0-9][a-z0-9-]*$/;
+function newCheckCommand(args) {
+  const name = args[0];
+  if (!name || !VALID_NAME.test(name)) {
+    console.error("Usage: vinaya new check <name>  (name: lowercase letters, digits, hyphens)");
+    process.exit(2);
+  }
+  const scriptsDir = join9(process.cwd(), CHECKS_DIR);
+  if (!existsSync7(scriptsDir))
+    mkdirSync3(scriptsDir, { recursive: true });
+  const targetPath = join9(scriptsDir, `${name}.ts`);
+  if (existsSync7(targetPath)) {
+    console.error(`Error: ${targetPath} already exists.`);
+    process.exit(1);
+  }
+  const template = readFileSync7(TEMPLATE_PATH, "utf-8");
+  const contents = template.split("{{CHECK_NAME}}").join(name);
+  writeFileSync5(targetPath, contents, "utf-8");
+  chmodSync2(targetPath, 493);
+  const relPath = join9(CHECKS_DIR, `${name}.ts`);
+  const registration = JSON.stringify({ checks: { [name]: { run: `./${relPath}`, scope: "diff" } } }, null, 2);
+  process.stdout.write(`Created ${relPath}
+
+Register it in vinaya.config.json:
+${registration}
+`);
+}
+
+// src/commands/pr.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+var RETRY_CREATE2 = "vinaya pr create --validate-only …";
+var RETRY_EDIT2 = "vinaya pr edit <n> --validate-only …";
+function git2(args) {
+  try {
+    return execFileSync4("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function localChangedFiles() {
+  const base = process.env.BASE_SHA || "origin/main";
+  let out = git2(["diff", "--name-only", `${base}...HEAD`]);
+  if (!out)
+    out = git2(["diff", "--name-only", "main...HEAD"]);
+  return out.split(`
+`).map((s) => s.trim()).filter(Boolean);
+}
+function locateBodyOrRefuse2(ghArgs, retryCommand) {
+  try {
+    return locateBody(ghArgs);
+  } catch (e) {
+    if (e instanceof ForgeArgError) {
+      refuse([makeCheckError("forge-args", e.message, `Fix the invocation, then re-run \`${retryCommand}\`.`)]);
+    }
+    throw e;
+  }
+}
+function reportPass2(json, command) {
+  if (json) {
+    printJson({ validated: true, written: false, command });
+  } else {
+    process.stdout.write(`✓ all brief-schema gates PASS — nothing written (--validate-only).
+`);
+  }
+}
+function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
+  const { finalArgs, cleanup } = resolveShippableArgs(ghArgs, bodyResult);
+  try {
+    const out = execFileSync4("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const url = out.trim();
+    if (json)
+      printJson({ validated: true, written: true, url });
+    else if (url)
+      process.stdout.write(`${url}
+`);
+  } finally {
+    cleanup();
+  }
+}
+function fetchPrForgeContext(prRef) {
+  let viewOut;
+  try {
+    viewOut = execFileSync4("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch {
+    refuse([
+      makeCheckError("forge-fetch", `Could not fetch PR ${prRef} from the forge (\`gh pr view\`) — the brief-schema gate cannot resolve the target PR's state.`, `Check \`gh auth status\` and network, then re-run \`${RETRY_EDIT2}\`. The edit is refused rather than validated against the local checkout.`)
+    ]);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(viewOut);
+  } catch {
+    refuse([
+      makeCheckError("forge-fetch", `Could not parse \`gh pr view ${prRef}\` output.`, `Re-run \`${RETRY_EDIT2}\`; the edit is refused rather than validated against the local checkout.`)
+    ]);
+  }
+  if (!parsed.headRefName) {
+    refuse([
+      makeCheckError("forge-fetch", `\`gh pr view ${prRef}\` returned no head branch — the target PR could not be resolved.`, `Confirm PR ${prRef} exists, then re-run \`${RETRY_EDIT2}\`.`)
+    ]);
+  }
+  const changedFiles2 = (parsed.files ?? []).map((f) => f.path);
+  return { changedFiles: changedFiles2 };
+}
+function prCreateCommand(args) {
+  const json = args.includes("--json");
+  const validateOnly = args.includes("--validate-only");
+  const ghArgs = args.filter((a) => a !== "--json" && a !== "--validate-only");
+  const bodyResult = locateBodyOrRefuse2(ghArgs, RETRY_CREATE2);
+  const body = bodyResult?.body ?? null;
+  const title = extractTitle(ghArgs);
+  if (body === null) {
+    refuse([
+      makeCheckError("forge-args", "No `--body-file <path>` (or `--body`) argument found — the brief-schema gate needs the PR body to validate it.", `Add \`--body-file <path>\` (or \`--body\`), then re-run \`${RETRY_CREATE2}\`.`)
+    ]);
+  }
+  const sections = resolveSections("pr", RETRY_CREATE2);
+  const changedFiles2 = localChangedFiles();
+  const errors = validateForgeWrite({
+    body,
+    title,
+    sections,
+    changedFiles: changedFiles2,
+    retryCommand: RETRY_CREATE2
+  });
+  if (errors.length > 0)
+    refuse(errors);
+  if (validateOnly) {
+    reportPass2(json, "pr create");
+    return;
+  }
+  runGhWrite2(["pr", "create"], ghArgs, bodyResult, json);
+}
+function prEditCommand(args) {
+  const json = args.includes("--json");
+  const validateOnly = args.includes("--validate-only");
+  const rest = args.filter((a) => a !== "--json" && a !== "--validate-only");
+  const prRef = rest[0];
+  if (!prRef || prRef.startsWith("-")) {
+    refuse([
+      makeCheckError("forge-args", "`pr edit` requires the target PR number/URL as the first argument.", "Pass the PR number, e.g. `vinaya pr edit 123 --body-file <path>`.")
+    ]);
+  }
+  const ghArgs = rest.slice(1);
+  const bodyResult = locateBodyOrRefuse2(ghArgs, RETRY_EDIT2);
+  const body = bodyResult?.body ?? null;
+  const title = extractTitle(ghArgs);
+  if (body === null && title === null) {
+    refuse([
+      makeCheckError("forge-args", "`pr edit` with neither `--body-file`/`--body` nor `--title` — nothing to validate or change.", `Pass a \`--body-file\`/\`--body\` or a \`--title\`, then re-run \`${RETRY_EDIT2}\`.`)
+    ]);
+  }
+  const sections = resolveSections("pr", RETRY_EDIT2);
+  let changedFiles2 = [];
+  if (body !== null) {
+    const ctx = fetchPrForgeContext(prRef);
+    changedFiles2 = ctx.changedFiles;
+  }
+  const errors = validateForgeWrite({
+    body: body ?? "",
+    title,
+    sections: body === null ? [] : sections,
+    changedFiles: changedFiles2,
+    retryCommand: RETRY_EDIT2
+  });
+  if (errors.length > 0)
+    refuse(errors);
+  if (validateOnly) {
+    reportPass2(json, "pr edit");
+    return;
+  }
+  runGhWrite2(["pr", "edit", prRef], ghArgs, bodyResult, json);
+}
+
+// src/commands/studio.ts
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
+import { dirname as dirname6, join as join10 } from "node:path";
+function resolveStudioTarget(cwd) {
+  let dir = cwd;
+  for (;; ) {
+    const webDir = join10(dir, "apps", "vinaya", "web");
+    const pkgPath = join10(webDir, "package.json");
+    if (existsSync8(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+        if (pkg.name === "@atta/vinaya-web") {
+          return { kind: "workspace", webDir };
+        }
+      } catch {}
+    }
+    const parent = dirname6(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return { kind: "missing" };
+}
+function spawnDev(webDir, args) {
+  return new Promise((resolve2) => {
+    const child = spawn2("bun", ["run", "dev", ...args], { cwd: webDir, stdio: "inherit" });
+    child.on("exit", (code) => resolve2(code ?? 0));
+  });
+}
+async function runStudio(cwd, args) {
+  const target = resolveStudioTarget(cwd);
+  switch (target.kind) {
+    case "workspace":
+      return spawnDev(target.webDir, args);
+    case "package":
+      return spawnDev(target.packageDir, args);
+    case "missing":
+      console.error("Vinaya Studio isn't available here — install '@vinaya/studio' to run it standalone.");
+      return 1;
+  }
+}
+
+// src/commands/upgrade.ts
+import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join11 } from "node:path";
+function realDeps4() {
+  return {
+    detectRepo: detectGitRepo,
+    hookDirFor: resolveHookDir,
+    confirm: async (q) => {
+      const yes = await promptYesNo(q, false);
+      closeStdin();
+      return yes;
+    }
+  };
+}
+function flags2(args) {
+  return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
+}
+function readManifest3(repoRoot) {
+  const p = join11(repoRoot, CONFIG_PATH);
+  if (!existsSync9(p))
+    return { kind: "missing" };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync9(p, "utf-8"));
+  } catch (err) {
+    return { kind: "invalid", error: `invalid JSON: ${err.message}` };
+  }
+  const parsed = VinayaConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    return {
+      kind: "invalid",
+      error: parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")
+    };
+  }
+  if (!parsed.data.managed)
+    return { kind: "not-initialized" };
+  return { kind: "ok", manifest: parsed.data.managed };
+}
+function writeManifestVersion(repoRoot, manifest) {
+  const configAbs = join11(repoRoot, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync9(configAbs, "utf-8"));
+  const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
+  writeFileSync6(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
+`, "utf-8");
+}
+function planUpgrade(ops, repoRoot, manifest) {
+  const entries = [];
+  let hasChanges = false;
+  const ownedFiles = new Set(manifest.files);
+  const blockKey = (path, marker) => `${path}::${marker}`;
+  const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
+  for (const op of ops) {
+    if (op.kind === "create-file") {
+      const abs2 = join11(repoRoot, op.path);
+      const exists = existsSync9(abs2);
+      const owned = ownedFiles.has(op.path);
+      let action;
+      if (op.path === CONFIG_PATH) {
+        action = "keep";
+      } else if (!owned) {
+        action = exists ? "refuse-foreign" : "not-installed";
+      } else if (!exists) {
+        action = "recreate";
+        hasChanges = true;
+      } else if (readFileSync9(abs2, "utf-8") !== op.content) {
+        action = "regenerate";
+        hasChanges = true;
+      } else {
+        action = "current";
+      }
+      entries.push({ kind: "create-file", op, action });
+    } else if (op.kind === "managed-block") {
+      const abs2 = join11(repoRoot, op.path);
+      const owned = ownedBlocks.has(blockKey(op.path, op.marker));
+      let action;
+      if (!owned) {
+        action = "not-installed";
+      } else if (!existsSync9(abs2)) {
+        action = "recreate-host";
+        hasChanges = true;
+      } else {
+        const content = readFileSync9(abs2, "utf-8");
+        const { begin, end } = markerLines(op.marker, op.comment);
+        if (!(content.includes(begin) && content.includes(end))) {
+          action = "recreate-append";
+          hasChanges = true;
+        } else if (!content.includes(renderBlock(op))) {
+          action = "regenerate-block";
+          hasChanges = true;
+        } else {
+          action = "current";
+        }
+      }
+      entries.push({ kind: "managed-block", op, action });
+    }
+  }
+  const versionMigration = manifest.version === MANAGED_MANIFEST_VERSION ? null : { from: manifest.version, to: MANAGED_MANIFEST_VERSION };
+  return { entries, versionMigration, hasChanges: hasChanges || versionMigration !== null };
+}
+function renderUpgradeDiff(plan) {
+  const lines = [];
+  if (plan.versionMigration) {
+    lines.push("── Manifest ─────────────────────────────");
+    lines.push(`  ~ migrate manifest version ${plan.versionMigration.from} → ${plan.versionMigration.to}`);
+    lines.push("");
+  }
+  for (const e of plan.entries) {
+    if (e.kind === "create-file") {
+      switch (e.action) {
+        case "regenerate":
+          lines.push(`  ~ regenerate ${e.op.path}`);
+          lines.push(indent(e.op.content));
+          break;
+        case "recreate":
+          lines.push(`  + recreate   ${e.op.path} (recorded as owned but missing on disk)`);
+          lines.push(indent(e.op.content));
+          break;
+        case "current":
+          lines.push(`  = current    ${e.op.path}`);
+          break;
+        case "keep":
+          lines.push(`  = keep       ${e.op.path} (adopter-owned content; only the ownership manifest is regenerated)`);
+          break;
+        case "refuse-foreign":
+          lines.push(`  ✖ REFUSE    ${e.op.path} — foreign content at a vinaya path not owned by vinaya; not touched`);
+          break;
+        case "not-installed":
+          lines.push(`  · skip      ${e.op.path} (not installed — that's \`vinaya init\`'s job, not upgrade's)`);
+          break;
+      }
+    } else {
+      switch (e.action) {
+        case "regenerate-block":
+          lines.push(`  ~ regenerate managed block in ${e.op.path}`);
+          lines.push(indent(renderBlock(e.op)));
+          break;
+        case "recreate-append":
+          lines.push(`  + restore    managed block in ${e.op.path} (your other lines untouched)`);
+          lines.push(indent(renderBlock(e.op)));
+          break;
+        case "recreate-host":
+          lines.push(`  + recreate   ${e.op.path} (recorded as owned but missing on disk — e.g. a fresh clone)`);
+          lines.push(indent(`${e.op.hostPreamble ?? ""}${renderBlock(e.op)}`));
+          break;
+        case "current":
+          lines.push(`  = current    ${e.op.path}`);
+          break;
+        case "not-installed":
+          lines.push(`  · skip      ${e.op.path} (not installed — that's \`vinaya init\`'s job, not upgrade's)`);
+          break;
+      }
+    }
+  }
+  return lines.join(`
+`);
+}
+function regenerateBlock(repoRoot, op) {
+  const abs2 = join11(repoRoot, op.path);
+  const content = readFileSync9(abs2, "utf-8");
+  const stripped = stripBlockFromContent(content, op.marker, op.comment);
+  if (stripped !== null) {
+    writeFileSync6(abs2, stripped.endsWith(`
+`) ? stripped : `${stripped}
+`, "utf-8");
+  }
+  appendBlock(repoRoot, op);
+}
+function applyUpgrade(plan, repoRoot) {
+  for (const e of plan.entries) {
+    if (e.kind === "create-file") {
+      if (e.action === "regenerate" || e.action === "recreate") {
+        writeFileWithDirs(join11(repoRoot, e.op.path), e.op.content, e.op.mode);
+      }
+    } else {
+      if (e.action === "recreate-host")
+        createHost(repoRoot, e.op);
+      else if (e.action === "recreate-append")
+        appendBlock(repoRoot, e.op);
+      else if (e.action === "regenerate-block")
+        regenerateBlock(repoRoot, e.op);
+    }
+  }
+}
+async function runUpgrade(args, deps) {
+  const { dryRun, yes } = flags2(args);
+  const repo = await deps.detectRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya upgrade` from inside your repo.");
+    return 1;
+  }
+  const read = readManifest3(repo.repoRoot);
+  if (read.kind === "missing" || read.kind === "not-initialized") {
+    console.error("Error: vinaya is not initialized in this repo. Run `vinaya init` first.");
+    return 1;
+  }
+  if (read.kind === "invalid") {
+    console.error(`Error: vinaya.config.json is invalid — ${read.error}`);
+    console.error("Fix it before upgrading (upgrade never guesses at a corrupt manifest).");
+    return 1;
+  }
+  const { manifest } = read;
+  if (manifest.version > MANAGED_MANIFEST_VERSION) {
+    console.error(`Error: this repo's vinaya manifest is version ${manifest.version}, newer than the installed vinaya ` + `package understands (version ${MANAGED_MANIFEST_VERSION}). Upgrade the vinaya package itself first, ` + "then re-run `vinaya upgrade`.");
+    return 1;
+  }
+  const hookDir = hookDirFromManifest(manifest, deps.hookDirFor(repo.repoRoot));
+  const ctx = { owner: repo.owner, repo: repo.repo, hookDir };
+  const ops = buildInitOps(ctx);
+  const plan = planUpgrade(ops, repo.repoRoot, manifest);
+  if (!plan.hasChanges) {
+    process.stdout.write(`vinaya upgrade — already current. Nothing to do.
+`);
+    return 0;
+  }
+  process.stdout.write(`vinaya upgrade — the full diff of every intended change:
+
+`);
+  process.stdout.write(`${renderUpgradeDiff(plan)}
+`);
+  if (dryRun) {
+    process.stdout.write(`
+--dry-run: nothing was written.
+`);
+    return 0;
+  }
+  if (!yes) {
+    const ok2 = await deps.confirm("Regenerate these vinaya-owned artifacts?");
+    if (!ok2) {
+      process.stdout.write(`Aborted. Nothing was written.
+`);
+      return 0;
+    }
+  }
+  applyUpgrade(plan, repo.repoRoot);
+  writeManifestVersion(repo.repoRoot, manifest);
+  process.stdout.write(`
+Vinaya upgraded.
+`);
+  return 0;
+}
+async function upgradeCommand(args) {
+  process.exit(await runUpgrade(args, realDeps4()));
+}
+
+// ../sources/src/commands.ts
+var COMMANDS = [
+  {
+    name: "help",
+    description: "Show this help text",
+    status: "shipped"
+  },
+  {
+    name: "version",
+    description: "Print the CLI version",
+    flags: [{ flag: "--json", description: "Enveloped JSON output (schema: 1)" }],
+    status: "shipped"
+  },
+  {
+    name: "init",
+    description: "Install Vinaya's git hooks, CI workflow, and starter config (diff-and-confirm, non-destructive)",
+    flags: [
+      { flag: "--dry-run", description: "Print the full diff without installing anything" },
+      { flag: "--yes", description: "Skip the confirmation prompt" }
+    ],
+    details: [
+      "It detects your repo, prints the complete diff of every intended change, and waits for your confirmation before installing anything. `--dry-run` prints that same diff and installs nothing. Nothing ever runs automatically on package install.",
+      "It installs one CI workflow that runs `vinaya check --all --diff-only`, alongside your existing workflows — refusing to overwrite rather than touching foreign content already at that path. Git hook stubs invoke the `vinaya` binary directly; if a hook already exists, it appends a delimited managed block, shown verbatim in the diff first, rather than overwriting it.",
+      "`vinaya.config.json` is seeded with a starter ruleset extracted from Vinaya's own battle-tested gates, not invented defaults. Issue and PR templates carrying the brief schema are added alongside your own; tier and `needs:*-input` labels are created only if they don't already exist — your existing labels are never modified.",
+      "The recommended branch-protection command is printed for you to run yourself — it is never applied, and your PATH is never touched. `eject` removes exactly the managed block it owns, or a whole file only if `init` created it."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "init product",
+    description: "Scaffold an additional governed product area in an already-initialized monorepo",
+    status: "shipped"
+  },
+  {
+    name: "check",
+    description: "Run one check, or every registered check",
+    flags: [
+      { flag: "--all", description: "Run every registered check instead of one named check" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" },
+      { flag: "--diff-only", description: "Scope diff-declared checks to changed files" },
+      { flag: "--parallel[=n]", description: "Concurrency cap (default: cpu-derived)" }
+    ],
+    status: "shipped"
+  },
+  {
+    name: "new check",
+    description: "Scaffold a custom check into ./scripts/vinaya-checks/",
+    status: "shipped"
+  },
+  {
+    name: "pr create",
+    description: "Open a pull request after full brief-schema validation",
+    flags: [
+      { flag: "--title", description: "PR title (validated against the forge-title grammar)" },
+      { flag: "--body-file", description: "Path to the PR body (stream-safe; the same bytes are validated and sent)" },
+      { flag: "--label", description: "Label(s) to apply (repeatable, comma-separated)" },
+      { flag: "--validate-only", description: "Run every gate and report PASS without opening the PR" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "Runs the config-defined brief-schema gate (`briefSchema.pr` in `vinaya.config.json`) LOCALLY before any `gh` write — prevention, not detection. On any failure it refuses with the versioned CheckError contract (one JSON line per finding on stderr, exit 1) whose `agent_recovery_prompt` names the exact corrective command."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "pr edit",
+    description: "Edit an existing pull request (<n>) after full brief-schema validation",
+    flags: [
+      { flag: "--title", description: "New PR title (validated against the forge-title grammar)" },
+      { flag: "--body-file", description: "Path to the new PR body (stream-safe; same bytes validated and sent)" },
+      { flag: "--validate-only", description: "Run every gate and report PASS without editing the PR" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "The target PR's real head branch and changed files are fetched from the forge to build the validation context — a failed fetch is a hard refusal, never a fall-back to the local checkout."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "issue create",
+    description: "Open an issue after full brief-schema validation",
+    flags: [
+      { flag: "--title", description: "Issue title (validated on task Issues)" },
+      { flag: "--body-file", description: "Path to the Issue body (stream-safe; same bytes validated and sent)" },
+      { flag: "--label", description: "Label(s) to apply; a `vinaya/tranche:*` label marks a task Issue" },
+      { flag: "--validate-only", description: "Run every gate and report PASS without opening the Issue" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "A task Issue (any `vinaya/tranche:*` label) must carry the full Planner rationale (`briefSchema.issue`); non-task Issues pass through unvalidated."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "issue edit",
+    description: "Edit an existing issue (<n>) after full brief-schema validation",
+    flags: [
+      { flag: "--title", description: "New Issue title (validated on task Issues)" },
+      { flag: "--body-file", description: "Path to the new Issue body (stream-safe; same bytes validated and sent)" },
+      { flag: "--validate-only", description: "Run every gate and report PASS without editing the Issue" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "The target Issue's actual labels are fetched from the forge and unioned with argv to decide task-Issue applicability — a failed fetch is a hard refusal."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "doctor",
+    description: "Diagnose hook, workflow, and config health — report only, never mutates",
+    flags: [{ flag: "--json", description: "Enveloped JSON output (schema: 1)" }],
+    status: "shipped"
+  },
+  {
+    name: "upgrade",
+    description: "Regenerate hooks, workflow, and config to the current contract version (diff-and-confirm)",
+    flags: [
+      { flag: "--dry-run", description: "Print the full diff without regenerating anything" },
+      { flag: "--yes", description: "Skip the confirmation prompt" }
+    ],
+    status: "shipped"
+  },
+  {
+    name: "eject",
+    description: "Remove every Vinaya-installed artifact, restoring the repo to stock",
+    flags: [
+      { flag: "--dry-run", description: "Print the full removal diff without removing anything" },
+      { flag: "--yes", description: "Skip the confirmation prompt" }
+    ],
+    status: "shipped"
+  },
+  {
+    name: "demo break",
+    description: "Run a guided refusal-then-fix demo on an isolated, discardable branch",
+    status: "planned"
+  },
+  {
+    name: "waiver",
+    description: "Apply the principal-verified 'vinaya/waiver:docs' label after prompting for a reason",
+    status: "planned"
+  },
+  {
+    name: "studio",
+    description: "Launch local Vinaya Studio against this repo (requires a Vinaya workspace checkout)",
+    status: "shipped"
+  }
+];
+// ../sources/src/select-source.ts
+import { z as z2 } from "zod";
+var StateSourceConfigSchema = z2.discriminatedUnion("kind", [
+  z2.object({ kind: z2.literal("forge"), owner: z2.string(), repo: z2.string() }),
+  z2.object({ kind: z2.literal("file"), root: z2.string().optional() })
+]);
+// src/lib/output.ts
+var NAME_COLUMN_WIDTH = 28;
+var PLANNED_MARKER = "[planned — not yet implemented] ";
+function row(indent2, name, description) {
+  const padded = name.length >= NAME_COLUMN_WIDTH ? `${name} ` : name.padEnd(NAME_COLUMN_WIDTH);
+  return `${indent2}${padded}${description}`;
+}
+function printHelp() {
+  const lines = ["vinaya — Vinaya CLI", "", "USAGE", "  vinaya <command> [options]", "", "COMMANDS"];
+  for (const command of COMMANDS) {
+    const marker = command.status === "planned" ? PLANNED_MARKER : "";
+    lines.push(row("  ", command.name, `${marker}${command.description}`));
+    for (const flag of command.flags ?? []) {
+      lines.push(row("    ", flag.flag, `${marker}${flag.description}`));
+    }
+  }
+  lines.push("", "Run 'vinaya version' to check what's installed.");
+  process.stdout.write(`${lines.join(`
+`)}
+`);
+}
+
+// src/index.ts
+var PACKAGE_ROOT = join12(dirname7(fileURLToPath4(import.meta.url)), "..");
+function readVersion2() {
+  const pkg = JSON.parse(readFileSync10(join12(PACKAGE_ROOT, "package.json"), "utf-8"));
+  return pkg.version;
+}
+var [, , command, ...args] = process.argv;
+if (!command || command === "help" || command === "--help" || command === "-h") {
+  printHelp();
+  process.exit(0);
+}
+try {
+  switch (command) {
+    case "version": {
+      const version = readVersion2();
+      if (args.includes("--json")) {
+        printJson({ version });
+      } else {
+        process.stdout.write(`${version}
+`);
+      }
+      break;
+    }
+    case "studio": {
+      const code = await runStudio(process.cwd(), args);
+      process.exit(code);
+      break;
+    }
+    case "init": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "product") {
+        await initProductCommand(rest);
+      } else {
+        await initCommand(args);
+      }
+      break;
+    }
+    case "eject": {
+      await ejectCommand(args);
+      break;
+    }
+    case "doctor": {
+      await doctorCommand(args);
+      break;
+    }
+    case "upgrade": {
+      await upgradeCommand(args);
+      break;
+    }
+    case "check": {
+      await checkCommand(args);
+      break;
+    }
+    case "new": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "check") {
+        newCheckCommand(rest);
+      } else {
+        console.error(`Unknown 'new' subcommand: ${subcommand ?? "(none)"}`);
+        process.exit(2);
+      }
+      break;
+    }
+    case "pr": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "create") {
+        prCreateCommand(rest);
+      } else if (subcommand === "edit") {
+        prEditCommand(rest);
+      } else {
+        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create' or 'edit')`);
+        process.exit(2);
+      }
+      break;
+    }
+    case "issue": {
+      const [subcommand, ...rest] = args;
+      if (subcommand === "create") {
+        issueCreateCommand(rest);
+      } else if (subcommand === "edit") {
+        issueEditCommand(rest);
+      } else {
+        console.error(`Unknown 'issue' subcommand: ${subcommand ?? "(none)"} (expected 'create' or 'edit')`);
+        process.exit(2);
+      }
+      break;
+    }
+    default:
+      console.error(`Unknown command: ${command}`);
+      printHelp();
+      process.exit(2);
+  }
+} catch (error2) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
+  console.error(`Error: ${message}`);
+  process.exit(1);
+}