@bensandee/tooling 0.93.1 → 0.95.0

package/dist/bin.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { accessSync, appendFileSync, closeSync, constants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import fs, { accessSync, appendFileSync, closeSync, constants, copyFileSync, existsSync, fstatSync, globSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import path, * as path$1 from "node:path";
 import { parseArgs, parseEnv } from "node:util";
 import { FatalError, TransientError, UnexpectedError, describeError, describeError as describeError$1, redact, redact as redact$1 } from "@bensandee/common";
@@ -15,7 +15,7 @@ import { isMap, isScalar, isSeq, parse as parse$1, parseAllDocuments, parseDocum
 import { StringDecoder } from "node:string_decoder";
 import { parse as parse$2 } from "smol-toml";
 import picomatch from "picomatch";
-import { tmpdir } from "node:os";
+import os, { tmpdir } from "node:os";
 import net from "node:net";
 import { createHmac } from "node:crypto";
 import { fileURLToPath } from "node:url";
@@ -175,7 +175,7 @@ function loadEnvFileForBin(rawArgs, bin, io = processIo) {
 //#region src/env-file-preload.ts
 const envFileLoad = loadEnvFileForBin(process.argv.slice(2), {
 	name: "bst",
-	version: "0.93.1"
+	version: "0.95.0"
 });
 //#endregion
 //#region ../cli-kit/src/logger.ts
@@ -448,7 +448,8 @@ function resolveRepoUrlFrom(readOrigin, readPackageUrl) {
 	const originUrl = normalizeGitUrl(readOrigin() ?? "");
 	if (originUrl !== null && parseGitUrl(originUrl) !== null) return originUrl;
 	const pkgUrl = readPackageUrl();
-	return pkgUrl !== null && parseGitUrl(pkgUrl) !== null ? pkgUrl : null;
+	if (pkgUrl === null || parseGitUrl(pkgUrl) === null) return null;
+	return normalizeGitUrl(pkgUrl);
 }
 function resolveForgejoCoordinates(env, repoUrl) {
 	const serverUrl = env["FORGEJO_SERVER_URL"];
@@ -554,10 +555,11 @@ function resolveIssueTarget(refTarget, repo) {
 	throw new RepoTargetMismatchError(`${repoTarget.serverUrl}/${repoTarget.repository}`, `${refTarget.serverUrl}/${refTarget.repository}`);
 }
 function normalizeGitUrl(raw) {
-	const sshMatch = raw.match(/^git@([^:]+):(.+?)(?:\.git)?$/);
+	const value = raw.startsWith("git+") ? raw.slice(4) : raw;
+	const sshMatch = value.match(/^git@([^:]+):(.+?)(?:\.git)?$/);
 	if (sshMatch) return `https://${sshMatch[1]}/${sshMatch[2]}`;
 	try {
-		const url = new URL(raw);
+		const url = new URL(value);
 		url.pathname = url.pathname.replace(/\.git$/, "");
 		url.username = "";
 		url.password = "";
@@ -688,7 +690,10 @@ const HealthRecordSchema = HealthMetricsSchema.extend(HealthObservationsSchema.s
 });
 const RATCHETED_METRIC_KEY_SET = new Set(RATCHETED_METRIC_KEYS);
 const ModuleCeilingsSchema = z.preprocess((value) => typeof value === "object" && value !== null ? Object.fromEntries(Object.entries(value).filter(([key]) => RATCHETED_METRIC_KEY_SET.has(key))) : value, z.partialRecord(z.enum(RATCHETED_METRIC_KEYS), z.record(z.string(), z.number().int().nonnegative())));
-const HealthBaselineSchema = HealthMetricsSchema.extend({ moduleCeilings: ModuleCeilingsSchema.optional() });
+const HealthBaselineSchema = HealthMetricsSchema.extend({
+	moduleCeilings: ModuleCeilingsSchema.optional(),
+	sizeBudgets: z.record(z.string(), z.number().int().nonnegative()).optional()
+});
 function parseHealthBaseline(raw) {
 	let json;
 	try {
@@ -757,6 +762,18 @@ function formatIssue$1(issue) {
 	}
 	return `  ${loc}: ${issue.message}`;
 }
+const SIZE_BUDGET_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+const SizeBudgetSchema = z.union([
+	z.object({ file: z.string().min(1).meta({ description: "Repo-relative path of the one file whose byte size is measured." }) }).meta({ description: "A size budget measuring the bytes of a single file." }),
+	z.object({
+		glob: z.string().min(1).meta({ description: "Glob matched against repo-relative paths under the target." }),
+		aggregate: z.enum(["total", "largest"]).meta({ description: "How the matched files become one number: the sum of their bytes, or the biggest single file." })
+	}).meta({ description: "A size budget measuring the bytes of every file a glob matches." }),
+	z.object({
+		script: z.string().min(1).meta({ description: "Package script run as `pnpm run --silent <script>`; it reports one number through the reserved measure marker." }),
+		files: z.array(z.string().min(1)).meta({ description: "Globs naming the code that computes the number: a match in the branch's diff marks the measurement as changed by this branch." })
+	}).meta({ description: "A size budget measured by running a package script that prints one number." })
+]);
 const HealthConfigSchema = z.strictObject({
 	enabled: z.boolean().optional().meta({ description: "Opts into the gate (default false; absent and false alike mean off). `health:check` and `health:summary` print a disabled notice and exit 0 rather than failing while off. Read at generation time as well as at check time, so enabling the gate takes a `repo:sync` as well as a config edit. Dominates `history`." }),
 	src: z.array(z.string()).optional().meta({ description: "Repo-relative directory roots the measurement is scoped to (default `[\"packages/*/src\"]` when a `packages/` directory exists at the repo root, else `[\"src\"]`). Scopes both the file-tree walk and the dependency-cruiser globs, but not the same way: for the file-tree walk, an entry is expanded against existing directories (one `*` segment only, nothing else). An entry the expander cannot represent at all (`src/**/*.ts`, any other `**`) and one that is well-formed but names no existing directory (a typo, a directory renamed after the config was written) are both reported by name, classified separately, and a run whose file-tree scope resolves to zero source files fails `health:check` before its baseline is read, created, updated, or reset -- `--no-fail-on-empty-src` downgrades that to a notice. For the dependency-cruiser globs the entry is spliced in verbatim, so a `**` entry like `packages/**/src` still cruises and leaves the graph metrics live even though `crowdedDirectories` and the linesOfCode observation see an empty tree. Use `packages/*/src`. The file-tree walk also drops test files, `.d.ts` declarations and `exclude` matches; the dependency-cruiser half drops only `exclude` matches, so a colocated test file or a `.d.ts` under a `src` root still carries graph edges." }),
@@ -766,11 +783,12 @@ const HealthConfigSchema = z.strictObject({
 	fanInLimit: z.number().int().nonnegative().optional().meta({ description: "A module is a fan-in outlier above this many importers, and only when it also exceeds `moduleSizeLimit` source lines (defaults 10 and 200) -- popularity alone is not coupling. Only value edges are counted: a type-only import is erased before the graph is built and never moves this count, and a third-party import resolves outside the graph entirely. A cross-package import counts unless `crossPackage` is off (default on) -- see that setting. Never duplicate a type or fork a helper to stay under the limit -- prefer a justified `exempt` entry, which names the hub, over raising the limit, which hides it." }),
 	fanOutLimit: z.number().int().nonnegative().optional().meta({ description: "A module is a fan-out outlier above this many first-party dependencies (default 10). Counted on the same value-edge basis as fanInLimit, `crossPackage` included, with the same consequence: an import you were about to inline or copy to protect this budget most likely costs nothing." }),
 	moduleSizeLimit: z.number().int().nonnegative().optional().meta({ description: "Raw source lines a module must exceed before its importer count can make it a fan-in outlier (default 200) -- comments and blanks included, since the question is how big the module is to read, not how much code it holds. A module with many importers and little surface is a leaf, not a junction: it has one job and no reason to change for any of its callers, so counting its importers reports popularity rather than coupling. Applies to fan-in only -- a small module with many dependencies is a barrel, which is a finding." }),
-	crossPackage: z.boolean().optional().meta({ description: "Count dependency edges that cross a workspace package boundary (default true). On by default because the alternative measures the wrong thing: with it off, moving a module into its own package removes its importers from every metric, so extracting a package hides a hub rather than fixing it. A monorepo adopting the default sees fan-in and fan-out rise once, and adopts that rise as a ceiling-only pull request -- a branch whose diff changes nothing but health-baseline.json and .tooling.json, which a person merges; a single-package repo has no workspace siblings to resolve, so no new edge enters its graph. Set it to false only where the package boundary is a curated API surface an edge across genuinely costs less, or to hold a baseline on the old measurement basis." }),
+	crossPackage: z.boolean().optional().meta({ description: "Count dependency edges that cross a workspace package boundary (default true). On by default because the alternative measures the wrong thing: with it off, moving a module into its own package removes its importers from every metric, so extracting a package hides a hub rather than fixing it. A monorepo adopting the default sees fan-in and fan-out rise once, and adopts that rise with `bst health:raise` in the pull request that adopts the setting, which a person merges; a single-package repo has no workspace siblings to resolve, so no new edge enters its graph. Set it to false only where the package boundary is a curated API surface an edge across genuinely costs less, or to hold a baseline on the old measurement basis." }),
 	history: z.enum(["orphan-branch", "none"]).optional().meta({ description: "How history is persisted. \"orphan-branch\" (default) has `health:record` append one JSON line per commit to `historyBranch` and has `repo:sync` emit the CI record and status steps; \"none\" turns both off. Does not disable the gate, since the baseline is a committed file. Ignored when `enabled` is false." }),
 	historyBranch: z.string().optional().meta({ description: "The orphan branch `health:record` appends to and `health:status` reads (default \"bst/health-metrics\"). Never merges into the default branch and holds no source; separate from `coverage.historyBranch` and must not share a branch with it. `branch:prune`'s built-in never-touch list matches the default name exactly, so a custom name should be named in `branchPrune.exclude` as well." }),
 	tolerance: z.number().int().nonnegative().optional().meta({ description: "Slack in offender counts before an increase is a regression: a metric fails when the current count exceeds baseline + tolerance (default 0, so any increase fails). The same allowance applies to every per-module ceiling in health-baseline.json's moduleCeilings, not only the headline metrics. A count, not a percentage -- coverage's percentage-point slack is `coverage.tolerancePp`. Raising it un-tracks every module beneath the new line at once, which is why a justified `exempt` entry is the better answer to one stubborn hub." }),
-	exempt: z.partialRecord(z.enum(EXEMPTABLE_METRIC_KEYS), z.record(z.string(), z.string().min(1).refine((reason) => reason.trim() !== "", { message: "must not be blank" }))).optional().meta({ description: "Per-metric, per-module exemption, keyed first by metric name (fanInOutliers, fanOutOutliers or crowdedDirectories) then by the repo-relative path exactly as `health:summary --explain` prints it: a module path for the two fan metrics, a directory path for crowdedDirectories. Each path maps to a required, non-empty justification string. An exempt module or directory is listed in the summary with its count and reason, carries no ceiling in health-baseline.json, and is counted in no metric -- it is out of the gate, not suppressed inside it. Adding one is a raise: it travels alone in a ceiling-only pull request, never beside code. An exempt module stays fully in the graph -- its edges still count toward every other module's fan-in/fan-out." })
+	sizeBudgets: z.record(z.string().regex(SIZE_BUDGET_ID_PATTERN), SizeBudgetSchema).optional().meta({ description: "Artifact size budgets: id -> what to measure. Each id records one ceiling in health-baseline.json's sizeBudgets, and `health:check` fails when the measured number exceeds it. Absent means no size metric at all. A budget with no recorded value fails as unrecorded until `--update-baseline` records it; a file or glob that measures nothing fails rather than reading as zero. Measured at the working tree only, never at the merge base, so a crossing always names this branch. Raising a recorded value is a raise: write it with `bst health:raise`, in the pull request whose change crossed the budget." }),
+	exempt: z.partialRecord(z.enum(EXEMPTABLE_METRIC_KEYS), z.record(z.string(), z.string().min(1).refine((reason) => reason.trim() !== "", { message: "must not be blank" }))).optional().meta({ description: "Per-metric, per-module exemption, keyed first by metric name (fanInOutliers, fanOutOutliers or crowdedDirectories) then by the repo-relative path exactly as `health:summary --explain` prints it: a module path for the two fan metrics, a directory path for crowdedDirectories. A key may instead be a picomatch glob (e.g. `packages/contract/src/core/**`), matched against the path itself and never its ancestors; an exact key wins over a glob that also matches, and otherwise the first matching glob's reason applies. A glob also covers modules added later, which still show in the summary with their counts. Each path maps to a required, non-empty justification string. An exempt module or directory is listed in the summary with its count and reason, carries no ceiling in health-baseline.json, and is counted in no metric -- it is out of the gate, not suppressed inside it. Adding one is a raise: write it with `bst health:raise --exempt`, in the pull request whose code made the module a hub. An exempt module stays fully in the graph -- its edges still count toward every other module's fan-in/fan-out." })
 });
 const CharsConfigSchema = z.strictObject({
 	enabled: z.boolean().optional().meta({ description: "Run the chars:check gate (default true). Set false to opt out -- the only off-switch: the gate scans tracked text files for LLM-tell punctuation and invisible or deceptive characters, and passes letters in any language." }),
@@ -838,8 +856,8 @@ const TolerantDockerCheckConfigSchema = z.object({
 	...DockerCheckConfigSchema.shape,
 	healthChecks: z.array(tolerantBlock(DeclarativeHealthCheckSchema)).optional()
 });
-const DEFAULT_BRANCH_NAME_PATTERN = /^(?!.*\/\/)(?!.*\.\.)(?!.*\/$)(?!.*\.lock$)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
-const DefaultBranchNameSchema = z.string().regex(DEFAULT_BRANCH_NAME_PATTERN, "must be a plain branch name: ASCII letters, digits, '.', '_', '-' and '/', starting with a letter or digit, with no '//', '..', trailing '/', or '.lock' suffix");
+const DEFAULT_BRANCH_NAME_PATTERN = /^(?!refs\/)(?!.*\/\/)(?!.*\.\.)(?!.*\/$)(?!.*\.lock$)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const DefaultBranchNameSchema = z.string().regex(DEFAULT_BRANCH_NAME_PATTERN, "must be a plain branch name: ASCII letters, digits, '.', '_', '-' and '/', starting with a letter or digit, with no leading 'refs/', no '//', '..', trailing '/', or '.lock' suffix");
 const AgentEnabledSliceSchema = z.looseObject({ agent: z.looseObject({ enabled: z.boolean().optional() }).optional() });
 function agentEnabledIn(raw) {
 	try {
@@ -875,6 +893,9 @@ const JS_EXTENSIONS$1 = /* @__PURE__ */ new Set([
 	".mjs",
 	".cjs"
 ]);
+function sourceGlob(stack, dir = "src") {
+	return `${dir}/**/*.{${[...stack === "typescript" ? TS_EXTENSIONS$1 : JS_EXTENSIONS$1].map((ext) => ext.slice(1)).join(",")}}`;
+}
 function isRootConfigFile(relPath) {
 	if (relPath.includes(path.sep)) return false;
 	return /\.config\.[cm]?[jt]sx?$/.test(relPath) || relPath.startsWith(".");
@@ -1041,6 +1062,12 @@ function detectProjectType(targetDir) {
 	if (pkg.exports || pkg.main || pkg.types || pkg.typings) return "library";
 	return "default";
 }
+function resolveProjectType(packageType, structure, builder) {
+	if (structure === "monorepo") return "default";
+	if (packageType === "react") return "react";
+	if (builder === "none") return "node";
+	return packageType;
+}
 const WEB_UI_DEPS = /* @__PURE__ */ new Set([
 	"react",
 	"react-dom",
@@ -1078,19 +1105,21 @@ function computeDefaults(targetDir) {
 	const detected = detectProject(targetDir);
 	const isMonorepo = detected.hasPnpmWorkspace;
 	const hasPrettier = detected.legacyConfigs.some((l) => l.tool === "prettier");
+	const structure = isMonorepo ? "monorepo" : "single";
+	const builder = detectBuilder(targetDir, readPackageJson(targetDir));
 	return {
-		structure: isMonorepo ? "monorepo" : "single",
+		structure,
 		useEslintPlugin: true,
 		formatter: hasPrettier ? "prettier" : "oxfmt",
 		stack: detectStack(targetDir),
-		builder: detectBuilder(targetDir, readPackageJson(targetDir)),
+		builder,
 		setupVitest: !isMonorepo && !detected.hasVitestConfig,
 		ci: detectCiPlatform(targetDir),
 		setupRenovate: true,
 		releaseStrategy: "none",
 		publishNpm: false,
 		publishDocker: false,
-		projectType: isMonorepo ? "default" : detectProjectType(targetDir),
+		projectType: resolveProjectType(detectProjectType(targetDir), structure, builder),
 		detectPackageTypes: true
 	};
 }
@@ -1159,7 +1188,7 @@ async function runInitPrompts(targetDir, saved, options) {
 	let ci = saved?.ci ?? defaults.ci;
 	const setupRenovate = saved?.setupRenovate ?? defaults.setupRenovate;
 	let releaseStrategy = saved?.releaseStrategy ?? defaults.releaseStrategy;
-	const projectType = saved?.projectType ?? defaults.projectType;
+	let projectType = saved?.projectType ?? defaults.projectType;
 	const detectPackageTypes = saved?.detectPackageTypes ?? defaults.detectPackageTypes;
 	const skipPrompts = (options?.skipStackPrompt ?? false) || Boolean(process.env["CI"]);
 	if (isFirstInit && defaults.stack === "none" && !skipPrompts) {
@@ -1216,6 +1245,7 @@ async function runInitPrompts(targetDir, saved, options) {
 			builder = builderAnswer;
 		}
 	}
+	if (saved?.projectType === void 0) projectType = resolveProjectType(detectProjectType(targetDir), structure, builder);
 	if (detected.legacyConfigs.some((l) => l.tool === "prettier") && isFirstInit) {
 		const formatterAnswer = await clack.select({
 			message: "Existing Prettier config found. Keep Prettier or migrate to oxfmt?",
@@ -1576,12 +1606,15 @@ function createDryRunContext(config, dockerDiscovery) {
 	};
 }
 //#endregion
+//#region src/repo-full-name.ts
+const REPO_FULL_NAME = /^(?!\.\.?\/)[\w.-]+\/(?!\.\.?$)[\w.-]+$/u;
+//#endregion
 //#region src/docs-check/config.ts
 const DEFAULT_STALE_DAYS = 30;
 const DocsConfigSchema = z.strictObject({
 	enforced: z.union([z.boolean(), z.array(z.string())]).optional().meta({ description: "Which discovered pairs fail the build. true = all; an array names active dirs (e.g. [\"docs/plans\"]); default false = every violation is advisory." }),
 	dirs: z.array(z.string()).optional().meta({ description: "Extra active doc dirs beyond convention (e.g. [\"docs/rfcs\"]). Each retires into its own retired/ subdir." }),
-	staleDays: z.number().int().nonnegative().optional().meta({ description: "Days before an untouched active doc is flagged (default 30; 0 disables the rule)." }),
+	staleDays: z.number().int().nonnegative().optional().meta({ description: "Days before an unchanged active doc is flagged (default 30; 0 disables the rule)." }),
 	staleEnforced: z.boolean().optional().meta({ description: "Make the staleness rule fatal inside an enforced pair (default false: staleness is always advisory)." })
 });
 const DEFAULT_DOCS_CONFIG = {
@@ -1713,9 +1746,9 @@ const LintSweepConfigSchema = z.strictObject({
 });
 const AgentEgressConfigSchema = z.strictObject({ browseHosts: z.array(z.string().min(1)).optional().meta({ description: "Host patterns this repo's agent containers may fetch from, on top of the hosts every run needs: an exact host (`fastdl.mongodb.org`) or a wildcard over its leftmost label (`*.example.com`). No ports. These join the browse lane, which serves GET and HEAD only." }) });
 const AgentConfigSchema = z.strictObject({
-	enabled: z.boolean().optional().meta({ description: "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. `bst setup:agent` sets it to true and runs the sync. Provisioning the agent's labels is not consent, and is never gated by this key." }),
+	enabled: z.boolean().optional().meta({ description: "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. `pnpm exec bst setup:agent` sets it to true and runs the sync. Provisioning the agent's labels is not consent, and is never gated by this key." }),
 	autonomy: z.boolean().optional().meta({ description: "Opt into interior autonomy (default false). When a phase's latest rationale reports readiness \"ready\" with an empty openQuestions[] and the review phase is clean, the agent applies the existing plan -> implement -> review -> park-at-mergeable advance itself instead of parking for a human. Never applies to the design/spec gate or the final merge from the mergeable terminal -- those always wait on a human. Also arms the trunk-red detector: when this repo's default branch combined status settles red, the agent files a tracking issue naming the failing checks and labels it agent/spec, starting the fix through the ordinary spec/plan/implement/review pipeline. It also closes that issue, with a comment, if the default branch recovers on its own before a human acts on it. Also arms the world-changed retrigger sweep: a pull request labelled agent-flags/autopilot that is parked at a -stuck or -failed terminal is re-queued when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base)." }),
-	preRunRebase: z.boolean().optional().meta({ description: "Merge the current default branch into the work branch before the implement (execute) phase's container starts (default true). A clean merge or an already-up-to-date branch runs the container as is; a conflicting merge is aborted, recorded on the run's status comment, and the run proceeds on the un-synced branch -- it never fails the run. Two consecutive conflicting attempts hand the unit to agent/repair before any container runs; a timeout or a failed merge never counts toward that pair. Set false to skip the attempt entirely for this repo: no fetch, no merge, no abort, and the branch is worked exactly as cloned." }),
+	preRunRebase: z.boolean().optional().meta({ description: "Merge the current default branch into the work branch before the container starts (default true) -- for an implement (execute) run, and for a spec or plan rerun on an existing branch. A clean merge or an already-up-to-date branch runs the container as is; a conflicting merge is aborted, recorded on the run's status comment, and the run proceeds on the un-synced branch -- a conflict, timeout or failed merge never fails the run, for any phase. Only the execute phase keeps the two-strike rule: two consecutive conflicting attempts hand the unit to agent/repair before any container runs, while a docs run just tries again on its next slice. Set false to skip the attempt entirely for this repo, in every phase: no fetch, no merge, no abort, and the branch is worked exactly as cloned." }),
 	backlog: z.boolean().optional().meta({ description: "Whether the agent may self-trigger backlog runs consuming this repo's .agent/findings/ ledger (default: on wherever the ledger exists, which only happens in a repo whose own review loop wrote it). A backlog run opens a pull request that fixes or refutes the pending findings; false disarms it, leaving the ledger to accumulate for a human. A run starts only once at least three findings are pending or one is older than seven days." }),
 	lintSweep: LintSweepConfigSchema.optional().meta({ description: "The lint-warning sweep: a periodic agent job that measures this repo's oxlint warnings on its default branch in a container and, past minWarnings, opens a pull request carrying a generated plan for an agent/implement run to work off." }),
 	priority: z.record(z.string(), z.enum([
@@ -1726,13 +1759,15 @@ const AgentConfigSchema = z.strictObject({
 	])).optional().meta({ description: "Map this repo's own issue-label names onto the agent's four priority levels, e.g. {\"P1\": \"critical\", \"P4\": \"low\"}. The map UNIONS with the built-in priority/<level> names rather than replacing them, and the agent does not create aliased labels -- the repo owns names the agent did not choose. Priority affects claim order only: it never changes a run's model, effort, or any budget." }),
 	triageAnalysis: z.boolean().optional().meta({ description: "Whether the agent may route its own agent-note/human-triage-needed issues through the agent/analyze stage (default: off). Unlike agent.backlog, which defaults on, this defaults off: a backlog run batches every pending finding into one container, while triage routing spends one container per issue -- arming it is the reversible direction, not disarming it." }),
 	egress: AgentEgressConfigSchema.optional().meta({ description: "Extra egress hosts this repo's agent containers may reach. `browseHosts` joins the agent's browse lane (GET and HEAD only) on top of the hosts every run needs; the passthrough lane stays agent-owned. Each entry is a host pattern -- an exact host or a *.host wildcard, never a port. Read from the repo's DEFAULT BRANCH, never off a pull request's own tree, so a run can never widen its own egress: the declaration takes effect on the first container started after a human merges it. An entry whose pattern the agent cannot parse refuses the run rather than being dropped. Changing this block holds the pull request from automerge." }),
-	findingHolds: FindingHoldsConfigSchema.optional().meta({ description: "Which of a pull request's linked open findings withhold its unattended merge. `rules` is ordered and the first `when` that matches decides; no match falls through to `default`; an absent block is { rules: [], default: true }, so every open linked finding holds by default. Read off the repo's DEFAULT BRANCH, never off the pull request's own tree -- a pull request cannot edit the rule deciding whether it is held. In a `mentions` entry a /.../flags pattern is a regular expression, a literal:<text> pattern is the substring <text> (how to name a path such as /src/utils), and anything else is a case-insensitive substring." })
+	findingHolds: FindingHoldsConfigSchema.optional().meta({ description: "Which of a pull request's linked open findings withhold its unattended merge. `rules` is ordered and the first `when` that matches decides; no match falls through to `default`; an absent block is { rules: [], default: true }, so every open linked finding holds by default. Read off the repo's DEFAULT BRANCH, never off the pull request's own tree -- a pull request cannot edit the rule deciding whether it is held. In a `mentions` entry a /.../flags pattern is a regular expression, a literal:<text> pattern is the substring <text> (how to name a path such as /src/utils), and anything else is a case-insensitive substring." }),
+	chatIssueRepos: z.array(z.string().regex(REPO_FULL_NAME)).optional().meta({ description: "Repositories with a DIFFERENT owner that a control-panel chat from this repository may file an issue in, each one a full `owner/name`, never a wildcard. A repository with the same owner needs no entry, and an entry grants nothing on its own: the target must have enabled the agent too. Read from the repo's DEFAULT BRANCH at the moment a card is applied, so a pull request cannot widen the reach of its own chat. Like every other `agent.*` key, this has no effect unless `agent.enabled` is true." })
 });
 const TolerantAgentConfigSchema = z.object({
 	...AgentConfigSchema.shape,
 	lintSweep: tolerantBlock(LintSweepConfigSchema).optional(),
 	findingHolds: z.unknown().optional(),
-	egress: z.unknown().optional()
+	egress: z.unknown().optional(),
+	chatIssueRepos: z.unknown().optional()
 });
 const BranchPruneConfigSchema = z.strictObject({
 	mergedDays: z.number().int().nonnegative().optional().meta({ description: "Days after a work branch's PR merged before bst branch:prune deletes it (default 7). Zero is valid on purpose (an explicit 'delete everything merged already'), matching the --merged-days CLI flag's contract." }),
@@ -1783,7 +1818,7 @@ const ToolingConfigSchema = z.strictObject({
 	docs: z.union([z.literal(false), DocsConfigSchema]).optional().meta({ description: "Plan/spec lifecycle gate (`bst docs:check`). Overrides only -- dirs are discovered by convention. Set to false to disable. Violations are advisory until a pair is named in `enforced`." }),
 	deploy: DeployConfigSchema.optional().meta({ description: "Generate a deploy-dispatch step in the release workflow that triggers a workflow_dispatch event in another repo after a successful release. The resolved release token must have rights on `dispatchRepo`." }),
 	pnpmWorkspace: z.literal(false).optional().meta({ description: "Set to false to opt out of pnpm-workspace.yaml management (skips both generation and the repo:sync --check validation)." }),
-	defaultBranch: DefaultBranchNameSchema.optional().meta({ description: "Repository default branch name, B. Drives the generated CI `on.push` trigger and every default-branch gate in `ci.yml` and `release.yml`, the release path (`release:changesets`, the version PR, `release:trigger`) and `checks:run`'s coverage gate. Generated output uses 'main' when unset; `checks:run` still falls back to `origin/HEAD`. Must be a plain branch name: ASCII letters, digits, '.', '_', '-' and '/'." }),
+	defaultBranch: DefaultBranchNameSchema.optional().meta({ description: "Repository default branch name. Drives the generated CI `on.push` trigger and every default-branch gate in `ci.yml` and `release.yml`, the release path (`release:changesets`, the version PR, `release:trigger`) and `checks:run`'s coverage gate. Generated output uses 'main' when unset; `checks:run` still falls back to `origin/HEAD`. Must be a plain branch name: ASCII letters, digits, '.', '_', '-' and '/', with no leading 'refs/'." }),
 	unmanagedDevDependencies: UnmanagedDevDependenciesSchema.optional().meta({ description: "devDependency names repo:sync must never add or re-pin. Escape hatch for holding a tooling-managed dep (oxlint, vitest, knip, ...) at a deliberately off-canonical version; without it, repo:sync raises any managed devDep whose version has drifted below the canonical pin." }),
 	stack: StackSchema.optional().meta({ description: "Whether the repo has TS/JS source. Detected from source evidence; TypeScript is never inferred from absence. Setting this key pins its value, even one that equals detection, and repo:sync keeps it until the key is deleted." }),
 	builder: z.enum([
@@ -1903,7 +1938,10 @@ function pruneCharsDefaults(value) {
 	return kept;
 }
 function saveToolingConfig(ctx, config) {
-	const defaults = computeDefaults(config.targetDir);
+	const defaults = {
+		...computeDefaults(config.targetDir),
+		projectType: resolveProjectType(detectProjectType(config.targetDir), config.structure, config.builder)
+	};
 	const isMonorepo = config.structure === "monorepo";
 	const existing = ctx.exists(CONFIG_FILE) ? ctx.read(CONFIG_FILE) : void 0;
 	const existingJson = parseExistingConfig(existing);
@@ -1918,7 +1956,7 @@ function saveToolingConfig(ctx, config) {
 		if (key === "chars" || key === "ascii") {
 			const pruned = pruneCharsDefaults(value);
 			if (pruned === void 0) continue;
-			result[key] = pruned;
+			result["chars"] = pruned;
 			continue;
 		}
 		result[key] = value;
@@ -1937,21 +1975,23 @@ function saveToolingConfig(ctx, config) {
 	};
 }
 function mergeWithSavedConfig(detected, saved) {
+	const structure = saved.structure ?? detected.structure;
+	const builder = saved.builder ?? detected.builder;
 	return {
 		name: detected.name,
 		targetDir: detected.targetDir,
-		structure: saved.structure ?? detected.structure,
+		structure,
 		useEslintPlugin: saved.useEslintPlugin ?? detected.useEslintPlugin,
 		formatter: saved.formatter ?? detected.formatter,
 		stack: saved.stack ?? detected.stack,
-		builder: saved.builder ?? detected.builder,
+		builder,
 		setupVitest: saved.setupVitest ?? detected.setupVitest,
 		ci: saved.ci ?? detected.ci,
 		setupRenovate: saved.setupRenovate ?? detected.setupRenovate,
 		releaseStrategy: saved.releaseStrategy ?? detected.releaseStrategy,
 		publishNpm: saved.publishNpm ?? detected.publishNpm,
 		publishDocker: saved.publishDocker ?? detected.publishDocker,
-		projectType: saved.projectType ?? detected.projectType,
+		projectType: saved.projectType ?? resolveProjectType(detectProjectType(detected.targetDir), structure, builder),
 		detectPackageTypes: saved.detectPackageTypes ?? detected.detectPackageTypes
 	};
 }
@@ -2088,10 +2128,7 @@ async function throwForgejoFailure(res, operation, notFoundMessage) {
 	if (res.status === 410) throw new FatalError(`${message}\nForgejo returned 410 Gone -- issues are likely disabled on this repository; retrying will not help.`);
 	throw new TransientError(message);
 }
-z.object({
-	secrets: z.array(z.object({ name: z.string() })),
-	total_count: z.number()
-});
+z.array(z.object({ name: z.string() }));
 const AccessTokenResponseSchema = z.object({ sha1: z.string() });
 const NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const FORBIDDEN_PREFIX_PATTERN = /^(FORGEJO_|GITEA_|GITHUB_|[0-9])/i;
@@ -2903,8 +2940,11 @@ function tracedRunners(logger) {
 					if (result.signal !== null && result.signal !== void 0) throw new UnexpectedError(`Command killed by signal ${result.signal}: ${commandLine(file, args)}`);
 					if (result.status !== 0) throw new UnexpectedError(`Command failed with exit code ${String(result.status)}: ${commandLine(file, args)}`);
 				}
-			} finally {
 				logger.trace(`execInherit [ok] ${file} (${sinceMs(startedAt)})`);
+			} catch (error) {
+				const reason = error instanceof Error ? error.message : String(error);
+				logger.trace(`execInherit [x] ${file} (${reason}, ${sinceMs(startedAt)})`);
+				throw error;
 			}
 		},
 		async fetch(url, init, retry) {
@@ -4485,8 +4525,8 @@ function buildWorkflowYaml(options) {
 }
 //#endregion
 //#region src/generators/mise-pin.ts
-const MISE_VERSION = "2026.10.8";
-const MISE_LINUX_X64_SHA256 = "c72477ae6c3a8e7d817a322f43da70e4643e75ee5c21265f1c19c894273b7428";
+const MISE_VERSION = "2026.10.15";
+const MISE_LINUX_X64_SHA256 = "e3b186d4c70627f27037be615becaf4acfb30e41fb6a1819486717dc94e4e2a9";
 const SETUP_MISE_ACTION_URL = "https://code.orangebikelabs.com/bensandee/common/actions/setup-mise";
 const SETUP_MISE_ACTION_TAG = "setup-mise@latest";
 const SETUP_MISE_ACTION_SHA = "ebe622ef0d24c7efec4a5f6093ddb18500900e24";
@@ -4716,7 +4756,7 @@ function detectReleaseAssetsConventionDirs(ctx) {
 	if (ctx.config.structure === "monorepo") {
 		const packages = getMonorepoPackages(ctx.targetDir);
 		for (const pkg of packages) {
-			const dirName = pkg.name.split("/").pop() ?? pkg.name;
+			const dirName = path.basename(pkg.dir);
 			const pkgRaw = ctx.read(`packages/${dirName}/package.json`);
 			if (!pkgRaw) continue;
 			if (parsePackageJson(pkgRaw)?.scripts?.["build:release-assets"]) dirs.push(`packages/${dirName}`);
@@ -4761,7 +4801,7 @@ async function generateDeployCi(ctx) {
 		action: "skipped",
 		description: "Publish workflow not applicable"
 	};
-	return retireManagedWorkflow(ctx, ctx.config.ci === "github" ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml", "run `bst docker:publish` to publish by hand") ?? {
+	return retireManagedWorkflow(ctx, ctx.config.ci === "github" ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml", "run `pnpm exec bst docker:publish` to publish by hand") ?? {
 		filePath,
 		action: "skipped",
 		description: "No publish workflow to retire"
@@ -4806,7 +4846,8 @@ function resolveFromOverrides(overrides, isMonorepo, stack) {
 		historyBranch: o.historyBranch ?? DEFAULT_HEALTH_HISTORY_BRANCH,
 		tolerance: o.tolerance ?? 0,
 		graphMetricsEnabled: stack !== "none",
-		exempt: o.exempt ?? {}
+		exempt: o.exempt ?? {},
+		sizeBudgets: o.sizeBudgets ?? {}
 	};
 }
 function resolveHealthConfigFromContext(reader, opts) {
@@ -5055,18 +5096,18 @@ function perPackageDevDeps(config) {
 		deps["typescript"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.19.1",
+			"@types/node": "24.19.2",
 			"@vitest/coverage-v8": "5.0.3",
-			"commit-and-tag-version": "13.2.1",
+			"commit-and-tag-version": "13.3.0",
 			"knip": "6.41.0",
-			"lefthook": "2.2.1",
-			"modern-web-guidance": "0.0.193",
-			"oxfmt": "0.72.0",
+			"lefthook": "2.2.2",
+			"modern-web-guidance": "0.0.194",
+			"oxfmt": "0.73.0",
 			"oxlint": "1.87.0",
-			"oxlint-tsgolint": "7.0.2003",
-			"prettier": "3.9.9",
+			"oxlint-tsgolint": "7.0.2004",
+			"prettier": "3.9.10",
 			"release-it": "21.1.1",
-			"tsdown": "0.23.0",
+			"tsdown": "0.23.1",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
 			"pnpm": "11.28.5"
@@ -5074,18 +5115,18 @@ function perPackageDevDeps(config) {
 		deps["@types/node"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.19.1",
+			"@types/node": "24.19.2",
 			"@vitest/coverage-v8": "5.0.3",
-			"commit-and-tag-version": "13.2.1",
+			"commit-and-tag-version": "13.3.0",
 			"knip": "6.41.0",
-			"lefthook": "2.2.1",
-			"modern-web-guidance": "0.0.193",
-			"oxfmt": "0.72.0",
+			"lefthook": "2.2.2",
+			"modern-web-guidance": "0.0.194",
+			"oxfmt": "0.73.0",
 			"oxlint": "1.87.0",
-			"oxlint-tsgolint": "7.0.2003",
-			"prettier": "3.9.9",
+			"oxlint-tsgolint": "7.0.2004",
+			"prettier": "3.9.10",
 			"release-it": "21.1.1",
-			"tsdown": "0.23.0",
+			"tsdown": "0.23.1",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
 			"pnpm": "11.28.5"
@@ -5094,18 +5135,18 @@ function perPackageDevDeps(config) {
 	if (config.builder === "tsdown") deps["tsdown"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.19.1",
+		"@types/node": "24.19.2",
 		"@vitest/coverage-v8": "5.0.3",
-		"commit-and-tag-version": "13.2.1",
+		"commit-and-tag-version": "13.3.0",
 		"knip": "6.41.0",
-		"lefthook": "2.2.1",
-		"modern-web-guidance": "0.0.193",
-		"oxfmt": "0.72.0",
+		"lefthook": "2.2.2",
+		"modern-web-guidance": "0.0.194",
+		"oxfmt": "0.73.0",
 		"oxlint": "1.87.0",
-		"oxlint-tsgolint": "7.0.2003",
-		"prettier": "3.9.9",
+		"oxlint-tsgolint": "7.0.2004",
+		"prettier": "3.9.10",
 		"release-it": "21.1.1",
-		"tsdown": "0.23.0",
+		"tsdown": "0.23.1",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
 		"pnpm": "11.28.5"
@@ -5117,18 +5158,18 @@ function vitestDevDeps() {
 		vitest: {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.19.1",
+			"@types/node": "24.19.2",
 			"@vitest/coverage-v8": "5.0.3",
-			"commit-and-tag-version": "13.2.1",
+			"commit-and-tag-version": "13.3.0",
 			"knip": "6.41.0",
-			"lefthook": "2.2.1",
-			"modern-web-guidance": "0.0.193",
-			"oxfmt": "0.72.0",
+			"lefthook": "2.2.2",
+			"modern-web-guidance": "0.0.194",
+			"oxfmt": "0.73.0",
 			"oxlint": "1.87.0",
-			"oxlint-tsgolint": "7.0.2003",
-			"prettier": "3.9.9",
+			"oxlint-tsgolint": "7.0.2004",
+			"prettier": "3.9.10",
 			"release-it": "21.1.1",
-			"tsdown": "0.23.0",
+			"tsdown": "0.23.1",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
 			"pnpm": "11.28.5"
@@ -5136,18 +5177,18 @@ function vitestDevDeps() {
 		"@vitest/coverage-v8": {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.19.1",
+			"@types/node": "24.19.2",
 			"@vitest/coverage-v8": "5.0.3",
-			"commit-and-tag-version": "13.2.1",
+			"commit-and-tag-version": "13.3.0",
 			"knip": "6.41.0",
-			"lefthook": "2.2.1",
-			"modern-web-guidance": "0.0.193",
-			"oxfmt": "0.72.0",
+			"lefthook": "2.2.2",
+			"modern-web-guidance": "0.0.194",
+			"oxfmt": "0.73.0",
 			"oxlint": "1.87.0",
-			"oxlint-tsgolint": "7.0.2003",
-			"prettier": "3.9.9",
+			"oxlint-tsgolint": "7.0.2004",
+			"prettier": "3.9.10",
 			"release-it": "21.1.1",
-			"tsdown": "0.23.0",
+			"tsdown": "0.23.1",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
 			"pnpm": "11.28.5"
@@ -5158,18 +5199,18 @@ function rootDevDeps(config) {
 	const deps = { lefthook: {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.19.1",
+		"@types/node": "24.19.2",
 		"@vitest/coverage-v8": "5.0.3",
-		"commit-and-tag-version": "13.2.1",
+		"commit-and-tag-version": "13.3.0",
 		"knip": "6.41.0",
-		"lefthook": "2.2.1",
-		"modern-web-guidance": "0.0.193",
-		"oxfmt": "0.72.0",
+		"lefthook": "2.2.2",
+		"modern-web-guidance": "0.0.194",
+		"oxfmt": "0.73.0",
 		"oxlint": "1.87.0",
-		"oxlint-tsgolint": "7.0.2003",
-		"prettier": "3.9.9",
+		"oxlint-tsgolint": "7.0.2004",
+		"prettier": "3.9.10",
 		"release-it": "21.1.1",
-		"tsdown": "0.23.0",
+		"tsdown": "0.23.1",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
 		"pnpm": "11.28.5"
@@ -5178,18 +5219,18 @@ function rootDevDeps(config) {
 		deps["knip"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.19.1",
+			"@types/node": "24.19.2",
 			"@vitest/coverage-v8": "5.0.3",
-			"commit-and-tag-version": "13.2.1",
+			"commit-and-tag-version": "13.3.0",
 			"knip": "6.41.0",
-			"lefthook": "2.2.1",
-			"modern-web-guidance": "0.0.193",
-			"oxfmt": "0.72.0",
+			"lefthook": "2.2.2",
+			"modern-web-guidance": "0.0.194",
+			"oxfmt": "0.73.0",
 			"oxlint": "1.87.0",
-			"oxlint-tsgolint": "7.0.2003",
-			"prettier": "3.9.9",
+			"oxlint-tsgolint": "7.0.2004",
+			"prettier": "3.9.10",
 			"release-it": "21.1.1",
-			"tsdown": "0.23.0",
+			"tsdown": "0.23.1",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
 			"pnpm": "11.28.5"
@@ -5197,18 +5238,18 @@ function rootDevDeps(config) {
 		deps["oxlint"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.19.1",
+			"@types/node": "24.19.2",
 			"@vitest/coverage-v8": "5.0.3",
-			"commit-and-tag-version": "13.2.1",
+			"commit-and-tag-version": "13.3.0",
 			"knip": "6.41.0",
-			"lefthook": "2.2.1",
-			"modern-web-guidance": "0.0.193",
-			"oxfmt": "0.72.0",
+			"lefthook": "2.2.2",
+			"modern-web-guidance": "0.0.194",
+			"oxfmt": "0.73.0",
 			"oxlint": "1.87.0",
-			"oxlint-tsgolint": "7.0.2003",
-			"prettier": "3.9.9",
+			"oxlint-tsgolint": "7.0.2004",
+			"prettier": "3.9.10",
 			"release-it": "21.1.1",
-			"tsdown": "0.23.0",
+			"tsdown": "0.23.1",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
 			"pnpm": "11.28.5"
@@ -5218,18 +5259,18 @@ function rootDevDeps(config) {
 	if (config.stack === "typescript") deps["oxlint-tsgolint"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.19.1",
+		"@types/node": "24.19.2",
 		"@vitest/coverage-v8": "5.0.3",
-		"commit-and-tag-version": "13.2.1",
+		"commit-and-tag-version": "13.3.0",
 		"knip": "6.41.0",
-		"lefthook": "2.2.1",
-		"modern-web-guidance": "0.0.193",
-		"oxfmt": "0.72.0",
+		"lefthook": "2.2.2",
+		"modern-web-guidance": "0.0.194",
+		"oxfmt": "0.73.0",
 		"oxlint": "1.87.0",
-		"oxlint-tsgolint": "7.0.2003",
-		"prettier": "3.9.9",
+		"oxlint-tsgolint": "7.0.2004",
+		"prettier": "3.9.10",
 		"release-it": "21.1.1",
-		"tsdown": "0.23.0",
+		"tsdown": "0.23.1",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
 		"pnpm": "11.28.5"
@@ -5242,18 +5283,18 @@ function addReleaseDeps(deps, ctx) {
 			deps["release-it"] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.19.1",
+				"@types/node": "24.19.2",
 				"@vitest/coverage-v8": "5.0.3",
-				"commit-and-tag-version": "13.2.1",
+				"commit-and-tag-version": "13.3.0",
 				"knip": "6.41.0",
-				"lefthook": "2.2.1",
-				"modern-web-guidance": "0.0.193",
-				"oxfmt": "0.72.0",
+				"lefthook": "2.2.2",
+				"modern-web-guidance": "0.0.194",
+				"oxfmt": "0.73.0",
 				"oxlint": "1.87.0",
-				"oxlint-tsgolint": "7.0.2003",
-				"prettier": "3.9.9",
+				"oxlint-tsgolint": "7.0.2004",
+				"prettier": "3.9.10",
 				"release-it": "21.1.1",
-				"tsdown": "0.23.0",
+				"tsdown": "0.23.1",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
 				"pnpm": "11.28.5"
@@ -5261,18 +5302,18 @@ function addReleaseDeps(deps, ctx) {
 			if (ctx.config.structure === "monorepo") deps["@release-it/bumper"] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.19.1",
+				"@types/node": "24.19.2",
 				"@vitest/coverage-v8": "5.0.3",
-				"commit-and-tag-version": "13.2.1",
+				"commit-and-tag-version": "13.3.0",
 				"knip": "6.41.0",
-				"lefthook": "2.2.1",
-				"modern-web-guidance": "0.0.193",
-				"oxfmt": "0.72.0",
+				"lefthook": "2.2.2",
+				"modern-web-guidance": "0.0.194",
+				"oxfmt": "0.73.0",
 				"oxlint": "1.87.0",
-				"oxlint-tsgolint": "7.0.2003",
-				"prettier": "3.9.9",
+				"oxlint-tsgolint": "7.0.2004",
+				"prettier": "3.9.10",
 				"release-it": "21.1.1",
-				"tsdown": "0.23.0",
+				"tsdown": "0.23.1",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
 				"pnpm": "11.28.5"
@@ -5282,18 +5323,18 @@ function addReleaseDeps(deps, ctx) {
 			if (wantsCommitAndTagVersion(ctx)) deps[COMMIT_AND_TAG_VERSION_PACKAGE] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.19.1",
+				"@types/node": "24.19.2",
 				"@vitest/coverage-v8": "5.0.3",
-				"commit-and-tag-version": "13.2.1",
+				"commit-and-tag-version": "13.3.0",
 				"knip": "6.41.0",
-				"lefthook": "2.2.1",
-				"modern-web-guidance": "0.0.193",
-				"oxfmt": "0.72.0",
+				"lefthook": "2.2.2",
+				"modern-web-guidance": "0.0.194",
+				"oxfmt": "0.73.0",
 				"oxlint": "1.87.0",
-				"oxlint-tsgolint": "7.0.2003",
-				"prettier": "3.9.9",
+				"oxlint-tsgolint": "7.0.2004",
+				"prettier": "3.9.10",
 				"release-it": "21.1.1",
-				"tsdown": "0.23.0",
+				"tsdown": "0.23.1",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
 				"pnpm": "11.28.5"
@@ -5302,18 +5343,18 @@ function addReleaseDeps(deps, ctx) {
 		case "changesets": deps["@changesets/cli"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.19.1",
+			"@types/node": "24.19.2",
 			"@vitest/coverage-v8": "5.0.3",
-			"commit-and-tag-version": "13.2.1",
+			"commit-and-tag-version": "13.3.0",
 			"knip": "6.41.0",
-			"lefthook": "2.2.1",
-			"modern-web-guidance": "0.0.193",
-			"oxfmt": "0.72.0",
+			"lefthook": "2.2.2",
+			"modern-web-guidance": "0.0.194",
+			"oxfmt": "0.73.0",
 			"oxlint": "1.87.0",
-			"oxlint-tsgolint": "7.0.2003",
-			"prettier": "3.9.9",
+			"oxlint-tsgolint": "7.0.2004",
+			"prettier": "3.9.10",
 			"release-it": "21.1.1",
-			"tsdown": "0.23.0",
+			"tsdown": "0.23.1",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
 			"pnpm": "11.28.5"
@@ -5430,18 +5471,18 @@ function applyMetadataDefaults(pkg, ctx, changes) {
 	const pinnedPnpm = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.19.1",
+		"@types/node": "24.19.2",
 		"@vitest/coverage-v8": "5.0.3",
-		"commit-and-tag-version": "13.2.1",
+		"commit-and-tag-version": "13.3.0",
 		"knip": "6.41.0",
-		"lefthook": "2.2.1",
-		"modern-web-guidance": "0.0.193",
-		"oxfmt": "0.72.0",
+		"lefthook": "2.2.2",
+		"modern-web-guidance": "0.0.194",
+		"oxfmt": "0.73.0",
 		"oxlint": "1.87.0",
-		"oxlint-tsgolint": "7.0.2003",
-		"prettier": "3.9.9",
+		"oxlint-tsgolint": "7.0.2004",
+		"prettier": "3.9.10",
 		"release-it": "21.1.1",
-		"tsdown": "0.23.0",
+		"tsdown": "0.23.1",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
 		"pnpm": "11.28.5"
@@ -5483,24 +5524,24 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.15.0";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.93.1";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.95.0";
 	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.17.0";
-	if (wantsAgentCli(ctx)) devDeps[AGENT_CLI_PACKAGE] = "0.1.2";
+	if (wantsAgentCli(ctx)) devDeps[AGENT_CLI_PACKAGE] = "0.1.3";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.19.1",
+		"@types/node": "24.19.2",
 		"@vitest/coverage-v8": "5.0.3",
-		"commit-and-tag-version": "13.2.1",
+		"commit-and-tag-version": "13.3.0",
 		"knip": "6.41.0",
-		"lefthook": "2.2.1",
-		"modern-web-guidance": "0.0.193",
-		"oxfmt": "0.72.0",
+		"lefthook": "2.2.2",
+		"modern-web-guidance": "0.0.194",
+		"oxfmt": "0.73.0",
 		"oxlint": "1.87.0",
-		"oxlint-tsgolint": "7.0.2003",
-		"prettier": "3.9.9",
+		"oxlint-tsgolint": "7.0.2004",
+		"prettier": "3.9.10",
 		"release-it": "21.1.1",
-		"tsdown": "0.23.0",
+		"tsdown": "0.23.1",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
 		"pnpm": "11.28.5"
@@ -5508,18 +5549,18 @@ function buildManagedDevDeps(ctx) {
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.19.1",
+		"@types/node": "24.19.2",
 		"@vitest/coverage-v8": "5.0.3",
-		"commit-and-tag-version": "13.2.1",
+		"commit-and-tag-version": "13.3.0",
 		"knip": "6.41.0",
-		"lefthook": "2.2.1",
-		"modern-web-guidance": "0.0.193",
-		"oxfmt": "0.72.0",
+		"lefthook": "2.2.2",
+		"modern-web-guidance": "0.0.194",
+		"oxfmt": "0.73.0",
 		"oxlint": "1.87.0",
-		"oxlint-tsgolint": "7.0.2003",
-		"prettier": "3.9.9",
+		"oxlint-tsgolint": "7.0.2004",
+		"prettier": "3.9.10",
 		"release-it": "21.1.1",
-		"tsdown": "0.23.0",
+		"tsdown": "0.23.1",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
 		"pnpm": "11.28.5"
@@ -5533,7 +5574,7 @@ async function generatePackageJson(ctx) {
 	const allScripts = buildManagedScripts(ctx);
 	const unmanaged = readUnmanagedDevDepNames(ctx);
 	const devDeps = buildManagedDevDeps(ctx);
-	if (existing) {
+	if (existing !== void 0 && existing.trim() !== "") {
 		const pkg = parsePackageJson(existing);
 		if (!pkg) return {
 			filePath,
@@ -5579,18 +5620,18 @@ async function generatePackageJson(ctx) {
 		packageManager: `pnpm@${{
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.19.1",
+			"@types/node": "24.19.2",
 			"@vitest/coverage-v8": "5.0.3",
-			"commit-and-tag-version": "13.2.1",
+			"commit-and-tag-version": "13.3.0",
 			"knip": "6.41.0",
-			"lefthook": "2.2.1",
-			"modern-web-guidance": "0.0.193",
-			"oxfmt": "0.72.0",
+			"lefthook": "2.2.2",
+			"modern-web-guidance": "0.0.194",
+			"oxfmt": "0.73.0",
 			"oxlint": "1.87.0",
-			"oxlint-tsgolint": "7.0.2003",
-			"prettier": "3.9.9",
+			"oxlint-tsgolint": "7.0.2004",
+			"prettier": "3.9.10",
 			"release-it": "21.1.1",
-			"tsdown": "0.23.0",
+			"tsdown": "0.23.1",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
 			"pnpm": "11.28.5"
@@ -5651,29 +5692,56 @@ function describeInclude(include) {
 	return `added include: ${formatInclude(include)}`;
 }
 function warnIfNarrowInclude(ctx, filePath, include) {
-	if (!Array.isArray(include) || include.length !== 1 || include[0] !== "src") return;
+	if (!Array.isArray(include) || include.length !== LEGACY_INCLUDE.length || !include.every((entry, index) => entry === LEGACY_INCLUDE[index])) return;
 	const testDir = path.join(path.dirname(filePath), "test");
 	if (!ctx.exists(testDir)) return;
 	log$1.warn(`${filePath}: "include" is ${formatInclude(include)}, so a test/ directory beside it sits outside tsc --noEmit and its types go unchecked. Consider "include": ${formatInclude(DEFAULT_INCLUDE)}.`);
 }
+const NODE_PRESET = "@bensandee/config/tsconfig/node";
+function extendsNodePreset(extendsValue) {
+	if (extendsValue === void 0) return false;
+	if (Array.isArray(extendsValue)) return extendsValue.includes(NODE_PRESET);
+	return extendsValue === NODE_PRESET;
+}
+const VERBATIM_MODULE_SYNTAX_KEY = "verbatimModuleSyntax";
 function buildGeneratedTsconfig(ctx, extendsValue, options = {}) {
 	const dir = options.dir ?? ".";
 	const include = options.include ?? DEFAULT_INCLUDE;
 	const config = {
 		extends: extendsValue,
+		...options.verbatimModuleSyntax ? { compilerOptions: { [VERBATIM_MODULE_SYNTAX_KEY]: true } } : {},
 		...ctx.exists(path.join(dir, "src")) ? { include: [...include] } : {}
 	};
 	return JSON.stringify(config, null, 2) + "\n";
 }
+function withMergedVerbatimKey(template) {
+	const parsed = parseTsconfig(template);
+	parsed.compilerOptions = {
+		...parsed.compilerOptions,
+		[VERBATIM_MODULE_SYNTAX_KEY]: true
+	};
+	return JSON.stringify(parsed, null, 2) + "\n";
+}
 async function generateTsconfig(ctx) {
 	const filePath = "tsconfig.json";
 	const existing = ctx.read(filePath);
 	if (ctx.config.structure === "monorepo") return [generateMonorepoRootTsconfig(ctx), ...ctx.config.detectPackageTypes ? generateMonorepoPackageTsconfigs(ctx) : []];
 	const extendsValue = `@bensandee/config/tsconfig/${ctx.config.projectType}`;
 	if (ctx.config.stack !== "typescript") {
-		const current = buildGeneratedTsconfig(ctx, extendsValue);
-		const legacy = buildGeneratedTsconfig(ctx, extendsValue, { include: LEGACY_INCLUDE });
-		if (existing !== void 0 && (existing === current || existing === legacy)) return [reportStaleConfig(filePath, `stack is ${ctx.config.stack}`)];
+		const nodePreset = extendsNodePreset(extendsValue);
+		const keylessCurrent = buildGeneratedTsconfig(ctx, extendsValue);
+		const keylessLegacy = buildGeneratedTsconfig(ctx, extendsValue, { include: LEGACY_INCLUDE });
+		const generated = /* @__PURE__ */ new Set([
+			buildGeneratedTsconfig(ctx, extendsValue, { verbatimModuleSyntax: nodePreset }),
+			buildGeneratedTsconfig(ctx, extendsValue, {
+				verbatimModuleSyntax: nodePreset,
+				include: LEGACY_INCLUDE
+			}),
+			keylessCurrent,
+			keylessLegacy,
+			...nodePreset ? [withMergedVerbatimKey(keylessCurrent), withMergedVerbatimKey(keylessLegacy)] : []
+		]);
+		if (existing !== void 0 && generated.has(existing)) return [reportStaleConfig(filePath, `stack is ${ctx.config.stack}`)];
 		return [{
 			filePath,
 			action: "skipped",
@@ -5681,7 +5749,7 @@ async function generateTsconfig(ctx) {
 		}];
 	}
 	if (!existing) {
-		ctx.write(filePath, buildGeneratedTsconfig(ctx, extendsValue));
+		ctx.write(filePath, buildGeneratedTsconfig(ctx, extendsValue, { verbatimModuleSyntax: extendsNodePreset(extendsValue) }));
 		return [{
 			filePath,
 			action: "created",
@@ -5734,6 +5802,13 @@ function mergeSingleTsconfig(ctx, filePath, extendsValue) {
 		parsed.extends = extendsValue;
 		changes.push(`added extends: ${extendsValue}`);
 	}
+	if (extendsNodePreset(parsed.extends) && parsed.compilerOptions?.[VERBATIM_MODULE_SYNTAX_KEY] === void 0) {
+		parsed.compilerOptions = {
+			...parsed.compilerOptions,
+			[VERBATIM_MODULE_SYNTAX_KEY]: true
+		};
+		changes.push(`added compilerOptions.${VERBATIM_MODULE_SYNTAX_KEY}: true`);
+	}
 	if (!parsed.include) {
 		const tsconfigDir = path.dirname(filePath);
 		const srcDir = tsconfigDir === "." ? "src" : path.join(tsconfigDir, "src");
@@ -6206,7 +6281,7 @@ function warnIfMissingJsonSummary(ctx) {
 		if (content === void 0) continue;
 		const issue = findJsonSummaryIssue(content);
 		if (issue === void 0) return;
-		log$1.warn(`${rel}: ${describeIssue(issue)} -- coverage tracking (bst coverage:summary / coverage:check) requires the "json-summary" reporter to read coverage/coverage-summary.json.`);
+		log$1.warn(`${rel}: ${describeIssue(issue)} -- coverage tracking (pnpm exec bst coverage:summary / coverage:check) requires the "json-summary" reporter to read coverage/coverage-summary.json.`);
 		return;
 	}
 }
@@ -6232,7 +6307,7 @@ function warnIfMissingInclude(ctx) {
 		const block = extractCoverageBlock(content);
 		if (block === void 0) return;
 		if (/\binclude\s*:/.test(block)) return;
-		log$1.warn(`${rel}: coverage.include is not set -- Vitest 3+ instruments only files a test imports, so an untested source file is invisible to coverage-baseline.json / bst coverage:check, not just uncovered. Suggested: coverage.include: ${suggestedInclude(ctx.config.structure)}.`);
+		log$1.warn(`${rel}: coverage.include is not set -- Vitest 3+ instruments only files a test imports, so an untested source file is invisible to coverage-baseline.json / pnpm exec bst coverage:check, not just uncovered. Suggested: coverage.include: ${suggestedInclude(ctx.config.structure)}.`);
 		return;
 	}
 }
@@ -6619,7 +6694,7 @@ async function generateTsdown(ctx) {
 		description: "Monorepo: tsdown config belongs in individual packages"
 	};
 	if (ctx.config.builder !== "tsdown") {
-		if (ctx.read(filePath) !== void 0 && isGeneratedTemplate(ctx, filePath, TSDOWN_CONFIG)) return reportStaleConfig(filePath, `builder is ${ctx.config.builder}`);
+		if (ctx.read(filePath) !== void 0 && isGeneratedTemplate(ctx, filePath, "import { defineConfig } from \"tsdown\";\n\nexport default defineConfig({\n  entry: [\"src/index.ts\"],\n});\n")) return reportStaleConfig(filePath, `builder is ${ctx.config.builder}`);
 		return {
 			filePath,
 			action: "skipped",
@@ -7478,7 +7553,7 @@ function ciDefaultBranch(source) {
 function refuseForgeDefaultMismatch(configured, source, command) {
 	const reported = ciDefaultBranch(source);
 	if (reported === void 0 || reported === configured) return;
-	throw new FatalError(`${command}: .tooling.json#defaultBranch is "${configured}", but the forge reports "${reported}" as this repository's default branch. Set .tooling.json#defaultBranch to "${reported}" and run bst repo:sync.`);
+	throw new FatalError(`${command}: .tooling.json#defaultBranch is "${configured}", but the forge reports "${reported}" as this repository's default branch. Set .tooling.json#defaultBranch to "${reported}" and run pnpm exec bst repo:sync.`);
 }
 //#endregion
 //#region src/generators/release-ci.ts
@@ -8007,15 +8082,15 @@ function ignorableDependencies(ctx) {
 function ignoreDependenciesField(dependencies) {
 	return dependencies.length > 0 ? `\n  ignoreDependencies: ${JSON.stringify(dependencies)},` : "";
 }
-function buildKnipConfigSingle(ignoreBinaries, ignoreDependencies) {
+function buildKnipConfigSingle(glob, ignoreBinaries, ignoreDependencies) {
 	return `import type { KnipConfig } from "knip";
 
 export default {
-  project: ["src/**/*.ts"],${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
+  project: ["${glob}"],${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
 } satisfies KnipConfig;
 `;
 }
-function buildKnipConfigMonorepo(ignoreBinaries, ignoreDependencies) {
+function buildKnipConfigMonorepo(glob, ignoreBinaries, ignoreDependencies) {
 	return `import type { KnipConfig } from "knip";
 
 export default {${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
@@ -8025,7 +8100,7 @@ export default {${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(
       project: [],
     },
     "packages/*": {
-      project: ["src/**/*.ts"],
+      project: ["${glob}"],
     },
   },
 } satisfies KnipConfig;
@@ -8118,17 +8193,20 @@ function ensureIgnoreInJson(content, ignoreBinaries, ignoreDependencies, needsHo
 	if (!changed) return void 0;
 	return JSON.stringify(parsed, null, 2) + "\n";
 }
+function arrayHasEntry(arrayContent, entry) {
+	return arrayContent.includes(`"${entry}"`) || arrayContent.includes(`'${entry}'`);
+}
 function missingIgnoreBinariesInTs(content, binaries) {
 	const match = /ignoreBinaries:\s*\[([^\]]*)\]/.exec(content);
 	if (!match) return binaries;
 	const arrayContent = match[1] ?? "";
-	return binaries.filter((binary) => !arrayContent.includes(`"${binary}"`));
+	return binaries.filter((binary) => !arrayHasEntry(arrayContent, binary));
 }
 function missingIgnoreDependenciesInTs(content, dependencies) {
 	const match = /ignoreDependencies:\s*\[([^\]]*)\]/.exec(content);
 	if (!match) return dependencies;
 	const arrayContent = match[1] ?? "";
-	return dependencies.filter((dependency) => !arrayContent.includes(`"${dependency}"`));
+	return dependencies.filter((dependency) => !arrayHasEntry(arrayContent, dependency));
 }
 function insertIntoTsArray(content, field, entries) {
 	const quoted = entries.map((entry) => `"${entry}"`).join(", ");
@@ -8190,6 +8268,7 @@ async function generateKnip(ctx) {
 	const isMonorepo = ctx.config.structure === "monorepo";
 	const ignoreBinaries = foreignOwnedBinaries(ctx);
 	const ignoreDependencies = ignorableDependencies(ctx);
+	const glob = sourceGlob(ctx.config.stack);
 	const buildConfig = isMonorepo ? buildKnipConfigMonorepo : buildKnipConfigSingle;
 	const existingPath = KNIP_CONFIG_PATHS.find((p) => ctx.exists(p));
 	if (existingPath) {
@@ -8200,7 +8279,7 @@ async function generateKnip(ctx) {
 			description: "Could not read existing knip config"
 		};
 		if (content.trim() === "") {
-			const blank = isJsonConfig(existingPath) ? ensureIgnorePattern("{}", existingPath, ignoreBinaries, ignoreDependencies) ?? "{}\n" : formattedTemplate(ctx, existingPath, buildConfig(ignoreBinaries, ignoreDependencies));
+			const blank = isJsonConfig(existingPath) ? ensureIgnorePattern("{}", existingPath, ignoreBinaries, ignoreDependencies) ?? "{}\n" : formattedTemplate(ctx, existingPath, buildConfig(glob, ignoreBinaries, ignoreDependencies));
 			ctx.write(existingPath, blank);
 			return {
 				filePath: existingPath,
@@ -8210,7 +8289,7 @@ async function generateKnip(ctx) {
 		}
 		const updated = ensureIgnorePattern(content, existingPath, ignoreBinaries, ignoreDependencies);
 		if (updated) {
-			ctx.write(existingPath, updated);
+			ctx.write(existingPath, ctx.format(existingPath, updated));
 			return {
 				filePath: existingPath,
 				action: "updated",
@@ -8223,7 +8302,7 @@ async function generateKnip(ctx) {
 			description: existingPath === filePath ? "Already configured" : `Existing config found at ${existingPath}`
 		};
 	}
-	ctx.write(filePath, formattedTemplate(ctx, filePath, buildConfig(ignoreBinaries, ignoreDependencies)));
+	ctx.write(filePath, formattedTemplate(ctx, filePath, buildConfig(glob, ignoreBinaries, ignoreDependencies)));
 	return {
 		filePath,
 		action: "created",
@@ -8342,7 +8421,7 @@ async function generatePnpmWorkspace(ctx) {
 	};
 	const isMonorepo = ctx.config.structure === "monorepo";
 	const existing = ctx.read(FILE_PATH);
-	if (existing === void 0) {
+	if (existing === void 0 || existing.trim() === "") {
 		ctx.write(FILE_PATH, isMonorepo ? FRESH_MONOREPO : FRESH_SINGLE);
 		return {
 			filePath: FILE_PATH,
@@ -8421,8 +8500,8 @@ function writeEmbedded(ctx, file) {
 }
 const NOT_BUILT = "run `pnpm build` from the repo root";
 async function generateClaudeHooks(ctx, embedded = {
-	hook: "/**\n * bst-hook -- Claude Code PreToolUse hook\n * @bensandee/claude-hooks\n * https://github.com/bensandee/tooling\n *\n * Auto-generated by @bensandee/tooling repo:sync -- do not edit manually.\n */\nimport * as fs from \"node:fs\";\nimport { existsSync, readFileSync, readdirSync, realpathSync, statSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { execFileSync } from \"node:child_process\";\n\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/util.js\nfunction joinValues(array, separator = \"|\") {\n	return array.map((val) => stringifyPrimitive(val)).join(separator);\n}\nfunction jsonStringifyReplacer(_, value) {\n	if (typeof value === \"bigint\") return value.toString();\n	return value;\n}\nvar Cached = class {\n	constructor(getter) {\n		this._getter = getter;\n		this._value = void 0;\n	}\n	get value() {\n		const getter = this._getter;\n		if (getter !== void 0) {\n			this._value = getter();\n			this._getter = void 0;\n		}\n		return this._value;\n	}\n};\nfunction cached(getter) {\n	return new Cached(getter);\n}\nfunction nullish(input) {\n	return input === null || input === void 0;\n}\nfunction cleanRegex(source) {\n	const start = source.startsWith(\"^\") ? 1 : 0;\n	const end = source.endsWith(\"$\") ? source.length - 1 : source.length;\n	return source.slice(start, end);\n}\nfunction assignProp(target, prop, value) {\n	Object.defineProperty(target, prop, {\n		value,\n		writable: true,\n		enumerable: true,\n		configurable: true\n	});\n}\nconst captureStackTrace = \"captureStackTrace\" in Error ? Error.captureStackTrace : (..._args) => {};\nfunction isObject(data) {\n	return typeof data === \"object\" && data !== null && !Array.isArray(data);\n}\nfunction isPlainObject(o) {\n	if (isObject(o) === false) return false;\n	const ctor = o.constructor;\n	if (ctor === void 0) return true;\n	if (typeof ctor !== \"function\") return true;\n	const prot = ctor.prototype;\n	if (isObject(prot) === false) return false;\n	if (Object.prototype.hasOwnProperty.call(prot, \"isPrototypeOf\") === false) return false;\n	return true;\n}\nfunction shallowClone(o) {\n	if (isPlainObject(o)) return { ...o };\n	if (Array.isArray(o)) return [...o];\n	if (o instanceof Map) return new Map(o);\n	if (o instanceof Set) return new Set(o);\n	return o;\n}\nfunction clone(inst, def, params) {\n	const cl = new inst._zod.constr(def ?? inst._zod.def);\n	if (!def || params?.parent) cl._zod.parent = inst;\n	return cl;\n}\nfunction normalizeParams(_params) {\n	const params = _params;\n	if (!params) return {};\n	if (typeof params === \"string\") return { error: () => params };\n	if (params?.message !== void 0) {\n		if (params?.error !== void 0) throw new Error(\"Cannot specify both `message` and `error` params\");\n		params.error = params.message;\n	}\n	delete params.message;\n	if (typeof params.error === \"string\") return {\n		...params,\n		error: () => params.error\n	};\n	return params;\n}\nfunction stringifyPrimitive(value) {\n	if (typeof value === \"bigint\") return value.toString() + \"n\";\n	if (typeof value === \"string\") return `\"${value}\"`;\n	return `${value}`;\n}\nfunction optionalKeys(shape) {\n	return Object.keys(shape).filter((k) => {\n		return shape[k]._zod.optin !== void 0 && shape[k]._zod.optout === \"optional\";\n	});\n}\nfunction aborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue !== true) return true;\n	return false;\n}\nfunction explicitlyAborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue === false) return true;\n	return false;\n}\nfunction prefixIssues(path, issues) {\n	return issues.map((iss) => {\n		var _a;\n		(_a = iss).path ?? (_a.path = []);\n		iss.path.unshift(path);\n		return iss;\n	});\n}\nfunction unwrapMessage(message) {\n	return typeof message === \"string\" ? message : message?.message;\n}\nfunction attachSchema(issues, start, inst) {\n	var _a;\n	for (let i = start; i < issues.length; i++) (_a = issues[i]).schema ?? (_a.schema = inst);\n}\nfunction finalizeIssue(iss, ctx, config) {\n	var _a;\n	const traits = iss.inst?._zod?.traits;\n	if (traits?.has(\"$ZodType\")) {\n		if (traits.has(\"$ZodCheck\")) (_a = iss).schema ?? (_a.schema = iss.inst);\n		else iss.schema = iss.inst;\n	}\n	const schemaError = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;\n	const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config.customError?.(iss)) ?? unwrapMessage(config.localeError?.(iss)) ?? \"Invalid input\";\n	const full = {};\n	for (const k of Object.keys(iss)) {\n		if (k === \"inst\" || k === \"schema\" || k === \"continue\" || k === \"input\" || k === \"__proto__\") continue;\n		full[k] = iss[k];\n	}\n	full.path ?? (full.path = []);\n	full.message = message;\n	if (ctx?.reportInput) full.input = iss.input;\n	return full;\n}\nconst highSurrogate = /[\\uD800-\\uDBFF]/;\nfunction codePointLength(str) {\n	const units = str.length;\n	if (!highSurrogate.test(str)) return units;\n	let count = units;\n	for (let i = 0; i < units - 1; i++) if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {\n		count--;\n		i++;\n	}\n	return count;\n}\nfunction getLengthableOrigin(input) {\n	if (Array.isArray(input)) return \"array\";\n	if (typeof input === \"string\") return \"string\";\n	return \"unknown\";\n}\nfunction parsedType(data) {\n	const t = typeof data;\n	switch (t) {\n		case \"number\": return Number.isNaN(data) ? \"nan\" : \"number\";\n		case \"object\": {\n			if (data === null) return \"null\";\n			if (Array.isArray(data)) return \"array\";\n			const obj = data;\n			if (obj && Object.getPrototypeOf(obj) !== Object.prototype && \"constructor\" in obj && obj.constructor) return obj.constructor.name;\n		}\n	}\n	return t;\n}\nfunction members(proto, table) {\n	for (const key in table) {\n		const desc = Object.getOwnPropertyDescriptor(table, key);\n		if (desc.get) Object.defineProperty(proto, key, {\n			...desc,\n			enumerable: false\n		});\n		else defineBound(proto, key, desc.value);\n	}\n}\nfunction own(inst, key, value, enumerable = true) {\n	Object.defineProperty(inst, key, {\n		configurable: true,\n		writable: true,\n		enumerable,\n		value\n	});\n	return value;\n}\nfunction hide(inst, key, value) {\n	return own(inst, key, value, false);\n}\nfunction defineBound(proto, key, fn) {\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			return this == null ? fn : own(this, key, fn.bind(this));\n		},\n		set(value) {\n			own(this, key, value);\n		}\n	});\n}\nfunction claim(inst, sentinel) {\n	const proto = Object.getPrototypeOf(inst);\n	return sentinel in proto ? void 0 : proto;\n}\nlet installing;\nlet broke = false;\nconst breaker = {\n	configurable: true,\n	get() {\n		broke = true;\n	}\n};\nfunction defineLazyInternal(inst, key, compute) {\n	const proto = Object.getPrototypeOf(inst._zod);\n	if (key in proto && installing !== inst._zod) {\n		installing = void 0;\n		return;\n	}\n	installing = inst._zod;\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			Object.defineProperty(this, key, breaker);\n			const outer = broke;\n			broke = false;\n			try {\n				const value = compute(this);\n				if (broke) delete this[key];\n				else Object.defineProperty(this, key, {\n					configurable: true,\n					writable: true,\n					value\n				});\n				broke = broke || outer;\n				return value;\n			} catch (err) {\n				delete this[key];\n				broke = broke || outer;\n				throw err;\n			}\n		},\n		set(value) {\n			Object.defineProperty(this, key, {\n				configurable: true,\n				writable: true,\n				value\n			});\n		}\n	});\n}\nfunction installLazyProp(inst, key, make, enumerable) {\n	const proto = claim(inst, key);\n	if (!proto) return;\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			const desc = {\n				configurable: true,\n				writable: true,\n				enumerable,\n				value: void 0\n			};\n			Object.defineProperty(this, key, desc);\n			desc.value = make(this);\n			Object.defineProperty(this, key, desc);\n			return desc.value;\n		},\n		set(value) {\n			Object.defineProperty(this, key, {\n				configurable: true,\n				writable: true,\n				enumerable,\n				value\n			});\n		}\n	});\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/core.js\nvar _a;\nconst _zodDesc = {\n	value: void 0,\n	enumerable: false\n};\nlet _E = \"captureStackTrace\" in Error ? Error : null;\nfunction newError(Definition) {\n	const E = _E;\n	if (E) {\n		const saved = E.stackTraceLimit;\n		if (typeof saved === \"number\") {\n			try {\n				E.stackTraceLimit = 0;\n			} catch {\n				_E = null;\n				return new Definition();\n			}\n			try {\n				return new Definition();\n			} finally {\n				E.stackTraceLimit = saved;\n			}\n		}\n	}\n	return new Definition();\n}\nfunction $constructor(name, initializer, proto, params) {\n	const zodProto = {};\n	function Internals(def) {\n		this.def = def;\n		this.constr = _;\n		this.traits = /* @__PURE__ */ new Set();\n	}\n	Internals.prototype = zodProto;\n	const protoMembers = proto;\n	const initialized = protoMembers && /* @__PURE__ */ new WeakSet();\n	function init(inst, def) {\n		if (!inst._zod) {\n			_zodDesc.value = new Internals(def);\n			try {\n				Object.defineProperty(inst, \"_zod\", _zodDesc);\n			} finally {\n				_zodDesc.value = void 0;\n			}\n		} else if (inst._zod.traits.has(name)) return;\n		inst._zod.traits.add(name);\n		initializer(inst, def);\n		if (initialized) {\n			const own = Object.getPrototypeOf(inst);\n			const ctorProto = inst._zod.constr.prototype;\n			let up = own;\n			while (up && up !== ctorProto) up = Object.getPrototypeOf(up);\n			const target = up ?? own;\n			if (!initialized.has(target)) {\n				initialized.add(target);\n				members(target, protoMembers);\n			}\n		}\n		const proto = _.prototype;\n		for (const k in proto) {\n			if (!Object.prototype.hasOwnProperty.call(proto, k)) continue;\n			if (!(k in inst)) inst[k] = proto[k].bind(inst);\n		}\n	}\n	const Parent = params?.Parent ?? Object;\n	class Definition extends Parent {}\n	Object.defineProperty(Definition, \"name\", { value: name });\n	function _(def) {\n		const inst = params?.Parent ? newError(Definition) : this;\n		init(inst, def);\n		const deferred = inst._zod.deferred;\n		if (deferred) {\n			for (const fn of deferred) fn();\n			inst._zod.deferred = void 0;\n		}\n		const pp = globalThis.__zod_globalConfig?.postProcessor;\n		if (pp) pp(inst);\n		return inst;\n	}\n	Object.defineProperty(_, \"init\", { value: init });\n	Object.defineProperty(_, Symbol.hasInstance, { value: (inst) => {\n		if (params?.Parent && inst instanceof params.Parent) return true;\n		return inst?._zod?.traits?.has(name);\n	} });\n	Object.defineProperty(_, \"name\", { value: name });\n	return _;\n}\nvar $ZodAsyncError = class extends Error {\n	constructor() {\n		super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);\n	}\n};\n(_a = globalThis).__zod_globalConfig ?? (_a.__zod_globalConfig = {});\nconst globalConfig = globalThis.__zod_globalConfig;\nfunction config(newConfig) {\n	if (newConfig) Object.assign(globalConfig, newConfig);\n	return globalConfig;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/errors.js\nfunction _getMessage() {\n	const internals = this._zod;\n	internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));\n	return internals.message;\n}\nfunction _setMessage(value) {\n	this._zod.message = value;\n}\nconst _messageDesc = {\n	get: _getMessage,\n	set: _setMessage,\n	enumerable: true,\n	configurable: true\n};\nconst _issuesDesc = {\n	value: void 0,\n	enumerable: false\n};\nconst _installedToString = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);\nconst initializer = (inst, def) => {\n	inst.name = \"$ZodError\";\n	_issuesDesc.value = def;\n	Object.defineProperty(inst, \"issues\", _issuesDesc);\n	_issuesDesc.value = void 0;\n	Object.defineProperty(inst, \"message\", _messageDesc);\n	const proto = Object.getPrototypeOf(inst);\n	if (!_installedToString.has(proto)) {\n		_installedToString.add(proto);\n		Object.defineProperty(proto, \"toString\", {\n			configurable: true,\n			enumerable: false,\n			get() {\n				const value = () => this.message;\n				Object.defineProperty(this, \"toString\", {\n					value,\n					configurable: true,\n					writable: true\n				});\n				return value;\n			},\n			set(value) {\n				Object.defineProperty(this, \"toString\", {\n					value,\n					configurable: true,\n					writable: true\n				});\n			}\n		});\n	}\n};\nconst $ZodError = $constructor(\"$ZodError\", initializer);\nconst $ZodRealError = $constructor(\"$ZodError\", initializer, void 0, { Parent: Error });\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/parse.js\nconst _parse = (_Err) => {\n	const fn = (schema, value, _ctx, _params) => {\n		const ctx = _ctx ? {\n			..._ctx,\n			async: false\n		} : { async: false };\n		const result = schema._zod.run({\n			value,\n			issues: []\n		}, ctx);\n		if (result instanceof Promise) throw new $ZodAsyncError();\n		if (result.issues.length) {\n			const e = new ((_params?.Err) ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n			captureStackTrace(e, _params?.callee ?? fn);\n			throw e;\n		}\n		return result.value;\n	};\n	return fn;\n};\nconst parse = /* @__PURE__*/ _parse($ZodRealError);\nconst _parseAsync = (_Err) => {\n	const fn = async (schema, value, _ctx, params) => {\n		const ctx = _ctx ? {\n			..._ctx,\n			async: true\n		} : { async: true };\n		let result = schema._zod.run({\n			value,\n			issues: []\n		}, ctx);\n		if (result instanceof Promise) result = await result;\n		if (result.issues.length) {\n			const e = new ((params?.Err) ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n			captureStackTrace(e, params?.callee ?? fn);\n			throw e;\n		}\n		return result.value;\n	};\n	return fn;\n};\nconst parseAsync = /* @__PURE__*/ _parseAsync($ZodRealError);\nconst _safeParse = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: false\n	} : { async: false };\n	const result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) throw new $ZodAsyncError();\n	return result.issues.length ? failure(_Err, result.issues, ctx) : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParse = /* @__PURE__*/ _safeParse($ZodRealError);\nfunction failure(Err, issues, ctx) {\n	let error;\n	return {\n		success: false,\n		get error() {\n			if (!error) {\n				error = new Err(issues.map((iss) => finalizeIssue(iss, ctx, config())));\n				issues = void 0;\n				ctx = void 0;\n			}\n			return error;\n		},\n		set error(e) {\n			error = e;\n			issues = void 0;\n			ctx = void 0;\n		}\n	};\n}\nconst _safeParseAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: true\n	} : { async: true };\n	let result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) result = await result;\n	return result.issues.length ? failure(_Err, result.issues, ctx) : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParseAsync = /* @__PURE__*/ _safeParseAsync($ZodRealError);\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/regexes.js\nconst anyString = /^[\\s\\S]{0,}$/;\nconst number = /^-?\\d+(?:\\.\\d+)?$/;\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/checks.js\nconst $ZodCheck = /*@__PURE__*/ $constructor(\"$ZodCheck\", (inst, def) => {\n	var _a;\n	inst._zod ?? (inst._zod = {});\n	inst._zod.def = def;\n	(_a = inst._zod).onattach ?? (_a.onattach = []);\n});\nconst _whenHasLength = (payload) => {\n	const val = payload.value;\n	return !nullish(val) && val.length !== void 0;\n};\nconst $ZodCheckMinLength = /*@__PURE__*/ $constructor(\"$ZodCheckMinLength\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = _whenHasLength);\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		const units = input.length;\n		if ((typeof input === \"string\" && units >= def.minimum && units < def.minimum * 2 ? codePointLength(input) : units) >= def.minimum) return;\n		const origin = getLengthableOrigin(input);\n		payload.issues.push({\n			origin,\n			code: \"too_small\",\n			minimum: def.minimum,\n			inclusive: true,\n			input,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/versions.js\nconst version = {\n	major: 4,\n	minor: 6,\n	patch: 5\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/schemas.js\nconst $ZodType = /*@__PURE__*/ $constructor(\"$ZodType\", (inst, def) => {\n	var _a;\n	inst ?? (inst = {});\n	inst._zod.def = def;\n	inst._zod.bag = inst._zod.bag || {};\n	inst._zod.version = version;\n	const defChecks = inst._zod.def.checks;\n	const checks = inst._zod.traits.has(\"$ZodCheck\") ? [inst, ...defChecks ?? []] : defChecks?.length ? [...defChecks] : [];\n	for (const ch of checks) for (const fn of ch._zod.onattach) fn(inst);\n	if (checks.length === 0) {\n		(_a = inst._zod).deferred ?? (_a.deferred = []);\n		inst._zod.deferred?.push(() => {\n			inst._zod.run = inst._zod.parse;\n		});\n	} else {\n		const runChecks = (payload, checks, ctx) => {\n			if (payload.memo) return payload;\n			let isAborted = aborted(payload);\n			let asyncResult;\n			for (const ch of checks) {\n				if (ch._zod.def.when) {\n					if (explicitlyAborted(payload)) continue;\n					if (!ch._zod.def.when(payload)) continue;\n				} else if (isAborted) continue;\n				const currLen = payload.issues.length;\n				const _ = ch._zod.check(payload);\n				if (_ instanceof Promise && ctx?.async === false) throw new $ZodAsyncError();\n				if (asyncResult || _ instanceof Promise) asyncResult = (asyncResult ?? Promise.resolve()).then(async () => {\n					await _;\n					if (payload.issues.length === currLen) return;\n					attachSchema(payload.issues, currLen, inst);\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				});\n				else {\n					if (payload.issues.length === currLen) continue;\n					attachSchema(payload.issues, currLen, inst);\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				}\n			}\n			if (asyncResult) return asyncResult.then(() => {\n				return payload;\n			});\n			return payload;\n		};\n		const handleCanaryResult = (canary, payload, ctx) => {\n			if (aborted(canary)) {\n				canary.aborted = true;\n				return canary;\n			}\n			const checkResult = runChecks(payload, checks, ctx);\n			if (checkResult instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return checkResult.then((checkResult) => inst._zod.parse(checkResult, ctx));\n			}\n			return inst._zod.parse(checkResult, ctx);\n		};\n		inst._zod.run = (payload, ctx) => {\n			if (ctx.skipChecks) return inst._zod.parse(payload, ctx);\n			if (ctx.direction === \"backward\") {\n				const canary = inst._zod.parse({\n					value: payload.value,\n					issues: []\n				}, {\n					...ctx,\n					skipChecks: true\n				});\n				if (canary instanceof Promise) return canary.then((canary) => {\n					return handleCanaryResult(canary, payload, ctx);\n				});\n				return handleCanaryResult(canary, payload, ctx);\n			}\n			const result = inst._zod.parse(payload, ctx);\n			if (result instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return result.then((result) => runChecks(result, checks, ctx));\n			}\n			return runChecks(result, checks, ctx);\n		};\n	}\n}, {\n	get \"~standard\"() {\n		return hide(this, \"~standard\", standardProps(this));\n	},\n	set \"~standard\"(value) {\n		own(this, \"~standard\", value);\n	}\n});\nconst toStandardResult = (r, ctx) => r.issues.length ? { issues: r.issues.map((iss) => finalizeIssue(iss, ctx, config())) } : { value: r.value };\nasync function validateAsync(inst, value) {\n	const ctx = { async: true };\n	return toStandardResult(await inst._zod.run({\n		value,\n		issues: []\n	}, ctx), ctx);\n}\nfunction standardProps(inst) {\n	return {\n		validate: (value) => {\n			const ctx = { async: false };\n			try {\n				const r = inst._zod.run({\n					value,\n					issues: []\n				}, ctx);\n				if (!(r instanceof Promise)) return toStandardResult(r, ctx);\n			} catch (_) {}\n			return validateAsync(inst, value);\n		},\n		vendor: \"zod\",\n		version: 1\n	};\n}\nconst $ZodString = /*@__PURE__*/ $constructor(\"$ZodString\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.pattern = def.pattern ?? anyString;\n	inst._zod.parse = (payload, _) => {\n		if (def.coerce) try {\n			payload.value = String(payload.value);\n		} catch (_) {}\n		if (typeof payload.value === \"string\") return payload;\n		payload.issues.push({\n			expected: \"string\",\n			code: \"invalid_type\",\n			input: payload.value,\n			inst\n		});\n		return payload;\n	};\n});\nconst $ZodUnknown = /*@__PURE__*/ $constructor(\"$ZodUnknown\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload) => payload;\n});\nfunction handleArrayResult(result, final, index) {\n	if (result.issues.length) final.issues.push(...prefixIssues(index, result.issues));\n	final.value[index] = result.value;\n}\nconst $ZodArray = /*@__PURE__*/ $constructor(\"$ZodArray\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!Array.isArray(input)) {\n			payload.issues.push({\n				expected: \"array\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = memo ? memo.alloc(inst, payload, Array(input.length), ctx) : Array(input.length);\n		const proms = [];\n		const abortEarly = ctx?.abortEarly;\n		for (let i = 0; i < input.length; i++) {\n			const item = input[i];\n			const result = def.element._zod.run({\n				value: item,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) proms.push(result.then((result) => handleArrayResult(result, payload, i)));\n			else {\n				handleArrayResult(result, payload, i);\n				if (abortEarly && result.issues.length !== 0 && aborted(result)) break;\n			}\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nfunction handlePropertyResult(result, final, key, input, optin, optout) {\n	const isPresent = key in input;\n	const isOptionalOut = optout === \"optional\";\n	if (!isPresent && isOptionalOut && optin === \"optional\") return;\n	if (result.issues.length) {\n		if (optin !== void 0 && isOptionalOut && !isPresent) return;\n		final.issues.push(...prefixIssues(key, result.issues));\n	}\n	if (!isPresent && optin === void 0) {\n		if (!result.issues.length) final.issues.push({\n			code: \"invalid_type\",\n			expected: \"nonoptional\",\n			input: void 0,\n			path: [key]\n		});\n		return;\n	}\n	if (result.value === void 0) {\n		if (isPresent || optin === \"defaulted\" && !isOptionalOut) final.value[key] = void 0;\n	} else final.value[key] = result.value;\n}\nconst NO_SYMBOL_KEYS = [];\nfunction normalizeDef(def) {\n	const keys = Object.keys(def.shape);\n	const ownSymbols = Object.getOwnPropertySymbols(def.shape);\n	const symbolKeys = ownSymbols.length ? ownSymbols : NO_SYMBOL_KEYS;\n	const allKeys = symbolKeys.length ? [...keys, ...symbolKeys] : keys;\n	for (const k of allKeys) if (!def.shape?.[k]?._zod?.traits?.has(\"$ZodType\")) throw new Error(`Invalid element at key \"${String(k)}\": expected a Zod schema`);\n	const okeys = optionalKeys(def.shape);\n	return {\n		...def,\n		allKeys,\n		symbolKeys,\n		keySet: new Set(keys),\n		numKeys: keys.length,\n		optionalKeys: new Set(okeys)\n	};\n}\nfunction handleCatchall(proms, input, payload, ctx, def, inst, abortEarly) {\n	const unrecognized = [];\n	const keySet = def.keySet;\n	const _catchall = def.catchall._zod;\n	const t = _catchall.def.type;\n	const optin = _catchall.optin;\n	const optout = _catchall.optout;\n	let seen = 0;\n	for (const key in input) {\n		if (abortEarly && payload.issues.length !== seen) {\n			if (aborted(payload, seen)) break;\n			seen = payload.issues.length;\n		}\n		if (keySet.has(key)) continue;\n		if (key === \"__proto__\") {\n			if (t === \"never\") unrecognized.push(key);\n			continue;\n		}\n		if (t === \"never\") {\n			unrecognized.push(key);\n			continue;\n		}\n		const r = _catchall.run({\n			value: input[key],\n			issues: []\n		}, ctx);\n		if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, optin, optout)));\n		else handlePropertyResult(r, payload, key, input, optin, optout);\n	}\n	if (unrecognized.length) payload.issues.push({\n		code: \"unrecognized_keys\",\n		keys: unrecognized,\n		input,\n		inst,\n		continue: true\n	});\n	if (!proms.length) return payload;\n	return Promise.all(proms).then(() => {\n		return payload;\n	});\n}\nconst $ZodObject = /*@__PURE__*/ $constructor(\"$ZodObject\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const desc = Object.getOwnPropertyDescriptor(def, \"shape\");\n	const sh = desc?.get ? desc.get.raw : def.shape ?? {};\n	if (sh) {\n		const get = () => {\n			const newSh = { ...sh };\n			Object.defineProperty(def, \"shape\", { value: newSh });\n			get.raw = newSh;\n			return newSh;\n		};\n		get.raw = sh;\n		Object.defineProperty(def, \"shape\", { get });\n	}\n	const _normalized = cached(() => normalizeDef(def));\n	defineLazyInternal(inst, \"propValues\", (zod) => {\n		const shape = zod.def.shape;\n		const propValues = {};\n		for (const key in shape) {\n			const field = shape[key]._zod;\n			if (field.values) {\n				if (!Object.prototype.hasOwnProperty.call(propValues, key)) assignProp(propValues, key, /* @__PURE__ */ new Set());\n				for (const v of field.values) propValues[key].add(v);\n				if (field.optin !== void 0) propValues[key].add(void 0);\n			}\n		}\n		return propValues;\n	});\n	const isObject$2 = isObject;\n	const catchall = def.catchall;\n	let value;\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		value ?? (value = _normalized.value);\n		const input = payload.value;\n		if (!isObject$2(input)) {\n			payload.issues.push({\n				expected: \"object\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n		const proms = [];\n		const shape = value.shape;\n		const abortEarly = ctx?.abortEarly;\n		let seen = payload.issues.length;\n		for (const key of value.allKeys) {\n			if (abortEarly && payload.issues.length !== seen) {\n				if (aborted(payload, seen)) break;\n				seen = payload.issues.length;\n			}\n			if (key === \"__proto__\") continue;\n			const el = shape[key];\n			const optin = el._zod.optin;\n			const optout = el._zod.optout;\n			const r = el._zod.run({\n				value: input[key],\n				issues: []\n			}, ctx);\n			if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, optin, optout)));\n			else handlePropertyResult(r, payload, key, input, optin, optout);\n		}\n		if (!catchall) return proms.length ? Promise.all(proms).then(() => payload) : payload;\n		return handleCatchall(proms, input, payload, ctx, _normalized.value, inst, abortEarly === true);\n	};\n});\nconst $ZodRecord = /*@__PURE__*/ $constructor(\"$ZodRecord\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!isPlainObject(input)) {\n			payload.issues.push({\n				expected: \"record\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		const proms = [];\n		const values = def.keyType._zod.values;\n		if (values && !def.partial) {\n			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n			const recordKeys = /* @__PURE__ */ new Set();\n			for (const key of values) if (typeof key === \"string\" || typeof key === \"number\" || typeof key === \"symbol\") {\n				recordKeys.add(typeof key === \"number\" ? key.toString() : key);\n				if (key === \"__proto__\") continue;\n				const keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (keyResult.issues.length) {\n					payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				if (outKey === \"__proto__\") continue;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			let unrecognized;\n			for (const key in input) if (!recordKeys.has(key)) {\n				if (def.mode === \"loose\") {\n					if (key === \"__proto__\") continue;\n					payload.value[key] = input[key];\n				} else {\n					unrecognized = unrecognized ?? [];\n					unrecognized.push(key);\n				}\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized,\n				continue: true\n			});\n		} else {\n			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n			let unrecognized;\n			for (const key of Reflect.ownKeys(input)) {\n				if (key === \"__proto__\") continue;\n				if (!Object.prototype.propertyIsEnumerable.call(input, key)) continue;\n				let keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (typeof key === \"string\" && number.test(key) && keyResult.issues.length) {\n					const retryResult = def.keyType._zod.run({\n						value: Number(key),\n						issues: []\n					}, ctx);\n					if (retryResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n					if (retryResult.issues.length === 0) keyResult = retryResult;\n				}\n				if (keyResult.issues.length) {\n					if (def.mode === \"loose\") payload.value[key] = input[key];\n					else if (values) {\n						unrecognized = unrecognized ?? [];\n						unrecognized.push(key);\n					} else payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				if (outKey === \"__proto__\") continue;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized,\n				continue: true\n			});\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nfunction handleOptionalResult(payload, result) {\n	payload.value = result.issues.length ? void 0 : result.value;\n	return payload;\n}\nconst $ZodOptional = /*@__PURE__*/ $constructor(\"$ZodOptional\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazyInternal(inst, \"optin\", (zod) => zod.def.innerType._zod.optin === \"defaulted\" ? \"defaulted\" : \"optional\");\n	inst._zod.optout = \"optional\";\n	defineLazyInternal(inst, \"values\", (zod) => {\n		const values = zod.def.innerType._zod.values;\n		return values ? /* @__PURE__ */ new Set([...values, void 0]) : void 0;\n	});\n	defineLazyInternal(inst, \"pattern\", (zod) => {\n		const pattern = zod.def.innerType._zod.pattern;\n		return pattern ? new RegExp(`^(${cleanRegex(pattern.source)})?$`) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		if (payload.value === void 0) {\n			if (def.innerType._zod.optin !== \"defaulted\") return payload;\n			const result = def.innerType._zod.run({\n				value: payload.value,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) return result.then((result) => handleOptionalResult(payload, result));\n			return handleOptionalResult(payload, result);\n		}\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodDefault = /*@__PURE__*/ $constructor(\"$ZodDefault\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"defaulted\";\n	defineLazyInternal(inst, \"values\", (zod) => zod.def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		if (payload.value === void 0) {\n			payload.value = def.defaultValue;\n			return payload;\n		}\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => handleDefaultResult(result, def));\n		return handleDefaultResult(result, def);\n	};\n});\nfunction handleDefaultResult(payload, def) {\n	if (payload.value === void 0) payload.value = def.defaultValue;\n	return payload;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/en.js\nconst error = () => {\n	const Sizable = {\n		string: {\n			unit: \"characters\",\n			verb: \"to have\"\n		},\n		file: {\n			unit: \"bytes\",\n			verb: \"to have\"\n		},\n		array: {\n			unit: \"items\",\n			verb: \"to have\"\n		},\n		set: {\n			unit: \"items\",\n			verb: \"to have\"\n		},\n		map: {\n			unit: \"entries\",\n			verb: \"to have\"\n		}\n	};\n	function getSizing(origin) {\n		return Sizable[origin] ?? null;\n	}\n	const FormatDictionary = {\n		regex: \"input\",\n		email: \"email address\",\n		url: \"URL\",\n		emoji: \"emoji\",\n		uuid: \"UUID\",\n		uuidv4: \"UUIDv4\",\n		uuidv6: \"UUIDv6\",\n		nanoid: \"nanoid\",\n		guid: \"GUID\",\n		cuid: \"cuid\",\n		cuid2: \"cuid2\",\n		ulid: \"ULID\",\n		xid: \"XID\",\n		ksuid: \"KSUID\",\n		datetime: \"ISO datetime\",\n		date: \"ISO date\",\n		time: \"ISO time\",\n		duration: \"ISO duration\",\n		ipv4: \"IPv4 address\",\n		ipv6: \"IPv6 address\",\n		mac: \"MAC address\",\n		cidrv4: \"IPv4 range\",\n		cidrv6: \"IPv6 range\",\n		base64: \"base64-encoded string\",\n		base64url: \"base64url-encoded string\",\n		json_string: \"JSON string\",\n		e164: \"E.164 number\",\n		currency_code: \"currency code\",\n		credit_card: \"credit card number\",\n		iban: \"IBAN\",\n		jwt: \"JWT\",\n		template_literal: \"input\"\n	};\n	const TypeDictionary = { nan: \"NaN\" };\n	function getTypeName(type, input) {\n		if (type === \"number\" && typeof input === \"number\" && !Number.isFinite(input)) return String(input);\n		return TypeDictionary[type] ?? type;\n	}\n	return (issue) => {\n		switch (issue.code) {\n			case \"invalid_type\": return `Invalid input: expected ${getTypeName(issue.expected)}, received ${getTypeName(parsedType(issue.input), issue.input)}`;\n			case \"invalid_value\":\n				if (issue.values.length === 1) return `Invalid input: expected ${stringifyPrimitive(issue.values[0])}`;\n				return `Invalid option: expected one of ${joinValues(issue.values, \"|\")}`;\n			case \"too_big\": {\n				const adj = issue.exact ? \"exactly \" : issue.inclusive ? \"<=\" : \"<\";\n				const sizing = getSizing(issue.origin);\n				if (sizing) return `Too big: expected ${issue.origin ?? \"value\"} to have ${adj}${issue.maximum.toString()} ${sizing.unit ?? \"elements\"}`;\n				return `Too big: expected ${issue.origin ?? \"value\"} to be ${adj}${issue.maximum.toString()}`;\n			}\n			case \"too_small\": {\n				const adj = issue.exact ? \"exactly \" : issue.inclusive ? \">=\" : \">\";\n				const sizing = getSizing(issue.origin);\n				if (sizing) return `Too small: expected ${issue.origin} to have ${adj}${issue.minimum.toString()} ${sizing.unit}`;\n				return `Too small: expected ${issue.origin} to be ${adj}${issue.minimum.toString()}`;\n			}\n			case \"invalid_format\": {\n				const _issue = issue;\n				if (_issue.format === \"starts_with\") return `Invalid string: must start with \"${_issue.prefix}\"`;\n				if (_issue.format === \"ends_with\") return `Invalid string: must end with \"${_issue.suffix}\"`;\n				if (_issue.format === \"includes\") return `Invalid string: must include \"${_issue.includes}\"`;\n				if (_issue.format === \"regex\") return `Invalid string: must match pattern ${_issue.pattern}`;\n				return `Invalid ${FormatDictionary[_issue.format] ?? issue.format}`;\n			}\n			case \"not_multiple_of\": return `Invalid number: must be a multiple of ${issue.divisor}`;\n			case \"unrecognized_keys\": return `Unrecognized key${issue.keys.length > 1 ? \"s\" : \"\"}: ${joinValues(issue.keys, \", \")}`;\n			case \"invalid_key\": return `Invalid key in ${issue.origin}`;\n			case \"invalid_union\":\n				if (issue.options && Array.isArray(issue.options) && issue.options.length > 0) return `Invalid discriminator value. Expected ${issue.options.map((o) => `'${o}'`).join(\" | \")}`;\n				if (issue.inclusive === false) return \"Invalid input: more than one option matched\";\n				return \"Invalid input\";\n			case \"invalid_element\": return `Invalid value in ${issue.origin}`;\n			default: return `Invalid input`;\n		}\n	};\n};\nfunction en_default() {\n	return { localeError: error() };\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/api.js\nfunction snapshotChecks(def) {\n	if (def.checks) def.checks = [...def.checks];\n	return def;\n}\n// @__NO_SIDE_EFFECTS__\nfunction _string(Class, params) {\n	return new Class(snapshotChecks({\n		type: \"string\",\n		...normalizeParams(params)\n	}));\n}\n// @__NO_SIDE_EFFECTS__\nfunction _unknown(Class) {\n	return new Class({ type: \"unknown\" });\n}\n// @__NO_SIDE_EFFECTS__\nfunction _minLength(minimum, params) {\n	return new $ZodCheckMinLength({\n		check: \"min_length\",\n		...normalizeParams(params),\n		minimum\n	});\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/mini/schemas.js\nconst ZodMiniType = /*@__PURE__*/ $constructor(\"ZodMiniType\", (inst, def) => {\n	if (!inst._zod) throw new Error(\"Uninitialized schema in ZodMiniType.\");\n	$ZodType.init(inst, def);\n	inst.def = def;\n	inst.type = def.type;\n}, {\n	get with() {\n		return this.check;\n	},\n	set with(value) {\n		own(this, \"with\", value);\n	},\n	parse(data, params) {\n		return parse(this, data, params, { callee: this.parse });\n	},\n	parseAsync(data, params) {\n		return parseAsync(this, data, params, { callee: this.parseAsync });\n	},\n	safeParse(data, params) {\n		return safeParse(this, data, params);\n	},\n	safeParseAsync(data, params) {\n		return safeParseAsync(this, data, params);\n	},\n	check(...checks) {\n		const def = this.def;\n		return this.clone({\n			...def,\n			checks: [...def.checks ?? [], ...checks.map((ch) => typeof ch === \"function\" ? { _zod: {\n				check: ch,\n				def: { check: \"custom\" },\n				onattach: []\n			} } : ch)]\n		}, { parent: true });\n	},\n	clone(_def, params) {\n		return clone(this, _def, params);\n	},\n	brand() {\n		return this;\n	},\n	register(reg, meta) {\n		reg.add(this, meta);\n		return this;\n	},\n	apply(fn, ...args) {\n		return args.length === 0 ? fn(this) : fn(this, ...args);\n	}\n});\nconst ZodMiniString = /*@__PURE__*/ $constructor(\"ZodMiniString\", (inst, def) => {\n	$ZodString.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction string(params) {\n	return _string(ZodMiniString, params);\n}\nconst ZodMiniUnknown = /*@__PURE__*/ $constructor(\"ZodMiniUnknown\", (inst, def) => {\n	$ZodUnknown.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction unknown() {\n	return _unknown(ZodMiniUnknown);\n}\nconst ZodMiniArray = /*@__PURE__*/ $constructor(\"ZodMiniArray\", (inst, def) => {\n	$ZodArray.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction array(element, params) {\n	return new ZodMiniArray({\n		type: \"array\",\n		element,\n		...normalizeParams(params)\n	});\n}\nconst ZodMiniObject = /*@__PURE__*/ $constructor(\"ZodMiniObject\", (inst, def) => {\n	$ZodObject.init(inst, def);\n	ZodMiniType.init(inst, def);\n	installLazyProp(inst, \"shape\", (self) => self._zod.def.shape, false);\n});\n// @__NO_SIDE_EFFECTS__\nfunction object(shape, params) {\n	const def = {\n		type: \"object\",\n		shape: shape ?? {},\n		...normalizeParams(params)\n	};\n	return new ZodMiniObject(def);\n}\nconst ZodMiniRecord = /*@__PURE__*/ $constructor(\"ZodMiniRecord\", (inst, def) => {\n	$ZodRecord.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction record(keyType, valueType, params) {\n	if (!valueType || !valueType._zod) return new ZodMiniRecord({\n		type: \"record\",\n		keyType: /* @__PURE__ */ string(),\n		valueType: keyType,\n		...normalizeParams(valueType)\n	});\n	return new ZodMiniRecord({\n		type: \"record\",\n		keyType,\n		valueType,\n		...normalizeParams(params)\n	});\n}\nconst ZodMiniOptional = /*@__PURE__*/ $constructor(\"ZodMiniOptional\", (inst, def) => {\n	$ZodOptional.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction optional(innerType) {\n	return new ZodMiniOptional({\n		type: \"optional\",\n		innerType\n	});\n}\nconst ZodMiniDefault = /*@__PURE__*/ $constructor(\"ZodMiniDefault\", (inst, def) => {\n	$ZodDefault.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction _default(innerType, defaultValue) {\n	return new ZodMiniDefault({\n		type: \"default\",\n		innerType,\n		get defaultValue() {\n			return typeof defaultValue === \"function\" ? defaultValue() : shallowClone(defaultValue);\n		}\n	});\n}\n\n//#endregion\n//#region src/lib/hook-io.ts\nconfig(en_default());\nconst HookInputSchema = object({\n	session_id: string(),\n	transcript_path: string(),\n	cwd: string(),\n	permission_mode: string(),\n	hook_event_name: string(),\n	tool_name: string(),\n	tool_input: record(string(), unknown())\n});\nasync function readHookInput() {\n	const chunks = [];\n	for await (const chunk of process.stdin) chunks.push(typeof chunk === \"string\" ? chunk : String(chunk));\n	let parsed;\n	try {\n		parsed = JSON.parse(chunks.join(\"\"));\n	} catch (_error) {\n		return {\n			ok: false,\n			raw: chunks.join(\"\").slice(0, 200),\n			error: \"invalid JSON\"\n		};\n	}\n	const result = HookInputSchema.safeParse(parsed);\n	if (!result.success) return {\n		ok: false,\n		raw: parsed,\n		error: result.error.message\n	};\n	return {\n		ok: true,\n		data: result.data\n	};\n}\nconst BashInputSchema = object({\n	command: string(),\n	description: optional(string())\n});\nconst FilePathInputSchema = object({ file_path: string() });\nconst SearchInputSchema = object({\n	pattern: string(),\n	path: optional(string())\n});\nfunction parseBashInput(toolInput) {\n	const result = BashInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction parseFilePathInput(toolInput) {\n	const result = FilePathInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction parseSearchInput(toolInput) {\n	const result = SearchInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction writeDeny(reason) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		permissionDecision: \"deny\",\n		...reason ? { permissionDecisionReason: reason } : {}\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\nfunction writeAdvice(advice) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		additionalContext: advice\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\n\n//#endregion\n//#region src/lib/audit.ts\nconst MAX_LOG_SIZE = 1048576;\nfunction getLogPath() {\n	const hookDir = path.dirname(fileURLToPath(import.meta.url));\n	return path.join(hookDir, \"bst-hook.audit.local.jsonl\");\n}\nfunction rotateIfNeeded(logPath) {\n	try {\n		if (fs.statSync(logPath).size > MAX_LOG_SIZE) {\n			const rotatedPath = `${logPath}.1`;\n			fs.renameSync(logPath, rotatedPath);\n		}\n	} catch (_error) {}\n}\nlet rotationChecked = false;\nfunction audit(entry) {\n	try {\n		const logPath = getLogPath();\n		if (!rotationChecked) {\n			rotateIfNeeded(logPath);\n			rotationChecked = true;\n		}\n		const record = {\n			timestamp: (/* @__PURE__ */ new Date()).toISOString(),\n			...entry\n		};\n		fs.appendFileSync(logPath, JSON.stringify(record) + \"\\n\");\n	} catch (err) {\n		process.stderr.write(`[bst-hook] audit write failed: ${err instanceof Error ? err.message : String(err)}\\n`);\n	}\n}\n\n//#endregion\n//#region src/lib/shell-tokenizer.ts\nfunction scanDoubleQuoted(input, start) {\n	let content = \"\";\n	let i = start;\n	while (i < input.length && input[i] !== \"\\\"\") {\n		if (input[i] === \"\\\\\" && i + 1 < input.length) {\n			const next = input[i + 1];\n			if (next === \"\\\"\" || next === \"\\\\\" || next === \"$\" || next === \"`\") {\n				content += next;\n				i += 2;\n				continue;\n			}\n		}\n		content += input[i];\n		i++;\n	}\n	if (i >= input.length) return null;\n	return {\n		content,\n		next: i + 1\n	};\n}\nfunction tokenize(input) {\n	const tokens = [];\n	let current = \"\";\n	let i = 0;\n	let inToken = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\") {\n			inToken = true;\n			i++;\n			while (i < input.length && input[i] !== \"'\") {\n				current += input[i];\n				i++;\n			}\n			if (i >= input.length) return {\n				ok: false,\n				error: \"unterminated single quote\"\n			};\n			i++;\n		} else if (ch === \"\\\"\") {\n			inToken = true;\n			const scanned = scanDoubleQuoted(input, i + 1);\n			if (!scanned) return {\n				ok: false,\n				error: \"unterminated double quote\"\n			};\n			current += scanned.content;\n			i = scanned.next;\n		} else if (ch === \"\\\\\" && i + 1 < input.length) {\n			inToken = true;\n			current += input[i + 1];\n			i += 2;\n		} else if (ch === \" \" || ch === \"	\") {\n			if (inToken) {\n				tokens.push(current);\n				current = \"\";\n				inToken = false;\n			}\n			i++;\n		} else {\n			inToken = true;\n			current += ch;\n			i++;\n		}\n	}\n	if (inToken) tokens.push(current);\n	return {\n		ok: true,\n		tokens\n	};\n}\nconst SAFE_UNQUOTED_RE = /^[A-Za-z0-9_\\-./=:@%+,]+$/;\nfunction quoteToken(token) {\n	if (token.length > 0 && SAFE_UNQUOTED_RE.test(token)) return token;\n	return \"'\" + token.replace(/'/g, \"'\\\\''\") + \"'\";\n}\nfunction joinTokens(tokens) {\n	return tokens.map(quoteToken).join(\" \");\n}\n\n//#endregion\n//#region src/lib/shell-splitter.ts\nfunction splitCommand(input) {\n	if (!input || !input.trim()) return [];\n	const segments = [];\n	let current = \"\";\n	let i = 0;\n	let inSingleQuote = false;\n	let inDoubleQuote = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\" && !inDoubleQuote) {\n			inSingleQuote = !inSingleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\"\" && !inSingleQuote) {\n			inDoubleQuote = !inDoubleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\\\" && !inSingleQuote && i + 1 < input.length) {\n			current += ch + input[i + 1];\n			i += 2;\n			continue;\n		}\n		if (!inSingleQuote && !inDoubleQuote) {\n			if (ch === \"&\" && i + 1 < input.length && input[i + 1] === \"&\") {\n				pushSegment(segments, current, \"&&\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"&\" && !(i + 1 < input.length && input[i + 1] === \">\") && !(i > 0 && (input[i - 1] === \">\" || input[i - 1] === \"<\"))) {\n				pushSegment(segments, current, \"&\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \"|\" && i + 1 < input.length && input[i + 1] === \"|\") {\n				pushSegment(segments, current, \"||\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"|\") {\n				pushSegment(segments, current, \"|\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \";\") {\n				pushSegment(segments, current, \";\");\n				current = \"\";\n				i++;\n				continue;\n			}\n		}\n		current += ch;\n		i++;\n	}\n	const trimmed = current.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator: null\n	});\n	return segments;\n}\nfunction pushSegment(segments, text, operator) {\n	const trimmed = text.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator\n	});\n}\n\n//#endregion\n//#region src/lib/injection-guard.ts\nfunction hasBraceExpansion(token) {\n	let depth = 0;\n	for (let i = 0; i < token.length; i++) {\n		const ch = token[i];\n		if (ch === \"{\") depth++;\n		else if (ch === \"}\") {\n			if (depth > 0) depth--;\n		} else if (depth >= 1 && (ch === \",\" || ch === \".\" && token[i + 1] === \".\")) return true;\n	}\n	return false;\n}\nfunction checkInjection(tokens, rawSegment) {\n	if (/[\\n\\r]/.test(rawSegment)) return {\n		safe: false,\n		reason: \"unquoted newline in command\"\n	};\n	for (const token of tokens) {\n		if (token === \"`\") return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"`\")) return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"$\")) return {\n			safe: false,\n			reason: \"unresolved dollar-expansion\"\n		};\n		if (hasBraceExpansion(token)) return {\n			safe: false,\n			reason: \"brace expansion\"\n		};\n		if (token.includes(\"<(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n		if (token.includes(\">(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n	}\n	return { safe: true };\n}\n\n//#endregion\n//#region src/lib/env-file.ts\nconst ENV_SAFE_SUFFIXES = [\n	\".sample\",\n	\".example\",\n	\".template\"\n];\nconst ENV_TOOL_OWNED_SUFFIXES = [\".check.env\"];\nconst ENV_FILE_PATTERN = /(^|[/\\\\])(\\.env(\\..*)?|.*\\.env(\\..*)?|\\.env)$/;\nfunction isEnvSafeSuffix(filename) {\n	return [...ENV_SAFE_SUFFIXES, ...ENV_TOOL_OWNED_SUFFIXES].some((suffix) => filename.endsWith(suffix));\n}\nfunction isEnvFile(filePath) {\n	if (isEnvSafeSuffix(path.basename(filePath))) return false;\n	return ENV_FILE_PATTERN.test(filePath);\n}\n\n//#endregion\n//#region src/lib/git-state.ts\nconst GIT_TIMEOUT_MS = 5e3;\nfunction getCurrentBranch(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--abbrev-ref\",\n			\"HEAD\"\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!out || out === \"HEAD\") return null;\n		return out;\n	} catch {\n		return null;\n	}\n}\nfunction getRepoTopLevel(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\"rev-parse\", \"--show-toplevel\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		return out === \"\" ? null : out;\n	} catch {\n		return null;\n	}\n}\nfunction getRemoteDefaultBranch(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\n			\"symbolic-ref\",\n			\"--short\",\n			\"refs/remotes/origin/HEAD\"\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!out) return null;\n		return out.startsWith(\"origin/\") ? out.slice(7) : out;\n	} catch {\n		return null;\n	}\n}\nconst DefaultBranchSchema = object({ defaultBranch: optional(string().check(_minLength(1))) });\nfunction getConfiguredDefaultBranch(topLevel) {\n	let parsed;\n	try {\n		parsed = JSON.parse(readFileSync(join(topLevel, \".tooling.json\"), \"utf-8\"));\n	} catch {\n		return null;\n	}\n	const result = DefaultBranchSchema.safeParse(parsed);\n	return result.success ? result.data.defaultBranch ?? null : null;\n}\nconst ALWAYS_PROTECTED = [\"main\", \"master\"];\nfunction getProtectedBranches(cwd, extra) {\n	const set = new Set(ALWAYS_PROTECTED);\n	const remote = getRemoteDefaultBranch(cwd);\n	if (remote) set.add(remote);\n	for (const b of extra) set.add(b);\n	return set;\n}\nfunction getUpstream(cwd, branch) {\n	try {\n		return execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--abbrev-ref\",\n			`${branch}@{upstream}`\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim() || null;\n	} catch {\n		return null;\n	}\n}\nfunction resolveCommit(cwd, rev) {\n	try {\n		return execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--verify\",\n			\"--quiet\",\n			`${rev}^{commit}`\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim() || null;\n	} catch {\n		return null;\n	}\n}\nfunction branchCarriesOtherFiles(cwd, allowed) {\n	const toplevel = getRepoTopLevel(cwd);\n	if (toplevel === null) return null;\n	try {\n		const defaultBranch = getConfiguredDefaultBranch(toplevel) ?? getRemoteDefaultBranch(toplevel) ?? \"main\";\n		const mergeBase = execFileSync(\"git\", [\n			\"merge-base\",\n			\"HEAD\",\n			`origin/${defaultBranch}`\n		], {\n			cwd: toplevel,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!mergeBase) return null;\n		const names = (args) => execFileSync(\"git\", args, {\n			cwd: toplevel,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().split(\"\\n\").filter((line) => line.length > 0);\n		return [...names([\n			\"diff\",\n			\"--name-only\",\n			mergeBase\n		]), ...names([\n			\"ls-files\",\n			\"--others\",\n			\"--exclude-standard\"\n		])].some((name) => !allowed.includes(name));\n	} catch {\n		return null;\n	}\n}\nfunction isPrimaryWorktree(cwd) {\n	try {\n		const gitDir = execFileSync(\"git\", [\"rev-parse\", \"--absolute-git-dir\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		const commonRaw = execFileSync(\"git\", [\"rev-parse\", \"--git-common-dir\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!gitDir || !commonRaw) return false;\n		const commonDir = resolve(cwd, commonRaw);\n		return realpathSync(gitDir) === realpathSync(commonDir);\n	} catch {\n		return false;\n	}\n}\n\n//#endregion\n//#region src/lib/git-short-options.ts\nconst VALUE_TAKING_LETTERS = {\n	switch: /* @__PURE__ */ new Set([\"c\", \"C\"]),\n	checkout: /* @__PURE__ */ new Set([\"b\", \"B\"]),\n	branch: /* @__PURE__ */ new Set([\"u\"]),\n	fetch: /* @__PURE__ */ new Set([\"o\", \"j\"])\n};\nfunction splitShortOptionCluster(token, sub) {\n	if (!token.startsWith(\"-\") || token.startsWith(\"--\") || token.length <= 1) return;\n	const valueLetters = VALUE_TAKING_LETTERS[sub];\n	const letters = [];\n	const chars = token.slice(1);\n	for (let i = 0; i < chars.length; i++) {\n		const ch = chars[i];\n		letters.push(ch);\n		if (valueLetters.has(ch)) return {\n			letters,\n			attachedValue: chars.slice(i + 1)\n		};\n	}\n	return { letters };\n}\n\n//#endregion\n//#region src/lib/path-scope.ts\nfunction pathFlavorFor(base) {\n	return /^[a-zA-Z]:[\\\\/]/.test(base) ? path.win32 : path.posix;\n}\nfunction resolveIn(base, target) {\n	return pathFlavorFor(base).resolve(base, target);\n}\nfunction isWithin(dir, target) {\n	const pp = pathFlavorFor(dir);\n	const rel = pp.relative(dir, target);\n	if (rel === \"\") return true;\n	if (rel === \"..\" || rel.startsWith(\"..\" + pp.sep)) return false;\n	return !pp.isAbsolute(rel);\n}\nfunction samePath(a, b) {\n	return pathFlavorFor(a).relative(a, b) === \"\";\n}\nfunction targetsGitDir(filePath, cwd) {\n	const pp = pathFlavorFor(cwd);\n	const resolved = resolveIn(cwd, filePath);\n	if (!isWithin(cwd, resolved)) return false;\n	const rel = pp.relative(cwd, resolved);\n	if (rel === \"\") return false;\n	return rel.split(pp.sep).includes(\".git\");\n}\nfunction targetsNodeModules(filePath, cwd) {\n	return resolveIn(cwd, filePath).split(/[/\\\\]/).includes(\"node_modules\");\n}\n\n//#endregion\n//#region src/rules.ts\nconst GIT_FLAGS_WITH_ARG = /* @__PURE__ */ new Set([\n	\"-C\",\n	\"-c\",\n	\"--git-dir\",\n	\"--work-tree\"\n]);\nfunction getGitSubcommand(tokens) {\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return t;\n	}\n}\nconst WORKTREE_ADVICE = \"You're creating a feature branch in the primary worktree. An isolated worktree keeps this work independent of other windows, and with no commits on this branch yet, converting is cheap -- `git worktree add ../<dir> -b <branch>` (a sibling outside the repo, with its own dependency install). Claude Code keeps this session inside its own working tree, so the work continues in a new session opened in the sibling worktree. If you cannot open a session there, stay in the primary checkout on this branch and check `git branch --show-current` before each commit.\";\nfunction isGitBranchCreation(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"checkout\" && sub !== \"switch\") return false;\n	const after = tokens.slice(tokens.indexOf(sub) + 1);\n	const creationLetters = sub === \"checkout\" ? [\"b\", \"B\"] : [\"c\", \"C\"];\n	return after.some((t) => {\n		const cluster = splitShortOptionCluster(t, sub);\n		return cluster !== void 0 && cluster.letters.some((l) => creationLetters.includes(l));\n	});\n}\nfunction worktreeAdvice(tokens, ctx) {\n	return isGitBranchCreation(tokens) && isPrimaryWorktree(ctx.cwd) ? WORKTREE_ADVICE : void 0;\n}\nconst GIT_FORCE_CREATE_LETTER = {\n	switch: \"C\",\n	checkout: \"B\"\n};\nconst GIT_FORCE_CREATE_LONG = {\n	flag: \"--force-create\",\n	shortest: \"--force-\"\n};\nfunction gitForceCreateTargets(after, letterSub) {\n	const letter = GIT_FORCE_CREATE_LETTER[letterSub];\n	const longFlag = GIT_FORCE_CREATE_LONG;\n	const targets = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (letterSub === \"switch\") {\n			const [flag, ...rest] = t.split(\"=\");\n			if (flag !== void 0 && flag.length >= longFlag.shortest.length && longFlag.flag.startsWith(flag)) {\n				const target = rest.length > 0 ? rest.join(\"=\") : after[i + 1];\n				if (target !== void 0) targets.push(target);\n				continue;\n			}\n		}\n		const cluster = splitShortOptionCluster(t, letterSub);\n		if (cluster === void 0 || !cluster.letters.includes(letter)) continue;\n		if (cluster.attachedValue !== void 0 && cluster.attachedValue !== \"\") {\n			targets.push(cluster.attachedValue);\n			continue;\n		}\n		const next = after[i + 1];\n		if (next !== void 0) targets.push(next);\n	}\n	return targets;\n}\nfunction gitCommandForceCreateTargets(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (sub === \"switch\" || sub === \"checkout\") return gitForceCreateTargets(tokens.slice(tokens.indexOf(sub) + 1), sub);\n	if (sub === \"worktree\") {\n		const worktreeIdx = tokens.indexOf(\"worktree\");\n		if (tokens[worktreeIdx + 1] !== \"add\") return [];\n		return gitForceCreateTargets(tokens.slice(worktreeIdx + 2), \"checkout\");\n	}\n	return [];\n}\nfunction isGitProtectedBranchForceCreate(tokens, ctx) {\n	const targets = gitCommandForceCreateTargets(tokens);\n	if (targets.length === 0) return false;\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	return targets.some((t) => protectedSet.has(t));\n}\nfunction isGitProtectedBranchRefWrite(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"branch\") return false;\n	const { flags, positionals } = splitGitBranchArgs(tokens.slice(tokens.indexOf(sub) + 1));\n	if (positionals.length === 0) return false;\n	let deleteMode = false;\n	let renameMode = false;\n	let copyMode = false;\n	let forceMode = false;\n	for (const flag of flags) {\n		if (flag.letters !== void 0) {\n			if (flag.letters.includes(\"d\") || flag.letters.includes(\"D\")) deleteMode = true;\n			if (flag.letters.includes(\"m\") || flag.letters.includes(\"M\")) renameMode = true;\n			if (flag.letters.includes(\"c\") || flag.letters.includes(\"C\")) copyMode = true;\n			if (flag.letters.includes(\"f\") || flag.letters.includes(\"M\") || flag.letters.includes(\"C\")) forceMode = true;\n			continue;\n		}\n		if (flag.name === \"delete\") deleteMode = true;\n		if (flag.name === \"move\") renameMode = true;\n		if (flag.name === \"copy\") copyMode = true;\n		if (flag.name === \"force\") forceMode = true;\n	}\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	if (deleteMode && positionals.some((p) => protectedSet.has(p))) return true;\n	if (renameMode && positionals.length >= 2 && protectedSet.has(positionals[0])) return true;\n	if (forceMode) {\n		const destination = renameMode || copyMode ? positionals[positionals.length - 1] : positionals[0];\n		if (destination !== void 0 && protectedSet.has(destination)) return true;\n	}\n	return false;\n}\nfunction refspecDestination(refspec) {\n	const spec = refspec.startsWith(\"+\") ? refspec.slice(1) : refspec;\n	const colon = spec.lastIndexOf(\":\");\n	return (colon === -1 ? spec : spec.slice(colon + 1)).replace(/^refs\\/heads\\//, \"\");\n}\nconst GIT_BRANCH_VALUE_FLAG_NAMES = /* @__PURE__ */ new Set([\n	\"contains\",\n	\"no-contains\",\n	\"merged\",\n	\"no-merged\",\n	\"points-at\",\n	\"sort\",\n	\"format\",\n	\"set-upstream-to\"\n]);\nfunction splitGitBranchArgs(after) {\n	const flags = [];\n	const positionals = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (t.startsWith(\"--\") && t !== \"--\") {\n			const eq = t.indexOf(\"=\");\n			const name = eq > 0 ? t.slice(2, eq) : t.slice(2);\n			flags.push({\n				raw: t,\n				name\n			});\n			if (eq < 0 && GIT_BRANCH_VALUE_FLAG_NAMES.has(name)) i++;\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, \"branch\");\n		if (cluster === void 0) {\n			flags.push({ raw: t });\n			continue;\n		}\n		flags.push({\n			raw: t,\n			letters: cluster.letters\n		});\n		if (cluster.attachedValue === \"\") i++;\n	}\n	return {\n		flags,\n		positionals\n	};\n}\nconst GIT_FETCH_VALUE_FLAG_NAMES = /* @__PURE__ */ new Set([\n	\"depth\",\n	\"deepen\",\n	\"shallow-since\",\n	\"shallow-exclude\",\n	\"negotiation-tip\",\n	\"filter\",\n	\"jobs\",\n	\"server-option\",\n	\"upload-pack\",\n	\"refmap\",\n	\"submodule-prefix\",\n	\"recurse-submodules-default\"\n]);\nfunction splitGitFetchArgs(after) {\n	const flags = [];\n	const positionals = [];\n	const refmaps = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (t === \"--\") {\n			flags.push({ raw: t });\n			continue;\n		}\n		if (t.startsWith(\"--\")) {\n			const eq = t.indexOf(\"=\");\n			const name = eq > 0 ? t.slice(2, eq) : t.slice(2);\n			flags.push({\n				raw: t,\n				name\n			});\n			if (name === \"refmap\") {\n				if (eq > 0) refmaps.push(t.slice(eq + 1));\n				else if (after[i + 1] !== void 0) refmaps.push(after[i + 1]);\n			}\n			if (eq < 0 && GIT_FETCH_VALUE_FLAG_NAMES.has(name)) i++;\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, \"fetch\");\n		if (cluster === void 0) {\n			flags.push({ raw: t });\n			continue;\n		}\n		flags.push({\n			raw: t,\n			letters: cluster.letters\n		});\n		if (cluster.attachedValue === \"\") i++;\n	}\n	return {\n		flags,\n		positionals,\n		refmaps\n	};\n}\nfunction fetchRefspecTarget(spec) {\n	const body = spec.startsWith(\"+\") ? spec.slice(1) : spec;\n	if (body.startsWith(\"^\")) return { kind: \"none\" };\n	if (!body.includes(\":\")) return { kind: \"none\" };\n	const destination = refspecDestination(body);\n	if (destination === \"\") return { kind: \"none\" };\n	if (destination.startsWith(\"refs/remotes/\")) return { kind: \"tracking\" };\n	if (destination.startsWith(\"refs/\")) return { kind: \"other\" };\n	return {\n		kind: \"branch\",\n		name: destination\n	};\n}\nfunction globToAnchoredRegex(glob) {\n	const escaped = glob.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n	return new RegExp(`^${escaped.replace(/\\\\\\*/g, \".*\")}$`);\n}\nfunction isProtectedFetchBranch(name, protectedSet) {\n	if (protectedSet.has(name)) return true;\n	if (!name.includes(\"*\")) return false;\n	const pattern = globToAnchoredRegex(name);\n	for (const member of protectedSet) if (pattern.test(member)) return true;\n	return false;\n}\nfunction isGitProtectedBranchFetchWrite(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"fetch\") return false;\n	const { positionals, refmaps } = splitGitFetchArgs(tokens.slice(tokens.indexOf(sub) + 1));\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	return [...positionals, ...refmaps].some((spec) => {\n		const target = fetchRefspecTarget(spec);\n		if (target.kind !== \"branch\" || target.name === void 0) return false;\n		return isProtectedFetchBranch(target.name, protectedSet);\n	});\n}\nfunction isGitProtectedUpdateRef(tokens, ctx) {\n	const after = tokens.slice(tokens.indexOf(\"update-ref\") + 1);\n	let ref;\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === \"-m\") {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		ref = t;\n		break;\n	}\n	if (ref === void 0) return false;\n	return getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []).has(ref.replace(/^refs\\/heads\\//, \"\"));\n}\nfunction gitEffectiveCwd(tokens, cwd) {\n	let dir = cwd;\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (t === \"-C\") {\n			const next = args[i + 1];\n			if (next !== void 0) dir = path.resolve(dir, next);\n			i++;\n			continue;\n		}\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (!t.startsWith(\"-\")) break;\n	}\n	return dir;\n}\nconst GIT_SWITCH_NEUTRAL_FLAGS = /* @__PURE__ */ new Set([\n	\"-q\",\n	\"--quiet\",\n	\"-f\",\n	\"--force\",\n	\"--discard-changes\",\n	\"-m\",\n	\"--merge\",\n	\"--no-track\",\n	\"--progress\",\n	\"--no-progress\",\n	\"--guess\",\n	\"--no-guess\",\n	\"--ignore-other-worktrees\",\n	\"--recurse-submodules\",\n	\"--no-recurse-submodules\"\n]);\nconst GIT_SWITCH_CREATE_FLAGS = /* @__PURE__ */ new Set([\n	\"--create\",\n	\"--force-create\",\n	\"--orphan\"\n]);\nconst GIT_CHECKOUT_PATH_FLAGS = /* @__PURE__ */ new Set([\n	\"--ours\",\n	\"--theirs\",\n	\"-p\",\n	\"--patch\",\n	\"--conflict\",\n	\"--pathspec-from-file\",\n	\"--pathspec-file-nul\",\n	\"--overlay\",\n	\"--no-overlay\"\n]);\nconst GIT_SWITCH_NEUTRAL_LETTERS = /* @__PURE__ */ new Set([\n	\"q\",\n	\"f\",\n	\"m\"\n]);\nfunction switchTarget(after, sub, isCheckoutBranch) {\n	if (sub === \"checkout\" && after.includes(\"--\")) return void 0;\n	const createLetters = sub === \"checkout\" ? [\"b\", \"B\"] : [\"c\", \"C\"];\n	const known = (l) => GIT_SWITCH_NEUTRAL_LETTERS.has(l) || createLetters.includes(l);\n	const positionals = [];\n	let created;\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (GIT_SWITCH_NEUTRAL_FLAGS.has(t)) continue;\n		const eq = t.indexOf(\"=\");\n		if (sub === \"checkout\" && GIT_CHECKOUT_PATH_FLAGS.has(eq === -1 ? t : t.slice(0, eq))) return;\n		if (GIT_SWITCH_CREATE_FLAGS.has(eq === -1 ? t : t.slice(0, eq))) {\n			created = eq === -1 ? after[++i] : t.slice(eq + 1);\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, sub);\n		if (cluster === void 0 || !cluster.letters.every(known)) return null;\n		if (cluster.letters.some((l) => createLetters.includes(l))) created = cluster.attachedValue ? cluster.attachedValue : after[++i];\n	}\n	if (created !== void 0) return created;\n	if (positionals.length !== 1) return void 0;\n	const target = positionals[0];\n	if (target === \"HEAD\" || target === \"@\") return void 0;\n	if (sub === \"checkout\" && !isCheckoutBranch(target)) return void 0;\n	return target;\n}\nfunction branchSwitch(tokens, ctx, resolved) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"switch\" && sub !== \"checkout\") return void 0;\n	const dir = gitEffectiveCwd(tokens, ctx.cwd);\n	const isCheckoutBranch = (name) => !resolved || getProtectedBranches(dir, ctx.repoProtectedBranches ?? []).has(name) || resolveCommit(dir, name) !== null;\n	const target = switchTarget(tokens.slice(tokens.indexOf(sub) + 1), sub, isCheckoutBranch);\n	if (!resolved) return target === void 0 ? void 0 : {\n		dir,\n		branch: null\n	};\n	return target === void 0 ? void 0 : {\n		dir,\n		branch: target\n	};\n}\nconst GIT_CHECKED_OUT_WRITES = /* @__PURE__ */ new Set([\n	\"commit\",\n	\"merge\",\n	\"rebase\",\n	\"cherry-pick\",\n	\"revert\",\n	\"am\",\n	\"pull\"\n]);\nfunction subcommandArgs(tokens, sub, valueFlags = /* @__PURE__ */ new Set()) {\n	const after = tokens.slice(tokens.indexOf(sub) + 1);\n	const flags = [];\n	const positionals = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		flags.push(t);\n		if (valueFlags.has(t)) i++;\n	}\n	return {\n		flags,\n		positionals\n	};\n}\nconst GIT_PUSH_VALUE_FLAGS = /* @__PURE__ */ new Set([\n	\"-o\",\n	\"--push-option\",\n	\"--repo\",\n	\"--receive-pack\",\n	\"--exec\"\n]);\nfunction isMergeFastForwardFromUpstream(tokens, upstream) {\n	const { flags, positionals } = subcommandArgs(tokens, \"merge\");\n	if (!flags.includes(\"--ff-only\") || positionals.length !== 1) return false;\n	const ref = positionals[0];\n	return ref === \"@{u}\" || ref === \"@{upstream}\" || upstream !== null && ref === upstream;\n}\nconst GIT_PULL_NO_REBASE = /* @__PURE__ */ new Set([\n	\"--rebase=false\",\n	\"--rebase=no\",\n	\"--rebase=off\",\n	\"--rebase=0\"\n]);\nfunction isPullFromUpstream(tokens, upstream) {\n	const { flags, positionals } = subcommandArgs(tokens, \"pull\");\n	if (flags.some((t) => t.startsWith(\"--rebase\") && !GIT_PULL_NO_REBASE.has(t) || t === \"--no-ff\" || !t.startsWith(\"--\") && t.slice(1).includes(\"r\"))) return false;\n	if (positionals.length === 0) return true;\n	if (positionals.length !== 2 || upstream === null) return false;\n	const [remote, branch] = positionals;\n	return `${remote}/${branch.replace(/^refs\\/heads\\//, \"\")}` === upstream;\n}\nfunction isRefMovingReset(tokens, cwd, head) {\n	if (tokens.slice(tokens.indexOf(\"reset\") + 1).includes(\"--\")) return false;\n	const { positionals } = subcommandArgs(tokens, \"reset\");\n	if (positionals.length !== 1) return false;\n	if (head !== \"HEAD\" && /^(HEAD|@)/.test(positionals[0])) return false;\n	const target = resolveCommit(cwd, positionals[0]);\n	if (target === null) return false;\n	return target !== resolveCommit(cwd, head);\n}\nfunction pushDestinations(tokens, current) {\n	const { positionals } = subcommandArgs(tokens, \"push\", GIT_PUSH_VALUE_FLAGS);\n	const refspecs = positionals.slice(1);\n	if (refspecs.length === 0) return null;\n	const names = [];\n	for (const spec of refspecs) {\n		const dst = refspecDestination(spec);\n		if (dst === \"HEAD\" || dst === \"@\") {\n			if (current !== null) names.push(current);\n			continue;\n		}\n		names.push(dst);\n	}\n	return names;\n}\nconst GIT_PUSH_EVERY_BRANCH = /* @__PURE__ */ new Set([\n	\"--all\",\n	\"--branches\",\n	\"--mirror\"\n]);\nfunction leavesRefInPlace(tokens, sub) {\n	const { flags } = subcommandArgs(tokens, sub);\n	if (flags.includes(\"--abort\") || flags.includes(\"--quit\")) return true;\n	return sub === \"commit\" && flags.includes(\"--dry-run\");\n}\nfunction movesProtectedRef(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub === void 0) return false;\n	if (sub === \"switch\" || sub === \"checkout\" || sub === \"worktree\") return isGitProtectedBranchForceCreate(tokens, ctx);\n	if (sub === \"branch\") return isGitProtectedBranchRefWrite(tokens, ctx);\n	if (sub === \"fetch\") return isGitProtectedBranchFetchWrite(tokens, ctx);\n	if (sub === \"update-ref\") return isGitProtectedUpdateRef(tokens, ctx);\n	if (sub !== \"push\" && sub !== \"reset\" && !GIT_CHECKED_OUT_WRITES.has(sub)) return false;\n	const cwd = gitEffectiveCwd(tokens, ctx.cwd);\n	const pending = ctx.pendingBranches?.[cwd];\n	const current = pending ? pending.branch : getCurrentBranch(cwd);\n	const protectedSet = getProtectedBranches(cwd, ctx.repoProtectedBranches ?? []);\n	const onProtected = current !== null && protectedSet.has(current);\n	if (sub === \"push\") {\n		const { flags } = subcommandArgs(tokens, \"push\", GIT_PUSH_VALUE_FLAGS);\n		if (flags.some((f) => GIT_PUSH_EVERY_BRANCH.has(f))) return true;\n		const destinations = pushDestinations(tokens, current);\n		if (destinations === null) {\n			if (flags.includes(\"--tags\")) return false;\n			return onProtected;\n		}\n		return destinations.some((d) => protectedSet.has(d));\n	}\n	if (!onProtected) return false;\n	if (leavesRefInPlace(tokens, sub)) return false;\n	if (sub === \"reset\") return isRefMovingReset(tokens, cwd, pending ? current : \"HEAD\");\n	if (sub === \"merge\" || sub === \"pull\") {\n		const upstream = getUpstream(cwd, current);\n		if (sub === \"merge\" && isMergeFastForwardFromUpstream(tokens, upstream)) return false;\n		if (sub === \"pull\" && isPullFromUpstream(tokens, upstream)) return false;\n	}\n	return true;\n}\nconst PNPM_BUILTINS = /* @__PURE__ */ new Set([\n	\"install\",\n	\"i\",\n	\"add\",\n	\"remove\",\n	\"rm\",\n	\"uninstall\",\n	\"un\",\n	\"update\",\n	\"up\",\n	\"upgrade\",\n	\"list\",\n	\"ls\",\n	\"ll\",\n	\"la\",\n	\"why\",\n	\"view\",\n	\"info\",\n	\"show\",\n	\"outdated\",\n	\"audit\",\n	\"licenses\",\n	\"init\",\n	\"create\",\n	\"link\",\n	\"unlink\",\n	\"pack\",\n	\"publish\",\n	\"config\",\n	\"set\",\n	\"get\",\n	\"store\",\n	\"cache\",\n	\"rebuild\",\n	\"rb\",\n	\"prune\",\n	\"dedupe\",\n	\"dlx\",\n	\"exec\",\n	\"run\",\n	\"patch\",\n	\"patch-commit\",\n	\"recursive\",\n	\"-r\"\n]);\nconst NPM_READ_OPS = /* @__PURE__ */ new Set([\n	\"view\",\n	\"info\",\n	\"show\"\n]);\nfunction isNpmReadOp(tokens) {\n	const sub = tokens[1];\n	return sub !== void 0 && NPM_READ_OPS.has(sub);\n}\nfunction getNpmRedirectReason(tokens) {\n	const sub = tokens[1];\n	const BASE = \"This project uses pnpm.\";\n	if (!sub) return `${BASE} Use \\`pnpm\\` instead of npm.`;\n	if (sub === \"install\" || sub === \"i\" || sub === \"ci\") {\n		if (tokens.slice(2).some((t) => !t.startsWith(\"-\"))) return `${BASE} Use \\`pnpm add <pkg>\\` instead of \\`npm install <pkg>\\`.`;\n		return `${BASE} Use \\`pnpm install\\` instead of npm.`;\n	}\n	if (sub === \"add\") return `${BASE} Use \\`pnpm add <pkg>\\` instead of npm.`;\n	if (sub === \"uninstall\" || sub === \"remove\" || sub === \"rm\" || sub === \"un\" || sub === \"r\") return `${BASE} Use \\`pnpm remove <pkg>\\` instead of npm.`;\n	if (sub === \"run\" || sub === \"run-script\") return `${BASE} Use \\`pnpm run <script>\\` or \\`pnpm <script>\\` instead of npm.`;\n	if (sub === \"test\" || sub === \"t\" || sub === \"tst\") return `${BASE} Use \\`pnpm test\\` instead of npm.`;\n	if (sub === \"start\") return `${BASE} Use \\`pnpm start\\` instead of npm.`;\n	if (sub === \"stop\") return `${BASE} Use \\`pnpm stop\\` instead of npm.`;\n	if (sub === \"restart\") return `${BASE} Use \\`pnpm restart\\` instead of npm.`;\n	if (sub === \"exec\") return `${BASE} Use \\`pnpm exec <cmd>\\` instead of npm.`;\n	if (sub === \"list\" || sub === \"ls\" || sub === \"ll\" || sub === \"la\") return `${BASE} Use \\`pnpm list\\` instead of npm.`;\n	if (sub === \"why\") return `${BASE} Use \\`pnpm why\\` instead of npm.`;\n	if (sub === \"outdated\") return `${BASE} Use \\`pnpm outdated\\` instead of npm.`;\n	if (sub === \"audit\") return `${BASE} Use \\`pnpm audit\\` instead of npm.`;\n	if (sub === \"update\" || sub === \"up\" || sub === \"upgrade\") return `${BASE} Use \\`pnpm update\\` instead of npm.`;\n	if (sub === \"init\") return `${BASE} Use \\`pnpm init\\` instead of npm.`;\n	if (sub === \"publish\") return `${BASE} Use \\`pnpm publish\\` instead of npm.`;\n	if (sub === \"link\") return `${BASE} Use \\`pnpm link\\` instead of npm.`;\n	if (sub === \"unlink\") return `${BASE} Use \\`pnpm unlink\\` instead of npm.`;\n	if (sub === \"pack\") return `${BASE} Use \\`pnpm pack\\` instead of npm.`;\n	if (sub === \"cache\") return `${BASE} Use \\`pnpm store\\` instead of \\`npm cache\\`.`;\n	if (sub === \"config\" || sub === \"set\" || sub === \"get\") return `${BASE} Use \\`pnpm config\\` instead of npm.`;\n	return `${BASE} Use the equivalent pnpm command instead of npm.`;\n}\nconst LAST_POSITIONAL_DEST = /* @__PURE__ */ new Set([\n	\"cp\",\n	\"mv\",\n	\"rsync\",\n	\"install\",\n	\"ln\"\n]);\nconst ALL_POSITIONAL_DEST = /* @__PURE__ */ new Set([\"tee\", \"truncate\"]);\nfunction explicitTargetDirectory(rest) {\n	for (const [i, t] of rest.entries()) {\n		if (t === \"-t\" || t === \"--target-directory\") return rest[i + 1] ?? null;\n		if (t.startsWith(\"--target-directory=\")) return t.slice(19);\n	}\n	return null;\n}\nconst OUTPUT_REDIRECT = /^(?:\\d*|&)>{1,2}$/;\nconst OUTPUT_REDIRECT_ATTACHED = /^(?:\\d*|&)>{1,2}(.+)$/;\nconst INPUT_REDIRECT = /^\\d*<$/;\nconst INPUT_REDIRECT_ATTACHED = /^\\d*<([^<].*)$/;\nfunction spacedRedirectDirection(token) {\n	if (OUTPUT_REDIRECT.test(token)) return \"out\";\n	if (INPUT_REDIRECT.test(token)) return \"in\";\n	return null;\n}\nfunction splitRedirects(tokens) {\n	const redirects = [];\n	const rest = [];\n	for (let i = 0; i < tokens.length; i++) {\n		const t = tokens[i];\n		const spaced = spacedRedirectDirection(t);\n		if (spaced !== null) {\n			const next = tokens[i + 1];\n			if (next !== void 0) redirects.push({\n				direction: spaced,\n				target: next\n			});\n			i++;\n			continue;\n		}\n		const out = OUTPUT_REDIRECT_ATTACHED.exec(t);\n		if (out) {\n			redirects.push({\n				direction: \"out\",\n				target: out[1]\n			});\n			continue;\n		}\n		const input = INPUT_REDIRECT_ATTACHED.exec(t);\n		if (input) {\n			redirects.push({\n				direction: \"in\",\n				target: input[1]\n			});\n			continue;\n		}\n		rest.push(t);\n	}\n	return {\n		redirects,\n		rest\n	};\n}\nfunction redirectTargets(tokens, direction) {\n	return splitRedirects(tokens).redirects.filter((r) => r.direction === direction).map((r) => r.target);\n}\nfunction writeDestinations(tokens) {\n	const cmd = path.basename(tokens[0] ?? \"\");\n	const rest = tokens.slice(1);\n	const dests = redirectTargets(tokens, \"out\");\n	if (cmd === \"dd\") dests.push(...rest.filter((t) => t.startsWith(\"of=\")).map((t) => t.slice(3)));\n	else if (cmd === \"sed\") {\n		if (rest.some((t) => t === \"--in-place\" || /^-[a-zA-Z]*i/.test(t))) dests.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	} else if (ALL_POSITIONAL_DEST.has(cmd)) dests.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	else if (LAST_POSITIONAL_DEST.has(cmd)) {\n		if (cmd === \"cp\" && rest.includes(\"--remove-destination\")) return dests;\n		const targetDir = explicitTargetDirectory(rest);\n		if (targetDir !== null) dests.push(targetDir);\n		else {\n			const last = rest.findLast((t) => !t.startsWith(\"-\"));\n			if (last !== void 0) dests.push(last);\n		}\n	}\n	return dests;\n}\nfunction writesIntoNodeModules(tokens, ctx) {\n	return writeDestinations(tokens).some((d) => targetsNodeModules(d, ctx.cwd));\n}\nconst NODE_MODULES_WRITE_REASON = \"Don't write into node_modules/. Its files are hardlinks into pnpm's global store, so overwriting one in place (plain `cp`, `>` redirect, `sed -i`, ...) writes through the link and corrupts that package for every project on this machine -- silently, since the directory you wrote into ends up fine. To test a local build as an installed dependency, run it directly (`node packages/<pkg>/dist/bin.mjs <cmd>`), or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`). If you must replace a file in place, `cp --remove-destination` is safe -- it unlinks the target first. Run `pnpm store status` to check whether the store is already damaged.\";\nfunction isChmod777(tokens) {\n	return tokens.some((t) => t === \"777\" || t === \"0777\");\n}\nfunction isGitForcePush(tokens) {\n	const pushIdx = tokens.indexOf(\"push\");\n	if (pushIdx === -1) return false;\n	return tokens.slice(pushIdx + 1).some((t) => t === \"--force\" || t === \"-f\");\n}\nconst ENV_READ_FILE_COMMANDS = /* @__PURE__ */ new Set([\n	\"cat\",\n	\"head\",\n	\"tail\",\n	\"less\",\n	\"more\",\n	\"source\",\n	\".\"\n]);\nconst GREP_FAMILY_COMMANDS = /* @__PURE__ */ new Set([\n	\"grep\",\n	\"rg\",\n	\"ag\"\n]);\nfunction grepFileOperands(rest) {\n	const files = [];\n	let patternAccountedFor = false;\n	let optionsEnded = false;\n	for (let i = 0; i < rest.length; i++) {\n		const t = rest[i];\n		if (!optionsEnded && t === \"--\") {\n			optionsEnded = true;\n			continue;\n		}\n		if (!optionsEnded) {\n			if (t === \"-f\" || t === \"--file\") {\n				const value = rest[i + 1];\n				if (value !== void 0) {\n					files.push(value);\n					i++;\n				}\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"--file=\")) {\n				files.push(t.slice(7));\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"-f\") && t !== \"-f\" && !t.startsWith(\"--\")) {\n				files.push(t.slice(2));\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t === \"-e\" || t === \"--regexp\") {\n				i++;\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"--regexp=\") || t.startsWith(\"-e\") && t !== \"-e\" && !t.startsWith(\"--\")) {\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"-\")) continue;\n		}\n		if (!patternAccountedFor) {\n			patternAccountedFor = true;\n			continue;\n		}\n		files.push(t);\n	}\n	return files;\n}\nfunction envFileOperands(tokens) {\n	const cmd = path.basename(tokens[0] ?? \"\");\n	const { redirects, rest } = splitRedirects(tokens.slice(1));\n	const operands = redirects.filter((r) => r.direction === \"in\").map((r) => r.target);\n	if (GREP_FAMILY_COMMANDS.has(cmd)) operands.push(...grepFileOperands(rest));\n	else if (ENV_READ_FILE_COMMANDS.has(cmd)) operands.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	return operands;\n}\nconst HEALTH_CEILING_FILES = [\"health-baseline.json\", \".tooling.json\"];\nconst HEALTH_BASELINE_FILE = \"health-baseline.json\";\nconst HEALTH_RAISE_REASON = \"A health ceiling raise travels alone: open a ceiling-only pull request -- only health-baseline.json and .tooling.json changed -- for a human to merge, or split the module. `health:check` refuses the raise beside code either way. To restore the default branch's copy run `git show origin/<default>:health-baseline.json > health-baseline.json`, and to adopt lower counts run `pnpm exec bst health:check --update-baseline`.\";\nfunction writesHealthBaseline(tokens, cwd) {\n	const destinations = writeDestinations(tokens);\n	if (!destinations.some((dest) => baseName(dest) === \"health-baseline.json\")) return false;\n	const root = getRepoTopLevel(cwd) ?? cwd;\n	return destinations.some((dest) => samePath(resolveIn(cwd, dest), path.join(root, HEALTH_BASELINE_FILE)));\n}\nfunction baseName(target) {\n	const segments = target.split(/[/\\\\]/);\n	return segments[segments.length - 1] ?? \"\";\n}\nfunction isBaselineRestore(tokens) {\n	if (tokens[0] !== \"git\") return false;\n	let i = 1;\n	while (tokens[i]?.startsWith(\"-\") === true) i += GIT_FLAGS_WITH_ARG.has(tokens[i] ?? \"\") ? 2 : 1;\n	if (tokens[i] !== \"show\") return false;\n	return tokens.slice(i + 1).some((token) => token.includes(\":\") && baseName(token.slice(token.lastIndexOf(\":\") + 1)) === \"health-baseline.json\");\n}\nfunction isHealthBaselineReset(tokens) {\n	return tokens.includes(\"health:check\") && tokens.includes(\"--update-baseline\") && tokens.includes(\"--reset\");\n}\nfunction raiseTravelsWithCode(cwd) {\n	return branchCarriesOtherFiles(cwd, HEALTH_CEILING_FILES) === true;\n}\nconst denyRules = [\n	{\n		name: \"sudo\",\n		match: /^sudo$/,\n		action: \"deny\",\n		reason: \"Don't use sudo. If you need elevated permissions, ask me to do it manually.\"\n	},\n	{\n		name: \"git-force-push\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitForcePush(tokens),\n		reason: \"Use `git push --force-with-lease` instead of `--force`.\"\n	},\n	{\n		name: \"git-protected-branch-write\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens, ctx) => movesProtectedRef(tokens, ctx),\n		reason: \"This would move a protected branch (main, master, the remote's default branch, or one listed in .claude/hooks/bst-hook.settings.json#protectedBranches). Work on a feature branch in a worktree: `git worktree add ../<repo>-<topic> -b feat/<topic>`, then commit and push there. To bring `main` up to date, use `git pull --ff-only`.\"\n	},\n	{\n		name: \"chmod-777\",\n		match: /^chmod$/,\n		action: \"deny\",\n		when: (tokens) => isChmod777(tokens),\n		reason: \"Don't use 777 permissions. Use more restrictive permissions.\"\n	},\n	{\n		name: \"node-modules-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens, ctx) => writesIntoNodeModules(tokens, ctx),\n		reason: NODE_MODULES_WRITE_REASON\n	},\n	{\n		name: \"env-file-read\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens) => envFileOperands(tokens).some(isEnvFile),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens) => redirectTargets(tokens, \"out\").some(isEnvFile),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"health-baseline-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens, ctx) => writesHealthBaseline(tokens, ctx.cwd) && !isBaselineRestore(tokens) && raiseTravelsWithCode(ctx.cwd),\n		reason: HEALTH_RAISE_REASON\n	},\n	{\n		name: \"health-baseline-reset\",\n		match: /^bst$/,\n		action: \"deny\",\n		when: (tokens, ctx) => isHealthBaselineReset(tokens) && raiseTravelsWithCode(ctx.cwd),\n		reason: HEALTH_RAISE_REASON\n	},\n	{\n		name: \"npx-redirect\",\n		match: /^npx$/,\n		action: \"deny\",\n		reason: \"This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\"\n	},\n	{\n		name: \"mise-self-update\",\n		match: /^mise$/,\n		action: \"deny\",\n		when: (tokens) => tokens[1] === \"self-update\",\n		reason: \"Don't self-update mise. The version is Renovate-managed; ask a human to bump the pin.\"\n	}\n];\n\n//#endregion\n//#region src/lib/script-resolver.ts\nconst PackageJsonSchema = object({ scripts: record(string(), unknown()) });\nfunction resolveScript(scriptName, cwd) {\n	const scripts = readScripts(cwd);\n	if (!scripts) return null;\n	const main = scripts[scriptName];\n	if (typeof main !== \"string\") return null;\n	const pre = scripts[`pre${scriptName}`];\n	const post = scripts[`post${scriptName}`];\n	return {\n		pre: typeof pre === \"string\" ? pre : null,\n		main,\n		post: typeof post === \"string\" ? post : null\n	};\n}\nfunction resolveFilteredScript(scriptName, filterPkg, cwd) {\n	const pkgDir = findWorkspacePackageDir(filterPkg, cwd);\n	if (!pkgDir) return null;\n	const script = resolveScript(scriptName, pkgDir);\n	if (!script) return null;\n	return {\n		...script,\n		pkgDir\n	};\n}\nfunction resolveRecursiveScripts(scriptName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	const results = [];\n	for (const pkgDir of pkgDirs) {\n		const resolved = resolveScript(scriptName, pkgDir);\n		if (resolved) results.push({\n			...resolved,\n			pkgDir\n		});\n	}\n	return results;\n}\nfunction listWorkspacePackageDirs(rootDir) {\n	const patterns = readWorkspacePatterns(rootDir);\n	if (!patterns) return null;\n	const dirs = [];\n	for (const pattern of patterns) {\n		if (!pattern.endsWith(\"/*\")) continue;\n		const baseDir = pattern.slice(0, -2);\n		const parentDir = resolve(rootDir, baseDir);\n		let entries;\n		try {\n			entries = readdirSync(parentDir);\n		} catch {\n			continue;\n		}\n		for (const entry of entries) {\n			const entryDir = join(parentDir, entry);\n			try {\n				if (!statSync(entryDir).isDirectory()) continue;\n			} catch {\n				continue;\n			}\n			dirs.push(entryDir);\n		}\n	}\n	return dirs.length > 0 ? dirs : null;\n}\nfunction findWorkspacePackageDir(pkgName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	for (const entryDir of pkgDirs) {\n		const name = readPackageName(entryDir);\n		if (name === pkgName || name === `@${pkgName}`) return entryDir;\n		if (entryDir.split(\"/\").pop() === pkgName) return entryDir;\n		if (name) {\n			if ((name.startsWith(\"@\") ? name.split(\"/\")[1] : name) === pkgName) return entryDir;\n		}\n	}\n	return null;\n}\nfunction readWorkspacePatterns(rootDir) {\n	try {\n		const lines = readFileSync(join(rootDir, \"pnpm-workspace.yaml\"), \"utf-8\").split(\"\\n\");\n		const packagesIdx = lines.findIndex((l) => /^packages\\s*:/.test(l));\n		if (packagesIdx === -1) return null;\n		const patterns = [];\n		for (let i = packagesIdx + 1; i < lines.length; i++) {\n			const line = lines[i];\n			const match = /^\\s+-\\s+(.+)$/.exec(line);\n			if (!match) break;\n			patterns.push(match[1].trim().replace(/['\"`]/g, \"\"));\n		}\n		return patterns.length > 0 ? patterns : null;\n	} catch {\n		return null;\n	}\n}\nconst PackageNameSchema = object({ name: string() });\nfunction readPackageName(dir) {\n	try {\n		const raw = readFileSync(join(dir, \"package.json\"), \"utf-8\");\n		const result = PackageNameSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.name;\n	} catch {\n		return null;\n	}\n}\nfunction readScripts(cwd) {\n	try {\n		const raw = readFileSync(join(cwd, \"package.json\"), \"utf-8\");\n		const result = PackageJsonSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.scripts;\n	} catch {\n		return null;\n	}\n}\n\n//#endregion\n//#region src/lib/workspace-root.ts\nfunction findWorkspaceRoot(cwd) {\n	let dir = resolve(cwd);\n	while (true) {\n		if (existsSync(join(dir, \"pnpm-workspace.yaml\"))) return dir;\n		const parent = dirname(dir);\n		if (parent === dir) return null;\n		dir = parent;\n	}\n}\n\n//#endregion\n//#region src/evaluate.ts\nconst MAX_EVAL_DEPTH = 5;\nfunction subshellBody(command) {\n	if (!command.startsWith(\"(\") || !command.endsWith(\")\")) return null;\n	let depth = 0;\n	let quote = null;\n	for (let i = 0; i < command.length; i++) {\n		const ch = command[i];\n		if (quote !== null) {\n			if (ch === quote) quote = null;\n			else if (ch === \"\\\\\" && quote === \"\\\"\") i++;\n			continue;\n		}\n		if (ch === \"\\\\\") i++;\n		else if (ch === \"'\" || ch === \"\\\"\") quote = ch;\n		else if (ch === \"(\") depth++;\n		else if (ch === \")\") {\n			depth--;\n			if (depth === 0) return i === command.length - 1 ? command.slice(1, -1) : null;\n		}\n	}\n	return null;\n}\nfunction extractCdDir(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok || tokenResult.tokens.length !== 2) return null;\n	const tokens = tokenResult.tokens;\n	if (tokens[0] !== \"cd\") return null;\n	const dir = tokens[1];\n	if (path.isAbsolute(dir)) return dir;\n	return path.resolve(ctx.cwd, dir);\n}\nfunction extractBranchSwitch(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok) return void 0;\n	let tokens = tokenResult.tokens;\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) envSkipped++;\n	tokens = tokens.slice(envSkipped);\n	if (tokens.length === 0 || path.basename(tokens[0]) !== \"git\") return void 0;\n	return branchSwitch(tokens, ctx, checkInjection(tokens, segment).safe);\n}\nfunction evaluateCommand(command, ctx) {\n	if (ctx.depth >= MAX_EVAL_DEPTH) return {\n		action: \"none\",\n		rule: null,\n		reason: \"max evaluation depth exceeded\"\n	};\n	const trimmed = command.trim();\n	if (!trimmed) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	const body = subshellBody(trimmed);\n	if (body !== null) return evaluateCommand(body, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	const segments = splitCommand(trimmed);\n	if (segments.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	let firstNone = null;\n	const currentCtx = { ...ctx };\n	let unknownAfterNext;\n	for (const segment of segments) {\n		if (segment.operator === \"&&\") {\n			const cdDir = extractCdDir(segment.command, currentCtx);\n			if (cdDir) currentCtx.cwd = cdDir;\n		}\n		const result = evaluateSegment(segment.command, currentCtx);\n		if (result.action === \"deny\") return result;\n		if (!firstNone) firstNone = result;\n		if (unknownAfterNext) {\n			currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[unknownAfterNext.dir]: unknownAfterNext\n			};\n			unknownAfterNext = void 0;\n		}\n		const switched = extractBranchSwitch(segment.command, currentCtx);\n		if (switched) {\n			const unknown = {\n				dir: switched.dir,\n				branch: null\n			};\n			if (segment.operator === \"&&\") currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[switched.dir]: switched\n			};\n			else if (segment.operator === \"||\") unknownAfterNext = unknown;\n			else currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[switched.dir]: unknown\n			};\n		}\n	}\n	return firstNone ?? {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n}\nfunction evaluateResolvedScript(resolved, ctx) {\n	if (resolved.pre) {\n		const preResult = evaluateCommand(resolved.pre, ctx);\n		if (preResult.action === \"deny\") return preResult;\n	}\n	const mainResult = evaluateCommand(resolved.main, ctx);\n	if (mainResult.action === \"deny\") return mainResult;\n	if (resolved.post) {\n		const postResult = evaluateCommand(resolved.post, ctx);\n		if (postResult.action === \"deny\") return postResult;\n	}\n	return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n}\nfunction evaluateSegment(rawSegment, ctx) {\n	const trimmed = rawSegment.trim();\n	const body = subshellBody(trimmed);\n	if (body !== null) return evaluateCommand(body, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (trimmed.startsWith(\"(\") && trimmed.endsWith(\")\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"subshell\"\n	};\n	const tokenResult = tokenize(rawSegment);\n	if (!tokenResult.ok) return {\n		action: \"none\",\n		rule: null,\n		reason: tokenResult.error\n	};\n	let tokens = tokenResult.tokens;\n	if (tokens.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) envSkipped++;\n	if (envSkipped >= tokens.length) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	tokens = tokens.slice(envSkipped);\n	if (writesIntoNodeModules(tokens, ctx)) return {\n		action: \"deny\",\n		rule: \"node-modules-write\",\n		reason: NODE_MODULES_WRITE_REASON\n	};\n	const injection = checkInjection(tokens, rawSegment);\n	if (!injection.safe) return {\n		action: \"none\",\n		rule: null,\n		reason: injection.reason\n	};\n	const SAFE_REDIRECT_TOKENS = /* @__PURE__ */ new Set([\n		\"2>&1\",\n		\"2>/dev/null\",\n		\">/dev/null\",\n		\"1>/dev/null\"\n	]);\n	tokens = tokens.filter((t, i) => {\n		if (SAFE_REDIRECT_TOKENS.has(t)) return false;\n		if ((t === \">\" || t === \">>\") && tokens[i + 1] === \"/dev/null\") return false;\n		if (t === \"/dev/null\" && i > 0 && (tokens[i - 1] === \">\" || tokens[i - 1] === \">>\")) return false;\n		return true;\n	});\n	const cmdName = path.basename(tokens[0]);\n	if (cmdName === \"command\" && tokens.length > 1) return evaluateCommand(joinTokens(tokens.slice(1)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (cmdName === \"env\") {\n		let envIdx = 1;\n		while (envIdx < tokens.length && /^\\w+=/.test(tokens[envIdx])) envIdx++;\n		if (envIdx >= tokens.length) return {\n			action: \"none\",\n			rule: null,\n			reason: null\n		};\n		return evaluateCommand(joinTokens(tokens.slice(envIdx)), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"pnpm\") return evaluatePnpm(tokens, ctx);\n	if (cmdName === \"npm\") return evaluateNpm(tokens);\n	if (cmdName === \"mise\" && tokens[1] === \"exec\") {\n		const inner = miseExecInner(tokens);\n		if (!inner) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare mise exec\"\n		};\n		return evaluateCommand(joinTokens(inner), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"bash\" || cmdName === \"sh\" || cmdName === \"zsh\") return evaluateShellC(tokens, ctx);\n	if (cmdName === \"xargs\") return evaluateXargs(tokens, ctx);\n	if (cmdName === \"node\" && (tokens.includes(\"-e\") || tokens.includes(\"-p\") || tokens.includes(\"--eval\") || tokens.includes(\"--print\"))) return {\n		action: \"none\",\n		rule: null,\n		reason: \"node eval\"\n	};\n	for (const rule of denyRules) if (rule.match.test(cmdName)) {\n		if (!rule.when || rule.when(tokens, ctx)) return {\n			action: \"deny\",\n			rule: rule.name,\n			reason: rule.reason ?? null\n		};\n	}\n	const advice = cmdName === \"git\" ? worktreeAdvice(tokens, ctx) : void 0;\n	return {\n		action: \"none\",\n		rule: null,\n		reason: `no rule matched: ${cmdName}`,\n		...advice ? { advice } : {}\n	};\n}\nfunction miseExecInner(tokens) {\n	const dashIdx = tokens.indexOf(\"--\");\n	if (dashIdx === -1) return void 0;\n	const inner = tokens.slice(dashIdx + 1);\n	return inner.length > 0 ? inner : void 0;\n}\nfunction scanPnpmFlags(subTokens, from, state) {\n	for (let i = from; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t.startsWith(\"--filter=\") || t === \"-F\" || t.startsWith(\"-F=\")) return {\n			name: void 0,\n			filterIdx: i\n		};\n		if (t === \"-r\" || t === \"--recursive\") {\n			state.isRecursive = true;\n			continue;\n		}\n		if (t === \"-w\" || t === \"--workspace-root\") {\n			state.isWorkspaceRoot = true;\n			continue;\n		}\n		if (t === \"-C\" || t === \"--dir\") {\n			state.dirOverride = subTokens[++i];\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			state.dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		return { name: t };\n	}\n	return { name: void 0 };\n}\nfunction evaluatePnpm(tokens, ctx) {\n	const subTokens = tokens.slice(1);\n	const state = {\n		isRecursive: false,\n		isWorkspaceRoot: false,\n		dirOverride: void 0\n	};\n	const scan = scanPnpmFlags(subTokens, 0, state);\n	if (scan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, scan.filterIdx, ctx);\n	const subcommand = scan.name;\n	const subcommandIdx = subcommand ? subTokens.indexOf(subcommand) : -1;\n	if (!subcommand) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (subcommand === \"dlx\") return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm dlx\"\n	};\n	if (subcommand === \"add\") return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm add\"\n	};\n	if (subcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcommandIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName;\n	let { isRecursive, isWorkspaceRoot, dirOverride } = state;\n	if (subcommand === \"run\") {\n		const runScan = scanPnpmFlags(subTokens, subcommandIdx + 1, state);\n		({isRecursive, isWorkspaceRoot, dirOverride} = state);\n		if (runScan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, runScan.filterIdx, ctx);\n		if (!runScan.name) return {\n			action: \"none\",\n			rule: null,\n			reason: \"pnpm run without script name\"\n		};\n		scriptName = runScan.name;\n	} else if (!PNPM_BUILTINS.has(subcommand)) scriptName = subcommand;\n	else return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (isRecursive) return evaluatePnpmRecursive(scriptName, ctx);\n	if (isWorkspaceRoot) {\n		const root = findWorkspaceRoot(ctx.cwd);\n		if (!root) return {\n			action: \"none\",\n			rule: null,\n			reason: \"workspace root not found\"\n		};\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: root\n		});\n	}\n	if (dirOverride) {\n		const resolved = path.resolve(ctx.cwd, dirOverride);\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: resolved\n		});\n	}\n	return evaluatePnpmScript(scriptName, ctx);\n}\nfunction evaluatePnpmScript(scriptName, ctx) {\n	const resolved = resolveScript(scriptName, ctx.cwd);\n	if (!resolved) return {\n		action: \"none\",\n		rule: null,\n		reason: \"script resolution failed\"\n	};\n	const res = evaluateResolvedScript(resolved, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (res.action === \"deny\") return res;\n	return {\n		action: \"none\",\n		rule: `pnpm-script:${scriptName}`,\n		reason: null\n	};\n}\nfunction evaluatePnpmRecursive(scriptName, ctx) {\n	const resolved = resolveRecursiveScripts(scriptName, ctx.cwd);\n	if (!resolved || resolved.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm recursive\"\n	};\n	for (const pkg of resolved) {\n		const res = evaluateResolvedScript(pkg, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: pkg.pkgDir ?? ctx.cwd\n		});\n		if (res.action === \"deny\") return res;\n	}\n	return {\n		action: \"none\",\n		rule: `pnpm-recursive:${scriptName}`,\n		reason: null\n	};\n}\nfunction evaluateNpm(tokens) {\n	if (isNpmReadOp(tokens)) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	return {\n		action: \"deny\",\n		rule: \"npm-redirect\",\n		reason: getNpmRedirectReason(tokens)\n	};\n}\nfunction evaluatePnpmFilter(_tokens, subTokens, filterIdx, ctx) {\n	const filterPkgs = [];\n	let cursor = filterIdx;\n	while (cursor < subTokens.length) {\n		const t = subTokens[cursor];\n		if (t === \"--filter\" || t === \"-F\") {\n			const pkg = subTokens[cursor + 1];\n			if (!pkg || pkg.startsWith(\"-\")) return {\n				action: \"none\",\n				rule: null,\n				reason: \"pnpm --filter without package\"\n			};\n			filterPkgs.push(pkg);\n			cursor += 2;\n		} else if (t.startsWith(\"--filter=\") || t.startsWith(\"-F=\")) {\n			const pkg = t.startsWith(\"-F=\") ? t.slice(3) : t.slice(9);\n			if (!pkg) return {\n				action: \"none\",\n				rule: null,\n				reason: \"pnpm --filter without package\"\n			};\n			filterPkgs.push(pkg);\n			cursor += 1;\n		} else break;\n	}\n	if (filterPkgs.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	let filterSubcommand;\n	let subcmdIdx = -1;\n	for (let i = cursor; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t === \"-F\") {\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"--filter=\") || t.startsWith(\"-F=\")) continue;\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		filterSubcommand = t;\n		subcmdIdx = i;\n		break;\n	}\n	if (!filterSubcommand) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without subcommand\"\n	};\n	if (PNPM_BUILTINS.has(filterSubcommand) && filterSubcommand !== \"run\" && filterSubcommand !== \"exec\") return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (filterSubcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcmdIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	const scriptName = filterSubcommand === \"run\" ? subTokens[subcmdIdx + 1] : filterSubcommand;\n	if (!scriptName || scriptName.startsWith(\"-\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter run without script name\"\n	};\n	if (PNPM_BUILTINS.has(scriptName) && scriptName !== \"run\") return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	for (const pkg of filterPkgs) {\n		const resolved = resolveFilteredScript(scriptName, pkg, ctx.cwd);\n		if (!resolved) return {\n			action: \"none\",\n			rule: null,\n			reason: \"filtered script resolution failed\"\n		};\n		const res = evaluateResolvedScript(resolved, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: resolved.pkgDir ?? ctx.cwd\n		});\n		if (res.action === \"deny\") return res;\n	}\n	return {\n		action: \"none\",\n		rule: `pnpm-filter:${filterPkgs.join(\",\")}:${scriptName}`,\n		reason: null\n	};\n}\nconst SHELL_LOGIN_FLAGS = /* @__PURE__ */ new Set([\"-l\", \"--login\"]);\nfunction evaluateShellC(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length && SHELL_LOGIN_FLAGS.has(tokens[i])) i++;\n	const flag = tokens[i];\n	if (flag === void 0 || !/^-[lc]+$/.test(flag) || !flag.includes(\"c\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell without a plain -c\"\n	};\n	const cmdArg = tokens[i + 1];\n	if (!cmdArg) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell -c without command\"\n	};\n	if (tokens.length > i + 2) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell -c with positional args\"\n	};\n	return evaluateCommand(cmdArg, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\nconst XARGS_ARG_FLAGS = /* @__PURE__ */ new Set([\n	\"-I\",\n	\"-d\",\n	\"-n\",\n	\"-P\",\n	\"-s\",\n	\"-L\",\n	\"-E\",\n	\"-a\",\n	\"--max-args\",\n	\"--max-procs\",\n	\"--delimiter\",\n	\"--replace\",\n	\"--max-lines\",\n	\"--max-chars\",\n	\"--arg-file\",\n	\"--process-slot-var\"\n]);\nconst XARGS_BOOL_FLAGS = /* @__PURE__ */ new Set([\n	\"-0\",\n	\"--null\",\n	\"-t\",\n	\"--verbose\",\n	\"-r\",\n	\"--no-run-if-empty\",\n	\"-p\",\n	\"--interactive\",\n	\"-x\",\n	\"--exit\",\n	\"--show-limits\"\n]);\nfunction evaluateXargs(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length) {\n		const t = tokens[i];\n		if (!t.startsWith(\"-\")) break;\n		if (XARGS_ARG_FLAGS.has(t)) {\n			i += 2;\n			continue;\n		}\n		const eqIdx = t.indexOf(\"=\");\n		if (eqIdx !== -1) {\n			const flagName = t.slice(0, eqIdx);\n			if (XARGS_ARG_FLAGS.has(flagName)) {\n				i++;\n				continue;\n			}\n		}\n		if (t.length > 2 && XARGS_ARG_FLAGS.has(t.slice(0, 2))) {\n			i++;\n			continue;\n		}\n		if (XARGS_BOOL_FLAGS.has(t)) {\n			i++;\n			continue;\n		}\n		return {\n			action: \"none\",\n			rule: null,\n			reason: \"xargs with unrecognised flags\"\n		};\n	}\n	if (i >= tokens.length) return {\n		action: \"none\",\n		rule: null,\n		reason: \"xargs without command\"\n	};\n	return evaluateCommand(joinTokens(tokens.slice(i)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\n\n//#endregion\n//#region src/file-rules.ts\nconst READ_TOOLS = /* @__PURE__ */ new Set([\n	\"Read\",\n	\"Glob\",\n	\"Grep\"\n]);\nconst WRITE_TOOLS = /* @__PURE__ */ new Set([\"Write\", \"Edit\"]);\nconst fileDenyRules = [\n	{\n		name: \"env-file-read\",\n		tools: READ_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"hooks-folder-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			const hooksDir = path.join(ctx.cwd, \".claude\", \"hooks\");\n			return isWithin(hooksDir, resolved);\n		},\n		reason: \"Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"git-dir-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => targetsGitDir(filePath, ctx.cwd),\n		reason: \"Don't write into .git/ directly. Its internals (config, hooks, refs) are not plain project files -- a config edit can redirect remotes or push destinations that other rules trust, and a hooks/ script runs automatically on the next commit/push. Use git subcommands instead, or ask the user.\"\n	},\n	{\n		name: \"node-modules-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => targetsNodeModules(filePath, ctx.cwd),\n		reason: \"Don't write into node_modules/. Its files are hardlinks into pnpm's global store -- editing one in place corrupts that package for every project on this machine. Edit the source package and rebuild, or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`).\"\n	},\n	{\n		name: \"claude-settings-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			return samePath(resolved, path.join(ctx.cwd, \".claude\", \"settings.json\"));\n		},\n		reason: \"Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"health-baseline-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx, toolInput) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			if (path.basename(resolved) !== \"health-baseline.json\") return false;\n			const root = getRepoTopLevel(ctx.cwd) ?? ctx.cwd;\n			if (!samePath(resolved, path.join(root, \"health-baseline.json\"))) return false;\n			if (!writeRaisesBaseline(resolved, toolInput)) return false;\n			return branchCarriesOtherFiles(ctx.cwd, HEALTH_CEILING_FILES) === true;\n		},\n		reason: HEALTH_RAISE_REASON\n	}\n];\nfunction writeRaisesBaseline(file, toolInput) {\n	let before;\n	try {\n		before = readFileSync(file, \"utf8\");\n	} catch (_error) {\n		return false;\n	}\n	const after = textAfterWrite(before, toolInput);\n	if (after === void 0) return false;\n	const beforeJson = parseJson(before);\n	const afterJson = parseJson(after);\n	if (beforeJson === void 0 || afterJson === void 0) return false;\n	return numberRises(beforeJson, afterJson);\n}\nfunction textAfterWrite(before, toolInput) {\n	const { content, old_string: oldText, new_string: newText, replace_all: all } = toolInput;\n	if (typeof content === \"string\") return content;\n	if (typeof oldText !== \"string\" || typeof newText !== \"string\" || oldText === \"\") return void 0;\n	const at = before.indexOf(oldText);\n	if (at === -1) return void 0;\n	if (all === true) return before.split(oldText).join(newText);\n	return before.slice(0, at) + newText + before.slice(at + oldText.length);\n}\nfunction parseJson(text) {\n	try {\n		const result = record(string(), unknown()).safeParse(JSON.parse(text));\n		return result.success ? result.data : void 0;\n	} catch (_error) {\n		return;\n	}\n}\nfunction numberRises(before, after) {\n	if (typeof after === \"number\") return typeof before !== \"number\" || after > before;\n	if (typeof after !== \"object\" || after === null) return false;\n	const beforeObject = typeof before === \"object\" && before !== null ? before : {};\n	return Object.entries(after).some(([key, value]) => numberRises(Object.entries(beforeObject).find(([k]) => k === key)?.[1], value));\n}\n\n//#endregion\n//#region src/evaluate-tool.ts\nconst FILE_PATH_TOOLS = /* @__PURE__ */ new Set([\n	\"Read\",\n	\"Write\",\n	\"Edit\"\n]);\nconst SEARCH_TOOLS = /* @__PURE__ */ new Set([\"Glob\", \"Grep\"]);\nfunction extractPath(toolName, toolInput, cwd) {\n	if (FILE_PATH_TOOLS.has(toolName)) return parseFilePathInput(toolInput)?.file_path ?? null;\n	if (SEARCH_TOOLS.has(toolName)) return parseSearchInput(toolInput)?.path ?? cwd;\n	return null;\n}\nfunction evaluateToolUse(toolName, toolInput, ctx) {\n	const filePath = extractPath(toolName, toolInput, ctx.cwd);\n	if (filePath === null) return {\n		action: \"none\",\n		rule: null,\n		reason: \"unknown tool input shape\"\n	};\n	for (const rule of fileDenyRules) if (rule.tools.has(toolName) && rule.when(filePath, ctx, toolInput)) return {\n		action: \"deny\",\n		rule: rule.name,\n		reason: rule.reason ?? null\n	};\n	return {\n		action: \"none\",\n		rule: null,\n		reason: \"no file rule matched\"\n	};\n}\n\n//#endregion\n//#region src/lib/settings.ts\nconst SETTINGS_PATH = \".claude/hooks/bst-hook.settings.json\";\nconst BstHookSettingsSchema = object({ protectedBranches: _default(array(string().check(_minLength(1))), []) });\nfunction isFileClean(cwd, relativePath) {\n	try {\n		execFileSync(\"git\", [\n			\"ls-files\",\n			\"--error-unmatch\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\"\n		});\n		execFileSync(\"git\", [\n			\"diff\",\n			\"--quiet\",\n			\"HEAD\",\n			\"--\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\"\n		});\n		return true;\n	} catch {\n		return false;\n	}\n}\nfunction loadRepoSettings(cwd) {\n	const root = findWorkspaceRoot(cwd) ?? cwd;\n	const settingsFile = join(root, SETTINGS_PATH);\n	const empty = { protectedBranches: [] };\n	if (!existsSync(settingsFile)) return empty;\n	if (!isFileClean(root, SETTINGS_PATH)) return empty;\n	try {\n		const raw = readFileSync(settingsFile, \"utf-8\");\n		const parsed = JSON.parse(raw);\n		const result = BstHookSettingsSchema.safeParse(parsed);\n		if (!result.success) return empty;\n		return { protectedBranches: result.data.protectedBranches };\n	} catch {\n		return empty;\n	}\n}\n\n//#endregion\n//#region src/index.ts\nconst inputResult = await readHookInput();\nif (!inputResult.ok) {\n	process.stderr.write(`[bst-hook] invalid hook input: ${inputResult.error}\\n`);\n	audit({\n		sessionId: \"unknown\",\n		cwd: \"unknown\",\n		command: `<invalid input: ${inputResult.error}>`,\n		decision: \"none\",\n		rule: null,\n		reason: `validation failed: ${inputResult.error}`,\n		permissionMode: void 0\n	});\n	process.exit(0);\n}\nconst input = inputResult.data;\nif (input.hook_event_name !== \"PreToolUse\") process.exit(0);\nif (!(/* @__PURE__ */ new Set([\n	\"Bash\",\n	\"Read\",\n	\"Write\",\n	\"Edit\",\n	\"Glob\",\n	\"Grep\"\n])).has(input.tool_name)) process.exit(0);\nconst repoSettings = loadRepoSettings(input.cwd);\nlet decision;\nlet auditCommand;\nif (input.tool_name === \"Bash\") {\n	const bashInput = parseBashInput(input.tool_input);\n	if (!bashInput) {\n		audit({\n			sessionId: input.session_id,\n			cwd: input.cwd,\n			toolName: input.tool_name,\n			command: `<invalid Bash input: ${JSON.stringify(input.tool_input).slice(0, 200)}>`,\n			decision: \"none\",\n			rule: null,\n			reason: \"Bash tool_input missing or invalid 'command' field\",\n			permissionMode: input.permission_mode\n		});\n		process.exit(0);\n	}\n	decision = evaluateCommand(bashInput.command, {\n		cwd: input.cwd,\n		depth: 0,\n		repoProtectedBranches: repoSettings.protectedBranches\n	});\n	auditCommand = bashInput.command;\n} else {\n	const projectDir = findWorkspaceRoot(input.cwd) ?? process.env[\"CLAUDE_PROJECT_DIR\"] ?? input.cwd;\n	decision = evaluateToolUse(input.tool_name, input.tool_input, {\n		cwd: projectDir,\n		sessionId: input.session_id\n	});\n	const filePath = String(input.tool_input[\"file_path\"] ?? input.tool_input[\"path\"] ?? \"\");\n	auditCommand = `${input.tool_name} ${filePath}`;\n}\naudit({\n	sessionId: input.session_id,\n	cwd: input.cwd,\n	toolName: input.tool_name,\n	command: auditCommand,\n	decision: decision.action,\n	rule: decision.rule,\n	reason: decision.reason,\n	permissionMode: input.permission_mode\n});\nif (decision.action === \"deny\") writeDeny(decision.reason);\nelse if (decision.advice) writeAdvice(decision.advice);\n\n//#endregion\nexport {  };",
-	guide: "# bst-hook Permission Guide\n\nThis project uses a PreToolUse hook (`bst-hook`) that checks each Bash command\nand file tool call before it runs. The hook only ever blocks a command; it does\nnot approve anything on its own. A command that matches a rule below is denied,\nwith a message that says what to do instead.\n\n## Denied commands\n\nThese are blocked. The hook tells you what to do instead.\n\n### Bash\n\n- **sudo**: Don't use sudo. If you need elevated permissions, ask me to do it manually.\n- **git-force-push**: Use `git push --force-with-lease` instead of `--force`.\n- **git-protected-branch-write**: This would move a protected branch (main, master, the remote's default branch, or one listed in .claude/hooks/bst-hook.settings.json#protectedBranches). Work on a feature branch in a worktree: `git worktree add ../<repo>-<topic> -b feat/<topic>`, then commit and push there. To bring `main` up to date, use `git pull --ff-only`.\n- **chmod-777**: Don't use 777 permissions. Use more restrictive permissions.\n- **node-modules-write**: Don't write into node_modules/. Its files are hardlinks into pnpm's global store, so overwriting one in place (plain `cp`, `>` redirect, `sed -i`, ...) writes through the link and corrupts that package for every project on this machine -- silently, since the directory you wrote into ends up fine. To test a local build as an installed dependency, run it directly (`node packages/<pkg>/dist/bin.mjs <cmd>`), or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`). If you must replace a file in place, `cp --remove-destination` is safe -- it unlinks the target first. Run `pnpm store status` to check whether the store is already damaged.\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **health-baseline-write**: A health ceiling raise travels alone: open a ceiling-only pull request -- only health-baseline.json and .tooling.json changed -- for a human to merge, or split the module. `health:check` refuses the raise beside code either way. To restore the default branch's copy run `git show origin/<default>:health-baseline.json > health-baseline.json`, and to adopt lower counts run `pnpm exec bst health:check --update-baseline`.\n- **health-baseline-reset**: A health ceiling raise travels alone: open a ceiling-only pull request -- only health-baseline.json and .tooling.json changed -- for a human to merge, or split the module. `health:check` refuses the raise beside code either way. To restore the default branch's copy run `git show origin/<default>:health-baseline.json > health-baseline.json`, and to adopt lower counts run `pnpm exec bst health:check --update-baseline`.\n- **npx-redirect**: This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\n- **mise-self-update**: Don't self-update mise. The version is Renovate-managed; ask a human to bump the pin.\n\n### File tools (Read, Write, Edit, Glob, Grep)\n\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **hooks-folder-write**: Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\n- **git-dir-write**: Don't write into .git/ directly. Its internals (config, hooks, refs) are not plain project files -- a config edit can redirect remotes or push destinations that other rules trust, and a hooks/ script runs automatically on the next commit/push. Use git subcommands instead, or ask the user.\n- **node-modules-write**: Don't write into node_modules/. Its files are hardlinks into pnpm's global store -- editing one in place corrupts that package for every project on this machine. Edit the source package and rebuild, or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`).\n- **claude-settings-write**: Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\n- **health-baseline-write**: A health ceiling raise travels alone: open a ceiling-only pull request -- only health-baseline.json and .tooling.json changed -- for a human to merge, or split the module. `health:check` refuses the raise beside code either way. To restore the default branch's copy run `git show origin/<default>:health-baseline.json > health-baseline.json`, and to adopt lower counts run `pnpm exec bst health:check --update-baseline`.\n\n## How commands are evaluated\n\n- **Pipelines and chains**: every segment is checked; a deny on any segment blocks the whole command.\n- **pnpm scripts**: `pnpm <script>` resolves against `package.json` (including pre/post hooks and `--filter` workspaces) and evaluates the resolved command recursively.\n- **cd propagation**: `cd dir && cmd` evaluates `cmd` relative to the new directory.\n- **Branch switch propagation**: `git switch <branch> && cmd` (or `git checkout <branch>`) evaluates a git write in `cmd` against the branch it switched to, not the one checked out before. This holds only across `&&` and only in the same directory.\n- **Audit log**: all decisions are logged to `.claude/hooks/bst-hook.audit.local.jsonl`.\n\n## Everything else\n\nA command that matches none of the rules above is judged by Claude Code's own\nauto mode, not by this hook.\n"
+	hook: "/**\n * bst-hook -- Claude Code PreToolUse hook\n * @bensandee/claude-hooks\n * https://github.com/bensandee/tooling\n *\n * Auto-generated by @bensandee/tooling repo:sync -- do not edit manually.\n */\nimport * as fs from \"node:fs\";\nimport { existsSync, readFileSync, readdirSync, realpathSync, statSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { execFileSync } from \"node:child_process\";\n\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/util.js\nfunction joinValues(array, separator = \"|\") {\n	return array.map((val) => stringifyPrimitive(val)).join(separator);\n}\nfunction jsonStringifyReplacer(_, value) {\n	if (typeof value === \"bigint\") return value.toString();\n	return value;\n}\nvar Cached = class {\n	constructor(getter) {\n		this._getter = getter;\n		this._value = void 0;\n	}\n	get value() {\n		const getter = this._getter;\n		if (getter !== void 0) {\n			this._value = getter();\n			this._getter = void 0;\n		}\n		return this._value;\n	}\n};\nfunction cached(getter) {\n	return new Cached(getter);\n}\nfunction nullish(input) {\n	return input === null || input === void 0;\n}\nfunction cleanRegex(source) {\n	const start = source.startsWith(\"^\") ? 1 : 0;\n	const end = source.endsWith(\"$\") ? source.length - 1 : source.length;\n	return source.slice(start, end);\n}\nfunction assignProp(target, prop, value) {\n	Object.defineProperty(target, prop, {\n		value,\n		writable: true,\n		enumerable: true,\n		configurable: true\n	});\n}\nconst captureStackTrace = \"captureStackTrace\" in Error ? Error.captureStackTrace : (..._args) => {};\nfunction isObject(data) {\n	return typeof data === \"object\" && data !== null && !Array.isArray(data);\n}\nfunction isPlainObject(o) {\n	if (isObject(o) === false) return false;\n	const ctor = o.constructor;\n	if (ctor === void 0) return true;\n	if (typeof ctor !== \"function\") return true;\n	const prot = ctor.prototype;\n	if (isObject(prot) === false) return false;\n	if (Object.prototype.hasOwnProperty.call(prot, \"isPrototypeOf\") === false) return false;\n	return true;\n}\nfunction shallowClone(o) {\n	if (isPlainObject(o)) return { ...o };\n	if (Array.isArray(o)) return [...o];\n	if (o instanceof Map) return new Map(o);\n	if (o instanceof Set) return new Set(o);\n	return o;\n}\nfunction clone(inst, def, params) {\n	const cl = new inst._zod.constr(def ?? inst._zod.def);\n	if (!def || params?.parent) cl._zod.parent = inst;\n	return cl;\n}\nfunction normalizeParams(_params) {\n	const params = _params;\n	if (!params) return {};\n	if (typeof params === \"string\") return { error: () => params };\n	if (params?.message !== void 0) {\n		if (params?.error !== void 0) throw new Error(\"Cannot specify both `message` and `error` params\");\n		params.error = params.message;\n	}\n	delete params.message;\n	if (typeof params.error === \"string\") return {\n		...params,\n		error: () => params.error\n	};\n	return params;\n}\nfunction stringifyPrimitive(value) {\n	if (typeof value === \"bigint\") return value.toString() + \"n\";\n	if (typeof value === \"string\") return `\"${value}\"`;\n	return `${value}`;\n}\nfunction optionalKeys(shape) {\n	return Object.keys(shape).filter((k) => {\n		return shape[k]._zod.optin !== void 0 && shape[k]._zod.optout === \"optional\";\n	});\n}\nfunction aborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue !== true) return true;\n	return false;\n}\nfunction explicitlyAborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue === false) return true;\n	return false;\n}\nfunction prefixIssues(path, issues) {\n	return issues.map((iss) => {\n		var _a;\n		(_a = iss).path ?? (_a.path = []);\n		iss.path.unshift(path);\n		return iss;\n	});\n}\nfunction unwrapMessage(message) {\n	return typeof message === \"string\" ? message : message?.message;\n}\nfunction sizeCaps(defChecks) {\n	const caps = [];\n	for (const ch of defChecks ?? []) {\n		const d = ch._zod.def;\n		if (!/_(length|size)$|_equals$/.test(d.check)) break;\n		const max = d.maximum ?? d.length ?? d.size;\n		if (max >= 0) caps.push([max, ch]);\n	}\n	return caps;\n}\nfunction attachSchema(issues, start, inst) {\n	var _a;\n	for (let i = start; i < issues.length; i++) (_a = issues[i]).schema ?? (_a.schema = inst);\n}\nfunction finalizeIssue(iss, ctx, config) {\n	var _a;\n	const traits = iss.inst?._zod?.traits;\n	if (traits?.has(\"$ZodType\")) {\n		if (traits.has(\"$ZodCheck\")) (_a = iss).schema ?? (_a.schema = iss.inst);\n		else iss.schema = iss.inst;\n	}\n	const schemaError = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;\n	const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config.customError?.(iss)) ?? unwrapMessage(config.localeError?.(iss)) ?? \"Invalid input\";\n	const full = {};\n	for (const k of Object.keys(iss)) {\n		if (k === \"inst\" || k === \"schema\" || k === \"continue\" || k === \"input\" || k === \"__proto__\") continue;\n		full[k] = iss[k];\n	}\n	full.path ?? (full.path = []);\n	full.message = message;\n	if (ctx?.reportInput) full.input = iss.input;\n	return full;\n}\nconst highSurrogate = /[\\uD800-\\uDBFF]/;\nfunction codePointLength(str) {\n	const units = str.length;\n	if (!highSurrogate.test(str)) return units;\n	let count = units;\n	for (let i = 0; i < units - 1; i++) if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {\n		count--;\n		i++;\n	}\n	return count;\n}\nfunction getLengthableOrigin(input) {\n	if (Array.isArray(input)) return \"array\";\n	if (typeof input === \"string\") return \"string\";\n	return \"unknown\";\n}\nfunction parsedType(data) {\n	const t = typeof data;\n	switch (t) {\n		case \"number\": return Number.isNaN(data) ? \"nan\" : \"number\";\n		case \"object\": {\n			if (data === null) return \"null\";\n			if (Array.isArray(data)) return \"array\";\n			const obj = data;\n			if (obj && Object.getPrototypeOf(obj) !== Object.prototype && \"constructor\" in obj && obj.constructor) return obj.constructor.name;\n		}\n	}\n	return t;\n}\nfunction members(proto, table) {\n	for (const key in table) {\n		const desc = Object.getOwnPropertyDescriptor(table, key);\n		if (desc.get) Object.defineProperty(proto, key, {\n			...desc,\n			enumerable: false\n		});\n		else defineBound(proto, key, desc.value);\n	}\n}\nfunction own(inst, key, value, enumerable = true) {\n	Object.defineProperty(inst, key, {\n		configurable: true,\n		writable: true,\n		enumerable,\n		value\n	});\n	return value;\n}\nfunction hide(inst, key, value) {\n	return own(inst, key, value, false);\n}\nfunction defineBound(proto, key, fn) {\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			return this == null ? fn : own(this, key, fn.bind(this));\n		},\n		set(value) {\n			own(this, key, value);\n		}\n	});\n}\nfunction claim(inst, sentinel) {\n	const proto = Object.getPrototypeOf(inst);\n	return sentinel in proto ? void 0 : proto;\n}\nlet installing;\nlet broke = false;\nconst breaker = {\n	configurable: true,\n	get() {\n		broke = true;\n	}\n};\nfunction defineLazyInternal(inst, key, compute) {\n	const proto = Object.getPrototypeOf(inst._zod);\n	if (key in proto && installing !== inst._zod) {\n		installing = void 0;\n		return;\n	}\n	installing = inst._zod;\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			Object.defineProperty(this, key, breaker);\n			const outer = broke;\n			broke = false;\n			try {\n				const value = compute(this);\n				if (broke) delete this[key];\n				else Object.defineProperty(this, key, {\n					configurable: true,\n					writable: true,\n					value\n				});\n				broke = broke || outer;\n				return value;\n			} catch (err) {\n				delete this[key];\n				broke = broke || outer;\n				throw err;\n			}\n		},\n		set(value) {\n			Object.defineProperty(this, key, {\n				configurable: true,\n				writable: true,\n				value\n			});\n		}\n	});\n}\nfunction installLazyProp(inst, key, make, enumerable) {\n	const proto = claim(inst, key);\n	if (!proto) return;\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			const desc = {\n				configurable: true,\n				writable: true,\n				enumerable,\n				value: void 0\n			};\n			Object.defineProperty(this, key, desc);\n			desc.value = make(this);\n			Object.defineProperty(this, key, desc);\n			return desc.value;\n		},\n		set(value) {\n			Object.defineProperty(this, key, {\n				configurable: true,\n				writable: true,\n				enumerable,\n				value\n			});\n		}\n	});\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/core.js\nvar _a;\nconst _zodDesc = {\n	value: void 0,\n	enumerable: false\n};\nlet _E = \"captureStackTrace\" in Error ? Error : null;\nfunction newError(Definition) {\n	const E = _E;\n	if (E) {\n		const saved = E.stackTraceLimit;\n		if (typeof saved === \"number\") {\n			try {\n				E.stackTraceLimit = 0;\n			} catch {\n				_E = null;\n				return new Definition();\n			}\n			try {\n				return new Definition();\n			} finally {\n				E.stackTraceLimit = saved;\n			}\n		}\n	}\n	return new Definition();\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction $constructor(name, initializer, proto, params) {\n	const zodProto = {};\n	function Internals(def) {\n		this.def = def;\n		this.constr = _;\n		this.traits = /* @__PURE__ */ new Set();\n	}\n	Internals.prototype = zodProto;\n	const protoMembers = proto;\n	const initialized = protoMembers && /* @__PURE__ */ new WeakSet();\n	function init(inst, def) {\n		if (!inst._zod) {\n			_zodDesc.value = new Internals(def);\n			try {\n				Object.defineProperty(inst, \"_zod\", _zodDesc);\n			} finally {\n				_zodDesc.value = void 0;\n			}\n		} else if (inst._zod.traits.has(name)) return;\n		inst._zod.traits.add(name);\n		initializer(inst, def);\n		if (initialized) {\n			const own = Object.getPrototypeOf(inst);\n			const ctorProto = inst._zod.constr.prototype;\n			let up = own;\n			while (up && up !== ctorProto) up = Object.getPrototypeOf(up);\n			const target = up ?? own;\n			if (!initialized.has(target)) {\n				initialized.add(target);\n				members(target, protoMembers);\n			}\n		}\n		const proto = _.prototype;\n		for (const k in proto) {\n			if (!Object.prototype.hasOwnProperty.call(proto, k)) continue;\n			if (!(k in inst)) inst[k] = proto[k].bind(inst);\n		}\n	}\n	const Parent = params?.Parent ?? Object;\n	class Definition extends Parent {}\n	Object.defineProperty(Definition, \"name\", { value: name });\n	function _(def) {\n		const inst = params?.Parent ? newError(Definition) : this;\n		init(inst, def);\n		const deferred = inst._zod.deferred;\n		if (deferred) {\n			for (const fn of deferred) fn();\n			inst._zod.deferred = void 0;\n		}\n		const pp = globalThis.__zod_globalConfig?.postProcessor;\n		if (pp) pp(inst);\n		return inst;\n	}\n	Object.defineProperty(_, \"init\", { value: init });\n	Object.defineProperty(_, Symbol.hasInstance, { value: (inst) => {\n		if (params?.Parent && inst instanceof params.Parent) return true;\n		return inst?._zod?.traits?.has(name);\n	} });\n	Object.defineProperty(_, \"name\", { value: name });\n	return _;\n}\nvar $ZodAsyncError = class extends Error {\n	constructor() {\n		super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);\n	}\n};\n(_a = globalThis).__zod_globalConfig ?? (_a.__zod_globalConfig = {});\nconst globalConfig = globalThis.__zod_globalConfig;\nfunction config(newConfig) {\n	if (newConfig) Object.assign(globalConfig, newConfig);\n	return globalConfig;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/errors.js\nfunction _getMessage() {\n	const internals = this._zod;\n	internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));\n	return internals.message;\n}\nfunction _setMessage(value) {\n	this._zod.message = value;\n}\nconst _messageDesc = {\n	get: _getMessage,\n	set: _setMessage,\n	enumerable: true,\n	configurable: true\n};\nconst _issuesDesc = {\n	value: void 0,\n	enumerable: false\n};\nconst _installedToString = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);\nconst initializer = (inst, def) => {\n	inst.name = \"$ZodError\";\n	_issuesDesc.value = def;\n	Object.defineProperty(inst, \"issues\", _issuesDesc);\n	_issuesDesc.value = void 0;\n	Object.defineProperty(inst, \"message\", _messageDesc);\n	const proto = Object.getPrototypeOf(inst);\n	if (!_installedToString.has(proto)) {\n		_installedToString.add(proto);\n		Object.defineProperty(proto, \"toString\", {\n			configurable: true,\n			enumerable: false,\n			get() {\n				const value = () => this.message;\n				Object.defineProperty(this, \"toString\", {\n					value,\n					configurable: true,\n					writable: true\n				});\n				return value;\n			},\n			set(value) {\n				Object.defineProperty(this, \"toString\", {\n					value,\n					configurable: true,\n					writable: true\n				});\n			}\n		});\n	}\n};\nconst $ZodRealError = /* @__PURE__ */ $constructor(\"$ZodError\", initializer, void 0, { Parent: Error });\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/parse.js\nconst _parse = (_Err) => {\n	const fn = (schema, value, _ctx, _params) => {\n		const ctx = _ctx ? {\n			..._ctx,\n			async: false\n		} : { async: false };\n		const result = schema._zod.run({\n			value,\n			issues: []\n		}, ctx);\n		if (result instanceof Promise) throw new $ZodAsyncError();\n		if (result.issues.length) {\n			const e = new ((_params?.Err) ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n			captureStackTrace(e, _params?.callee ?? fn);\n			throw e;\n		}\n		return result.value;\n	};\n	return fn;\n};\nconst parse = /* @__PURE__*/ _parse($ZodRealError);\nconst _parseAsync = (_Err) => {\n	const fn = async (schema, value, _ctx, params) => {\n		const ctx = _ctx ? {\n			..._ctx,\n			async: true\n		} : { async: true };\n		let result = schema._zod.run({\n			value,\n			issues: []\n		}, ctx);\n		if (result instanceof Promise) result = await result;\n		if (result.issues.length) {\n			const e = new ((params?.Err) ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n			captureStackTrace(e, params?.callee ?? fn);\n			throw e;\n		}\n		return result.value;\n	};\n	return fn;\n};\nconst parseAsync = /* @__PURE__*/ _parseAsync($ZodRealError);\nconst _safeParse = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: false\n	} : { async: false };\n	const result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) throw new $ZodAsyncError();\n	return result.issues.length ? failure(_Err, result.issues, ctx) : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParse = /* @__PURE__*/ _safeParse($ZodRealError);\nfunction failure(Err, issues, ctx) {\n	let error;\n	return {\n		success: false,\n		get error() {\n			if (!error) {\n				error = new Err(issues.map((iss) => finalizeIssue(iss, ctx, config())));\n				issues = void 0;\n				ctx = void 0;\n			}\n			return error;\n		},\n		set error(e) {\n			error = e;\n			issues = void 0;\n			ctx = void 0;\n		}\n	};\n}\nconst _safeParseAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: true\n	} : { async: true };\n	let result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) result = await result;\n	return result.issues.length ? failure(_Err, result.issues, ctx) : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParseAsync = /* @__PURE__*/ _safeParseAsync($ZodRealError);\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/regexes.js\nconst anyString = /^[\\s\\S]{0,}$/;\nconst number = /^-?\\d+(?:\\.\\d+)?$/;\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/checks.js\nconst $ZodCheck = /*@__PURE__*/ $constructor(\"$ZodCheck\", (inst, def) => {\n	var _a;\n	inst._zod ?? (inst._zod = {});\n	inst._zod.def = def;\n	(_a = inst._zod).onattach ?? (_a.onattach = []);\n});\nconst _whenHasLength = (payload) => {\n	const val = payload.value;\n	return !nullish(val) && val.length !== void 0;\n};\nconst $ZodCheckMinLength = /*@__PURE__*/ $constructor(\"$ZodCheckMinLength\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = _whenHasLength);\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		const units = input.length;\n		if ((typeof input === \"string\" && units >= def.minimum && units < def.minimum * 2 ? codePointLength(input) : units) >= def.minimum) return;\n		const origin = getLengthableOrigin(input);\n		payload.issues.push({\n			origin,\n			code: \"too_small\",\n			minimum: def.minimum,\n			inclusive: true,\n			input,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/versions.js\nconst version = {\n	major: 4,\n	minor: 6,\n	patch: 7\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/schemas.js\nconst $ZodType = /*@__PURE__*/ $constructor(\"$ZodType\", (inst, def) => {\n	var _a;\n	inst ?? (inst = {});\n	inst._zod.def = def;\n	inst._zod.bag = inst._zod.bag || {};\n	inst._zod.version = version;\n	const defChecks = inst._zod.def.checks;\n	const checks = inst._zod.traits.has(\"$ZodCheck\") ? [inst, ...defChecks ?? []] : defChecks?.length ? [...defChecks] : [];\n	for (const ch of checks) for (const fn of ch._zod.onattach) fn(inst);\n	if (checks.length === 0) {\n		(_a = inst._zod).deferred ?? (_a.deferred = []);\n		inst._zod.deferred?.push(() => {\n			inst._zod.run = inst._zod.parse;\n		});\n	} else {\n		const runChecks = (payload, checks, ctx) => {\n			if (payload.memo) return payload;\n			let isAborted = aborted(payload);\n			let asyncResult;\n			for (const ch of checks) {\n				if (ch._zod.def.when) {\n					if (explicitlyAborted(payload)) continue;\n					if (!ch._zod.def.when(payload)) continue;\n				} else if (isAborted) continue;\n				const currLen = payload.issues.length;\n				const _ = ch._zod.check(payload);\n				if (_ instanceof Promise && ctx?.async === false) throw new $ZodAsyncError();\n				if (asyncResult || _ instanceof Promise) asyncResult = (asyncResult ?? Promise.resolve()).then(async () => {\n					await _;\n					if (payload.issues.length === currLen) return;\n					attachSchema(payload.issues, currLen, inst);\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				});\n				else {\n					if (payload.issues.length === currLen) continue;\n					attachSchema(payload.issues, currLen, inst);\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				}\n			}\n			if (asyncResult) return asyncResult.then(() => {\n				return payload;\n			});\n			return payload;\n		};\n		const handleCanaryResult = (canary, payload, ctx) => {\n			if (aborted(canary)) {\n				canary.aborted = true;\n				return canary;\n			}\n			const checkResult = runChecks(payload, checks, ctx);\n			if (checkResult instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return checkResult.then((checkResult) => inst._zod.parse(checkResult, ctx));\n			}\n			return inst._zod.parse(checkResult, ctx);\n		};\n		inst._zod.run = (payload, ctx) => {\n			if (ctx.skipChecks) return inst._zod.parse(payload, ctx);\n			if (ctx.direction === \"backward\") {\n				const canary = inst._zod.parse({\n					value: payload.value,\n					issues: []\n				}, {\n					...ctx,\n					skipChecks: true\n				});\n				if (canary instanceof Promise) return canary.then((canary) => {\n					return handleCanaryResult(canary, payload, ctx);\n				});\n				return handleCanaryResult(canary, payload, ctx);\n			}\n			const result = inst._zod.parse(payload, ctx);\n			if (result instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return result.then((result) => runChecks(result, checks, ctx));\n			}\n			return runChecks(result, checks, ctx);\n		};\n	}\n}, {\n	get \"~standard\"() {\n		return hide(this, \"~standard\", standardProps(this));\n	},\n	set \"~standard\"(value) {\n		own(this, \"~standard\", value);\n	}\n});\nconst toStandardResult = (r, ctx) => r.issues.length ? { issues: r.issues.map((iss) => finalizeIssue(iss, ctx, config())) } : { value: r.value };\nasync function validateAsync(inst, value) {\n	const ctx = { async: true };\n	return toStandardResult(await inst._zod.run({\n		value,\n		issues: []\n	}, ctx), ctx);\n}\nfunction standardProps(inst) {\n	return {\n		validate: (value) => {\n			const ctx = { async: false };\n			try {\n				const r = inst._zod.run({\n					value,\n					issues: []\n				}, ctx);\n				if (!(r instanceof Promise)) return toStandardResult(r, ctx);\n			} catch (_) {}\n			return validateAsync(inst, value);\n		},\n		vendor: \"zod\",\n		version: 1\n	};\n}\nconst $ZodString = /*@__PURE__*/ $constructor(\"$ZodString\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.pattern = def.pattern ?? anyString;\n	inst._zod.parse = (payload, _) => {\n		if (def.coerce) try {\n			payload.value = String(payload.value);\n		} catch (_) {}\n		if (typeof payload.value === \"string\") return payload;\n		payload.issues.push({\n			expected: \"string\",\n			code: \"invalid_type\",\n			input: payload.value,\n			inst\n		});\n		return payload;\n	};\n});\nconst $ZodUnknown = /*@__PURE__*/ $constructor(\"$ZodUnknown\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload) => payload;\n});\nfunction capSize(inst, size) {\n	const caps = sizeCaps(inst._zod.def.checks);\n	if (!caps.length) return;\n	const cap = Math.min(...caps.map((c) => c[0]));\n	const parse = inst._zod.parse;\n	inst._zod.parse = (payload, ctx) => {\n		const n = size(payload.value);\n		if (n > cap && !ctx?.skipChecks && ctx?.direction !== \"backward\") {\n			for (const [max, ch] of sizeCaps(inst._zod.def.checks)) if (n > max && ch._zod.def.when(payload)) {\n				const start = payload.issues.length;\n				ch._zod.check(payload);\n				payload.issues[start].continue = false;\n				attachSchema(payload.issues, start, inst);\n				return payload;\n			}\n		}\n		return parse(payload, ctx);\n	};\n}\nconst arraySize = (input) => Array.isArray(input) ? input.length : -1;\nfunction handleArrayResult(result, final, index) {\n	if (result.issues.length) final.issues.push(...prefixIssues(index, result.issues));\n	final.value[index] = result.value;\n}\nconst $ZodArray = /*@__PURE__*/ $constructor(\"$ZodArray\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!Array.isArray(input)) {\n			payload.issues.push({\n				expected: \"array\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = memo ? memo.alloc(inst, payload, Array(input.length), ctx) : Array(input.length);\n		const proms = [];\n		const abortEarly = ctx?.abortEarly;\n		for (let i = 0; i < input.length; i++) {\n			const item = input[i];\n			const result = def.element._zod.run({\n				value: item,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) proms.push(result.then((result) => handleArrayResult(result, payload, i)));\n			else {\n				handleArrayResult(result, payload, i);\n				if (abortEarly && result.issues.length !== 0 && aborted(result)) break;\n			}\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n	capSize(inst, arraySize);\n});\nfunction handlePropertyResult(result, final, key, input, optin, optout) {\n	const isPresent = key in input;\n	const isOptionalOut = optout === \"optional\";\n	if (!isPresent && isOptionalOut && optin === \"optional\") return;\n	if (result.issues.length) {\n		if (optin !== void 0 && isOptionalOut && !isPresent) return;\n		final.issues.push(...prefixIssues(key, result.issues));\n	}\n	if (!isPresent && optin === void 0) {\n		if (!result.issues.length) final.issues.push({\n			code: \"invalid_type\",\n			expected: \"nonoptional\",\n			input: void 0,\n			path: [key]\n		});\n		return;\n	}\n	if (result.value === void 0) {\n		if (isPresent || optin === \"defaulted\" && !isOptionalOut) final.value[key] = void 0;\n	} else final.value[key] = result.value;\n}\nconst NO_SYMBOL_KEYS = [];\nfunction normalizeDef(def) {\n	const keys = Object.keys(def.shape);\n	const ownSymbols = Object.getOwnPropertySymbols(def.shape);\n	const symbolKeys = ownSymbols.length ? ownSymbols : NO_SYMBOL_KEYS;\n	const allKeys = symbolKeys.length ? [...keys, ...symbolKeys] : keys;\n	for (const k of allKeys) if (!def.shape?.[k]?._zod?.traits?.has(\"$ZodType\")) throw new Error(`Invalid element at key \"${String(k)}\": expected a Zod schema`);\n	const okeys = optionalKeys(def.shape);\n	return {\n		...def,\n		allKeys,\n		symbolKeys,\n		keySet: new Set(keys),\n		numKeys: keys.length,\n		optionalKeys: new Set(okeys)\n	};\n}\nfunction handleCatchall(proms, input, payload, ctx, def, inst, abortEarly) {\n	const unrecognized = [];\n	const keySet = def.keySet;\n	const _catchall = def.catchall._zod;\n	const t = _catchall.def.type;\n	const optin = _catchall.optin;\n	const optout = _catchall.optout;\n	let seen = 0;\n	for (const key in input) {\n		if (abortEarly && payload.issues.length !== seen) {\n			if (aborted(payload, seen)) break;\n			seen = payload.issues.length;\n		}\n		if (keySet.has(key)) continue;\n		if (key === \"__proto__\") {\n			if (t === \"never\") unrecognized.push(key);\n			continue;\n		}\n		if (t === \"never\") {\n			unrecognized.push(key);\n			continue;\n		}\n		const r = _catchall.run({\n			value: input[key],\n			issues: []\n		}, ctx);\n		if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, optin, optout)));\n		else handlePropertyResult(r, payload, key, input, optin, optout);\n	}\n	if (unrecognized.length) payload.issues.push({\n		code: \"unrecognized_keys\",\n		keys: unrecognized,\n		input,\n		inst,\n		continue: true\n	});\n	if (!proms.length) return payload;\n	return Promise.all(proms).then(() => {\n		return payload;\n	});\n}\nconst $ZodObject = /*@__PURE__*/ $constructor(\"$ZodObject\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const desc = Object.getOwnPropertyDescriptor(def, \"shape\");\n	const sh = desc?.get ? desc.get.raw : def.shape ?? {};\n	if (sh) {\n		const get = () => {\n			const newSh = { ...sh };\n			Object.defineProperty(def, \"shape\", { value: newSh });\n			get.raw = newSh;\n			return newSh;\n		};\n		get.raw = sh;\n		Object.defineProperty(def, \"shape\", { get });\n	}\n	const _normalized = cached(() => normalizeDef(def));\n	defineLazyInternal(inst, \"propValues\", (zod) => {\n		const shape = zod.def.shape;\n		const propValues = {};\n		for (const key in shape) {\n			const field = shape[key]._zod;\n			if (field.values) {\n				if (!Object.prototype.hasOwnProperty.call(propValues, key)) assignProp(propValues, key, /* @__PURE__ */ new Set());\n				for (const v of field.values) propValues[key].add(v);\n				if (field.optin !== void 0) propValues[key].add(void 0);\n			}\n		}\n		return propValues;\n	});\n	const isObject$1 = isObject;\n	const catchall = def.catchall;\n	let value;\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		value ?? (value = _normalized.value);\n		const input = payload.value;\n		if (!isObject$1(input)) {\n			payload.issues.push({\n				expected: \"object\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n		const proms = [];\n		const shape = value.shape;\n		const abortEarly = ctx?.abortEarly;\n		let seen = payload.issues.length;\n		for (const key of value.allKeys) {\n			if (abortEarly && payload.issues.length !== seen) {\n				if (aborted(payload, seen)) break;\n				seen = payload.issues.length;\n			}\n			if (key === \"__proto__\") continue;\n			const el = shape[key];\n			const optin = el._zod.optin;\n			const optout = el._zod.optout;\n			const r = el._zod.run({\n				value: input[key],\n				issues: []\n			}, ctx);\n			if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, optin, optout)));\n			else handlePropertyResult(r, payload, key, input, optin, optout);\n		}\n		if (!catchall) return proms.length ? Promise.all(proms).then(() => payload) : payload;\n		return handleCatchall(proms, input, payload, ctx, _normalized.value, inst, abortEarly === true);\n	};\n});\nconst $ZodRecord = /*@__PURE__*/ $constructor(\"$ZodRecord\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!isPlainObject(input)) {\n			payload.issues.push({\n				expected: \"record\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		const proms = [];\n		const values = def.keyType._zod.values;\n		if (values && !def.partial) {\n			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n			const recordKeys = /* @__PURE__ */ new Set();\n			for (const key of values) if (typeof key === \"string\" || typeof key === \"number\" || typeof key === \"symbol\") {\n				recordKeys.add(typeof key === \"number\" ? key.toString() : key);\n				if (key === \"__proto__\") continue;\n				const keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (keyResult.issues.length) {\n					payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				if (outKey === \"__proto__\") continue;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			let unrecognized;\n			for (const key in input) if (!recordKeys.has(key)) {\n				if (def.mode === \"loose\") {\n					if (key === \"__proto__\") continue;\n					payload.value[key] = input[key];\n				} else {\n					unrecognized = unrecognized ?? [];\n					unrecognized.push(key);\n				}\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized,\n				continue: true\n			});\n		} else {\n			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n			let unrecognized;\n			for (const key of Reflect.ownKeys(input)) {\n				if (key === \"__proto__\") continue;\n				if (!Object.prototype.propertyIsEnumerable.call(input, key)) continue;\n				let keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (typeof key === \"string\" && number.test(key) && keyResult.issues.length) {\n					const retryResult = def.keyType._zod.run({\n						value: Number(key),\n						issues: []\n					}, ctx);\n					if (retryResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n					if (retryResult.issues.length === 0) keyResult = retryResult;\n				}\n				if (keyResult.issues.length) {\n					if (def.mode === \"loose\") payload.value[key] = input[key];\n					else if (values) {\n						unrecognized = unrecognized ?? [];\n						unrecognized.push(key);\n					} else payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				if (outKey === \"__proto__\") continue;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized,\n				continue: true\n			});\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nfunction handleOptionalResult(payload, result) {\n	payload.value = result.issues.length ? void 0 : result.value;\n	return payload;\n}\nconst $ZodOptional = /*@__PURE__*/ $constructor(\"$ZodOptional\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazyInternal(inst, \"optin\", (zod) => zod.def.innerType._zod.optin === \"defaulted\" ? \"defaulted\" : \"optional\");\n	inst._zod.optout = \"optional\";\n	defineLazyInternal(inst, \"values\", (zod) => {\n		const values = zod.def.innerType._zod.values;\n		return values ? /* @__PURE__ */ new Set([...values, void 0]) : void 0;\n	});\n	defineLazyInternal(inst, \"pattern\", (zod) => {\n		const pattern = zod.def.innerType._zod.pattern;\n		return pattern ? new RegExp(`^(${cleanRegex(pattern.source)})?$`) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		if (payload.value === void 0) {\n			if (def.innerType._zod.optin !== \"defaulted\") return payload;\n			const result = def.innerType._zod.run({\n				value: payload.value,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) return result.then((result) => handleOptionalResult(payload, result));\n			return handleOptionalResult(payload, result);\n		}\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodDefault = /*@__PURE__*/ $constructor(\"$ZodDefault\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"defaulted\";\n	defineLazyInternal(inst, \"values\", (zod) => zod.def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		if (payload.value === void 0) {\n			payload.value = def.defaultValue;\n			return payload;\n		}\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => handleDefaultResult(result, def));\n		return handleDefaultResult(result, def);\n	};\n});\nfunction handleDefaultResult(payload, def) {\n	if (payload.value === void 0) payload.value = def.defaultValue;\n	return payload;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/en.js\nconst error = () => {\n	const Sizable = {\n		string: {\n			unit: \"characters\",\n			verb: \"to have\"\n		},\n		file: {\n			unit: \"bytes\",\n			verb: \"to have\"\n		},\n		array: {\n			unit: \"items\",\n			verb: \"to have\"\n		},\n		set: {\n			unit: \"items\",\n			verb: \"to have\"\n		},\n		map: {\n			unit: \"entries\",\n			verb: \"to have\"\n		}\n	};\n	function getSizing(origin) {\n		return Sizable[origin] ?? null;\n	}\n	const FormatDictionary = {\n		regex: \"input\",\n		email: \"email address\",\n		url: \"URL\",\n		emoji: \"emoji\",\n		uuid: \"UUID\",\n		uuidv4: \"UUIDv4\",\n		uuidv6: \"UUIDv6\",\n		nanoid: \"nanoid\",\n		guid: \"GUID\",\n		cuid: \"cuid\",\n		cuid2: \"cuid2\",\n		ulid: \"ULID\",\n		xid: \"XID\",\n		ksuid: \"KSUID\",\n		datetime: \"ISO datetime\",\n		date: \"ISO date\",\n		time: \"ISO time\",\n		duration: \"ISO duration\",\n		ipv4: \"IPv4 address\",\n		ipv6: \"IPv6 address\",\n		mac: \"MAC address\",\n		cidrv4: \"IPv4 range\",\n		cidrv6: \"IPv6 range\",\n		base64: \"base64-encoded string\",\n		base64url: \"base64url-encoded string\",\n		json_string: \"JSON string\",\n		e164: \"E.164 number\",\n		currency_code: \"currency code\",\n		credit_card: \"credit card number\",\n		iban: \"IBAN\",\n		jwt: \"JWT\",\n		template_literal: \"input\"\n	};\n	const TypeDictionary = { nan: \"NaN\" };\n	function getTypeName(type, input) {\n		if (type === \"number\" && typeof input === \"number\" && !Number.isFinite(input)) return String(input);\n		return TypeDictionary[type] ?? type;\n	}\n	return (issue) => {\n		switch (issue.code) {\n			case \"invalid_type\": return `Invalid input: expected ${getTypeName(issue.expected)}, received ${getTypeName(parsedType(issue.input), issue.input)}`;\n			case \"invalid_value\":\n				if (issue.values.length === 1) return `Invalid input: expected ${stringifyPrimitive(issue.values[0])}`;\n				return `Invalid option: expected one of ${joinValues(issue.values, \"|\")}`;\n			case \"too_big\": {\n				const adj = issue.exact ? \"exactly \" : issue.inclusive ? \"<=\" : \"<\";\n				const sizing = getSizing(issue.origin);\n				if (sizing) return `Too big: expected ${issue.origin ?? \"value\"} to have ${adj}${issue.maximum.toString()} ${sizing.unit ?? \"elements\"}`;\n				return `Too big: expected ${issue.origin ?? \"value\"} to be ${adj}${issue.maximum.toString()}`;\n			}\n			case \"too_small\": {\n				const adj = issue.exact ? \"exactly \" : issue.inclusive ? \">=\" : \">\";\n				const sizing = getSizing(issue.origin);\n				if (sizing) return `Too small: expected ${issue.origin} to have ${adj}${issue.minimum.toString()} ${sizing.unit}`;\n				return `Too small: expected ${issue.origin} to be ${adj}${issue.minimum.toString()}`;\n			}\n			case \"invalid_format\": {\n				const _issue = issue;\n				if (_issue.format === \"starts_with\") return `Invalid string: must start with \"${_issue.prefix}\"`;\n				if (_issue.format === \"ends_with\") return `Invalid string: must end with \"${_issue.suffix}\"`;\n				if (_issue.format === \"includes\") return `Invalid string: must include \"${_issue.includes}\"`;\n				if (_issue.format === \"regex\") return `Invalid string: must match pattern ${_issue.pattern}`;\n				return `Invalid ${FormatDictionary[_issue.format] ?? issue.format}`;\n			}\n			case \"not_multiple_of\": return `Invalid number: must be a multiple of ${issue.divisor}`;\n			case \"unrecognized_keys\": return `Unrecognized key${issue.keys.length > 1 ? \"s\" : \"\"}: ${joinValues(issue.keys, \", \")}`;\n			case \"invalid_key\": return `Invalid key in ${issue.origin}`;\n			case \"invalid_union\":\n				if (issue.options && Array.isArray(issue.options) && issue.options.length > 0) return `Invalid discriminator value. Expected ${issue.options.map((o) => `'${o}'`).join(\" | \")}`;\n				if (issue.inclusive === false) return \"Invalid input: more than one option matched\";\n				return \"Invalid input\";\n			case \"invalid_element\": return `Invalid value in ${issue.origin}`;\n			default: return `Invalid input`;\n		}\n	};\n};\nfunction en_default() {\n	return { localeError: error() };\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/api.js\nfunction snapshotChecks(def) {\n	if (def.checks) def.checks = [...def.checks];\n	return def;\n}\n// @__NO_SIDE_EFFECTS__\nfunction _string(Class, params) {\n	return new Class(snapshotChecks({\n		type: \"string\",\n		...normalizeParams(params)\n	}));\n}\n// @__NO_SIDE_EFFECTS__\nfunction _unknown(Class) {\n	return new Class({ type: \"unknown\" });\n}\n// @__NO_SIDE_EFFECTS__\nfunction _minLength(minimum, params) {\n	return new $ZodCheckMinLength({\n		check: \"min_length\",\n		...normalizeParams(params),\n		minimum\n	});\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/mini/schemas.js\nconst ZodMiniType = /*@__PURE__*/ $constructor(\"ZodMiniType\", (inst, def) => {\n	if (!inst._zod) throw new Error(\"Uninitialized schema in ZodMiniType.\");\n	$ZodType.init(inst, def);\n	inst.def = def;\n	inst.type = def.type;\n}, {\n	get with() {\n		return this.check;\n	},\n	set with(value) {\n		own(this, \"with\", value);\n	},\n	parse(data, params) {\n		return parse(this, data, params, { callee: this.parse });\n	},\n	parseAsync(data, params) {\n		return parseAsync(this, data, params, { callee: this.parseAsync });\n	},\n	safeParse(data, params) {\n		return safeParse(this, data, params);\n	},\n	safeParseAsync(data, params) {\n		return safeParseAsync(this, data, params);\n	},\n	check(...checks) {\n		const def = this.def;\n		return this.clone({\n			...def,\n			checks: [...def.checks ?? [], ...checks.map((ch) => typeof ch === \"function\" ? { _zod: {\n				check: ch,\n				def: { check: \"custom\" },\n				onattach: []\n			} } : ch)]\n		}, { parent: true });\n	},\n	clone(_def, params) {\n		return clone(this, _def, params);\n	},\n	brand() {\n		return this;\n	},\n	register(reg, meta) {\n		reg.add(this, meta);\n		return this;\n	},\n	apply(fn, ...args) {\n		return args.length === 0 ? fn(this) : fn(this, ...args);\n	}\n});\nconst ZodMiniString = /*@__PURE__*/ $constructor(\"ZodMiniString\", (inst, def) => {\n	$ZodString.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction string(params) {\n	return _string(ZodMiniString, params);\n}\nconst ZodMiniUnknown = /*@__PURE__*/ $constructor(\"ZodMiniUnknown\", (inst, def) => {\n	$ZodUnknown.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction unknown() {\n	return _unknown(ZodMiniUnknown);\n}\nconst ZodMiniArray = /*@__PURE__*/ $constructor(\"ZodMiniArray\", (inst, def) => {\n	$ZodArray.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction array(element, params) {\n	return new ZodMiniArray({\n		type: \"array\",\n		element,\n		...normalizeParams(params)\n	});\n}\nconst ZodMiniObject = /*@__PURE__*/ $constructor(\"ZodMiniObject\", (inst, def) => {\n	$ZodObject.init(inst, def);\n	ZodMiniType.init(inst, def);\n	installLazyProp(inst, \"shape\", (self) => self._zod.def.shape, false);\n});\n// @__NO_SIDE_EFFECTS__\nfunction object(shape, params) {\n	const def = {\n		type: \"object\",\n		shape: shape ?? {},\n		...normalizeParams(params)\n	};\n	return new ZodMiniObject(def);\n}\nconst ZodMiniRecord = /*@__PURE__*/ $constructor(\"ZodMiniRecord\", (inst, def) => {\n	$ZodRecord.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction record(keyType, valueType, params) {\n	if (!valueType || !valueType._zod) return new ZodMiniRecord({\n		type: \"record\",\n		keyType: /* @__PURE__ */ string(),\n		valueType: keyType,\n		...normalizeParams(valueType)\n	});\n	return new ZodMiniRecord({\n		type: \"record\",\n		keyType,\n		valueType,\n		...normalizeParams(params)\n	});\n}\nconst ZodMiniOptional = /*@__PURE__*/ $constructor(\"ZodMiniOptional\", (inst, def) => {\n	$ZodOptional.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction optional(innerType) {\n	return new ZodMiniOptional({\n		type: \"optional\",\n		innerType\n	});\n}\nconst ZodMiniDefault = /*@__PURE__*/ $constructor(\"ZodMiniDefault\", (inst, def) => {\n	$ZodDefault.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction _default(innerType, defaultValue) {\n	return new ZodMiniDefault({\n		type: \"default\",\n		innerType,\n		get defaultValue() {\n			return typeof defaultValue === \"function\" ? defaultValue() : shallowClone(defaultValue);\n		}\n	});\n}\n\n//#endregion\n//#region src/lib/hook-io.ts\nconfig(en_default());\nconst HookInputSchema = object({\n	session_id: string(),\n	transcript_path: string(),\n	cwd: string(),\n	permission_mode: string(),\n	hook_event_name: string(),\n	tool_name: string(),\n	tool_input: record(string(), unknown())\n});\nasync function readHookInput() {\n	const chunks = [];\n	for await (const chunk of process.stdin) chunks.push(typeof chunk === \"string\" ? chunk : String(chunk));\n	let parsed;\n	try {\n		parsed = JSON.parse(chunks.join(\"\"));\n	} catch (_error) {\n		return {\n			ok: false,\n			raw: chunks.join(\"\").slice(0, 200),\n			error: \"invalid JSON\"\n		};\n	}\n	const result = HookInputSchema.safeParse(parsed);\n	if (!result.success) return {\n		ok: false,\n		raw: parsed,\n		error: result.error.message\n	};\n	return {\n		ok: true,\n		data: result.data\n	};\n}\nconst BashInputSchema = object({\n	command: string(),\n	description: optional(string())\n});\nconst FilePathInputSchema = object({ file_path: string() });\nconst SearchInputSchema = object({\n	pattern: string(),\n	path: optional(string())\n});\nfunction parseBashInput(toolInput) {\n	const result = BashInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction parseFilePathInput(toolInput) {\n	const result = FilePathInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction parseSearchInput(toolInput) {\n	const result = SearchInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction writeDeny(reason) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		permissionDecision: \"deny\",\n		...reason ? { permissionDecisionReason: reason } : {}\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\nfunction writeAdvice(advice) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		additionalContext: advice\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\n\n//#endregion\n//#region src/lib/audit.ts\nconst MAX_LOG_SIZE = 1048576;\nfunction getLogPath() {\n	const hookDir = path.dirname(fileURLToPath(import.meta.url));\n	return path.join(hookDir, \"bst-hook.audit.local.jsonl\");\n}\nfunction rotateIfNeeded(logPath) {\n	try {\n		if (fs.statSync(logPath).size > MAX_LOG_SIZE) {\n			const rotatedPath = `${logPath}.1`;\n			fs.renameSync(logPath, rotatedPath);\n		}\n	} catch (_error) {}\n}\nlet rotationChecked = false;\nfunction audit(entry) {\n	try {\n		const logPath = getLogPath();\n		if (!rotationChecked) {\n			rotateIfNeeded(logPath);\n			rotationChecked = true;\n		}\n		const record = {\n			timestamp: (/* @__PURE__ */ new Date()).toISOString(),\n			...entry\n		};\n		fs.appendFileSync(logPath, JSON.stringify(record) + \"\\n\");\n	} catch (err) {\n		process.stderr.write(`[bst-hook] audit write failed: ${err instanceof Error ? err.message : String(err)}\\n`);\n	}\n}\n\n//#endregion\n//#region src/lib/shell-tokenizer.ts\nfunction scanDoubleQuoted(input, start) {\n	let content = \"\";\n	let i = start;\n	while (i < input.length && input[i] !== \"\\\"\") {\n		if (input[i] === \"\\\\\" && i + 1 < input.length) {\n			const next = input[i + 1];\n			if (next === \"\\\"\" || next === \"\\\\\" || next === \"$\" || next === \"`\") {\n				content += next;\n				i += 2;\n				continue;\n			}\n		}\n		content += input[i];\n		i++;\n	}\n	if (i >= input.length) return null;\n	return {\n		content,\n		next: i + 1\n	};\n}\nfunction tokenize(input) {\n	const tokens = [];\n	let current = \"\";\n	let i = 0;\n	let inToken = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\") {\n			inToken = true;\n			i++;\n			while (i < input.length && input[i] !== \"'\") {\n				current += input[i];\n				i++;\n			}\n			if (i >= input.length) return {\n				ok: false,\n				error: \"unterminated single quote\"\n			};\n			i++;\n		} else if (ch === \"\\\"\") {\n			inToken = true;\n			const scanned = scanDoubleQuoted(input, i + 1);\n			if (!scanned) return {\n				ok: false,\n				error: \"unterminated double quote\"\n			};\n			current += scanned.content;\n			i = scanned.next;\n		} else if (ch === \"\\\\\" && i + 1 < input.length) {\n			inToken = true;\n			current += input[i + 1];\n			i += 2;\n		} else if (ch === \" \" || ch === \"	\") {\n			if (inToken) {\n				tokens.push(current);\n				current = \"\";\n				inToken = false;\n			}\n			i++;\n		} else {\n			inToken = true;\n			current += ch;\n			i++;\n		}\n	}\n	if (inToken) tokens.push(current);\n	return {\n		ok: true,\n		tokens\n	};\n}\nconst SAFE_UNQUOTED_RE = /^[A-Za-z0-9_\\-./=:@%+,]+$/;\nfunction quoteToken(token) {\n	if (token.length > 0 && SAFE_UNQUOTED_RE.test(token)) return token;\n	return \"'\" + token.replace(/'/g, \"'\\\\''\") + \"'\";\n}\nfunction joinTokens(tokens) {\n	return tokens.map(quoteToken).join(\" \");\n}\n\n//#endregion\n//#region src/lib/shell-splitter.ts\nfunction splitCommand(input) {\n	if (!input || !input.trim()) return [];\n	const segments = [];\n	let current = \"\";\n	let i = 0;\n	let inSingleQuote = false;\n	let inDoubleQuote = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\" && !inDoubleQuote) {\n			inSingleQuote = !inSingleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\"\" && !inSingleQuote) {\n			inDoubleQuote = !inDoubleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\\\" && !inSingleQuote && i + 1 < input.length) {\n			current += ch + input[i + 1];\n			i += 2;\n			continue;\n		}\n		if (!inSingleQuote && !inDoubleQuote) {\n			if (ch === \"&\" && i + 1 < input.length && input[i + 1] === \"&\") {\n				pushSegment(segments, current, \"&&\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"&\" && !(i + 1 < input.length && input[i + 1] === \">\") && !(i > 0 && (input[i - 1] === \">\" || input[i - 1] === \"<\"))) {\n				pushSegment(segments, current, \"&\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \"|\" && i + 1 < input.length && input[i + 1] === \"|\") {\n				pushSegment(segments, current, \"||\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"|\") {\n				pushSegment(segments, current, \"|\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \";\") {\n				pushSegment(segments, current, \";\");\n				current = \"\";\n				i++;\n				continue;\n			}\n		}\n		current += ch;\n		i++;\n	}\n	const trimmed = current.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator: null\n	});\n	return segments;\n}\nfunction pushSegment(segments, text, operator) {\n	const trimmed = text.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator\n	});\n}\n\n//#endregion\n//#region src/lib/injection-guard.ts\nfunction hasBraceExpansion(token) {\n	let depth = 0;\n	for (let i = 0; i < token.length; i++) {\n		const ch = token[i];\n		if (ch === \"{\") depth++;\n		else if (ch === \"}\") {\n			if (depth > 0) depth--;\n		} else if (depth >= 1 && (ch === \",\" || ch === \".\" && token[i + 1] === \".\")) return true;\n	}\n	return false;\n}\nfunction checkInjection(tokens, rawSegment) {\n	if (/[\\n\\r]/.test(rawSegment)) return {\n		safe: false,\n		reason: \"unquoted newline in command\"\n	};\n	for (const token of tokens) {\n		if (token === \"`\") return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"`\")) return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"$\")) return {\n			safe: false,\n			reason: \"unresolved dollar-expansion\"\n		};\n		if (hasBraceExpansion(token)) return {\n			safe: false,\n			reason: \"brace expansion\"\n		};\n		if (token.includes(\"<(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n		if (token.includes(\">(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n	}\n	return { safe: true };\n}\n\n//#endregion\n//#region src/lib/env-file.ts\nconst ENV_SAFE_SUFFIXES = [\n	\".sample\",\n	\".example\",\n	\".template\"\n];\nconst ENV_TOOL_OWNED_SUFFIXES = [\".check.env\"];\nconst ENV_FILE_PATTERN = /(^|[/\\\\])(\\.env(\\..*)?|.*\\.env(\\..*)?|\\.env)$/;\nfunction isEnvSafeSuffix(filename) {\n	return [...ENV_SAFE_SUFFIXES, ...ENV_TOOL_OWNED_SUFFIXES].some((suffix) => filename.endsWith(suffix));\n}\nfunction isEnvFile(filePath) {\n	if (isEnvSafeSuffix(path.basename(filePath))) return false;\n	return ENV_FILE_PATTERN.test(filePath);\n}\n\n//#endregion\n//#region src/lib/git-state.ts\nconst GIT_TIMEOUT_MS = 5e3;\nfunction getCurrentBranch(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--abbrev-ref\",\n			\"HEAD\"\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!out || out === \"HEAD\") return null;\n		return out;\n	} catch {\n		return null;\n	}\n}\nfunction getRepoTopLevel(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\"rev-parse\", \"--show-toplevel\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		return out === \"\" ? null : out;\n	} catch {\n		return null;\n	}\n}\nfunction getRemoteDefaultBranch(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\n			\"symbolic-ref\",\n			\"--short\",\n			\"refs/remotes/origin/HEAD\"\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!out) return null;\n		return out.startsWith(\"origin/\") ? out.slice(7) : out;\n	} catch {\n		return null;\n	}\n}\nconst DefaultBranchSchema = object({ defaultBranch: optional(string().check(_minLength(1))) });\nfunction getConfiguredDefaultBranch(topLevel) {\n	let parsed;\n	try {\n		parsed = JSON.parse(readFileSync(join(topLevel, \".tooling.json\"), \"utf-8\"));\n	} catch {\n		return null;\n	}\n	const result = DefaultBranchSchema.safeParse(parsed);\n	return result.success ? result.data.defaultBranch ?? null : null;\n}\nconst ALWAYS_PROTECTED = [\"main\", \"master\"];\nfunction getProtectedBranches(cwd, extra) {\n	const set = new Set(ALWAYS_PROTECTED);\n	const remote = getRemoteDefaultBranch(cwd);\n	if (remote) set.add(remote);\n	for (const b of extra) set.add(b);\n	return set;\n}\nfunction getUpstream(cwd, branch) {\n	try {\n		return execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--abbrev-ref\",\n			`${branch}@{upstream}`\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: 5e3\n		}).toString().trim() || null;\n	} catch {\n		return null;\n	}\n}\nfunction resolveCommit(cwd, rev) {\n	try {\n		return execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--verify\",\n			\"--quiet\",\n			`${rev}^{commit}`\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: 5e3\n		}).toString().trim() || null;\n	} catch {\n		return null;\n	}\n}\nfunction branchCarriesOtherFiles(cwd, allowed) {\n	const toplevel = getRepoTopLevel(cwd);\n	if (toplevel === null) return null;\n	try {\n		const defaultBranch = getConfiguredDefaultBranch(toplevel) ?? getRemoteDefaultBranch(toplevel) ?? \"main\";\n		const mergeBase = execFileSync(\"git\", [\n			\"merge-base\",\n			\"HEAD\",\n			`origin/${defaultBranch}`\n		], {\n			cwd: toplevel,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!mergeBase) return null;\n		const names = (args) => execFileSync(\"git\", args, {\n			cwd: toplevel,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().split(\"\\n\").filter((line) => line.length > 0);\n		return [...names([\n			\"diff\",\n			\"--name-only\",\n			mergeBase\n		]), ...names([\n			\"ls-files\",\n			\"--others\",\n			\"--exclude-standard\"\n		])].some((name) => !allowed.includes(name));\n	} catch {\n		return null;\n	}\n}\nfunction isPrimaryWorktree(cwd) {\n	try {\n		const gitDir = execFileSync(\"git\", [\"rev-parse\", \"--absolute-git-dir\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		const commonRaw = execFileSync(\"git\", [\"rev-parse\", \"--git-common-dir\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!gitDir || !commonRaw) return false;\n		const commonDir = resolve(cwd, commonRaw);\n		return realpathSync(gitDir) === realpathSync(commonDir);\n	} catch {\n		return false;\n	}\n}\n\n//#endregion\n//#region src/lib/git-short-options.ts\nconst VALUE_TAKING_LETTERS = {\n	switch: /* @__PURE__ */ new Set([\"c\", \"C\"]),\n	checkout: /* @__PURE__ */ new Set([\"b\", \"B\"]),\n	branch: /* @__PURE__ */ new Set([\"u\"]),\n	fetch: /* @__PURE__ */ new Set([\"o\", \"j\"])\n};\nfunction splitShortOptionCluster(token, sub) {\n	if (!token.startsWith(\"-\") || token.startsWith(\"--\") || token.length <= 1) return;\n	const valueLetters = VALUE_TAKING_LETTERS[sub];\n	const letters = [];\n	const chars = token.slice(1);\n	for (let i = 0; i < chars.length; i++) {\n		const ch = chars[i];\n		letters.push(ch);\n		if (valueLetters.has(ch)) return {\n			letters,\n			attachedValue: chars.slice(i + 1)\n		};\n	}\n	return { letters };\n}\n\n//#endregion\n//#region src/lib/path-scope.ts\nfunction pathFlavorFor(base) {\n	return /^[a-zA-Z]:[\\\\/]/.test(base) ? path.win32 : path.posix;\n}\nfunction resolveIn(base, target) {\n	return pathFlavorFor(base).resolve(base, target);\n}\nfunction isWithin(dir, target) {\n	const pp = pathFlavorFor(dir);\n	const rel = pp.relative(dir, target);\n	if (rel === \"\") return true;\n	if (rel === \"..\" || rel.startsWith(\"..\" + pp.sep)) return false;\n	return !pp.isAbsolute(rel);\n}\nfunction samePath(a, b) {\n	return pathFlavorFor(a).relative(a, b) === \"\";\n}\nfunction targetsGitDir(filePath, cwd) {\n	const pp = pathFlavorFor(cwd);\n	const resolved = resolveIn(cwd, filePath);\n	if (!isWithin(cwd, resolved)) return false;\n	const rel = pp.relative(cwd, resolved);\n	if (rel === \"\") return false;\n	return rel.split(pp.sep).includes(\".git\");\n}\nfunction targetsNodeModules(filePath, cwd) {\n	return resolveIn(cwd, filePath).split(/[/\\\\]/).includes(\"node_modules\");\n}\n\n//#endregion\n//#region src/rules.ts\nconst GIT_FLAGS_WITH_ARG = /* @__PURE__ */ new Set([\n	\"-C\",\n	\"-c\",\n	\"--git-dir\",\n	\"--work-tree\"\n]);\nfunction getGitSubcommand(tokens) {\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return t;\n	}\n}\nconst WORKTREE_ADVICE = \"You're creating a feature branch in the primary worktree. An isolated worktree keeps this work independent of other windows, and with no commits on this branch yet, converting is cheap -- `git worktree add ../<dir> -b <branch>` (a sibling outside the repo, with its own dependency install). Claude Code keeps this session inside its own working tree, so the work continues in a new session opened in the sibling worktree. If you cannot open a session there, stay in the primary checkout on this branch and check `git branch --show-current` before each commit.\";\nfunction isGitBranchCreation(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"checkout\" && sub !== \"switch\") return false;\n	const after = tokens.slice(tokens.indexOf(sub) + 1);\n	const creationLetters = sub === \"checkout\" ? [\"b\", \"B\"] : [\"c\", \"C\"];\n	return after.some((t) => {\n		const cluster = splitShortOptionCluster(t, sub);\n		return cluster !== void 0 && cluster.letters.some((l) => creationLetters.includes(l));\n	});\n}\nfunction worktreeAdvice(tokens, ctx) {\n	return isGitBranchCreation(tokens) && isPrimaryWorktree(ctx.cwd) ? WORKTREE_ADVICE : void 0;\n}\nconst GIT_FORCE_CREATE_LETTER = {\n	switch: \"C\",\n	checkout: \"B\"\n};\nconst GIT_FORCE_CREATE_LONG = {\n	flag: \"--force-create\",\n	shortest: \"--force-\"\n};\nfunction gitForceCreateTargets(after, letterSub) {\n	const letter = GIT_FORCE_CREATE_LETTER[letterSub];\n	const longFlag = GIT_FORCE_CREATE_LONG;\n	const targets = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (letterSub === \"switch\") {\n			const [flag, ...rest] = t.split(\"=\");\n			if (flag !== void 0 && flag.length >= longFlag.shortest.length && longFlag.flag.startsWith(flag)) {\n				const target = rest.length > 0 ? rest.join(\"=\") : after[i + 1];\n				if (target !== void 0) targets.push(target);\n				continue;\n			}\n		}\n		const cluster = splitShortOptionCluster(t, letterSub);\n		if (cluster === void 0 || !cluster.letters.includes(letter)) continue;\n		if (cluster.attachedValue !== void 0 && cluster.attachedValue !== \"\") {\n			targets.push(cluster.attachedValue);\n			continue;\n		}\n		const next = after[i + 1];\n		if (next !== void 0) targets.push(next);\n	}\n	return targets;\n}\nfunction gitCommandForceCreateTargets(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (sub === \"switch\" || sub === \"checkout\") return gitForceCreateTargets(tokens.slice(tokens.indexOf(sub) + 1), sub);\n	if (sub === \"worktree\") {\n		const worktreeIdx = tokens.indexOf(\"worktree\");\n		if (tokens[worktreeIdx + 1] !== \"add\") return [];\n		return gitForceCreateTargets(tokens.slice(worktreeIdx + 2), \"checkout\");\n	}\n	return [];\n}\nfunction isGitProtectedBranchForceCreate(tokens, ctx) {\n	const targets = gitCommandForceCreateTargets(tokens);\n	if (targets.length === 0) return false;\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	return targets.some((t) => protectedSet.has(t));\n}\nfunction isGitProtectedBranchRefWrite(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"branch\") return false;\n	const { flags, positionals } = splitGitBranchArgs(tokens.slice(tokens.indexOf(sub) + 1));\n	if (positionals.length === 0) return false;\n	let deleteMode = false;\n	let renameMode = false;\n	let copyMode = false;\n	let forceMode = false;\n	for (const flag of flags) {\n		if (flag.letters !== void 0) {\n			if (flag.letters.includes(\"d\") || flag.letters.includes(\"D\")) deleteMode = true;\n			if (flag.letters.includes(\"m\") || flag.letters.includes(\"M\")) renameMode = true;\n			if (flag.letters.includes(\"c\") || flag.letters.includes(\"C\")) copyMode = true;\n			if (flag.letters.includes(\"f\") || flag.letters.includes(\"M\") || flag.letters.includes(\"C\")) forceMode = true;\n			continue;\n		}\n		if (flag.name === \"delete\") deleteMode = true;\n		if (flag.name === \"move\") renameMode = true;\n		if (flag.name === \"copy\") copyMode = true;\n		if (flag.name === \"force\") forceMode = true;\n	}\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	if (deleteMode && positionals.some((p) => protectedSet.has(p))) return true;\n	if (renameMode && positionals.length >= 2 && protectedSet.has(positionals[0])) return true;\n	if (forceMode) {\n		const destination = renameMode || copyMode ? positionals[positionals.length - 1] : positionals[0];\n		if (destination !== void 0 && protectedSet.has(destination)) return true;\n	}\n	return false;\n}\nfunction refspecDestination(refspec) {\n	const spec = refspec.startsWith(\"+\") ? refspec.slice(1) : refspec;\n	const colon = spec.lastIndexOf(\":\");\n	return (colon === -1 ? spec : spec.slice(colon + 1)).replace(/^refs\\/heads\\//, \"\");\n}\nconst GIT_BRANCH_VALUE_FLAG_NAMES = /* @__PURE__ */ new Set([\n	\"contains\",\n	\"no-contains\",\n	\"merged\",\n	\"no-merged\",\n	\"points-at\",\n	\"sort\",\n	\"format\",\n	\"set-upstream-to\"\n]);\nfunction splitGitBranchArgs(after) {\n	const flags = [];\n	const positionals = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (t.startsWith(\"--\") && t !== \"--\") {\n			const eq = t.indexOf(\"=\");\n			const name = eq > 0 ? t.slice(2, eq) : t.slice(2);\n			flags.push({\n				raw: t,\n				name\n			});\n			if (eq < 0 && GIT_BRANCH_VALUE_FLAG_NAMES.has(name)) i++;\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, \"branch\");\n		if (cluster === void 0) {\n			flags.push({ raw: t });\n			continue;\n		}\n		flags.push({\n			raw: t,\n			letters: cluster.letters\n		});\n		if (cluster.attachedValue === \"\") i++;\n	}\n	return {\n		flags,\n		positionals\n	};\n}\nconst GIT_FETCH_VALUE_FLAG_NAMES = /* @__PURE__ */ new Set([\n	\"depth\",\n	\"deepen\",\n	\"shallow-since\",\n	\"shallow-exclude\",\n	\"negotiation-tip\",\n	\"filter\",\n	\"jobs\",\n	\"server-option\",\n	\"upload-pack\",\n	\"refmap\",\n	\"submodule-prefix\",\n	\"recurse-submodules-default\"\n]);\nfunction splitGitFetchArgs(after) {\n	const flags = [];\n	const positionals = [];\n	const refmaps = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (t === \"--\") {\n			flags.push({ raw: t });\n			continue;\n		}\n		if (t.startsWith(\"--\")) {\n			const eq = t.indexOf(\"=\");\n			const name = eq > 0 ? t.slice(2, eq) : t.slice(2);\n			flags.push({\n				raw: t,\n				name\n			});\n			if (name === \"refmap\") {\n				if (eq > 0) refmaps.push(t.slice(eq + 1));\n				else if (after[i + 1] !== void 0) refmaps.push(after[i + 1]);\n			}\n			if (eq < 0 && GIT_FETCH_VALUE_FLAG_NAMES.has(name)) i++;\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, \"fetch\");\n		if (cluster === void 0) {\n			flags.push({ raw: t });\n			continue;\n		}\n		flags.push({\n			raw: t,\n			letters: cluster.letters\n		});\n		if (cluster.attachedValue === \"\") i++;\n	}\n	return {\n		flags,\n		positionals,\n		refmaps\n	};\n}\nfunction fetchRefspecTarget(spec) {\n	const body = spec.startsWith(\"+\") ? spec.slice(1) : spec;\n	if (body.startsWith(\"^\")) return { kind: \"none\" };\n	if (!body.includes(\":\")) return { kind: \"none\" };\n	const destination = refspecDestination(body);\n	if (destination === \"\") return { kind: \"none\" };\n	if (destination.startsWith(\"refs/remotes/\")) return { kind: \"tracking\" };\n	if (destination.startsWith(\"refs/\")) return { kind: \"other\" };\n	return {\n		kind: \"branch\",\n		name: destination\n	};\n}\nfunction globToAnchoredRegex(glob) {\n	const escaped = glob.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n	return new RegExp(`^${escaped.replace(/\\\\\\*/g, \".*\")}$`);\n}\nfunction isProtectedFetchBranch(name, protectedSet) {\n	if (protectedSet.has(name)) return true;\n	if (!name.includes(\"*\")) return false;\n	const pattern = globToAnchoredRegex(name);\n	for (const member of protectedSet) if (pattern.test(member)) return true;\n	return false;\n}\nfunction isGitProtectedBranchFetchWrite(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"fetch\") return false;\n	const { positionals, refmaps } = splitGitFetchArgs(tokens.slice(tokens.indexOf(sub) + 1));\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	return [...positionals, ...refmaps].some((spec) => {\n		const target = fetchRefspecTarget(spec);\n		if (target.kind !== \"branch\" || target.name === void 0) return false;\n		return isProtectedFetchBranch(target.name, protectedSet);\n	});\n}\nfunction isGitProtectedUpdateRef(tokens, ctx) {\n	const after = tokens.slice(tokens.indexOf(\"update-ref\") + 1);\n	let ref;\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === \"-m\") {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		ref = t;\n		break;\n	}\n	if (ref === void 0) return false;\n	return getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []).has(ref.replace(/^refs\\/heads\\//, \"\"));\n}\nfunction gitEffectiveCwd(tokens, cwd) {\n	let dir = cwd;\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (t === \"-C\") {\n			const next = args[i + 1];\n			if (next !== void 0) dir = path.resolve(dir, next);\n			i++;\n			continue;\n		}\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (!t.startsWith(\"-\")) break;\n	}\n	return dir;\n}\nconst GIT_SWITCH_NEUTRAL_FLAGS = /* @__PURE__ */ new Set([\n	\"-q\",\n	\"--quiet\",\n	\"-f\",\n	\"--force\",\n	\"--discard-changes\",\n	\"-m\",\n	\"--merge\",\n	\"--no-track\",\n	\"--progress\",\n	\"--no-progress\",\n	\"--guess\",\n	\"--no-guess\",\n	\"--ignore-other-worktrees\",\n	\"--recurse-submodules\",\n	\"--no-recurse-submodules\"\n]);\nconst GIT_SWITCH_CREATE_FLAGS = /* @__PURE__ */ new Set([\n	\"--create\",\n	\"--force-create\",\n	\"--orphan\"\n]);\nconst GIT_CHECKOUT_PATH_FLAGS = /* @__PURE__ */ new Set([\n	\"--ours\",\n	\"--theirs\",\n	\"-p\",\n	\"--patch\",\n	\"--conflict\",\n	\"--pathspec-from-file\",\n	\"--pathspec-file-nul\",\n	\"--overlay\",\n	\"--no-overlay\"\n]);\nconst GIT_SWITCH_NEUTRAL_LETTERS = /* @__PURE__ */ new Set([\n	\"q\",\n	\"f\",\n	\"m\"\n]);\nfunction switchTarget(after, sub, isCheckoutBranch) {\n	if (sub === \"checkout\" && after.includes(\"--\")) return void 0;\n	const createLetters = sub === \"checkout\" ? [\"b\", \"B\"] : [\"c\", \"C\"];\n	const known = (l) => GIT_SWITCH_NEUTRAL_LETTERS.has(l) || createLetters.includes(l);\n	const positionals = [];\n	let created;\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (GIT_SWITCH_NEUTRAL_FLAGS.has(t)) continue;\n		const eq = t.indexOf(\"=\");\n		if (sub === \"checkout\" && GIT_CHECKOUT_PATH_FLAGS.has(eq === -1 ? t : t.slice(0, eq))) return;\n		if (GIT_SWITCH_CREATE_FLAGS.has(eq === -1 ? t : t.slice(0, eq))) {\n			created = eq === -1 ? after[++i] : t.slice(eq + 1);\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, sub);\n		if (cluster === void 0 || !cluster.letters.every(known)) return null;\n		if (cluster.letters.some((l) => createLetters.includes(l))) created = cluster.attachedValue ? cluster.attachedValue : after[++i];\n	}\n	if (created !== void 0) return created;\n	if (positionals.length !== 1) return void 0;\n	const target = positionals[0];\n	if (target === \"HEAD\" || target === \"@\") return void 0;\n	if (sub === \"checkout\" && !isCheckoutBranch(target)) return void 0;\n	return target;\n}\nfunction branchSwitch(tokens, ctx, resolved) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"switch\" && sub !== \"checkout\") return void 0;\n	const dir = gitEffectiveCwd(tokens, ctx.cwd);\n	const isCheckoutBranch = (name) => !resolved || getProtectedBranches(dir, ctx.repoProtectedBranches ?? []).has(name) || resolveCommit(dir, name) !== null;\n	const target = switchTarget(tokens.slice(tokens.indexOf(sub) + 1), sub, isCheckoutBranch);\n	if (!resolved) return target === void 0 ? void 0 : {\n		dir,\n		branch: null\n	};\n	return target === void 0 ? void 0 : {\n		dir,\n		branch: target\n	};\n}\nconst GIT_CHECKED_OUT_WRITES = /* @__PURE__ */ new Set([\n	\"commit\",\n	\"merge\",\n	\"rebase\",\n	\"cherry-pick\",\n	\"revert\",\n	\"am\",\n	\"pull\"\n]);\nfunction subcommandArgs(tokens, sub, valueFlags = /* @__PURE__ */ new Set()) {\n	const after = tokens.slice(tokens.indexOf(sub) + 1);\n	const flags = [];\n	const positionals = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		flags.push(t);\n		if (valueFlags.has(t)) i++;\n	}\n	return {\n		flags,\n		positionals\n	};\n}\nconst GIT_PUSH_VALUE_FLAGS = /* @__PURE__ */ new Set([\n	\"-o\",\n	\"--push-option\",\n	\"--repo\",\n	\"--receive-pack\",\n	\"--exec\"\n]);\nfunction isMergeFastForwardFromUpstream(tokens, upstream) {\n	const { flags, positionals } = subcommandArgs(tokens, \"merge\");\n	if (!flags.includes(\"--ff-only\") || positionals.length !== 1) return false;\n	const ref = positionals[0];\n	return ref === \"@{u}\" || ref === \"@{upstream}\" || upstream !== null && ref === upstream;\n}\nconst GIT_PULL_NO_REBASE = /* @__PURE__ */ new Set([\n	\"--rebase=false\",\n	\"--rebase=no\",\n	\"--rebase=off\",\n	\"--rebase=0\"\n]);\nfunction isPullFromUpstream(tokens, upstream) {\n	const { flags, positionals } = subcommandArgs(tokens, \"pull\");\n	if (flags.some((t) => t.startsWith(\"--rebase\") && !GIT_PULL_NO_REBASE.has(t) || t === \"--no-ff\" || !t.startsWith(\"--\") && t.slice(1).includes(\"r\"))) return false;\n	if (positionals.length === 0) return true;\n	if (positionals.length !== 2 || upstream === null) return false;\n	const [remote, branch] = positionals;\n	return `${remote}/${branch.replace(/^refs\\/heads\\//, \"\")}` === upstream;\n}\nfunction isRefMovingReset(tokens, cwd, head) {\n	if (tokens.slice(tokens.indexOf(\"reset\") + 1).includes(\"--\")) return false;\n	const { positionals } = subcommandArgs(tokens, \"reset\");\n	if (positionals.length !== 1) return false;\n	if (head !== \"HEAD\" && /^(HEAD|@)/.test(positionals[0])) return false;\n	const target = resolveCommit(cwd, positionals[0]);\n	if (target === null) return false;\n	return target !== resolveCommit(cwd, head);\n}\nfunction pushDestinations(tokens, current) {\n	const { positionals } = subcommandArgs(tokens, \"push\", GIT_PUSH_VALUE_FLAGS);\n	const refspecs = positionals.slice(1);\n	if (refspecs.length === 0) return null;\n	const names = [];\n	for (const spec of refspecs) {\n		const dst = refspecDestination(spec);\n		if (dst === \"HEAD\" || dst === \"@\") {\n			if (current !== null) names.push(current);\n			continue;\n		}\n		names.push(dst);\n	}\n	return names;\n}\nconst GIT_PUSH_EVERY_BRANCH = /* @__PURE__ */ new Set([\n	\"--all\",\n	\"--branches\",\n	\"--mirror\"\n]);\nfunction leavesRefInPlace(tokens, sub) {\n	const { flags } = subcommandArgs(tokens, sub);\n	if (flags.includes(\"--abort\") || flags.includes(\"--quit\")) return true;\n	return sub === \"commit\" && flags.includes(\"--dry-run\");\n}\nfunction movesProtectedRef(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub === void 0) return false;\n	if (sub === \"switch\" || sub === \"checkout\" || sub === \"worktree\") return isGitProtectedBranchForceCreate(tokens, ctx);\n	if (sub === \"branch\") return isGitProtectedBranchRefWrite(tokens, ctx);\n	if (sub === \"fetch\") return isGitProtectedBranchFetchWrite(tokens, ctx);\n	if (sub === \"update-ref\") return isGitProtectedUpdateRef(tokens, ctx);\n	if (sub !== \"push\" && sub !== \"reset\" && !GIT_CHECKED_OUT_WRITES.has(sub)) return false;\n	const cwd = gitEffectiveCwd(tokens, ctx.cwd);\n	const pending = ctx.pendingBranches?.[cwd];\n	const current = pending ? pending.branch : getCurrentBranch(cwd);\n	const protectedSet = getProtectedBranches(cwd, ctx.repoProtectedBranches ?? []);\n	const onProtected = current !== null && protectedSet.has(current);\n	if (sub === \"push\") {\n		const { flags } = subcommandArgs(tokens, \"push\", GIT_PUSH_VALUE_FLAGS);\n		if (flags.some((f) => GIT_PUSH_EVERY_BRANCH.has(f))) return true;\n		const destinations = pushDestinations(tokens, current);\n		if (destinations === null) {\n			if (flags.includes(\"--tags\")) return false;\n			return onProtected;\n		}\n		return destinations.some((d) => protectedSet.has(d));\n	}\n	if (!onProtected) return false;\n	if (leavesRefInPlace(tokens, sub)) return false;\n	if (sub === \"reset\") return isRefMovingReset(tokens, cwd, pending ? current : \"HEAD\");\n	if (sub === \"merge\" || sub === \"pull\") {\n		const upstream = getUpstream(cwd, current);\n		if (sub === \"merge\" && isMergeFastForwardFromUpstream(tokens, upstream)) return false;\n		if (sub === \"pull\" && isPullFromUpstream(tokens, upstream)) return false;\n	}\n	return true;\n}\nconst PNPM_BUILTINS = /* @__PURE__ */ new Set([\n	\"install\",\n	\"i\",\n	\"add\",\n	\"remove\",\n	\"rm\",\n	\"uninstall\",\n	\"un\",\n	\"update\",\n	\"up\",\n	\"upgrade\",\n	\"list\",\n	\"ls\",\n	\"ll\",\n	\"la\",\n	\"why\",\n	\"view\",\n	\"info\",\n	\"show\",\n	\"outdated\",\n	\"audit\",\n	\"licenses\",\n	\"init\",\n	\"create\",\n	\"link\",\n	\"unlink\",\n	\"pack\",\n	\"publish\",\n	\"config\",\n	\"set\",\n	\"get\",\n	\"store\",\n	\"cache\",\n	\"rebuild\",\n	\"rb\",\n	\"prune\",\n	\"dedupe\",\n	\"dlx\",\n	\"exec\",\n	\"run\",\n	\"patch\",\n	\"patch-commit\",\n	\"recursive\",\n	\"-r\"\n]);\nconst NPM_READ_OPS = /* @__PURE__ */ new Set([\n	\"view\",\n	\"info\",\n	\"show\"\n]);\nfunction isNpmReadOp(tokens) {\n	const sub = tokens[1];\n	return sub !== void 0 && NPM_READ_OPS.has(sub);\n}\nfunction getNpmRedirectReason(tokens) {\n	const sub = tokens[1];\n	const BASE = \"This project uses pnpm.\";\n	if (!sub) return `${BASE} Use \\`pnpm\\` instead of npm.`;\n	if (sub === \"install\" || sub === \"i\" || sub === \"ci\") {\n		if (tokens.slice(2).some((t) => !t.startsWith(\"-\"))) return `${BASE} Use \\`pnpm add <pkg>\\` instead of \\`npm install <pkg>\\`.`;\n		return `${BASE} Use \\`pnpm install\\` instead of npm.`;\n	}\n	if (sub === \"add\") return `${BASE} Use \\`pnpm add <pkg>\\` instead of npm.`;\n	if (sub === \"uninstall\" || sub === \"remove\" || sub === \"rm\" || sub === \"un\" || sub === \"r\") return `${BASE} Use \\`pnpm remove <pkg>\\` instead of npm.`;\n	if (sub === \"run\" || sub === \"run-script\") return `${BASE} Use \\`pnpm run <script>\\` or \\`pnpm <script>\\` instead of npm.`;\n	if (sub === \"test\" || sub === \"t\" || sub === \"tst\") return `${BASE} Use \\`pnpm test\\` instead of npm.`;\n	if (sub === \"start\") return `${BASE} Use \\`pnpm start\\` instead of npm.`;\n	if (sub === \"stop\") return `${BASE} Use \\`pnpm stop\\` instead of npm.`;\n	if (sub === \"restart\") return `${BASE} Use \\`pnpm restart\\` instead of npm.`;\n	if (sub === \"exec\") return `${BASE} Use \\`pnpm exec <cmd>\\` instead of npm.`;\n	if (sub === \"list\" || sub === \"ls\" || sub === \"ll\" || sub === \"la\") return `${BASE} Use \\`pnpm list\\` instead of npm.`;\n	if (sub === \"why\") return `${BASE} Use \\`pnpm why\\` instead of npm.`;\n	if (sub === \"outdated\") return `${BASE} Use \\`pnpm outdated\\` instead of npm.`;\n	if (sub === \"audit\") return `${BASE} Use \\`pnpm audit\\` instead of npm.`;\n	if (sub === \"update\" || sub === \"up\" || sub === \"upgrade\") return `${BASE} Use \\`pnpm update\\` instead of npm.`;\n	if (sub === \"init\") return `${BASE} Use \\`pnpm init\\` instead of npm.`;\n	if (sub === \"publish\") return `${BASE} Use \\`pnpm publish\\` instead of npm.`;\n	if (sub === \"link\") return `${BASE} Use \\`pnpm link\\` instead of npm.`;\n	if (sub === \"unlink\") return `${BASE} Use \\`pnpm unlink\\` instead of npm.`;\n	if (sub === \"pack\") return `${BASE} Use \\`pnpm pack\\` instead of npm.`;\n	if (sub === \"cache\") return `${BASE} Use \\`pnpm store\\` instead of \\`npm cache\\`.`;\n	if (sub === \"config\" || sub === \"set\" || sub === \"get\") return `${BASE} Use \\`pnpm config\\` instead of npm.`;\n	return `${BASE} Use the equivalent pnpm command instead of npm.`;\n}\nconst LAST_POSITIONAL_DEST = /* @__PURE__ */ new Set([\n	\"cp\",\n	\"mv\",\n	\"rsync\",\n	\"install\",\n	\"ln\"\n]);\nconst ALL_POSITIONAL_DEST = /* @__PURE__ */ new Set([\"tee\", \"truncate\"]);\nfunction explicitTargetDirectory(rest) {\n	for (const [i, t] of rest.entries()) {\n		if (t === \"-t\" || t === \"--target-directory\") return rest[i + 1] ?? null;\n		if (t.startsWith(\"--target-directory=\")) return t.slice(19);\n	}\n	return null;\n}\nconst OUTPUT_REDIRECT = /^(?:\\d*|&)>{1,2}$/;\nconst OUTPUT_REDIRECT_ATTACHED = /^(?:\\d*|&)>{1,2}(.+)$/;\nconst INPUT_REDIRECT = /^\\d*<$/;\nconst INPUT_REDIRECT_ATTACHED = /^\\d*<([^<].*)$/;\nfunction spacedRedirectDirection(token) {\n	if (OUTPUT_REDIRECT.test(token)) return \"out\";\n	if (INPUT_REDIRECT.test(token)) return \"in\";\n	return null;\n}\nfunction splitRedirects(tokens) {\n	const redirects = [];\n	const rest = [];\n	for (let i = 0; i < tokens.length; i++) {\n		const t = tokens[i];\n		const spaced = spacedRedirectDirection(t);\n		if (spaced !== null) {\n			const next = tokens[i + 1];\n			if (next !== void 0) redirects.push({\n				direction: spaced,\n				target: next\n			});\n			i++;\n			continue;\n		}\n		const out = OUTPUT_REDIRECT_ATTACHED.exec(t);\n		if (out) {\n			redirects.push({\n				direction: \"out\",\n				target: out[1]\n			});\n			continue;\n		}\n		const input = INPUT_REDIRECT_ATTACHED.exec(t);\n		if (input) {\n			redirects.push({\n				direction: \"in\",\n				target: input[1]\n			});\n			continue;\n		}\n		rest.push(t);\n	}\n	return {\n		redirects,\n		rest\n	};\n}\nfunction redirectTargets(tokens, direction) {\n	return splitRedirects(tokens).redirects.filter((r) => r.direction === direction).map((r) => r.target);\n}\nfunction writeDestinations(tokens) {\n	const cmd = path.basename(tokens[0] ?? \"\");\n	const rest = tokens.slice(1);\n	const dests = redirectTargets(tokens, \"out\");\n	if (cmd === \"dd\") dests.push(...rest.filter((t) => t.startsWith(\"of=\")).map((t) => t.slice(3)));\n	else if (cmd === \"sed\") {\n		if (rest.some((t) => t === \"--in-place\" || /^-[a-zA-Z]*i/.test(t))) dests.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	} else if (ALL_POSITIONAL_DEST.has(cmd)) dests.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	else if (LAST_POSITIONAL_DEST.has(cmd)) {\n		if (cmd === \"cp\" && rest.includes(\"--remove-destination\")) return dests;\n		const targetDir = explicitTargetDirectory(rest);\n		if (targetDir !== null) dests.push(targetDir);\n		else {\n			const last = rest.findLast((t) => !t.startsWith(\"-\"));\n			if (last !== void 0) dests.push(last);\n		}\n	}\n	return dests;\n}\nfunction writesIntoNodeModules(tokens, ctx) {\n	return writeDestinations(tokens).some((d) => targetsNodeModules(d, ctx.cwd));\n}\nconst NODE_MODULES_WRITE_REASON = \"Don't write into node_modules/. Its files are hardlinks into pnpm's global store, so overwriting one in place (plain `cp`, `>` redirect, `sed -i`, ...) writes through the link and corrupts that package for every project on this machine -- silently, since the directory you wrote into ends up fine. To test a local build as an installed dependency, run it directly (`node packages/<pkg>/dist/bin.mjs <cmd>`), or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`). If you must replace a file in place, `cp --remove-destination` is safe -- it unlinks the target first. Run `pnpm store status` to check whether the store is already damaged.\";\nfunction isChmod777(tokens) {\n	return tokens.some((t) => t === \"777\" || t === \"0777\");\n}\nfunction isGitForcePush(tokens) {\n	const pushIdx = tokens.indexOf(\"push\");\n	if (pushIdx === -1) return false;\n	return tokens.slice(pushIdx + 1).some((t) => t === \"--force\" || t === \"-f\");\n}\nconst ENV_READ_FILE_COMMANDS = /* @__PURE__ */ new Set([\n	\"cat\",\n	\"head\",\n	\"tail\",\n	\"less\",\n	\"more\",\n	\"source\",\n	\".\"\n]);\nconst GREP_FAMILY_COMMANDS = /* @__PURE__ */ new Set([\n	\"grep\",\n	\"rg\",\n	\"ag\"\n]);\nfunction grepFileOperands(rest) {\n	const files = [];\n	let patternAccountedFor = false;\n	let optionsEnded = false;\n	for (let i = 0; i < rest.length; i++) {\n		const t = rest[i];\n		if (!optionsEnded && t === \"--\") {\n			optionsEnded = true;\n			continue;\n		}\n		if (!optionsEnded) {\n			if (t === \"-f\" || t === \"--file\") {\n				const value = rest[i + 1];\n				if (value !== void 0) {\n					files.push(value);\n					i++;\n				}\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"--file=\")) {\n				files.push(t.slice(7));\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"-f\") && t !== \"-f\" && !t.startsWith(\"--\")) {\n				files.push(t.slice(2));\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t === \"-e\" || t === \"--regexp\") {\n				i++;\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"--regexp=\") || t.startsWith(\"-e\") && t !== \"-e\" && !t.startsWith(\"--\")) {\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"-\")) continue;\n		}\n		if (!patternAccountedFor) {\n			patternAccountedFor = true;\n			continue;\n		}\n		files.push(t);\n	}\n	return files;\n}\nfunction envFileOperands(tokens) {\n	const cmd = path.basename(tokens[0] ?? \"\");\n	const { redirects, rest } = splitRedirects(tokens.slice(1));\n	const operands = redirects.filter((r) => r.direction === \"in\").map((r) => r.target);\n	if (GREP_FAMILY_COMMANDS.has(cmd)) operands.push(...grepFileOperands(rest));\n	else if (ENV_READ_FILE_COMMANDS.has(cmd)) operands.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	return operands;\n}\nconst HEALTH_CEILING_FILES = [\"health-baseline.json\", \".tooling.json\"];\nconst HEALTH_RAISE_REASON = \"Run `pnpm exec bst health:raise` to raise only what this branch crossed. `--update-baseline --reset` records every outlier, including the ones already on the default branch.\";\nfunction isHealthBaselineReset(tokens) {\n	return tokens.includes(\"health:check\") && tokens.includes(\"--update-baseline\") && tokens.includes(\"--reset\");\n}\nfunction raiseTravelsWithCode(cwd) {\n	return branchCarriesOtherFiles(cwd, HEALTH_CEILING_FILES) === true;\n}\nconst denyRules = [\n	{\n		name: \"sudo\",\n		match: /^sudo$/,\n		action: \"deny\",\n		reason: \"Don't use sudo. If you need elevated permissions, ask me to do it manually.\"\n	},\n	{\n		name: \"git-force-push\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitForcePush(tokens),\n		reason: \"Use `git push --force-with-lease` instead of `--force`.\"\n	},\n	{\n		name: \"git-protected-branch-write\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens, ctx) => movesProtectedRef(tokens, ctx),\n		reason: \"This would move a protected branch (main, master, the remote's default branch, or one listed in .claude/hooks/bst-hook.settings.json#protectedBranches). Work on a feature branch in a worktree: `git worktree add ../<repo>-<topic> -b feat/<topic>`, then commit and push there. To bring `main` up to date, use `git pull --ff-only`.\"\n	},\n	{\n		name: \"chmod-777\",\n		match: /^chmod$/,\n		action: \"deny\",\n		when: (tokens) => isChmod777(tokens),\n		reason: \"Don't use 777 permissions. Use more restrictive permissions.\"\n	},\n	{\n		name: \"node-modules-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens, ctx) => writesIntoNodeModules(tokens, ctx),\n		reason: NODE_MODULES_WRITE_REASON\n	},\n	{\n		name: \"env-file-read\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens) => envFileOperands(tokens).some(isEnvFile),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens) => redirectTargets(tokens, \"out\").some(isEnvFile),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"health-baseline-reset\",\n		match: /^bst$/,\n		action: \"deny\",\n		when: (tokens, ctx) => isHealthBaselineReset(tokens) && raiseTravelsWithCode(ctx.cwd),\n		reason: HEALTH_RAISE_REASON\n	},\n	{\n		name: \"npx-redirect\",\n		match: /^npx$/,\n		action: \"deny\",\n		reason: \"This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\"\n	},\n	{\n		name: \"mise-self-update\",\n		match: /^mise$/,\n		action: \"deny\",\n		when: (tokens) => tokens[1] === \"self-update\",\n		reason: \"Don't self-update mise. The version is Renovate-managed; ask a human to bump the pin.\"\n	}\n];\n\n//#endregion\n//#region src/lib/script-resolver.ts\nconst PackageJsonSchema = object({ scripts: record(string(), unknown()) });\nfunction resolveScript(scriptName, cwd) {\n	const scripts = readScripts(cwd);\n	if (!scripts) return null;\n	const main = scripts[scriptName];\n	if (typeof main !== \"string\") return null;\n	const pre = scripts[`pre${scriptName}`];\n	const post = scripts[`post${scriptName}`];\n	return {\n		pre: typeof pre === \"string\" ? pre : null,\n		main,\n		post: typeof post === \"string\" ? post : null\n	};\n}\nfunction resolveFilteredScript(scriptName, filterPkg, cwd) {\n	const pkgDir = findWorkspacePackageDir(filterPkg, cwd);\n	if (!pkgDir) return null;\n	const script = resolveScript(scriptName, pkgDir);\n	if (!script) return null;\n	return {\n		...script,\n		pkgDir\n	};\n}\nfunction resolveRecursiveScripts(scriptName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	const results = [];\n	for (const pkgDir of pkgDirs) {\n		const resolved = resolveScript(scriptName, pkgDir);\n		if (resolved) results.push({\n			...resolved,\n			pkgDir\n		});\n	}\n	return results;\n}\nfunction listWorkspacePackageDirs(rootDir) {\n	const patterns = readWorkspacePatterns(rootDir);\n	if (!patterns) return null;\n	const dirs = [];\n	for (const pattern of patterns) {\n		if (!pattern.endsWith(\"/*\")) continue;\n		const baseDir = pattern.slice(0, -2);\n		const parentDir = resolve(rootDir, baseDir);\n		let entries;\n		try {\n			entries = readdirSync(parentDir);\n		} catch {\n			continue;\n		}\n		for (const entry of entries) {\n			const entryDir = join(parentDir, entry);\n			try {\n				if (!statSync(entryDir).isDirectory()) continue;\n			} catch {\n				continue;\n			}\n			dirs.push(entryDir);\n		}\n	}\n	return dirs.length > 0 ? dirs : null;\n}\nfunction findWorkspacePackageDir(pkgName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	for (const entryDir of pkgDirs) {\n		const name = readPackageName(entryDir);\n		if (name === pkgName || name === `@${pkgName}`) return entryDir;\n		if (entryDir.split(\"/\").pop() === pkgName) return entryDir;\n		if (name) {\n			if ((name.startsWith(\"@\") ? name.split(\"/\")[1] : name) === pkgName) return entryDir;\n		}\n	}\n	return null;\n}\nfunction readWorkspacePatterns(rootDir) {\n	try {\n		const lines = readFileSync(join(rootDir, \"pnpm-workspace.yaml\"), \"utf-8\").split(\"\\n\");\n		const packagesIdx = lines.findIndex((l) => /^packages\\s*:/.test(l));\n		if (packagesIdx === -1) return null;\n		const patterns = [];\n		for (let i = packagesIdx + 1; i < lines.length; i++) {\n			const line = lines[i];\n			const match = /^\\s+-\\s+(.+)$/.exec(line);\n			if (!match) break;\n			patterns.push(match[1].trim().replace(/['\"`]/g, \"\"));\n		}\n		return patterns.length > 0 ? patterns : null;\n	} catch {\n		return null;\n	}\n}\nconst PackageNameSchema = object({ name: string() });\nfunction readPackageName(dir) {\n	try {\n		const raw = readFileSync(join(dir, \"package.json\"), \"utf-8\");\n		const result = PackageNameSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.name;\n	} catch {\n		return null;\n	}\n}\nfunction readScripts(cwd) {\n	try {\n		const raw = readFileSync(join(cwd, \"package.json\"), \"utf-8\");\n		const result = PackageJsonSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.scripts;\n	} catch {\n		return null;\n	}\n}\n\n//#endregion\n//#region src/lib/workspace-root.ts\nfunction findWorkspaceRoot(cwd) {\n	let dir = resolve(cwd);\n	while (true) {\n		if (existsSync(join(dir, \"pnpm-workspace.yaml\"))) return dir;\n		const parent = dirname(dir);\n		if (parent === dir) return null;\n		dir = parent;\n	}\n}\n\n//#endregion\n//#region src/evaluate.ts\nconst MAX_EVAL_DEPTH = 5;\nfunction subshellBody(command) {\n	if (!command.startsWith(\"(\") || !command.endsWith(\")\")) return null;\n	let depth = 0;\n	let quote = null;\n	for (let i = 0; i < command.length; i++) {\n		const ch = command[i];\n		if (quote !== null) {\n			if (ch === quote) quote = null;\n			else if (ch === \"\\\\\" && quote === \"\\\"\") i++;\n			continue;\n		}\n		if (ch === \"\\\\\") i++;\n		else if (ch === \"'\" || ch === \"\\\"\") quote = ch;\n		else if (ch === \"(\") depth++;\n		else if (ch === \")\") {\n			depth--;\n			if (depth === 0) return i === command.length - 1 ? command.slice(1, -1) : null;\n		}\n	}\n	return null;\n}\nfunction extractCdDir(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok || tokenResult.tokens.length !== 2) return null;\n	const tokens = tokenResult.tokens;\n	if (tokens[0] !== \"cd\") return null;\n	const dir = tokens[1];\n	if (path.isAbsolute(dir)) return dir;\n	return path.resolve(ctx.cwd, dir);\n}\nfunction extractBranchSwitch(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok) return void 0;\n	let tokens = tokenResult.tokens;\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) envSkipped++;\n	tokens = tokens.slice(envSkipped);\n	if (tokens.length === 0 || path.basename(tokens[0]) !== \"git\") return void 0;\n	return branchSwitch(tokens, ctx, checkInjection(tokens, segment).safe);\n}\nfunction evaluateCommand(command, ctx) {\n	if (ctx.depth >= MAX_EVAL_DEPTH) return {\n		action: \"none\",\n		rule: null,\n		reason: \"max evaluation depth exceeded\"\n	};\n	const trimmed = command.trim();\n	if (!trimmed) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	const body = subshellBody(trimmed);\n	if (body !== null) return evaluateCommand(body, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	const segments = splitCommand(trimmed);\n	if (segments.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	let firstNone = null;\n	const currentCtx = { ...ctx };\n	let unknownAfterNext;\n	for (const segment of segments) {\n		if (segment.operator === \"&&\") {\n			const cdDir = extractCdDir(segment.command, currentCtx);\n			if (cdDir) currentCtx.cwd = cdDir;\n		}\n		const result = evaluateSegment(segment.command, currentCtx);\n		if (result.action === \"deny\") return result;\n		if (!firstNone) firstNone = result;\n		if (unknownAfterNext) {\n			currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[unknownAfterNext.dir]: unknownAfterNext\n			};\n			unknownAfterNext = void 0;\n		}\n		const switched = extractBranchSwitch(segment.command, currentCtx);\n		if (switched) {\n			const unknown = {\n				dir: switched.dir,\n				branch: null\n			};\n			if (segment.operator === \"&&\") currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[switched.dir]: switched\n			};\n			else if (segment.operator === \"||\") unknownAfterNext = unknown;\n			else currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[switched.dir]: unknown\n			};\n		}\n	}\n	return firstNone ?? {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n}\nfunction evaluateResolvedScript(resolved, ctx) {\n	if (resolved.pre) {\n		const preResult = evaluateCommand(resolved.pre, ctx);\n		if (preResult.action === \"deny\") return preResult;\n	}\n	const mainResult = evaluateCommand(resolved.main, ctx);\n	if (mainResult.action === \"deny\") return mainResult;\n	if (resolved.post) {\n		const postResult = evaluateCommand(resolved.post, ctx);\n		if (postResult.action === \"deny\") return postResult;\n	}\n	return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n}\nfunction evaluateSegment(rawSegment, ctx) {\n	const trimmed = rawSegment.trim();\n	const body = subshellBody(trimmed);\n	if (body !== null) return evaluateCommand(body, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (trimmed.startsWith(\"(\") && trimmed.endsWith(\")\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"subshell\"\n	};\n	const tokenResult = tokenize(rawSegment);\n	if (!tokenResult.ok) return {\n		action: \"none\",\n		rule: null,\n		reason: tokenResult.error\n	};\n	let tokens = tokenResult.tokens;\n	if (tokens.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) envSkipped++;\n	if (envSkipped >= tokens.length) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	tokens = tokens.slice(envSkipped);\n	if (writesIntoNodeModules(tokens, ctx)) return {\n		action: \"deny\",\n		rule: \"node-modules-write\",\n		reason: NODE_MODULES_WRITE_REASON\n	};\n	const injection = checkInjection(tokens, rawSegment);\n	if (!injection.safe) return {\n		action: \"none\",\n		rule: null,\n		reason: injection.reason\n	};\n	const SAFE_REDIRECT_TOKENS = /* @__PURE__ */ new Set([\n		\"2>&1\",\n		\"2>/dev/null\",\n		\">/dev/null\",\n		\"1>/dev/null\"\n	]);\n	tokens = tokens.filter((t, i) => {\n		if (SAFE_REDIRECT_TOKENS.has(t)) return false;\n		if ((t === \">\" || t === \">>\") && tokens[i + 1] === \"/dev/null\") return false;\n		if (t === \"/dev/null\" && i > 0 && (tokens[i - 1] === \">\" || tokens[i - 1] === \">>\")) return false;\n		return true;\n	});\n	const cmdName = path.basename(tokens[0]);\n	if (cmdName === \"command\" && tokens.length > 1) return evaluateCommand(joinTokens(tokens.slice(1)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (cmdName === \"env\") {\n		let envIdx = 1;\n		while (envIdx < tokens.length && /^\\w+=/.test(tokens[envIdx])) envIdx++;\n		if (envIdx >= tokens.length) return {\n			action: \"none\",\n			rule: null,\n			reason: null\n		};\n		return evaluateCommand(joinTokens(tokens.slice(envIdx)), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"pnpm\") return evaluatePnpm(tokens, ctx);\n	if (cmdName === \"npm\") return evaluateNpm(tokens);\n	if (cmdName === \"mise\" && tokens[1] === \"exec\") {\n		const inner = miseExecInner(tokens);\n		if (!inner) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare mise exec\"\n		};\n		return evaluateCommand(joinTokens(inner), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"bash\" || cmdName === \"sh\" || cmdName === \"zsh\") return evaluateShellC(tokens, ctx);\n	if (cmdName === \"xargs\") return evaluateXargs(tokens, ctx);\n	if (cmdName === \"node\" && (tokens.includes(\"-e\") || tokens.includes(\"-p\") || tokens.includes(\"--eval\") || tokens.includes(\"--print\"))) return {\n		action: \"none\",\n		rule: null,\n		reason: \"node eval\"\n	};\n	for (const rule of denyRules) if (rule.match.test(cmdName)) {\n		if (!rule.when || rule.when(tokens, ctx)) return {\n			action: \"deny\",\n			rule: rule.name,\n			reason: rule.reason ?? null\n		};\n	}\n	const advice = cmdName === \"git\" ? worktreeAdvice(tokens, ctx) : void 0;\n	return {\n		action: \"none\",\n		rule: null,\n		reason: `no rule matched: ${cmdName}`,\n		...advice ? { advice } : {}\n	};\n}\nfunction miseExecInner(tokens) {\n	const dashIdx = tokens.indexOf(\"--\");\n	if (dashIdx === -1) return void 0;\n	const inner = tokens.slice(dashIdx + 1);\n	return inner.length > 0 ? inner : void 0;\n}\nfunction scanPnpmFlags(subTokens, from, state) {\n	for (let i = from; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t.startsWith(\"--filter=\") || t === \"-F\" || t.startsWith(\"-F=\")) return {\n			name: void 0,\n			filterIdx: i\n		};\n		if (t === \"-r\" || t === \"--recursive\") {\n			state.isRecursive = true;\n			continue;\n		}\n		if (t === \"-w\" || t === \"--workspace-root\") {\n			state.isWorkspaceRoot = true;\n			continue;\n		}\n		if (t === \"-C\" || t === \"--dir\") {\n			state.dirOverride = subTokens[++i];\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			state.dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		return { name: t };\n	}\n	return { name: void 0 };\n}\nfunction evaluatePnpm(tokens, ctx) {\n	const subTokens = tokens.slice(1);\n	const state = {\n		isRecursive: false,\n		isWorkspaceRoot: false,\n		dirOverride: void 0\n	};\n	const scan = scanPnpmFlags(subTokens, 0, state);\n	if (scan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, scan.filterIdx, ctx, state.dirOverride);\n	const subcommand = scan.name;\n	const subcommandIdx = subcommand ? subTokens.indexOf(subcommand) : -1;\n	if (!subcommand) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (subcommand === \"dlx\") return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm dlx\"\n	};\n	if (subcommand === \"add\") return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm add\"\n	};\n	if (subcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcommandIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName;\n	let { isRecursive, isWorkspaceRoot, dirOverride } = state;\n	if (subcommand === \"run\") {\n		const runScan = scanPnpmFlags(subTokens, subcommandIdx + 1, state);\n		({isRecursive, isWorkspaceRoot, dirOverride} = state);\n		if (runScan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, runScan.filterIdx, ctx, state.dirOverride);\n		if (!runScan.name) return {\n			action: \"none\",\n			rule: null,\n			reason: \"pnpm run without script name\"\n		};\n		scriptName = runScan.name;\n	} else if (!PNPM_BUILTINS.has(subcommand)) scriptName = subcommand;\n	else return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (isRecursive) return evaluatePnpmRecursive(scriptName, ctx);\n	if (isWorkspaceRoot) {\n		const root = findWorkspaceRoot(ctx.cwd);\n		if (!root) return {\n			action: \"none\",\n			rule: null,\n			reason: \"workspace root not found\"\n		};\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: root\n		});\n	}\n	if (dirOverride) {\n		const resolved = path.resolve(ctx.cwd, dirOverride);\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: resolved\n		});\n	}\n	return evaluatePnpmScript(scriptName, ctx);\n}\nfunction evaluatePnpmScript(scriptName, ctx) {\n	const resolved = resolveScript(scriptName, ctx.cwd);\n	if (!resolved) return {\n		action: \"none\",\n		rule: null,\n		reason: \"script resolution failed\"\n	};\n	const res = evaluateResolvedScript(resolved, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (res.action === \"deny\") return res;\n	return {\n		action: \"none\",\n		rule: `pnpm-script:${scriptName}`,\n		reason: null\n	};\n}\nfunction evaluatePnpmRecursive(scriptName, ctx) {\n	const resolved = resolveRecursiveScripts(scriptName, ctx.cwd);\n	if (!resolved || resolved.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm recursive\"\n	};\n	for (const pkg of resolved) {\n		const res = evaluateResolvedScript(pkg, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: pkg.pkgDir ?? ctx.cwd\n		});\n		if (res.action === \"deny\") return res;\n	}\n	return {\n		action: \"none\",\n		rule: `pnpm-recursive:${scriptName}`,\n		reason: null\n	};\n}\nfunction evaluateNpm(tokens) {\n	if (isNpmReadOp(tokens)) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	return {\n		action: \"deny\",\n		rule: \"npm-redirect\",\n		reason: getNpmRedirectReason(tokens)\n	};\n}\nfunction collectFiltersAndScan(subTokens, from, filterPkgs) {\n	let dirOverride;\n	for (let i = from; i < subTokens.length; i += 1) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t === \"-F\") {\n			const pkg = subTokens[i + 1];\n			if (pkg === void 0 || pkg.startsWith(\"-\")) return void 0;\n			filterPkgs.push(pkg);\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"--filter=\") || t.startsWith(\"-F=\")) {\n			const pkg = t.startsWith(\"-F=\") ? t.slice(3) : t.slice(9);\n			if (pkg === \"\") return void 0;\n			filterPkgs.push(pkg);\n			continue;\n		}\n		if (t === \"-r\" || t === \"--recursive\" || t === \"-w\" || t === \"--workspace-root\") continue;\n		if (t === \"-C\" || t === \"--dir\") {\n			dirOverride = subTokens[i + 1];\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return {\n			name: t,\n			index: i,\n			dirOverride\n		};\n	}\n	return {\n		name: void 0,\n		index: -1,\n		dirOverride\n	};\n}\nfunction evaluatePnpmFilter(_tokens, subTokens, filterIdx, ctx, stateDir) {\n	const filterPkgs = [];\n	const scan = collectFiltersAndScan(subTokens, filterIdx, filterPkgs);\n	if (scan === void 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	let dirOverride = scan.dirOverride ?? stateDir;\n	if (filterPkgs.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	const filterSubcommand = scan.name;\n	const subcmdIdx = scan.index;\n	if (filterSubcommand === void 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without subcommand\"\n	};\n	if (PNPM_BUILTINS.has(filterSubcommand) && filterSubcommand !== \"run\" && filterSubcommand !== \"exec\") return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (filterSubcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcmdIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName = filterSubcommand;\n	if (filterSubcommand === \"run\") {\n		const runScan = collectFiltersAndScan(subTokens, subcmdIdx + 1, filterPkgs);\n		if (runScan === void 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"pnpm --filter without package\"\n		};\n		scriptName = runScan.name;\n		if (runScan.dirOverride !== void 0) dirOverride = runScan.dirOverride;\n	}\n	if (scriptName === void 0 || scriptName.startsWith(\"-\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter run without script name\"\n	};\n	if (PNPM_BUILTINS.has(scriptName) && scriptName !== \"run\") return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	const baseDir = dirOverride ? path.resolve(ctx.cwd, dirOverride) : ctx.cwd;\n	for (const pkg of filterPkgs) {\n		const resolved = resolveFilteredScript(scriptName, pkg, baseDir);\n		if (!resolved) return {\n			action: \"none\",\n			rule: null,\n			reason: \"filtered script resolution failed\"\n		};\n		const res = evaluateResolvedScript(resolved, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: resolved.pkgDir ?? baseDir\n		});\n		if (res.action === \"deny\") return res;\n	}\n	return {\n		action: \"none\",\n		rule: `pnpm-filter:${filterPkgs.join(\",\")}:${scriptName}`,\n		reason: null\n	};\n}\nconst SHELL_LOGIN_FLAGS = /* @__PURE__ */ new Set([\"-l\", \"--login\"]);\nfunction evaluateShellC(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length && SHELL_LOGIN_FLAGS.has(tokens[i])) i++;\n	const flag = tokens[i];\n	if (flag === void 0 || !/^-[lc]+$/.test(flag) || !flag.includes(\"c\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell without a plain -c\"\n	};\n	const cmdArg = tokens[i + 1];\n	if (!cmdArg) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell -c without command\"\n	};\n	if (tokens.length > i + 2) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell -c with positional args\"\n	};\n	return evaluateCommand(cmdArg, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\nconst XARGS_ARG_FLAGS = /* @__PURE__ */ new Set([\n	\"-I\",\n	\"-d\",\n	\"-n\",\n	\"-P\",\n	\"-s\",\n	\"-L\",\n	\"-E\",\n	\"-a\",\n	\"--max-args\",\n	\"--max-procs\",\n	\"--delimiter\",\n	\"--replace\",\n	\"--max-lines\",\n	\"--max-chars\",\n	\"--arg-file\",\n	\"--process-slot-var\"\n]);\nconst XARGS_BOOL_FLAGS = /* @__PURE__ */ new Set([\n	\"-0\",\n	\"--null\",\n	\"-t\",\n	\"--verbose\",\n	\"-r\",\n	\"--no-run-if-empty\",\n	\"-p\",\n	\"--interactive\",\n	\"-x\",\n	\"--exit\",\n	\"--show-limits\"\n]);\nfunction evaluateXargs(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length) {\n		const t = tokens[i];\n		if (!t.startsWith(\"-\")) break;\n		if (XARGS_ARG_FLAGS.has(t)) {\n			i += 2;\n			continue;\n		}\n		const eqIdx = t.indexOf(\"=\");\n		if (eqIdx !== -1) {\n			const flagName = t.slice(0, eqIdx);\n			if (XARGS_ARG_FLAGS.has(flagName)) {\n				i++;\n				continue;\n			}\n		}\n		if (t.length > 2 && XARGS_ARG_FLAGS.has(t.slice(0, 2))) {\n			i++;\n			continue;\n		}\n		if (XARGS_BOOL_FLAGS.has(t)) {\n			i++;\n			continue;\n		}\n		return {\n			action: \"none\",\n			rule: null,\n			reason: \"xargs with unrecognised flags\"\n		};\n	}\n	if (i >= tokens.length) return {\n		action: \"none\",\n		rule: null,\n		reason: \"xargs without command\"\n	};\n	return evaluateCommand(joinTokens(tokens.slice(i)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\n\n//#endregion\n//#region src/file-rules.ts\nconst READ_TOOLS = /* @__PURE__ */ new Set([\n	\"Read\",\n	\"Glob\",\n	\"Grep\"\n]);\nconst WRITE_TOOLS = /* @__PURE__ */ new Set([\"Write\", \"Edit\"]);\nconst fileDenyRules = [\n	{\n		name: \"env-file-read\",\n		tools: READ_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"hooks-folder-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			const hooksDir = path.join(ctx.cwd, \".claude\", \"hooks\");\n			return isWithin(hooksDir, resolved);\n		},\n		reason: \"Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"git-dir-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => targetsGitDir(filePath, ctx.cwd),\n		reason: \"Don't write into .git/ directly. Its internals (config, hooks, refs) are not plain project files -- a config edit can redirect remotes or push destinations that other rules trust, and a hooks/ script runs automatically on the next commit/push. Use git subcommands instead, or ask the user.\"\n	},\n	{\n		name: \"node-modules-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => targetsNodeModules(filePath, ctx.cwd),\n		reason: \"Don't write into node_modules/. Its files are hardlinks into pnpm's global store -- editing one in place corrupts that package for every project on this machine. Edit the source package and rebuild, or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`).\"\n	},\n	{\n		name: \"claude-settings-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			return samePath(resolved, path.join(ctx.cwd, \".claude\", \"settings.json\"));\n		},\n		reason: \"Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\"\n	}\n];\n\n//#endregion\n//#region src/evaluate-tool.ts\nconst FILE_PATH_TOOLS = /* @__PURE__ */ new Set([\n	\"Read\",\n	\"Write\",\n	\"Edit\"\n]);\nconst SEARCH_TOOLS = /* @__PURE__ */ new Set([\"Glob\", \"Grep\"]);\nfunction extractPath(toolName, toolInput, cwd) {\n	if (FILE_PATH_TOOLS.has(toolName)) return parseFilePathInput(toolInput)?.file_path ?? null;\n	if (SEARCH_TOOLS.has(toolName)) return parseSearchInput(toolInput)?.path ?? cwd;\n	return null;\n}\nfunction evaluateToolUse(toolName, toolInput, ctx) {\n	const filePath = extractPath(toolName, toolInput, ctx.cwd);\n	if (filePath === null) return {\n		action: \"none\",\n		rule: null,\n		reason: \"unknown tool input shape\"\n	};\n	for (const rule of fileDenyRules) if (rule.tools.has(toolName) && rule.when(filePath, ctx, toolInput)) return {\n		action: \"deny\",\n		rule: rule.name,\n		reason: rule.reason ?? null\n	};\n	return {\n		action: \"none\",\n		rule: null,\n		reason: \"no file rule matched\"\n	};\n}\n\n//#endregion\n//#region src/lib/settings.ts\nconst SETTINGS_PATH = \".claude/hooks/bst-hook.settings.json\";\nconst BstHookSettingsSchema = object({ protectedBranches: _default(array(string().check(_minLength(1))), []) });\nfunction isFileClean(cwd, relativePath) {\n	try {\n		execFileSync(\"git\", [\n			\"ls-files\",\n			\"--error-unmatch\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\",\n			timeout: GIT_TIMEOUT_MS\n		});\n		execFileSync(\"git\", [\n			\"diff\",\n			\"--quiet\",\n			\"HEAD\",\n			\"--\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\",\n			timeout: GIT_TIMEOUT_MS\n		});\n		return true;\n	} catch {\n		return false;\n	}\n}\nfunction loadRepoSettings(cwd) {\n	const root = findWorkspaceRoot(cwd) ?? cwd;\n	const settingsFile = join(root, SETTINGS_PATH);\n	const empty = { protectedBranches: [] };\n	if (!existsSync(settingsFile)) return empty;\n	if (!isFileClean(root, SETTINGS_PATH)) return empty;\n	try {\n		const raw = readFileSync(settingsFile, \"utf-8\");\n		const parsed = JSON.parse(raw);\n		const result = BstHookSettingsSchema.safeParse(parsed);\n		if (!result.success) return empty;\n		return { protectedBranches: result.data.protectedBranches };\n	} catch {\n		return empty;\n	}\n}\n\n//#endregion\n//#region src/index.ts\nconst inputResult = await readHookInput();\nif (!inputResult.ok) {\n	process.stderr.write(`[bst-hook] invalid hook input: ${inputResult.error}\\n`);\n	audit({\n		sessionId: \"unknown\",\n		cwd: \"unknown\",\n		command: `<invalid input: ${inputResult.error}>`,\n		decision: \"none\",\n		rule: null,\n		reason: `validation failed: ${inputResult.error}`,\n		permissionMode: void 0\n	});\n	process.exit(0);\n}\nconst input = inputResult.data;\nif (input.hook_event_name !== \"PreToolUse\") process.exit(0);\nif (!(/* @__PURE__ */ new Set([\n	\"Bash\",\n	\"Read\",\n	\"Write\",\n	\"Edit\",\n	\"Glob\",\n	\"Grep\"\n])).has(input.tool_name)) process.exit(0);\nconst repoSettings = loadRepoSettings(input.cwd);\nlet decision;\nlet auditCommand;\nif (input.tool_name === \"Bash\") {\n	const bashInput = parseBashInput(input.tool_input);\n	if (!bashInput) {\n		audit({\n			sessionId: input.session_id,\n			cwd: input.cwd,\n			toolName: input.tool_name,\n			command: `<invalid Bash input: ${JSON.stringify(input.tool_input).slice(0, 200)}>`,\n			decision: \"none\",\n			rule: null,\n			reason: \"Bash tool_input missing or invalid 'command' field\",\n			permissionMode: input.permission_mode\n		});\n		process.exit(0);\n	}\n	decision = evaluateCommand(bashInput.command, {\n		cwd: input.cwd,\n		depth: 0,\n		repoProtectedBranches: repoSettings.protectedBranches\n	});\n	auditCommand = bashInput.command;\n} else {\n	const projectDir = findWorkspaceRoot(input.cwd) ?? process.env[\"CLAUDE_PROJECT_DIR\"] ?? input.cwd;\n	decision = evaluateToolUse(input.tool_name, input.tool_input, {\n		cwd: projectDir,\n		sessionId: input.session_id\n	});\n	const filePath = String(input.tool_input[\"file_path\"] ?? input.tool_input[\"path\"] ?? \"\");\n	auditCommand = `${input.tool_name} ${filePath}`;\n}\naudit({\n	sessionId: input.session_id,\n	cwd: input.cwd,\n	toolName: input.tool_name,\n	command: auditCommand,\n	decision: decision.action,\n	rule: decision.rule,\n	reason: decision.reason,\n	permissionMode: input.permission_mode\n});\nif (decision.action === \"deny\") writeDeny(decision.reason);\nelse if (decision.advice) writeAdvice(decision.advice);\n\n//#endregion\nexport {  };",
+	guide: "# bst-hook Permission Guide\n\nThis project uses a PreToolUse hook (`bst-hook`) that checks each Bash command\nand file tool call before it runs. The hook only ever blocks a command; it does\nnot approve anything on its own. A command that matches a rule below is denied,\nwith a message that says what to do instead.\n\n## Denied commands\n\nThese are blocked. The hook tells you what to do instead.\n\n### Bash\n\n- **sudo**: Don't use sudo. If you need elevated permissions, ask me to do it manually.\n- **git-force-push**: Use `git push --force-with-lease` instead of `--force`.\n- **git-protected-branch-write**: This would move a protected branch (main, master, the remote's default branch, or one listed in .claude/hooks/bst-hook.settings.json#protectedBranches). Work on a feature branch in a worktree: `git worktree add ../<repo>-<topic> -b feat/<topic>`, then commit and push there. To bring `main` up to date, use `git pull --ff-only`.\n- **chmod-777**: Don't use 777 permissions. Use more restrictive permissions.\n- **node-modules-write**: Don't write into node_modules/. Its files are hardlinks into pnpm's global store, so overwriting one in place (plain `cp`, `>` redirect, `sed -i`, ...) writes through the link and corrupts that package for every project on this machine -- silently, since the directory you wrote into ends up fine. To test a local build as an installed dependency, run it directly (`node packages/<pkg>/dist/bin.mjs <cmd>`), or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`). If you must replace a file in place, `cp --remove-destination` is safe -- it unlinks the target first. Run `pnpm store status` to check whether the store is already damaged.\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **health-baseline-reset**: Run `pnpm exec bst health:raise` to raise only what this branch crossed. `--update-baseline --reset` records every outlier, including the ones already on the default branch.\n- **npx-redirect**: This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\n- **mise-self-update**: Don't self-update mise. The version is Renovate-managed; ask a human to bump the pin.\n\n### File tools (Read, Write, Edit, Glob, Grep)\n\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **hooks-folder-write**: Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\n- **git-dir-write**: Don't write into .git/ directly. Its internals (config, hooks, refs) are not plain project files -- a config edit can redirect remotes or push destinations that other rules trust, and a hooks/ script runs automatically on the next commit/push. Use git subcommands instead, or ask the user.\n- **node-modules-write**: Don't write into node_modules/. Its files are hardlinks into pnpm's global store -- editing one in place corrupts that package for every project on this machine. Edit the source package and rebuild, or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`).\n- **claude-settings-write**: Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\n\n## How commands are evaluated\n\n- **Pipelines and chains**: every segment is checked; a deny on any segment blocks the whole command.\n- **pnpm scripts**: `pnpm <script>` resolves against `package.json` (including pre/post hooks and `--filter` workspaces) and evaluates the resolved command recursively.\n- **cd propagation**: `cd dir && cmd` evaluates `cmd` relative to the new directory.\n- **Branch switch propagation**: `git switch <branch> && cmd` (or `git checkout <branch>`) evaluates a git write in `cmd` against the branch it switched to, not the one checked out before. This holds only across `&&` and only in the same directory.\n- **Audit log**: all decisions are logged to `.claude/hooks/bst-hook.audit.local.jsonl`.\n\n## Everything else\n\nA command that matches none of the rules above is judged by Claude Code's own\nauto mode, not by this hook.\n"
 }) {
 	const results = [{
 		filePath: HOOK_PATH,
@@ -8528,7 +8607,7 @@ function serializeSettings$1(settings) {
 }
 function writeOrMergeSettings(ctx, filePath, generated) {
 	const existing = ctx.read(filePath);
-	if (existing) {
+	if (existing !== void 0 && existing.trim() !== "") {
 		const parsed = parseClaudeSettings(existing);
 		if (!parsed) return {
 			filePath,
@@ -9399,7 +9478,7 @@ const GIT_GUIDE_BODY = [
 	"",
 	"**A merge with no conflicts is not yet a merge that works.** Read the incoming diff for what your branch builds on -- a field made required, a shared schema, a size budget -- and run the full check before you push the merge. Fix what it finds in the merge commit itself, so that commit passes on its own.",
 	"",
-	"**Never trust git's merge of a baseline file** (`health-baseline.json`, `coverage-baseline.json`): a merge that reports no conflict can still drop the default branch's own entries. Take the default branch's copy, re-measure the merged tree, and adopt only what your branch changed."
+	"**Never trust git's merge of a baseline file** (`health-baseline.json`, `coverage-baseline.json`): a merge that reports no conflict can still drop the default branch's own entries. Take the default branch's copy, then re-measure: `pnpm exec bst health:raise` for `health-baseline.json`, the coverage command for the other. Adopt only what your branch changed."
 ].join("\n");
 const PLAN_LIFECYCLE_GUIDE_BODY = [
 	"# Plan lifecycle",
@@ -9433,22 +9512,25 @@ const PLANNING_GUIDE_BODY = [
 	"",
 	"A plan may be written by you, by another session, or by a headless agent, and the run that executes it may be any of these. That run never asks which plan is meant: it finds the plan from the branch alone, so the name and the git history must say it.",
 	"",
-	"- A branch has one live plan. Tooling looks first for a path under `docs/` that carries the marker of the issue or pull request the run works (`issue-<n>` or `pr-<n>`), then for the one live plan the branch **added**. A plan the branch only edited or renamed is not an added file, so a plan that has neither the marker nor the add is invisible to the run that should execute it, however clearly its text names the work.",
+	"- A plan this branch **added** is found without a marker, counted at its new path when the branch moved it there with `git mv`. A plan the branch did not add is found by a marker in its path -- the marker of either half of the pair the run works, `issue-<n>` or `pr-<n>` -- or, when the branch added no plan at all, by being the one plan it modified that still has a task open. A plan with none of these is invisible to the run that should execute it, however clearly its text names the work.",
 	"- Name a new plan `docs/plans/<YYYY-MM-DD>-<topic>.md`, and when the work has an issue or pull request, put its marker in the name: `docs/plans/<YYYY-MM-DD>-issue-<n>-<topic>.md`. The marker is what keeps the plan findable when a second plan joins the branch.",
 	"- To refine a plan this branch already added, edit it in place and keep its name, so the branch never carries two plans for one piece of work.",
-	"- A plan the branch inherited from the default branch -- a deferred plan, or a plan that landed in an earlier pull request -- is found only by its marker. To work one, whether you rewrite it or execute it, rename it with `git mv` to a name that carries the marker, in the first commit that touches it. Use the marker of the object the run works: when an agent executes the plan on a pull request, that is the pull request's `pr-<n>`, not the issue's. Do not edit an inherited plan under its old name.",
-	"- After committing the plan, check that it is findable: `git diff --name-status <default branch>...HEAD -- docs/plans` lists it with `A`, or its path carries the marker.",
+	"- To work a plan the branch inherited from the default branch -- a deferred plan, or one that landed in an earlier pull request -- rename it with `git mv` to a name that carries the marker, in the first commit that touches it, then work it under that name. Use the marker of the object the run works: when an agent executes the plan on a pull request, that is the pull request's `pr-<n>`.",
+	"- After committing the plan, check that it is findable: `pnpm exec bst docs:check` reports R9 for a plan on the branch that the lookup above could not find.",
 	"",
 	"### Writing the plan",
 	"",
 	"- Check the plan's premises against the tree before building on them. \"Today X is broken\" is a claim: read the code that handles X, not just the line that throws.",
+	"- A plan or spec that must mention a character `chars:check` denies names it by its code point (`U+202E`) or by the escape its context uses, and never pastes the glyph: an active doc is inside the gate's scope and holds the branch red until it retires.",
 	"- Label each task `Task <n>:` at the start of its heading or checkbox, numbered from 1, so `plan:brief` can find it. To split a task after the plan is written, give the parts one lowercase letter (`Task 18a:`, `Task 18b:`) rather than renumbering, so later tasks and every cross-reference keep their numbers. A checkbox's first sentence is the task's name on the control panel: end it with a period inside one short line, and put the files, commands, and checks in the sentences after it.",
 	`- Give each task what makes it unambiguous and nothing more: a test's name and its assertions with the spec's exact values and why that test fails before the change, a code change's exact signature and file, a command with the output that means it passed. Write out a body only for an algorithm the signature and tests do not determine. Work that uses another task's result names that task's interfaces, never repeats its code. A task with no test to write says \`${TEST_EVIDENCE_PREFIXES.noTest} <reason>\` in the plan, so the executor inherits the call instead of making it cold.`,
 	"- Keep tasks small. Each one runs its own test cycle and ends in a result that can be checked on its own: write the failing test, watch it fail, make it pass, commit. A run cut off partway then loses one task, not the plan. A large plan is fine; a large task is not.",
-	"- A plan that builds on earlier work opens with a task that checks the prerequisite exists, and records a `**Blocked:**` note if it does not, instead of rebuilding it.",
+	"- A plan that builds on earlier work opens with a task that checks the prerequisite exists, and records a `**Blocked:**` note if it does not, instead of rebuilding it. It covers work a later change can supply and a run can retry once it lands; work only a person can do goes in a human phase, the next bullet.",
+	"- Split the plan into phases, each a heading above its tasks (a `##` phase heading over `###` task headings), and mark each phase in its heading as autonomous or as needing a person; for a human phase, name what it needs: hardware, data not in the repository, access, a decision. A phase label is a heading, never a checkbox, because a checkbox reads as a task and gets claimed as work. Task numbers run across the whole plan: a phase never restarts them. The bullet above is for work a later change can supply; this one is for work only a person can do.",
+	"- Put autonomous phases first: a human phase goes after every autonomous phase and before the retire task, and no autonomous task depends on a human phase, so the executor commits everything it can do alone before it needs a person. Open each human phase with what the person does, where they commit the result, and how the executor checks that the result is there; the check reads only what is committed, because an executor may not have the device, the data, or the access the person has, and the phase's boxes get ticked once that check passes on the committed result. Data too large to commit gets a committed stand-in the plan names, such as a sample, a summary, or recorded results; when no stand-in can do the job, the phase is hand work from start to finish and the person ticks its boxes.",
 	"- State a judgement that recurs across many places once, as a rule in the plan, so every task decides it the same way.",
 	"- Where the property that matters is out of the executor's reach (a container, a live process, a real network), say so and name the test that stands in for watching it.",
-	"- The last task retires the plan (see the plan-lifecycle guide). Its checkbox text starts with the literal `Retire this plan`, not `Task <n>:`, so tooling can recognize it, and that first sentence ends there: `Retire this plan and its spec.`, then the command.",
+	"- The last task retires the plan (see the plan-lifecycle guide). Its checkbox text starts with the literal `Retire this plan`, not `Task <n>:`, so tooling can recognize it, and that first sentence ends there: `Retire this plan and its spec.`, then the command. Put that box under its own heading after the last phase rather than straight under the last task's boxes, so it reads as its own unit and not as another step of that task.",
 	"- Reread the finished plan against the spec. A plan several times longer than its spec has written the program instead of the decisions: replace bodies with signatures, test names, and assertions. A line that decides nothing (\"TBD\", \"handle edge cases\", a type no task defines) is the opposite failure. Fix both.",
 	"",
 	"## Working through a plan",
@@ -9505,18 +9587,18 @@ function webUiGuideBody() {
 	const mwg = `pnpm dlx modern-web-guidance@${{
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.19.1",
+		"@types/node": "24.19.2",
 		"@vitest/coverage-v8": "5.0.3",
-		"commit-and-tag-version": "13.2.1",
+		"commit-and-tag-version": "13.3.0",
 		"knip": "6.41.0",
-		"lefthook": "2.2.1",
-		"modern-web-guidance": "0.0.193",
-		"oxfmt": "0.72.0",
+		"lefthook": "2.2.2",
+		"modern-web-guidance": "0.0.194",
+		"oxfmt": "0.73.0",
 		"oxlint": "1.87.0",
-		"oxlint-tsgolint": "7.0.2003",
-		"prettier": "3.9.9",
+		"oxlint-tsgolint": "7.0.2004",
+		"prettier": "3.9.10",
 		"release-it": "21.1.1",
-		"tsdown": "0.23.0",
+		"tsdown": "0.23.1",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
 		"pnpm": "11.28.5"
@@ -9613,11 +9695,13 @@ const HEALTH_RULE_TAIL = [
 	"",
 	"So never duplicate a type, or fork a helper, to protect a fan budget -- import it. Nor move a module out of its home directory to dodge crowding. The converse holds: turning a type-only import into a value import adds an edge, so a module that already imports another for its types gains a real edge the first time it imports a value from it.",
 	"",
-	"**An exemption takes a module or directory out of the gate.** It is listed with its count and reason in `health:summary --explain`, carries no ceiling, and is counted in no metric. `crowdedDirectories` is exemptable by directory path. Adding one is a raise too.",
+	"**An exemption takes a module or directory out of the gate.** It is listed with its count and reason in `health:summary --explain`, carries no ceiling, and is counted in no metric. `crowdedDirectories` is exemptable by directory path. A key may be a glob. Adding one is a raise too.",
+	"",
+	"**A raise travels with the code that caused it.** A raise is a higher count or ceiling, a ceiling for a module that has none, a new exemption, or a higher limit. Write it with `pnpm exec bst health:raise` in the pull request whose code crossed the budget; say in the commit why, and a person merges it. Its `--exempt <leaf> --reason \"<text>\"` is for a hub by construction. Never raise a limit to pass. `--update-baseline --reset` rebuilds a baseline, never one branch.",
 	"",
-	"**A raise travels alone.** A raise is a higher count or ceiling, a ceiling for a module that has none, a new exemption, or a higher limit. It lands only as a ceiling-only pull request -- one whose diff changes nothing but `health-baseline.json` and `.tooling.json` -- which a human merges. When `health:check` refuses, split the module or open that pull request, and stop. Never run `pnpm exec bst health:check --update-baseline --reset` on a branch that carries code.",
+	"Prefer an exemption to raising `fanInLimit` or `fanOutLimit`: an exemption names the hub in `health:summary --explain`, while a higher limit silently un-tracks every module beneath it. A per-module ceiling has no such shadow -- it ratchets one module at one count and fails again one edge later.",
 	"",
-	"Prefer an exemption to raising `fanInLimit` or `fanOutLimit`: an exemption names the hub in `health:summary --explain`, while a higher limit silently un-tracks every module beneath it. A per-module ceiling has no such shadow -- it ratchets one module at one count and fails again one edge later."
+	"**Never contort code to meet a budget.** Write the correct solution, then adjust the budget to match: a health ceiling as the raise rule above says, and a bundle or other size budget by a full 1%, rounded up, never to the byte."
 ];
 function healthRuleBody(config) {
 	const lines = [...HEALTH_RULE_HEAD];
@@ -9752,7 +9836,7 @@ function agentGuides(config, coverageEnabled, healthEnabled, webUiEnabled) {
 		},
 		{
 			name: "health.md",
-			trigger: "add a cross-module import, or when `health:check` fails",
+			trigger: "add a cross-module import, or when `health:check` or a size budget fails",
 			body: healthRuleBody(config),
 			enabled: healthEnabled
 		}
@@ -10079,7 +10163,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.93.1 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.95.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -10879,6 +10963,21 @@ function parseWarnMarkerLine(line) {
 	const count = Number.parseInt(match[1] ?? "", 10);
 	return Number.isNaN(count) ? null : count;
 }
+const MEASURE_LINE = new RegExp(`^::bst-health:: measure (\\d+)\\s*$`);
+function parseMeasureMarkerLine(line) {
+	const match = MEASURE_LINE.exec(line);
+	if (match === null) return void 0;
+	const value = Number.parseInt(match[1] ?? "", 10);
+	return Number.isNaN(value) ? void 0 : value;
+}
+function readMeasureMarker(stdout) {
+	let found;
+	for (const line of stdout.split("\n")) {
+		const parsed = parseMeasureMarkerLine(line);
+		if (parsed !== void 0) found = parsed;
+	}
+	return found;
+}
 //#endregion
 //#region src/checks/step-exec.ts
 function execStep(cmd, cwd, sink = process.stdout) {
@@ -10976,7 +11075,7 @@ function createRealHealthExecutor(rootDir) {
 				};
 				return {
 					stdout: "",
-					stderr: "",
+					stderr: describeError$1(err),
 					exitCode: 1
 				};
 			}
@@ -11027,17 +11126,13 @@ function createRealHealthExecutor(rootDir) {
 }
 //#endregion
 //#region src/codebase-health/reference.ts
-const HEALTH_CEILING_FILES = ["health-baseline.json", ".tooling.json"];
 const BASELINE_FILE$2 = "health-baseline.json";
-const TOOLING_FILE = ".tooling.json";
+const TOOLING_FILE$1 = ".tooling.json";
 function repoPrefix(executor, cwd) {
 	const result = executor.exec("git", ["rev-parse", "--show-prefix"], { cwd });
 	if (result.exitCode !== 0) return "";
 	return result.stdout.trim();
 }
-function ceilingFileNamesAt(prefix) {
-	return HEALTH_CEILING_FILES.map((name) => `${prefix}${name}`);
-}
 const DefaultBranchSchema = z.object({ defaultBranch: z.string().optional() });
 function parseDefaultBranchOverride(raw) {
 	if (raw === void 0 || raw.trim() === "") return void 0;
@@ -11061,9 +11156,9 @@ function resolveReferenceBranch(executor, cwd, prefix, ciEvent) {
 		"--quiet",
 		ref
 	], cwd) !== void 0) {
-		const branch = parseDefaultBranchOverride(showAt(executor, cwd, ref, `${prefix}${TOOLING_FILE}`)) ?? chosen;
+		const branch = parseDefaultBranchOverride(showAt(executor, cwd, ref, `${prefix}${TOOLING_FILE$1}`)) ?? chosen;
 		if (anchor !== void 0) return { branch };
-		const namedElsewhere = parseDefaultBranchOverride(executor.readFile(TOOLING_FILE));
+		const namedElsewhere = parseDefaultBranchOverride(executor.readFile(TOOLING_FILE$1));
 		if (namedElsewhere === void 0 || namedElsewhere === branch) return { branch };
 		return {
 			branch,
@@ -11071,7 +11166,7 @@ function resolveReferenceBranch(executor, cwd, prefix, ciEvent) {
 		};
 	}
 	if (anchor !== void 0) return { branch: chosen };
-	return { branch: parseDefaultBranchOverride(executor.readFile(TOOLING_FILE)) ?? "main" };
+	return { branch: parseDefaultBranchOverride(executor.readFile(TOOLING_FILE$1)) ?? "main" };
 }
 function originHeadBranch(git, cwd) {
 	const head = git([
@@ -11113,10 +11208,10 @@ function readReference(executor, opts) {
 		reason: `health: cannot read the reference at the merge base with origin/${branch}. Run \`git fetch origin ${branch}\` so the default branch is present (a shallow clone or a missing remote-tracking ref makes it absent), or set .tooling.json#defaultBranch on the default branch if it has another name -- once that branch is fetched, its own copy of the setting decides, not this branch's. health:check fails closed without a reference.`
 	};
 	const baselineText = showAt(executor, opts.cwd, sha, `${prefix}${BASELINE_FILE$2}`);
-	const toolingText = showAt(executor, opts.cwd, sha, `${prefix}${TOOLING_FILE}`);
+	const toolingText = showAt(executor, opts.cwd, sha, `${prefix}${TOOLING_FILE$1}`);
 	const health = resolveHealthConfigFromContext({
-		exists: (rel) => rel === TOOLING_FILE && toolingText !== void 0,
-		read: (rel) => rel === TOOLING_FILE ? toolingText : void 0,
+		exists: (rel) => rel === TOOLING_FILE$1 && toolingText !== void 0,
+		read: (rel) => rel === TOOLING_FILE$1 ? toolingText : void 0,
 		config: { stack: opts.stack }
 	}, { isMonorepo: opts.isMonorepo });
 	const reference = {
@@ -11155,8 +11250,67 @@ const RAISABLE_LIMITS = [
 	"moduleSizeLimit",
 	"tolerance"
 ];
+const GATE_SWITCHES = ["enabled", "crossPackage"];
+const EXCLUDE_LEAF_PREFIX = "health.exclude.";
+function canonicalJson(value) {
+	return JSON.stringify(sortKeys(value));
+}
+const JsonObjectSchema$1 = z.record(z.string(), z.unknown());
+function sortKeys(value) {
+	if (Array.isArray(value)) return value.map(sortKeys);
+	const object = JsonObjectSchema$1.safeParse(value);
+	if (object.success) {
+		const keys = Object.keys(object.data).toSorted();
+		const sorted = {};
+		for (const key of keys) sorted[key] = sortKeys(object.data[key]);
+		return sorted;
+	}
+	return value;
+}
+function sizeRaises(reference, current) {
+	const raises = [];
+	for (const [id, base] of Object.entries(reference.baseline?.sizeBudgets ?? {})) {
+		if (current.baseline === void 0) continue;
+		const now = current.baseline.sizeBudgets?.[id];
+		if (now === void 0) {
+			if (current.health.sizeBudgets[id] !== void 0) raises.push({
+				leaf: `sizeBudgets.${id}`,
+				reference: String(base),
+				current: "absent"
+			});
+			continue;
+		}
+		if (now > base) raises.push({
+			leaf: `sizeBudgets.${id}`,
+			reference: String(base),
+			current: String(now)
+		});
+	}
+	for (const [id, base] of Object.entries(reference.health.sizeBudgets)) {
+		const now = current.health.sizeBudgets[id];
+		if (now === void 0) {
+			raises.push({
+				leaf: `health.sizeBudgets.${id}`,
+				reference: "present",
+				current: "absent"
+			});
+			continue;
+		}
+		const baseJson = canonicalJson(base);
+		if (baseJson !== canonicalJson(now)) raises.push({
+			leaf: `health.sizeBudgets.${id}`,
+			reference: baseJson,
+			current: canonicalJson(now)
+		});
+	}
+	return raises;
+}
 function findRaises(reference, current) {
-	return [...baselineRaises(reference, current), ...configRaises(reference.health, current.health)];
+	return [
+		...baselineRaises(reference, current),
+		...sizeRaises(reference, current),
+		...configRaises(reference.health, current.health)
+	];
 }
 function baselineRaises(reference, current) {
 	const raises = [];
@@ -11168,7 +11322,7 @@ function baselineRaises(reference, current) {
 			reference: String(base),
 			current: String(now)
 		});
-		else if (base !== void 0 && now === void 0 && current.baseline !== void 0 && current.measured?.metrics[key] !== void 0) raises.push({
+		else if (base !== void 0 && now === void 0 && current.baseline !== void 0 && (current.measured === void 0 || current.measured.metrics[key] !== void 0)) raises.push({
 			leaf: key,
 			reference: String(base),
 			current: "absent"
@@ -11179,7 +11333,7 @@ function baselineRaises(reference, current) {
 		for (const [module, base] of Object.entries(reference.baseline?.moduleCeilings?.[key] ?? {})) {
 			if (current.baseline === void 0) continue;
 			if (current.baseline.moduleCeilings?.[key]?.[module] !== void 0) continue;
-			if (measured[module] === void 0) continue;
+			if (current.measured !== void 0 && measured[module] === void 0) continue;
 			raises.push({
 				leaf: `moduleCeilings.${key}.${module}`,
 				reference: String(base),
@@ -11233,11 +11387,11 @@ function configRaises(reference, current) {
 		});
 	}
 	for (const pattern of current.exclude) if (!reference.exclude.includes(pattern)) raises.push({
-		leaf: `health.exclude.${pattern}`,
+		leaf: `${EXCLUDE_LEAF_PREFIX}${pattern}`,
 		reference: "absent",
 		current: "present"
 	});
-	for (const name of ["enabled", "crossPackage"]) if (reference[name] && !current[name]) raises.push({
+	for (const name of GATE_SWITCHES) if (reference[name] && !current[name]) raises.push({
 		leaf: `health.${name}`,
 		reference: "true",
 		current: "false"
@@ -11265,11 +11419,6 @@ function branchDiffNames(executor, cwd, mergeBase) {
 	}
 	return [...names].toSorted();
 }
-function isCeilingOnly(names, prefix = "") {
-	if (names.length === 0) return false;
-	const files = ceilingFileNamesAt(prefix);
-	return names.every((name) => files.includes(name));
-}
 //#endregion
 //#region ../forgejo/src/git.ts
 const GIT_LOCAL_TIMEOUT_MS = 6e4;
@@ -11932,6 +12081,26 @@ function logCoverageChoice(vc, coverage, useCoverageScript, requested) {
 	if (coverage.enabled && !useCoverageScript && coverage.source === "config") log$1.warn("coverage.gateOnPullRequests is set but test:coverage script is not defined; falling back to test");
 	debug(vc, `Coverage: ${requested ?? "auto"} (source: ${coverage.source}) -> ${useCoverageScript ? "test:coverage" : "test"}`);
 }
+function withLegacyCharsScript(definedScripts) {
+	const scripts = new Set(definedScripts);
+	if (!scripts.has(CHARS_CHECK.name) && definedScripts.has(LEGACY_CHARS_CHECK_SCRIPT)) scripts.add(CHARS_CHECK.name);
+	return scripts;
+}
+function withAddedChecks(builtinChecks, add) {
+	const builtinNames = new Set(builtinChecks.map((check) => check.name));
+	function isBuiltInName(name) {
+		if (builtinNames.has(name)) return true;
+		const alias = legacyCharsAlias(name);
+		return alias !== void 0 && builtinNames.has(alias);
+	}
+	return [...builtinChecks, ...add.filter((name) => !isBuiltInName(name)).map((name) => ({ name }))];
+}
+function scriptNameFor(checkName, definedScripts, useCoverageScript) {
+	if (checkName === "test" && useCoverageScript) return "test:coverage";
+	if (checkName === "lint" && definedScripts.has("lint:report")) return "lint:report";
+	if (checkName === CHARS_CHECK.name && !definedScripts.has(CHARS_CHECK.name) && definedScripts.has(LEGACY_CHARS_CHECK_SCRIPT)) return LEGACY_CHARS_CHECK_SCRIPT;
+	return checkName;
+}
 async function runRunChecks(targetDir, options = {}) {
 	const exec = options.execCommand ?? execStep;
 	const getScripts = options.getScripts ?? defaultGetScripts;
@@ -11946,17 +12115,9 @@ async function runRunChecks(targetDir, options = {}) {
 	const reporter = isCI ? ciReporter : localReporter;
 	const vc = { verbose: options.verbose ?? false };
 	const definedScripts = getScripts(targetDir);
-	const definedCheckScripts = new Set(definedScripts);
-	if (!definedCheckScripts.has(CHARS_CHECK.name) && definedScripts.has(LEGACY_CHARS_CHECK_SCRIPT)) definedCheckScripts.add(CHARS_CHECK.name);
+	const definedCheckScripts = withLegacyCharsScript(definedScripts);
 	const addedNames = new Set(add);
-	const builtinChecks = resolveRunBuiltins(targetDir, toolingConfig, options.referenceEnablesHealth);
-	const builtinNames = new Set(builtinChecks.map((check) => check.name));
-	function isBuiltInName(name) {
-		if (builtinNames.has(name)) return true;
-		const alias = legacyCharsAlias(name);
-		return alias !== void 0 && builtinNames.has(alias);
-	}
-	const allChecks = [...builtinChecks, ...add.filter((name) => !isBuiltInName(name)).map((name) => ({ name }))];
+	const allChecks = withAddedChecks(resolveRunBuiltins(targetDir, toolingConfig, options.referenceEnablesHealth), add);
 	const failures = [];
 	const warnedSteps = [];
 	const notDefined = [];
@@ -11980,10 +12141,7 @@ async function runRunChecks(targetDir, options = {}) {
 			} else notDefined.push(check.name);
 			continue;
 		}
-		let scriptName = check.name;
-		if (check.name === "test" && useCoverageScript) scriptName = "test:coverage";
-		if (check.name === "lint" && definedScripts.has("lint:report")) scriptName = "lint:report";
-		if (check.name === CHARS_CHECK.name && !definedScripts.has(CHARS_CHECK.name) && definedScripts.has(LEGACY_CHARS_CHECK_SCRIPT)) scriptName = LEGACY_CHARS_CHECK_SCRIPT;
+		const scriptName = scriptNameFor(check.name, definedScripts, useCoverageScript);
 		const cmd = check.args ? `pnpm run ${scriptName} ${check.args}` : `pnpm run ${scriptName}`;
 		debug(vc, `Running: ${cmd} (in ${targetDir})`);
 		reporter.groupStart(check.name);
@@ -12213,7 +12371,7 @@ function findInertAgentKeys(saved) {
 function runInertAgentSettingsGate(saved) {
 	const keys = findInertAgentKeys(saved);
 	if (keys.length === 0) return [];
-	log$1.warn(`.tooling.json sets ${keys.map((key) => `agent.${key}`).join(", ")}, but agent.enabled is not true, so the agent ignores them. Run \`bst setup:agent\` to enable the agent, or remove those keys.`);
+	log$1.warn(`.tooling.json sets ${keys.map((key) => `agent.${key}`).join(", ")}, but agent.enabled is not true, so the agent ignores them. Run \`pnpm exec bst setup:agent\` to enable the agent, or remove those keys.`);
 	return keys;
 }
 function runPublishConfigGate(config, targetDir) {
@@ -12271,7 +12429,7 @@ function warnUnconfiguredDefaultBranch(targetDir, saved, git = defaultGitRunner)
 	if (head === void 0) return;
 	const name = head.startsWith("origin/") ? head.slice(7) : head;
 	if (name === "" || name === "main") return;
-	log$1.warn(`origin/HEAD names "${name}", but .tooling.json sets no defaultBranch, so the generated CI workflow triggers on "${DEFAULT_BRANCH}" and gates its release steps there. Set .tooling.json#defaultBranch to "${name}" and run bst repo:sync.`);
+	log$1.warn(`origin/HEAD names "${name}", but .tooling.json sets no defaultBranch, so the generated CI workflow triggers on "${DEFAULT_BRANCH}" and gates its release steps there. Set .tooling.json#defaultBranch to "${name}" and run pnpm exec bst repo:sync.`);
 }
 function warnCoveredChecksAdd(config, targetDir) {
 	const covered = coveredChecksAddEntries(config, readPackageJson(targetDir)?.scripts ?? {});
@@ -12483,7 +12641,7 @@ async function runUpdateReport(targetDir, flags = {}, options = {}) {
 	const dockerDiscovery = createDockerDiscoveryMemo();
 	const saved = loadToolingConfigStrict(targetDir);
 	if (!saved) {
-		log$1.error("No .tooling.json found. Run `bst repo:sync` first to initialize the project.");
+		log$1.error("No .tooling.json found. Run `pnpm exec bst repo:sync` first to initialize the project.");
 		process.exitCode = 1;
 		return {
 			status: "stopped",
@@ -13118,7 +13276,9 @@ async function runVersionMode(executor, config) {
 		debug(config, `Changed packages: ${changedDirs.length > 0 ? changedDirs.join(", ") : "(none)"}`);
 		stampChangelogDates(executor, config.cwd, changedDirs, true);
 	} else stampChangelogDates(executor, config.cwd, [], false);
-	debugExec(config, "pnpm install --no-frozen-lockfile", executor.exec("pnpm", ["install", "--no-frozen-lockfile"], { cwd: config.cwd }));
+	const installResult = executor.exec("pnpm", ["install", "--no-frozen-lockfile"], { cwd: config.cwd });
+	debugExec(config, "pnpm install --no-frozen-lockfile", installResult);
+	if (installResult.exitCode !== 0) throw new FatalError(`pnpm install --no-frozen-lockfile failed (exit code ${String(installResult.exitCode)}):\n${childOutput(installResult)}`);
 	const { title, body } = buildPrContent(executor, config.cwd, packagesBefore);
 	debug(config, `PR title: ${title}`);
 	const addResult = executor.exec("git", ["add", "-A"], { cwd: config.cwd });
@@ -14650,7 +14810,7 @@ function ownerOf(names) {
 }
 //#endregion
 //#region src/work-status/claim.ts
-const HANDOVER_ROUTES = "Claim it from the control panel's \"Claim for hand work\", or remove the agent label by hand and run bst work:start again.";
+const HANDOVER_ROUTES = "Claim it from the control panel's \"Claim for hand work\", or remove the agent label by hand and run pnpm exec bst work:start again.";
 function decideClaim(report, enabled) {
 	if (!enabled) return {
 		kind: "answer",
@@ -14725,7 +14885,7 @@ async function writeClaim(executor, cwd, target, number) {
 		const flag = (await fetchAllForgejoLabels(executor, conn)).find((label) => label.name === HAND_AUTHORED_LABEL);
 		if (flag === void 0) return {
 			outcome: "failed",
-			reason: `The forge has no label named ${HAND_AUTHORED_LABEL}. Provision the agent's labels first with bst-agent agent:labels --repo ${conn.repository}, or the control panel's Provision labels.`
+			reason: `The forge has no label named ${HAND_AUTHORED_LABEL}. Provision the agent's labels first with pnpm exec bst-agent agent:labels --repo ${conn.repository}, or the control panel's Provision labels.`
 		};
 		await addForgejoIssueLabel(executor, conn, number, HAND_AUTHORED_LABEL, /* @__PURE__ */ new Map([[HAND_AUTHORED_LABEL, flag.id]]));
 		return {
@@ -14742,14 +14902,19 @@ async function writeClaim(executor, cwd, target, number) {
 //#endregion
 //#region src/work-status/consent.ts
 async function readAgentConsent(git, defaultBranch) {
-	const onBranch = await git.show(`origin/${defaultBranch}`, ".tooling.json");
+	const base = await git.resolveBase(defaultBranch);
+	if (base !== `origin/${defaultBranch}`) return {
+		enabled: agentEnabledIn(readWorkingTree(git.topLevel)),
+		source: "working-tree"
+	};
+	const onBranch = await git.show(base, ".tooling.json");
 	if (onBranch !== null) return {
 		enabled: agentEnabledIn(onBranch),
 		source: "default-branch"
 	};
 	return {
-		enabled: agentEnabledIn(readWorkingTree(git.topLevel)),
-		source: "working-tree"
+		enabled: false,
+		source: "default-branch"
 	};
 }
 function readWorkingTree(topLevel) {
@@ -15148,6 +15313,17 @@ function githubPrHost(executor, cwd, signal) {
 		}
 	};
 }
+function parseGhJson(stdout, command) {
+	let payload;
+	try {
+		payload = JSON.parse(stdout);
+	} catch {
+		throw new UnexpectedError(`'${command}' printed something that is not JSON: ${stdout.trim().slice(0, 200) || "no output"}`);
+	}
+	const value = z.json().safeParse(payload);
+	if (!value.success) throw new UnexpectedError(`Unexpected '${command}' response: ${value.error.message} (${stdout.trim().slice(0, 200) || "no output"})`);
+	return value.data;
+}
 const GitHubPrContentSchema = z.object({
 	title: z.string(),
 	body: z.string().nullish()
@@ -15165,7 +15341,7 @@ async function readGitHubPrContent(executor, cwd, prNumber, signal) {
 		signal
 	});
 	if (result.exitCode !== 0) throw new FatalError(`Failed to read PR #${String(prNumber)}: ${result.stderr || result.stdout}`);
-	const parsed = GitHubPrContentSchema.safeParse(JSON.parse(result.stdout));
+	const parsed = GitHubPrContentSchema.safeParse(parseGhJson(result.stdout, "gh pr view"));
 	if (!parsed.success) throw new UnexpectedError(`Unexpected 'gh pr view' response: ${parsed.error.message}`);
 	return {
 		title: parsed.data.title,
@@ -15194,7 +15370,7 @@ async function findOpenGitHubPr(executor, cwd, branch, signal) {
 	if (result.exitCode !== 0) throw new TransientError(`'gh pr list' exited ${String(result.exitCode)}: ${result.stderr.trim() || "no output"} -- cannot tell whether ${branch} has an open PR`);
 	const out = result.stdout.trim();
 	if (out === "") return null;
-	const parsed = GitHubPrListSchema.safeParse(JSON.parse(out));
+	const parsed = GitHubPrListSchema.safeParse(parseGhJson(out, "gh pr list"));
 	if (!parsed.success) throw new UnexpectedError(`Unexpected 'gh pr list' response: ${parsed.error.message}`);
 	const first = parsed.data[0];
 	return first === void 0 ? null : {
@@ -15290,7 +15466,7 @@ function githubPrEditHost(executor, cwd, repository) {
 				"state,isDraft,title,headRefName,baseRefName,mergeable,url"
 			]);
 			if (result.exitCode !== 0) throw new FatalError(`Failed to read PR #${String(number)}: ${result.stderr || result.stdout}`);
-			const parsed = GitHubPrEditStateSchema.safeParse(JSON.parse(result.stdout));
+			const parsed = GitHubPrEditStateSchema.safeParse(parseGhJson(result.stdout, "gh pr view"));
 			if (!parsed.success) throw new UnexpectedError(`Unexpected 'gh pr view' response: ${parsed.error.message}`);
 			const data = parsed.data;
 			return {
@@ -17226,7 +17402,9 @@ var MarkupLexer = class {
 	matchesIslandClose() {
 		const start = this.i + 2;
 		const end = start + this.islandCloseTag.length;
-		return this.text.slice(start, end).toLowerCase() === this.islandCloseTag;
+		if (this.text.slice(start, end).toLowerCase() !== this.islandCloseTag) return false;
+		const next = this.text[end] ?? "";
+		return next === ">" || next === "/" || /\s/.test(next);
 	}
 	closeIsland() {
 		this.flushTo(this.i, "code");
@@ -18255,6 +18433,9 @@ function parsePlanBoxes(planText) {
 		};
 	});
 }
+function countOutstandingBoxes(planText, options) {
+	return parsePlanBoxes(planText).filter((box) => isOutstanding(box, options)).length;
+}
 //#endregion
 //#region src/plan-workspace/status.ts
 const RETIRED_SEGMENT = /(^|\/)retired\//;
@@ -18392,14 +18573,14 @@ function unavailableWith(reason) {
 		reason
 	};
 }
-function unavailable(error) {
+function unavailable$1(error) {
 	return unavailableWith(reasonText(error));
 }
 async function section(build) {
 	try {
 		return await build();
 	} catch (error) {
-		return unavailable(error);
+		return unavailable$1(error);
 	}
 }
 function reasonText(error) {
@@ -18613,7 +18794,7 @@ function liftedFactsOf(resolved, forgeDown) {
 	return {
 		runLive: complete || read.runLive.length > 0 ? read.runLive : null,
 		heldByHand: complete || read.heldByHand ? read.heldByHand : null,
-		owner: complete || ownership.owner !== "unclaimed" ? ownership.owner : null
+		owner: complete || ownership.owner === "agent" ? ownership.owner : null
 	};
 }
 async function docsSection({ git, docsExtraDirs, resolved }) {
@@ -18758,6 +18939,26 @@ function objectRows(value) {
 	if (value.issueUnavailable !== void 0) rows.push(`  issue unavailable -- ${value.issueUnavailable}`);
 	return rows;
 }
+function docsRows(value) {
+	const rows = [`  base ${value.base}`];
+	for (const spec of value.specs) rows.push(`  spec ${spec.path}${spec.retired ? " (retired)" : ""}`);
+	for (const plan of value.plans) rows.push(`  plan ${plan.path}: ${String(plan.status.checked)} of ${String(plan.status.total)} checked, ${String(plan.status.outstanding)} outstanding${plan.status.declined > 0 ? `, ${String(plan.status.declined)} declined` : ""}`);
+	if (value.specs.length === 0 && value.plans.length === 0) rows.push("  no spec or plan changed on this branch");
+	return rows;
+}
+function labelRows(value) {
+	const rows = [];
+	for (const [where, groups] of [["pull request", value.pr], ["issue", value.issue]]) {
+		if (groups.length === 0) continue;
+		rows.push(`  ${where}:`);
+		for (const group of groups) for (const label of group.labels) {
+			const described = label.description === null ? "" : ` -- ${label.description}`;
+			rows.push(`    ${label.name}${described} [${group.scope}]`);
+		}
+	}
+	if (value.descriptionsUnavailable !== void 0) rows.push(`  descriptions unavailable -- ${value.descriptionsUnavailable}`);
+	return rows;
+}
 function nothingInFlight(report) {
 	const { object, docs, commits } = report;
 	if (object.state !== "absent" || docs.state !== "ok" || commits.state !== "ok") return null;
@@ -18785,29 +18986,11 @@ function renderWorkStatus(report, options) {
 	if (report.heldByHand === true) lines.push("HELD BY HAND: agent-flags/hand-authored -- a human claimed this one; do not drive it.");
 	if (options?.agentEnabled === true && report.owner === "unclaimed") {
 		const number = claimableNumber(report);
-		if (number !== null) lines.push(`UNCLAIMED: no agent label and no hand claim -- run \`bst work:start ${String(number)}\` before you work this.`);
+		if (number !== null) lines.push(`UNCLAIMED: no agent label and no hand claim -- run \`pnpm exec bst work:start ${String(number)}\` before you work this.`);
 	}
 	lines.push(...block("object", report.object, objectRows));
-	lines.push(...block("docs", report.docs, (value) => {
-		const rows = [`  base ${value.base}`];
-		for (const spec of value.specs) rows.push(`  spec ${spec.path}${spec.retired ? " (retired)" : ""}`);
-		for (const plan of value.plans) rows.push(`  plan ${plan.path}: ${String(plan.status.checked)} of ${String(plan.status.total)} checked, ${String(plan.status.outstanding)} outstanding${plan.status.declined > 0 ? `, ${String(plan.status.declined)} declined` : ""}`);
-		if (value.specs.length === 0 && value.plans.length === 0) rows.push("  no spec or plan changed on this branch");
-		return rows;
-	}));
-	lines.push(...block("labels", report.labels, (value) => {
-		const rows = [];
-		for (const [where, groups] of [["pull request", value.pr], ["issue", value.issue]]) {
-			if (groups.length === 0) continue;
-			rows.push(`  ${where}:`);
-			for (const group of groups) for (const label of group.labels) {
-				const described = label.description === null ? "" : ` -- ${label.description}`;
-				rows.push(`    ${label.name}${described} [${group.scope}]`);
-			}
-		}
-		if (value.descriptionsUnavailable !== void 0) rows.push(`  descriptions unavailable -- ${value.descriptionsUnavailable}`);
-		return rows;
-	}));
+	lines.push(...block("docs", report.docs, docsRows));
+	lines.push(...block("labels", report.labels, labelRows));
 	lines.push(...block("feedback", report.feedback, (value) => {
 		const from = value.cutoffSource === "agent-comment" ? "last agent comment" : "head commit";
 		const rows = [`  since ${value.cutoff} (the ${from}), ${String(value.agentComments)} agent comment(s) held back`];
@@ -18868,7 +19051,7 @@ const workStartCommand = defineCommand({
 	async run({ args }) {
 		const { ref, executor, git, forge } = await prepareWorkStatus(typeof args.ref === "string" ? args.ref.trim() : "", process.cwd());
 		const number = ref?.number;
-		if (number === void 0) throw new FatalError("Usage: bst work:start needs an issue or pull request number or URL");
+		if (number === void 0) throw new FatalError("Usage: pnpm exec bst work:start needs an issue or pull request number or URL");
 		const docs = resolveDocsConfig(git.topLevel);
 		const defaultBranch = resolveDefaultBranch({ cwd: git.topLevel });
 		const report = await buildWorkStatus({
@@ -18954,6 +19137,7 @@ function collectInputArgs(rawArgs) {
 	for (let i = 0; i < rawArgs.length; i += 1) {
 		const arg = rawArgs[i];
 		if (arg === void 0) continue;
+		if (arg === "--") break;
 		if (arg === INPUT_FLAG) {
 			const next = rawArgs[i + 1];
 			if (next === void 0) throw new FatalError("Missing value for --input: expected `--input key=value`");
@@ -19633,8 +19817,8 @@ function formatPrUpdate(result, rewrites, flags) {
 //#endregion
 //#region src/release/pull-request.ts
 const BST_COMMANDS = {
-	create: "bst pr:create",
-	update: "bst pr:update"
+	create: "pnpm exec bst pr:create",
+	update: "pnpm exec bst pr:update"
 };
 const BST_FLAGS = {
 	body: "--body",
@@ -20748,7 +20932,7 @@ function requireDockerCredentials(registryHost) {
 	};
 	const missing = [...username ? [] : ["DOCKER_USERNAME"], ...password ? [] : ["DOCKER_PASSWORD"]].join(" / ");
 	const { username: secretUsername, password: secretPassword } = dockerSecretNames(registryHost);
-	throw new FatalError(`Missing required environment variable(s): ${missing}. On CI, these env vars are populated from registry-specific secrets -- for registry "${registryHost}", that's secrets.${secretUsername} / secrets.${secretPassword}. Set those on the repository (try \`bst setup:secrets\`), or export DOCKER_USERNAME / DOCKER_PASSWORD locally.`);
+	throw new FatalError(`Missing required environment variable(s): ${missing}. On CI, these env vars are populated from registry-specific secrets -- for registry "${registryHost}", that's secrets.${secretUsername} / secrets.${secretPassword}. Set those on the repository (try \`pnpm exec bst setup:secrets\`), or export DOCKER_USERNAME / DOCKER_PASSWORD locally.`);
 }
 function resolveRegistryConfig(cwd) {
 	const envHost = process.env["DOCKER_REGISTRY_HOST"];
@@ -21098,7 +21282,7 @@ function composePs(executor, config) {
 //#region src/docker-check/health.ts
 const DOCKER_RUN_START_FAILURE_EXIT_CODE = 125;
 const PROBE_TIMEOUT_SECONDS = "5";
-const PROBE_IMAGE = "curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777";
+const PROBE_IMAGE = "curlimages/curl:8.23.0@sha256:a134550be58ab783810e613ae96fd253c38f7bdd16d9bf9be350700c7a29ac06";
 function getContainerHealth(containers, serviceName) {
 	return containers.find((c) => c.Service === serviceName)?.Health ?? "unknown";
 }
@@ -21561,6 +21745,11 @@ function countByMode(entries) {
 	for (const entry of entries) if (entry.permissionMode !== void 0) counts[entry.permissionMode] = (counts[entry.permissionMode] ?? 0) + 1;
 	return counts;
 }
+function parseTailCount(raw) {
+	const value = Number(raw);
+	if (!Number.isInteger(value) || value <= 0) throw new FatalError(`--tail must be a positive whole number of entries, got "${raw}"`);
+	return value;
+}
 function parseAuditLog(logPath) {
 	if (!existsSync(logPath)) return [];
 	const lines = readFileSync(logPath, "utf-8").split("\n").filter(Boolean);
@@ -21622,7 +21811,9 @@ const hooksAuditCommand = defineCommand({
 	async run({ args }) {
 		const out = createCliOutput(args.json === true);
 		const targetDir = args.dir ? path.resolve(args.dir) : findProjectRoot(process.cwd());
-		let entries = parseAuditLog(path.join(targetDir, ".claude/hooks/bst-hook.audit.local.jsonl"));
+		const logPath = path.join(targetDir, ".claude/hooks/bst-hook.audit.local.jsonl");
+		const tailCount = args.tail === void 0 ? null : parseTailCount(args.tail);
+		let entries = parseAuditLog(logPath);
 		if (entries.length === 0) {
 			out.json({ entries: [] });
 			out.text("No audit log entries found.");
@@ -21631,17 +21822,15 @@ const hooksAuditCommand = defineCommand({
 		const decisionFilter = args.decision === "passthrough" ? "none" : args.decision;
 		if (decisionFilter) entries = entries.filter((e) => e.decision === decisionFilter);
 		if (args.json === true) {
-			const tail = args.tail ? Number.parseInt(args.tail, 10) : entries.length;
 			const byMode = countByMode(entries);
 			out.json({
-				entries: entries.slice(-tail),
+				entries: tailCount === null ? entries : entries.slice(-tailCount),
 				counts: countDecisions(entries),
 				...Object.keys(byMode).length > 0 ? { byMode } : {}
 			});
 			return;
 		}
-		if (args.tail) {
-			const tailCount = Number.parseInt(args.tail, 10);
+		if (tailCount !== null) {
 			for (const entry of entries.slice(-tailCount)) {
 				const ts = new Date(entry.timestamp).toLocaleString();
 				const rule = entry.rule ? `  [${entry.rule}]` : "";
@@ -21822,7 +22011,7 @@ const CHANGE_ACTIONS = /* @__PURE__ */ new Set([
 ]);
 async function runSetupAgent(targetDir, options) {
 	const saved = loadToolingConfigStrict(targetDir);
-	if (saved === void 0) throw new FatalError(`No .tooling.json in ${targetDir}. Run bst repo:sync first to create one, so the repo's own conventions are chosen before the agent is enabled.`);
+	if (saved === void 0) throw new FatalError(`No .tooling.json in ${targetDir}. Run pnpm exec bst repo:sync first to create one, so the repo's own conventions are chosen before the agent is enabled.`);
 	const previous = previousState(saved);
 	let consent = "already-enabled";
 	if (previous !== "true") {
@@ -21854,7 +22043,7 @@ async function runSetupAgent(targetDir, options) {
 	if (report.status === "stopped" || failed.length > 0) status = "failed";
 	else if (changed.length > 0) status = "changed";
 	else status = "up-to-date";
-	if (status === "failed") log$1.error("The sync failed. Fix what it reported, then run bst setup:agent again.");
+	if (status === "failed") log$1.error("The sync failed. Fix what it reported, then run pnpm exec bst setup:agent again.");
 	else log$1.info("Commit these changes and land them on the default branch; the agent reads consent there within about a minute.");
 	return {
 		dir: targetDir,
@@ -22699,7 +22888,7 @@ function serializeBaseline(baseline) {
 //#region src/commands/coverage-check.ts
 const COVERAGE_SUMMARY_FILE$1 = "coverage/coverage-summary.json";
 const BASELINE_FILE$1 = "coverage-baseline.json";
-const MIGRATION_NOTICE = `${BASELINE_FILE$1} predates coverage.include scoping (no scope marker). Totals may have shifted because previously-untested files entered the denominator for the first time -- that is not necessarily a regression. This comparison is advisory only until the baseline is migrated: run \`pnpm test:coverage && bst coverage:check --update-baseline --reset\` once to adopt the honest, marked baseline. Normal gating resumes after that.`;
+const MIGRATION_NOTICE = `${BASELINE_FILE$1} predates coverage.include scoping (no scope marker). Totals may have shifted because previously-untested files entered the denominator for the first time -- that is not necessarily a regression. This comparison is advisory only until the baseline is migrated: run \`pnpm test:coverage && pnpm exec bst coverage:check --update-baseline --reset\` once to adopt the honest, marked baseline. Normal gating resumes after that.`;
 function applyBaselineUpdate$1(out, baselinePath, baseline, current, options) {
 	const { reset, floorPp } = options;
 	if (reset) {
@@ -22736,7 +22925,7 @@ const coverageCheckCommand = defineCommand({
 		},
 		reset: {
 			type: "boolean",
-			description: "With --update-baseline, rewrite coverage-baseline.json unconditionally, even when totals dropped. The one-shot migration to adopt an honest coverage.include-scoped baseline: pnpm test:coverage && bst coverage:check --update-baseline --reset."
+			description: "With --update-baseline, rewrite coverage-baseline.json unconditionally, even when totals dropped. The one-shot migration to adopt an honest coverage.include-scoped baseline: pnpm test:coverage && pnpm exec bst coverage:check --update-baseline --reset."
 		},
 		"fail-on-missing-baseline": {
 			type: "boolean",
@@ -22921,13 +23110,14 @@ const coverageStatusCommand = defineCommand({
 });
 //#endregion
 //#region src/codebase-health/baseline.ts
-function serializeHealthBaseline(metrics, ceilings) {
+function serializeHealthBaseline(metrics, ceilings, sizeBudgets) {
 	const ordered = {};
 	for (const key of METRIC_KEYS) {
 		const value = metrics[key];
 		if (value !== void 0) ordered[key] = value;
 	}
 	if (ceilings !== void 0 && Object.keys(ceilings).length > 0) ordered["moduleCeilings"] = ceilings;
+	if (sizeBudgets !== void 0 && Object.keys(sizeBudgets).length > 0) ordered["sizeBudgets"] = sizeBudgets;
 	return JSON.stringify(ordered, null, 2) + "\n";
 }
 //#endregion
@@ -22957,6 +23147,20 @@ function createExcludeMatcher(patterns) {
 	};
 }
 //#endregion
+//#region src/codebase-health/exempt-match.ts
+function exemptKeyMatcher(key) {
+	if (!picomatch.scan(key).isGlob) return (path) => path === key;
+	const isMatch = picomatch(key, { dot: true });
+	return (path) => isMatch(path);
+}
+function createExemptLookup(reasons) {
+	const globs = Object.entries(reasons).filter(([key]) => picomatch.scan(key).isGlob).map(([key, reason]) => ({
+		matches: exemptKeyMatcher(key),
+		reason
+	}));
+	return (path) => reasons[path] ?? globs.find((glob) => glob.matches(path))?.reason;
+}
+//#endregion
 //#region src/codebase-health/depcruise.ts
 const DependencySchema = z.object({
 	module: z.string(),
@@ -22980,10 +23184,11 @@ function partitionExempt(list, reasons) {
 		kept: list,
 		exempt: []
 	};
+	const reasonFor = createExemptLookup(reasons);
 	const kept = [];
 	const exempt = [];
 	for (const entry of list) {
-		const reason = reasons[entry.module];
+		const reason = reasonFor(entry.module);
 		if (reason === void 0) kept.push(entry);
 		else exempt.push({
 			...entry,
@@ -23563,7 +23768,40 @@ function offenderEntries(details, key) {
 //#endregion
 //#region src/codebase-health/compare.ts
 const DEFAULT_TOLERANCE = 0;
-function compareMetrics(baseline, current, tolerance = DEFAULT_TOLERANCE, currentCeilings = {}) {
+function compareSizeBudgets(baseline, measurements) {
+	const results = [];
+	for (const measurement of measurements) {
+		const ceiling = baseline.sizeBudgets?.[measurement.id];
+		if (measurement.measured === void 0) {
+			results.push({
+				id: measurement.id,
+				ceiling,
+				pass: false,
+				reason: measurement.unmeasured ?? "not measured"
+			});
+			continue;
+		}
+		if (ceiling === void 0) {
+			results.push({
+				id: measurement.id,
+				measured: measurement.measured,
+				pass: false,
+				reason: "unrecorded",
+				measurerChanged: measurement.measurerChanged
+			});
+			continue;
+		}
+		results.push({
+			id: measurement.id,
+			ceiling,
+			measured: measurement.measured,
+			pass: measurement.measured <= ceiling,
+			measurerChanged: measurement.measurerChanged
+		});
+	}
+	return results;
+}
+function compareMetrics(baseline, current, tolerance = DEFAULT_TOLERANCE, currentCeilings = {}, sizes = []) {
 	const metrics = METRIC_KEYS.map((key) => {
 		const b = baseline[key];
 		const c = current[key];
@@ -23598,23 +23836,65 @@ function compareMetrics(baseline, current, tolerance = DEFAULT_TOLERANCE, curren
 			});
 		}
 	}
-	const newOutliers = [];
+	const uncoveredOutliers = [];
 	if (baseline.moduleCeilings !== void 0) {
-		for (const key of RATCHETED_METRIC_KEYS) for (const [module, count] of Object.entries(currentCeilings[key] ?? {})) if (baseline.moduleCeilings[key]?.[module] === void 0) newOutliers.push({
+		for (const key of RATCHETED_METRIC_KEYS) for (const [module, count] of Object.entries(currentCeilings[key] ?? {})) if (baseline.moduleCeilings[key]?.[module] === void 0) uncoveredOutliers.push({
 			key,
 			module,
 			current: count
 		});
 	}
+	const sizeResults = compareSizeBudgets(baseline, sizes);
 	return {
-		pass: metrics.every((m) => m.pass) && ceilings.every((c) => c.pass),
+		pass: metrics.every((m) => m.pass) && ceilings.every((c) => c.pass) && sizeResults.every((s) => s.pass),
 		tolerance,
 		metrics,
 		ceilings,
-		newOutliers
+		uncoveredOutliers,
+		sizeResults
+	};
+}
+function needsBaseMeasurement(result) {
+	const failedKeys = new Set(result.metrics.filter((m) => m.pass === false).map((m) => m.key));
+	return RATCHETED_METRIC_KEYS.some((key) => failedKeys.has(key) && result.uncoveredOutliers.some((o) => o.key === key));
+}
+function attributeOutliers(uncovered, base) {
+	if (base.status !== "measured") return {
+		outlierBase: base.status === "unavailable" ? {
+			status: "unavailable",
+			mergeBase: base.mergeBase,
+			reason: base.reason
+		} : { status: "not-needed" },
+		newOutliers: [],
+		baseOutliers: [],
+		unattributedOutliers: [...uncovered]
+	};
+	const newOutliers = [];
+	const baseOutliers = [];
+	for (const outlier of uncovered) {
+		const baseCount = base.ceilings[outlier.key]?.[outlier.module];
+		if (baseCount === void 0) {
+			newOutliers.push(outlier);
+			continue;
+		}
+		baseOutliers.push({
+			key: outlier.key,
+			module: outlier.module,
+			base: baseCount,
+			current: outlier.current
+		});
+	}
+	return {
+		outlierBase: {
+			status: "measured",
+			mergeBase: base.mergeBase
+		},
+		newOutliers,
+		baseOutliers,
+		unattributedOutliers: []
 	};
 }
-function isFlatOrBetter(baseline, current, currentCeilings = {}) {
+function isFlatOrBetter(baseline, current, currentCeilings = {}, sizes = []) {
 	const metricsFlat = METRIC_KEYS.every((key) => {
 		const b = baseline[key];
 		const c = current[key];
@@ -23630,7 +23910,133 @@ function isFlatOrBetter(baseline, current, currentCeilings = {}) {
 			return curr <= base;
 		});
 	});
-	return metricsFlat && ceilingsFlat;
+	const sizesFlat = sizes.every((s) => {
+		const recorded = baseline.sizeBudgets?.[s.id];
+		if (recorded === void 0) return true;
+		if (s.measured === void 0) return false;
+		return s.measured <= recorded;
+	});
+	return metricsFlat && ceilingsFlat && sizesFlat;
+}
+//#endregion
+//#region src/codebase-health/base-checkout.ts
+const TEMP_PREFIX = "bst-health-base-";
+function withMergeBaseCheckout(executor, targetDir, mergeBase, use) {
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), TEMP_PREFIX));
+	const tree = path.join(tmp, "tree");
+	const index = path.join(tmp, "index");
+	try {
+		fs.mkdirSync(tree, { recursive: true });
+		const gitDir = gitOutput(executor.exec("git", ["rev-parse", "--absolute-git-dir"], { cwd: targetDir }), "git rev-parse --absolute-git-dir").trim();
+		const workRoot = gitOutput(executor.exec("git", ["rev-parse", "--show-toplevel"], { cwd: targetDir }), "git rev-parse --show-toplevel").trim();
+		const intoCheckout = (args) => executor.exec("git", [
+			`--git-dir=${gitDir}`,
+			`--work-tree=${tree}`,
+			...args
+		], {
+			cwd: tree,
+			env: { GIT_INDEX_FILE: index }
+		});
+		gitOutput(intoCheckout(["read-tree", mergeBase]), `git read-tree ${mergeBase.slice(0, 12)}`);
+		gitOutput(intoCheckout(["checkout-index", "-a"]), "git checkout-index -a");
+		mirrorNodeModules(workRoot, tree);
+		return use(tree);
+	} finally {
+		fs.rmSync(tmp, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function gitOutput(result, command) {
+	if (result.exitCode === 0) return result.stdout;
+	const detail = result.stderr.trim().split("\n")[0] ?? "";
+	throw new TransientError(`${command} failed: ${detail === "" ? `exit ${String(result.exitCode)}` : detail}`);
+}
+function mirrorNodeModules(workingRoot, checkoutRoot) {
+	mirrorTree(workingRoot, checkoutRoot, "");
+}
+function mirrorTree(workingRoot, checkoutRoot, rel) {
+	mirrorEntries(path.join(workingRoot, rel, "node_modules"), path.join(checkoutRoot, rel, "node_modules"));
+	let entries;
+	try {
+		entries = fs.readdirSync(path.join(checkoutRoot, rel), { withFileTypes: true });
+	} catch (_error) {
+		return;
+	}
+	for (const entry of entries) {
+		if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+		if (entry.name === ".git" || entry.name === "node_modules") continue;
+		mirrorTree(workingRoot, checkoutRoot, path.join(rel, entry.name));
+	}
+}
+function mirrorEntries(source, dest) {
+	let entries;
+	try {
+		entries = fs.readdirSync(source, { withFileTypes: true });
+	} catch (_error) {
+		return;
+	}
+	fs.mkdirSync(dest, { recursive: true });
+	for (const entry of entries) {
+		const src = path.join(source, entry.name);
+		const target = path.join(dest, entry.name);
+		if (entry.isSymbolicLink()) {
+			const link = safeReadlink(src);
+			if (link !== void 0 && !path.isAbsolute(link)) {
+				linkRelative(link, target);
+				continue;
+			}
+		} else if (entry.isDirectory() && entry.name.startsWith("@")) {
+			mirrorEntries(src, target);
+			continue;
+		}
+		try {
+			fs.symlinkSync(src, target, entry.isDirectory() ? "dir" : "file");
+		} catch (_error) {}
+	}
+}
+function safeReadlink(file) {
+	try {
+		return fs.readlinkSync(file);
+	} catch (_error) {
+		return;
+	}
+}
+function linkRelative(link, target) {
+	try {
+		fs.symlinkSync(link, target);
+	} catch (_error) {}
+}
+//#endregion
+//#region src/codebase-health/base-outliers.ts
+function unavailable(reason) {
+	return {
+		status: "unavailable",
+		reason: firstLine(reason)
+	};
+}
+function firstLine(text) {
+	return text.trim().split("\n")[0] ?? "";
+}
+function measureBaseOutliers(opts) {
+	const collect = opts.collect ?? collectDetails;
+	try {
+		return withMergeBaseCheckout(opts.executor, opts.targetDir, opts.mergeBase, (checkoutRoot) => {
+			const baseTarget = path.join(checkoutRoot, opts.prefix);
+			const collectConfig = buildCollectConfig(opts.config, { tsConfig: existsSync(path.join(baseTarget, "tsconfig.json")) ? "tsconfig.json" : void 0 });
+			const details = collect(createRealHealthExecutor(baseTarget), collectConfig);
+			const unresolved = details.unresolvedFirstParty;
+			if (unresolved !== void 0 && unresolved.length > 0) return unavailable(`the base cruise could not resolve ${String(unresolved.length)} first-party imports`);
+			if (opts.config.graphMetricsEnabled && details.circularDependencies === void 0) return unavailable("the base cruise produced no graph metrics");
+			return {
+				status: "measured",
+				ceilings: ceilingsFromDetails(details)
+			};
+		});
+	} catch (error) {
+		return unavailable(describeError$1(error));
+	}
 }
 //#endregion
 //#region src/codebase-health/render.ts
@@ -23718,7 +24124,7 @@ function formatExplain(details) {
 	}
 	return lines.join("\n");
 }
-function formatCompareDiff(result, details) {
+function formatCompareDiff(result, details, attribution) {
 	const lines = [];
 	for (const m of result.metrics) {
 		if (m.baseline === void 0 && m.current === void 0) continue;
@@ -23736,10 +24142,34 @@ function formatCompareDiff(result, details) {
 		if (c.pass) continue;
 		lines.push(`  ${CEILING_LABELS[c.key]}: ${c.module} ${c.baseline} -> ${c.current} (ceiling)`);
 	}
+	for (const s of result.sizeResults) if (!s.pass) {
+		let line;
+		if (s.measured === void 0) line = `  size: ${s.id} unmeasured (${s.reason ?? "not measured"})`;
+		else if (s.ceiling === void 0) line = `  size: ${s.id} -- -> ${s.measured} (unrecorded)`;
+		else line = `  size: ${s.id} ${s.ceiling} -> ${s.measured} (ceiling)`;
+		lines.push(line);
+		if (s.measurerChanged === true) lines.push(`  size: ${s.id} measured by code this branch changed`);
+	}
 	const failedKeys = new Set(result.metrics.filter((m) => m.pass === false).map((m) => m.key));
-	for (const o of result.newOutliers) {
+	let printedAttribution = false;
+	for (const o of attribution.newOutliers) {
 		if (!failedKeys.has(o.key)) continue;
 		lines.push(`  ${CEILING_LABELS[o.key]}: ${o.module} -- -> ${o.current} (new)`);
+		printedAttribution = true;
+	}
+	for (const o of attribution.baseOutliers) {
+		if (!failedKeys.has(o.key)) continue;
+		lines.push(`  ${CEILING_LABELS[o.key]}: ${o.module} ${o.base} -> ${o.current} (on base)`);
+		printedAttribution = true;
+	}
+	for (const o of attribution.unattributedOutliers) {
+		if (!failedKeys.has(o.key)) continue;
+		lines.push(`  ${CEILING_LABELS[o.key]}: ${o.module} -- -> ${o.current} (no ceiling)`);
+		printedAttribution = true;
+	}
+	if (printedAttribution) {
+		if (attribution.outlierBase.status === "measured") lines.push(`  outliers attributed against the merge base ${attribution.outlierBase.mergeBase}`);
+		else if (attribution.outlierBase.status === "unavailable") lines.push(`  outliers not attributed: the merge base ${attribution.outlierBase.mergeBase} could not be measured (${attribution.outlierBase.reason})`);
 	}
 	lines.push(result.pass ? "health: PASS" : "health: FAIL");
 	return lines.join("\n");
@@ -23760,7 +24190,7 @@ function formatGraphUnavailableForSummary(details, graphMetricsEnabled, diagnost
 }
 function formatStaleEntries(stale) {
 	return stale.map((entry) => {
-		if (entry.kind === "exemption") return `health.exempt: "${entry.path}" is not a module or directory this run measured, so it suppresses nothing. Delete the entry, or repoint it at wherever ${entry.path} moved to.`;
+		if (entry.kind === "exemption") return `health.exempt: "${entry.path}" names no module or directory this run measured, so it suppresses nothing. Delete the entry, or repoint it at wherever ${entry.path} moved to.`;
 		return `health-baseline: the recorded ${CEILING_LABELS[entry.metric] ?? entry.metric} ceiling for "${entry.path}" (ceiling ${String(entry.count ?? 0)}) names a path this run did not measure, so that ratchet is switched off. If the path moved, re-baseline it; if it is gone, --update-baseline drops it.`;
 	});
 }
@@ -23788,7 +24218,7 @@ function formatSourceDiagnosis(sources, graphMetricsEnabled) {
 			`Resolved roots: ${resolvedRoots}.`,
 			graphClause,
 			filtersClause,
-			`Run "bst health:summary --explain" for the full breakdown.`
+			`Run "pnpm exec bst health:summary --explain" for the full breakdown.`
 		].filter((part) => part.length > 0).join(" ")
 	};
 }
@@ -23797,69 +24227,90 @@ function formatUnresolvedFirstParty(entries) {
 	lines.push(`  An unresolved first-party import leaves the dependency graph, improving every health`, `  metric. Fix the import, or the resolve options that were supposed to follow it.`);
 	return lines.join("\n");
 }
-const REFUSAL_FILE_CAP = 8;
-function formatRaiseRefusal(raises, otherFiles) {
-	const lines = [`health: refused -- a health ceiling raise cannot travel with code.`, ...raises.map((r) => `  ${r.leaf}: ${r.reference} -> ${r.current}`)];
-	const shown = otherFiles.slice(0, REFUSAL_FILE_CAP);
-	if (shown.length > 0) {
-		const more = otherFiles.length - shown.length;
-		const suffix = more > 0 ? ` (+${String(more)} more)` : "";
-		lines.push(`  this branch also changes: ${shown.join(", ")}${suffix}`);
-	}
-	lines.push(`  Split the module so the graph does not grow, or open a ceiling-only pull request --`, `  only health-baseline.json and .tooling.json changed -- for a human to merge.`);
-	return lines.join("\n");
+const CARRIED_RAISES_FIRST_LINE = "raises carried by this branch:";
+function formatCarriedRaises(raises) {
+	return [CARRIED_RAISES_FIRST_LINE, ...raises.map((r) => `  ${r.leaf}: ${r.reference} -> ${r.current}`)].join("\n");
 }
 //#endregion
-//#region src/codebase-health/staleness.ts
-function wasMeasured(metric, path, details) {
-	if (metric === "crowdedDirectories") return details.directories.has(path);
-	return details.graphModules?.has(path) ?? true;
+//#region src/codebase-health/size.ts
+function byteLength(absolute) {
+	try {
+		const stats = statSync(absolute);
+		return stats.isFile() ? stats.size : void 0;
+	} catch (_error) {
+		return;
+	}
 }
-function findStaleEntries(baseline, details, exempt) {
-	const stale = [];
-	for (const key of RATCHETED_METRIC_KEYS) {
-		const recorded = baseline.moduleCeilings?.[key];
-		if (recorded === void 0) continue;
-		for (const [path, count] of Object.entries(recorded)) {
-			if (wasMeasured(key, path, details)) continue;
-			stale.push({
-				kind: "ceiling",
-				metric: key,
-				path,
-				count
-			});
-		}
+function measurerChanged(budget, changedNames) {
+	const patterns = [...budget.files, "package.json"];
+	const matches = picomatch(patterns, { dot: true });
+	return changedNames.some((name) => matches(name));
+}
+function measureSizeBudgets(targetDir, budgets, options) {
+	const measurements = [];
+	for (const [id, budget] of Object.entries(budgets).toSorted(([a], [b]) => a.localeCompare(b))) measurements.push(measureOne(targetDir, id, budget, options));
+	return measurements;
+}
+function measureOne(targetDir, id, budget, options) {
+	if ("file" in budget) {
+		const bytes = byteLength(path.join(targetDir, budget.file));
+		if (bytes === void 0) return {
+			id,
+			unmeasured: `no file at ${budget.file}`
+		};
+		return {
+			id,
+			measured: bytes
+		};
 	}
-	for (const key of EXEMPTABLE_METRIC_KEYS) for (const path of Object.keys(exempt[key] ?? {})) {
-		if (wasMeasured(key, path, details)) continue;
-		stale.push({
-			kind: "exemption",
-			metric: key,
-			path
-		});
+	if ("glob" in budget) {
+		const sizes = [];
+		for (const match of globSync(budget.glob, { cwd: targetDir })) {
+			const bytes = byteLength(path.join(targetDir, match));
+			if (bytes !== void 0) sizes.push(bytes);
+		}
+		if (sizes.length === 0) return {
+			id,
+			unmeasured: `glob ${budget.glob} matched no files`
+		};
+		let total = 0;
+		let largest = 0;
+		for (const bytes of sizes) {
+			total += bytes;
+			if (bytes > largest) largest = bytes;
+		}
+		return {
+			id,
+			measured: budget.aggregate === "largest" ? largest : total
+		};
 	}
-	return stale;
+	const result = options.executor.exec("pnpm", [
+		"run",
+		"--silent",
+		budget.script
+	], { cwd: targetDir });
+	if (result.exitCode !== 0) return {
+		id,
+		unmeasured: `script ${budget.script} exited ${String(result.exitCode)}`
+	};
+	const reported = readMeasureMarker(result.stdout);
+	if (reported === void 0) return {
+		id,
+		unmeasured: `script ${budget.script} printed no measure marker`
+	};
+	if (!measurerChanged(budget, options.changedNames)) return {
+		id,
+		measured: reported
+	};
+	return {
+		id,
+		measured: reported,
+		measurerChanged: true
+	};
 }
 //#endregion
-//#region src/commands/health-check.ts
+//#region src/codebase-health/measure.ts
 const BASELINE_FILE = "health-baseline.json";
-function assessRaises(executor, targetDir, current, out) {
-	const read = readTargetReference(executor, targetDir, out);
-	if (read.kind === "unavailable") throw new FatalError(read.reason);
-	const reference = read.reference;
-	if (reference.baseline === void 0) {
-		out.notice(`${BASELINE_FILE} has no counterpart on the default branch yet, so there is nothing to raise against.`);
-		return {
-			reference: {
-				status: "no-baseline",
-				mergeBase: reference.mergeBase
-			},
-			raises: [],
-			raiseRefused: false
-		};
-	}
-	return refuseBesideCode(executor, targetDir, reference, findRaises(reference, current), out);
-}
 function readTargetReference(executor, targetDir, out) {
 	const context = detectHealthContext(targetDir);
 	const read = readReference(executor, {
@@ -23871,32 +24322,171 @@ function readTargetReference(executor, targetDir, out) {
 	if (read.kind === "read" && read.warning !== void 0) out.notice(read.warning);
 	return read;
 }
-function refuseBesideCode(executor, targetDir, reference, raises, out) {
-	if (raises.length === 0) return {
-		reference: {
-			status: "read",
-			mergeBase: reference.mergeBase
-		},
-		raises,
-		raiseRefused: false
-	};
-	const names = branchDiffNames(executor, targetDir, reference.mergeBase);
-	const raiseRefused = !isCeilingOnly(names, reference.prefix);
-	if (raiseRefused) {
-		const ceilingFiles = ceilingFileNamesAt(reference.prefix);
-		const otherFiles = names.filter((name) => !ceilingFiles.includes(name));
-		out.text(formatRaiseRefusal(raises, otherFiles));
-		process.exitCode = 1;
+function reportCarriedRaises(raises, out) {
+	if (raises.length === 0) return;
+	out.text(formatCarriedRaises(raises));
+	out.text(formatWarnMarker(raises.length));
+}
+function assessRaises(executor, targetDir, current, out) {
+	const read = readTargetReference(executor, targetDir, out);
+	if (read.kind === "unavailable") throw new FatalError(read.reason);
+	const reference = read.reference;
+	if (reference.baseline === void 0) {
+		out.notice(`${BASELINE_FILE} has no counterpart on the default branch yet, so there is nothing to raise against.`);
+		return {
+			fields: {
+				reference: {
+					status: "no-baseline",
+					mergeBase: reference.mergeBase
+				},
+				raises: []
+			},
+			prefix: reference.prefix
+		};
 	}
 	return {
-		reference: {
-			status: "read",
-			mergeBase: reference.mergeBase
+		fields: {
+			reference: {
+				status: "read",
+				mergeBase: reference.mergeBase
+			},
+			raises: findRaises(reference, current)
 		},
-		raises,
-		raiseRefused
+		prefix: reference.prefix
+	};
+}
+function attributeRun(run) {
+	const { result, executor, targetDir, fields, prefix, config } = run;
+	if (!needsBaseMeasurement(result)) return attributeOutliers(result.uncoveredOutliers, { status: "not-needed" });
+	const mergeBase = fields.reference.mergeBase;
+	const measurement = measureBaseOutliers({
+		executor,
+		targetDir,
+		mergeBase,
+		prefix,
+		config
+	});
+	const base = measurement.status === "measured" ? {
+		status: "measured",
+		mergeBase,
+		ceilings: measurement.ceilings
+	} : {
+		status: "unavailable",
+		mergeBase,
+		reason: measurement.reason
 	};
+	return attributeOutliers(result.uncoveredOutliers, base);
+}
+function changedPathsForMeasurers(executor, targetDir, sizeBudgets, mergeBase, prefix) {
+	if (!Object.values(sizeBudgets).some((budget) => "script" in budget)) return [];
+	return branchDiffNames(executor, targetDir, mergeBase).filter((name) => name.startsWith(prefix)).map((name) => name.slice(prefix.length)).filter((name) => name !== "");
+}
+function refuseUnresolvedImports(details) {
+	const entries = details.unresolvedFirstParty;
+	if (entries !== void 0 && entries.length > 0) throw new FatalError(formatUnresolvedFirstParty(entries));
 }
+function refuseEmptyScope(details, config, failOnEmptySrc, out) {
+	const { warnings, emptyScope } = formatSourceDiagnosis(details.sources, config.graphMetricsEnabled);
+	for (const warning of warnings) out.notice(warning);
+	if (emptyScope !== void 0 && failOnEmptySrc !== false) throw new FatalError(emptyScope);
+	if (emptyScope !== void 0) out.notice(emptyScope);
+}
+function measureHealth(targetDir, config, out, opts = {}) {
+	const executor = createRealHealthExecutor(targetDir);
+	const details = collectDetails(executor, buildCollectConfig(config, { tsConfig: existsSync(path.join(targetDir, "tsconfig.json")) ? "tsconfig.json" : void 0 }));
+	const current = metricsFromDetails(details);
+	const ceilings = ceilingsFromDetails(details);
+	refuseUnresolvedImports(details);
+	refuseEmptyScope(details, config, opts.failOnEmptySrc, out);
+	const baselinePath = path.join(targetDir, BASELINE_FILE);
+	const treeBaseline = existsSync(baselinePath) ? parseHealthBaseline(readFileSync(baselinePath, "utf-8")) : void 0;
+	const raiseAssessment = assessRaises(executor, targetDir, {
+		baseline: treeBaseline,
+		health: config,
+		measured: {
+			metrics: current,
+			ceilings
+		}
+	}, out);
+	const sizes = measureSizeBudgets(targetDir, config.sizeBudgets, {
+		executor,
+		changedNames: changedPathsForMeasurers(executor, targetDir, config.sizeBudgets, raiseAssessment.fields.reference.mergeBase, raiseAssessment.prefix)
+	});
+	if (treeBaseline === void 0) return {
+		executor,
+		details,
+		current,
+		ceilings,
+		sizes,
+		baselinePath,
+		referenceFields: raiseAssessment.fields,
+		prefix: raiseAssessment.prefix,
+		existing: void 0
+	};
+	const result = compareMetrics(treeBaseline, current, config.tolerance, ceilings, sizes);
+	const attribution = attributeRun({
+		result,
+		executor,
+		targetDir,
+		fields: raiseAssessment.fields,
+		prefix: raiseAssessment.prefix,
+		config
+	});
+	return {
+		executor,
+		details,
+		current,
+		ceilings,
+		sizes,
+		baselinePath,
+		referenceFields: raiseAssessment.fields,
+		prefix: raiseAssessment.prefix,
+		existing: {
+			baseline: treeBaseline,
+			result,
+			attribution
+		}
+	};
+}
+//#endregion
+//#region src/codebase-health/staleness.ts
+function wasMeasured(metric, path, details) {
+	if (metric === "crowdedDirectories") return details.directories.has(path);
+	return details.graphModules?.has(path) ?? true;
+}
+function exemptionWasMeasured(metric, key, details) {
+	const measured = metric === "crowdedDirectories" ? details.directories : details.graphModules;
+	if (measured === void 0) return true;
+	const matches = exemptKeyMatcher(key);
+	return [...measured].some(matches);
+}
+function findStaleEntries(baseline, details, exempt) {
+	const stale = [];
+	for (const key of RATCHETED_METRIC_KEYS) {
+		const recorded = baseline.moduleCeilings?.[key];
+		if (recorded === void 0) continue;
+		for (const [path, count] of Object.entries(recorded)) {
+			if (wasMeasured(key, path, details)) continue;
+			stale.push({
+				kind: "ceiling",
+				metric: key,
+				path,
+				count
+			});
+		}
+	}
+	for (const key of EXEMPTABLE_METRIC_KEYS) for (const path of Object.keys(exempt[key] ?? {})) {
+		if (exemptionWasMeasured(key, path, details)) continue;
+		stale.push({
+			kind: "exemption",
+			metric: key,
+			path
+		});
+	}
+	return stale;
+}
+//#endregion
+//#region src/commands/health-check.ts
 function assessSwitchOff(executor, targetDir, config, out) {
 	const read = readTargetReference(executor, targetDir, out);
 	if (read.kind === "unavailable") return void 0;
@@ -23907,17 +24497,28 @@ function assessSwitchOff(executor, targetDir, config, out) {
 	const named = healthOverridesAt(targetDir);
 	const limitsOver = { ...config };
 	for (const name of RAISABLE_LIMITS) if (named?.[name] === void 0) limitsOver[name] = reference.health[name];
-	return refuseBesideCode(executor, targetDir, reference, findRaises(reference, {
-		baseline: treeBaseline,
-		health: limitsOver
-	}), out);
+	return {
+		reference: {
+			status: "read",
+			mergeBase: reference.mergeBase
+		},
+		raises: findRaises(reference, {
+			baseline: treeBaseline,
+			health: limitsOver
+		})
+	};
 }
-function refuseUnresolvedImports(details) {
-	const entries = details.unresolvedFirstParty;
-	if (entries !== void 0 && entries.length > 0) throw new FatalError(formatUnresolvedFirstParty(entries));
+function sizeValuesToRecord(baseline, sizes, reset) {
+	const recorded = { ...baseline?.sizeBudgets };
+	for (const measurement of sizes) {
+		if (measurement.measured === void 0) continue;
+		if (!reset && recorded[measurement.id] !== void 0) continue;
+		recorded[measurement.id] = measurement.measured;
+	}
+	return Object.keys(recorded).length > 0 ? recorded : void 0;
 }
 function handleMissingBaseline(state, updateBaseline, failOnMissingBaseline) {
-	const { baselinePath, config, details, current, ceilings, out } = state;
+	const { baselinePath, config, details, current, ceilings, sizes, out } = state;
 	if (updateBaseline === true) {
 		if (config.graphMetricsEnabled && details.circularDependencies === void 0) {
 			out.notice(`Skipped baseline creation: graph metrics are unavailable this run. Fix the cruise before creating ${BASELINE_FILE}.`);
@@ -23930,7 +24531,7 @@ function handleMissingBaseline(state, updateBaseline, failOnMissingBaseline) {
 			process.exitCode = 1;
 			return;
 		}
-		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings));
+		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings, sizeValuesToRecord(void 0, sizes, false)));
 		out.notice(`Created ${BASELINE_FILE} (no prior baseline).`);
 		out.json({
 			status: "baseline-created",
@@ -23954,18 +24555,23 @@ function handleMissingBaseline(state, updateBaseline, failOnMissingBaseline) {
 	throw new FatalError(message);
 }
 function applyBaselineUpdate(state, baseline, reset) {
-	const { baselinePath, config, details, current, ceilings, out } = state;
+	const { baselinePath, config, details, current, ceilings, sizes, out } = state;
 	if (config.graphMetricsEnabled && details.circularDependencies === void 0) {
 		out.notice(`Skipped baseline update: graph metrics are unavailable this run. Fix the cruise before updating.`);
 		process.exitCode = 1;
 	} else if (reset === true) {
-		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings));
+		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings, sizeValuesToRecord(baseline, sizes, true)));
 		out.notice(`Reset ${BASELINE_FILE} to the current run.`);
-	} else if (isFlatOrBetter(baseline, current, ceilings)) {
-		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings));
+	} else if (isFlatOrBetter(baseline, current, ceilings, sizes)) {
+		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings, sizeValuesToRecord(baseline, sizes, false)));
 		out.notice(`Updated ${BASELINE_FILE} (no regressions).`);
 	} else out.notice(`Skipped baseline update: a metric or ceiling regressed. Fix the regression before updating.`);
 }
+function collectRegressions(result, details) {
+	const regressions = {};
+	for (const m of result.metrics) if (!m.pass) regressions[m.key] = offenderEntries(details, m.key);
+	return regressions;
+}
 const healthCheckCommand = defineCommand({
 	meta: {
 		name: "health:check",
@@ -23998,7 +24604,7 @@ const healthCheckCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: status (compared | disabled | baseline-created | missing-baseline | graph-unavailable). disabled carries reference, raises and raiseRefused only when the default branch has health enabled -- switching it off is a raise -- and nothing otherwise. Every other status carries reference ({status (read | no-baseline), mergeBase}), raises ([{leaf, reference, current}]) and raiseRefused (whether the branch carries anything besides the two health files beside a raise; it is the refusal, and a raise with raiseRefused true still reports the comparison below). baseline-created, missing-baseline and graph-unavailable carry metrics ({crowdedDirectories, circularDependencies?, fanInOutliers?, fanOutOutliers?}) and sources. compared carries pass, tolerance, metrics (a list: [{key (crowdedDirectories | circularDependencies | fanInOutliers | fanOutOutliers), baseline?, current?, delta?, pass}]), ceilings ([{key (fanInOutliers | fanOutOutliers | crowdedDirectories), module, baseline, current, pass}]), graphMetricsEnabled, graphMetricsMissing, staleEntries ([{kind (ceiling | exemption), metric, path, count?}]), regressions ({<failing metric key>: [{module, count} | {from, to}]}) and sources. sources is {entries ([{pattern, roots, status (resolved | unmatched | unrepresentable)}]), roots, fileCount}."
+			description: "Emit one JSON document: status (compared | disabled | baseline-created | missing-baseline | graph-unavailable). disabled carries reference and raises only when the default branch has health enabled -- switching it off is a raise -- and nothing otherwise. Every other status carries reference ({status (read | no-baseline), mergeBase}) and raises ([{leaf, reference, current}]: every way this branch's two health files are higher than the default branch's, which it carries with its own code and a person merges). baseline-created, missing-baseline and graph-unavailable carry metrics ({crowdedDirectories, circularDependencies?, fanInOutliers?, fanOutOutliers?}) and sources. compared carries pass, tolerance, metrics (a list: [{key (crowdedDirectories | circularDependencies | fanInOutliers | fanOutOutliers), baseline?, current?, delta?, pass}]), ceilings ([{key (fanInOutliers | fanOutOutliers | crowdedDirectories), module, baseline, current, pass}]), sizeBudgets ([{id, ceiling?, measured?, pass, reason?}] -- every budget .tooling.json#health.sizeBudgets declares; reason is `unrecorded` for a declared budget with no recorded value, or the measurer's own explanation when it measured nothing), outlierBase ({status (measured | not-needed | unavailable), mergeBase?, reason?}), newOutliers ([{key, module, current}], outliers not on the merge base; empty unless measured), baseOutliers ([{key, module, base, current}]) and unattributedOutliers ([{key, module, current}], every outlier with no ceiling when the base was not measured), graphMetricsEnabled, graphMetricsMissing, staleEntries ([{kind (ceiling | exemption), metric, path, count?}]), regressions ({<failing metric key>: [{module, count} | {from, to}]}) and sources. sources is {entries ([{pattern, roots, status (resolved | unmatched | unrepresentable)}]), roots, fileCount}."
 		}
 	},
 	run({ args }) {
@@ -24007,69 +24613,365 @@ const healthCheckCommand = defineCommand({
 		const config = resolveHealthConfig(targetDir);
 		if (!config.enabled) {
 			out.notice("health: disabled (set .tooling.json#health.enabled to true to enable).");
+			const switchOff = assessSwitchOff(createRealHealthExecutor(targetDir), targetDir, config, out);
 			out.json({
 				status: "disabled",
-				...assessSwitchOff(createRealHealthExecutor(targetDir), targetDir, config, out)
+				...switchOff
 			});
+			reportCarriedRaises(switchOff?.raises ?? [], out);
 			return;
 		}
 		if (!config.graphMetricsEnabled) out.notice("health: graph metrics disabled (no JS/TS source to cruise) -- crowdedDirectories only.");
-		const executor = createRealHealthExecutor(targetDir);
-		const details = collectDetails(executor, buildCollectConfig(config, { tsConfig: existsSync(path.join(targetDir, "tsconfig.json")) ? "tsconfig.json" : void 0 }));
-		const current = metricsFromDetails(details);
-		const ceilings = ceilingsFromDetails(details);
-		refuseUnresolvedImports(details);
-		const { warnings, emptyScope } = formatSourceDiagnosis(details.sources, config.graphMetricsEnabled);
-		for (const warning of warnings) out.notice(warning);
-		if (emptyScope !== void 0 && args["fail-on-empty-src"] !== false) throw new FatalError(emptyScope);
-		if (emptyScope !== void 0) out.notice(emptyScope);
-		const baselinePath = path.join(targetDir, BASELINE_FILE);
-		const treeBaseline = existsSync(baselinePath) ? parseHealthBaseline(readFileSync(baselinePath, "utf-8")) : void 0;
-		const referenceFields = assessRaises(executor, targetDir, {
-			baseline: treeBaseline,
-			health: config,
-			measured: {
-				metrics: current,
-				ceilings
-			}
-		}, out);
+		const run = measureHealth(targetDir, config, out, { failOnEmptySrc: args["fail-on-empty-src"] });
 		const state = {
-			baselinePath,
+			baselinePath: run.baselinePath,
 			config,
-			details,
-			current,
-			ceilings,
+			details: run.details,
+			current: run.current,
+			ceilings: run.ceilings,
+			sizes: run.sizes,
 			out,
-			referenceFields
+			referenceFields: run.referenceFields
 		};
-		if (treeBaseline === void 0) {
+		if (run.existing === void 0) {
 			handleMissingBaseline(state, args["update-baseline"], args["fail-on-missing-baseline"]);
 			return;
 		}
-		const baseline = treeBaseline;
-		const result = compareMetrics(baseline, current, config.tolerance, ceilings);
-		out.text(formatCompareDiff(result, details));
-		const regressions = {};
-		for (const m of result.metrics) if (!m.pass) regressions[m.key] = offenderEntries(details, m.key);
-		const graphUnavailable = formatGraphUnavailable(baseline, details, config.graphMetricsEnabled, details.graphDiagnostic);
+		const { baseline, result, attribution } = run.existing;
+		out.text(formatCompareDiff(result, run.details, attribution));
+		reportCarriedRaises(run.referenceFields.raises, out);
+		const regressions = collectRegressions(result, run.details);
+		const graphUnavailable = formatGraphUnavailable(baseline, run.details, config.graphMetricsEnabled, run.details.graphDiagnostic);
 		if (graphUnavailable !== void 0) out.notice(graphUnavailable);
-		const stale = findStaleEntries(baseline, details, config.exempt);
+		const stale = findStaleEntries(baseline, run.details, config.exempt);
 		for (const warning of formatStaleEntries(stale)) out.notice(warning);
 		out.json({
 			status: "compared",
-			...referenceFields,
-			...result,
+			...run.referenceFields,
+			pass: result.pass,
+			tolerance: result.tolerance,
+			metrics: result.metrics,
+			ceilings: result.ceilings,
+			sizeBudgets: result.sizeResults,
+			outlierBase: attribution.outlierBase,
+			newOutliers: attribution.newOutliers,
+			baseOutliers: attribution.baseOutliers,
+			unattributedOutliers: attribution.unattributedOutliers,
 			graphMetricsEnabled: config.graphMetricsEnabled,
 			graphMetricsMissing: graphUnavailable !== void 0,
 			staleEntries: stale,
 			regressions,
-			sources: details.sources
+			sources: run.details.sources
 		});
 		if (args["update-baseline"] === true) applyBaselineUpdate(state, baseline, args.reset);
 		if (!result.pass || graphUnavailable !== void 0) process.exitCode = 1;
 	}
 });
 //#endregion
+//#region src/codebase-health/raise.ts
+const SIZE_RAISE_FACTOR = 1.01;
+function sizeRaiseValue(measured) {
+	return Math.floor(measured * SIZE_RAISE_FACTOR) + 1;
+}
+const JsonObjectSchema = z.record(z.string(), z.unknown());
+const EXEMPT_LEAF_KEYS = [
+	{
+		prefix: "fan-in",
+		key: "fanInOutliers"
+	},
+	{
+		prefix: "fan-out",
+		key: "fanOutOutliers"
+	},
+	{
+		prefix: "crowding",
+		key: "crowdedDirectories"
+	}
+];
+function refuseDeniableReason(leaf, reason) {
+	const fixed = fixText(`// ${reason}`, {
+		offenders: resolveOffenders(),
+		path: "health-raise.ts"
+	});
+	const refused = fixed.decisions.find((decision) => !decision.applied);
+	if (refused !== void 0) throw new FatalError(`health:raise: the reason for --exempt "${leaf}" carries ${refused.hit.offender.codepoint} (${refused.hit.offender.name}): ${refused.reason ?? "this gate denies it"}. Rewrite it in ASCII.`);
+	return fixed.text.slice(3);
+}
+function parseExemptLeaf(leaf) {
+	const separator = leaf.indexOf(":");
+	const prefix = separator < 0 ? "" : leaf.slice(0, separator).trim();
+	const path = separator < 0 ? "" : leaf.slice(separator + 1).trim();
+	if (prefix === "size") throw new FatalError(`health:raise: --exempt "${leaf}" names a size budget, which has no module to exempt. Run without --exempt: "health:raise" widens a grown size budget by measurement.`);
+	const named = EXEMPT_LEAF_KEYS.find((entry) => entry.prefix === prefix);
+	if (named === void 0 || path === "") throw new FatalError(`health:raise: --exempt "${leaf}" names no exemptable leaf. Pass one "health:check" printed: "fan-in: <path>", "fan-out: <path>", "crowding: <path>".`);
+	return {
+		key: named.key,
+		path
+	};
+}
+function copyCeilings(ceilings) {
+	const copy = {};
+	for (const key of RATCHETED_METRIC_KEYS) {
+		const byModule = ceilings?.[key];
+		if (byModule !== void 0) copy[key] = { ...byModule };
+	}
+	return copy;
+}
+function writeCeiling(ceilings, key, module, to) {
+	const byModule = ceilings[key] ?? {};
+	byModule[module] = to;
+	ceilings[key] = byModule;
+}
+function headlineFor(baseline, comparison, key, exemptCount) {
+	const measured = comparison.metrics.find((metric) => metric.key === key)?.current;
+	if (measured === void 0) return void 0;
+	const remaining = Math.max(0, measured - exemptCount);
+	return baseline[key] === void 0 ? remaining : Math.max(baseline[key] ?? 0, remaining);
+}
+function exemptionWrites(input) {
+	const writes = [];
+	const notes = [];
+	for (const request of input.exemptions) {
+		const parsed = parseExemptLeaf(request.leaf);
+		if (parsed === void 0) continue;
+		const recorded = input.config.exempt[parsed.key]?.[parsed.path];
+		if (recorded !== void 0) {
+			notes.push(`health.exempt.${parsed.key}.${parsed.path} already reads "${recorded}"; the reason was not overwritten.`);
+			continue;
+		}
+		writes.push({
+			key: parsed.key,
+			path: parsed.path,
+			reason: refuseDeniableReason(request.leaf, request.reason)
+		});
+	}
+	return {
+		writes,
+		notes
+	};
+}
+function objectAt(parent, key, where) {
+	const existing = parent[key];
+	if (existing === void 0) return {};
+	const parsed = JsonObjectSchema.safeParse(existing);
+	if (!parsed.success) throw new FatalError(`health:raise: ${where}#${key} is not an object, so an exemption cannot be written there.`);
+	return { ...parsed.data };
+}
+function applyExemptions(tooling, writes) {
+	if (writes.length === 0) return void 0;
+	const file = JsonObjectSchema.safeParse(tooling ?? {});
+	if (!file.success) throw new FatalError(`health:raise: .tooling.json is not a JSON object, so no exemption can be written.`);
+	const result = { ...file.data };
+	for (const write of writes) {
+		const health = objectAt(result, "health", ".tooling.json");
+		const exempt = objectAt(health, "exempt", ".tooling.json#health");
+		const table = objectAt(exempt, write.key, ".tooling.json#health.exempt");
+		table[write.path] = write.reason;
+		exempt[write.key] = table;
+		health["exempt"] = exempt;
+		result["health"] = health;
+	}
+	return result;
+}
+function planHealthRaise(input) {
+	const ceilings = copyCeilings(input.baseline.moduleCeilings);
+	const ceilingWrites = [];
+	const headlines = {};
+	const notes = [];
+	const exemptions = exemptionWrites(input);
+	notes.push(...exemptions.notes);
+	const isExcused = (key, module) => exemptions.writes.some((write) => write.key === key && exemptKeyMatcher(write.path)(module));
+	const exemptedCount = /* @__PURE__ */ new Map();
+	const countExcused = (key, module) => {
+		if (isExcused(key, module)) exemptedCount.set(key, (exemptedCount.get(key) ?? 0) + 1);
+	};
+	for (const outlier of input.attribution.newOutliers) countExcused(outlier.key, outlier.module);
+	for (const ceiling of input.comparison.ceilings) if (!ceiling.pass) countExcused(ceiling.key, ceiling.module);
+	const outlierBase = input.attribution.outlierBase;
+	if (outlierBase.status === "unavailable") notes.push(`no "(new)" ceiling was written: the merge base ${outlierBase.mergeBase} could not be measured (${outlierBase.reason}), so nothing could be called a first crossing.`);
+	for (const outlier of input.attribution.newOutliers) {
+		if (isExcused(outlier.key, outlier.module)) continue;
+		writeCeiling(ceilings, outlier.key, outlier.module, outlier.current);
+		const headline = headlineFor(input.baseline, input.comparison, outlier.key, exemptedCount.get(outlier.key) ?? 0);
+		if (headline !== void 0) headlines[outlier.key] = headline;
+		ceilingWrites.push({
+			key: outlier.key,
+			module: outlier.module,
+			value: outlier.current,
+			...headline === void 0 ? {} : { headline }
+		});
+	}
+	for (const ceiling of input.comparison.ceilings) {
+		if (ceiling.pass) continue;
+		if (isExcused(ceiling.key, ceiling.module)) continue;
+		writeCeiling(ceilings, ceiling.key, ceiling.module, ceiling.current);
+		ceilingWrites.push({
+			key: ceiling.key,
+			module: ceiling.module,
+			value: ceiling.current
+		});
+	}
+	const sizeBudgets = { ...input.baseline.sizeBudgets };
+	const sizeWrites = [];
+	for (const size of input.comparison.sizeResults) {
+		if (size.pass || size.measured === void 0 || size.ceiling === void 0) continue;
+		if (size.measured <= size.ceiling) continue;
+		const value = sizeRaiseValue(size.measured);
+		sizeBudgets[size.id] = value;
+		sizeWrites.push({
+			id: size.id,
+			value
+		});
+	}
+	return {
+		baseline: widenedBaseline(input.baseline, headlines, ceilings, sizeBudgets),
+		tooling: applyExemptions(input.tooling, exemptions.writes),
+		ceilings: ceilingWrites,
+		sizes: sizeWrites,
+		exemptions: exemptions.writes,
+		notes
+	};
+}
+function widenedBaseline(baseline, headlines, ceilings, sizeBudgets) {
+	const widened = { ...baseline };
+	for (const key of METRIC_KEYS) {
+		const headline = headlines[key];
+		if (headline !== void 0) widened[key] = headline;
+	}
+	widened.moduleCeilings = Object.keys(ceilings).length > 0 ? ceilings : void 0;
+	widened.sizeBudgets = Object.keys(sizeBudgets).length > 0 ? sizeBudgets : void 0;
+	return widened;
+}
+function planHasWrites(plan) {
+	return plan.ceilings.length > 0 || plan.sizes.length > 0 || plan.exemptions.length > 0;
+}
+//#endregion
+//#region src/commands/health-raise.ts
+const JsonValueSchema = z.json();
+const TOOLING_FILE = ".tooling.json";
+function collectExemptPairs(rawArgs) {
+	const leaves = collectFlagValues(rawArgs, "--exempt");
+	const reasons = collectFlagValues(rawArgs, "--reason");
+	if (leaves.length === 0 && reasons.length > 0) throw new FatalError(`health:raise: ${String(reasons.length)} --reason given with no --exempt to explain.`);
+	if (reasons.length < leaves.length) throw new FatalError(`health:raise: ${String(leaves.length)} --exempt given with only ${String(reasons.length)} --reason. Every exemption owes its own reason: it is the line a later reader judges.`);
+	return leaves.map((leaf, index) => ({
+		leaf,
+		reason: reasons[index] ?? ""
+	}));
+}
+function formatterFor(targetDir) {
+	const detected = computeDefaults(targetDir);
+	return createContentFormatter({
+		targetDir,
+		formatter: loadToolingConfig(targetDir)?.formatter ?? detected.formatter
+	});
+}
+function readToolingFile(targetDir) {
+	const full = path.join(targetDir, TOOLING_FILE);
+	if (!existsSync(full)) return void 0;
+	const text = readFileSync(full, "utf-8");
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : "unknown error";
+		throw new FatalError(`health:raise: ${TOOLING_FILE} is not JSON: ${reason}. Fix the file and re-run.`);
+	}
+	const parsed = JsonValueSchema.safeParse(json);
+	if (!parsed.success) throw new FatalError(`health:raise: ${TOOLING_FILE} is not JSON: ${parsed.error.message}`);
+	return parsed.data;
+}
+function describePlan(plan) {
+	const lines = [];
+	for (const ceiling of plan.ceilings) {
+		const headline = ceiling.headline === void 0 ? "" : `, ${ceiling.key} set to ${String(ceiling.headline)}`;
+		lines.push(`health-baseline: ${ceiling.key} ${ceiling.module} ceiling ${String(ceiling.value)}${headline}`);
+	}
+	for (const size of plan.sizes) lines.push(`health-baseline: size budget ${size.id} widened to ${String(size.value)}`);
+	for (const exemption of plan.exemptions) lines.push(`${TOOLING_FILE}: health.exempt.${exemption.key}.${exemption.path} exempted -- ${exemption.reason}`);
+	for (const note of plan.notes) lines.push(`health: ${note}`);
+	return lines;
+}
+const healthRaiseCommand = defineCommand({
+	meta: {
+		name: "health:raise",
+		description: "Widen the health budgets this branch crossed, by measurement: no number is an argument. Writes health-baseline.json (a new outlier's ceiling plus its headline count, a grown module ceiling, a grown size budget) and, for --exempt pairs, .tooling.json#health.exempt. Does nothing unless .tooling.json#health.enabled is true."
+	},
+	args: {
+		dir: {
+			type: "positional",
+			valueHint: "dir",
+			description: "Project directory (default: current directory)",
+			required: false
+		},
+		"dry-run": {
+			type: "boolean",
+			description: "Print what would be written and write nothing"
+		},
+		exempt: {
+			type: "string",
+			description: "Exempt this leaf instead of recording a ceiling (repeatable), as \"health:check\" printed it: \"fan-in: src/a.ts\""
+		},
+		reason: {
+			type: "string",
+			description: "Why this exemption is justified (repeatable; one per --exempt)"
+		},
+		json: {
+			type: "boolean",
+			description: "Emit one JSON document: status (raised | nothing-to-raise | disabled), dryRun, wrote ([path]), ceilings ([{key, module, value, headline?}]), sizeBudgets ([{id, value}]), exemptions ([{key, path, reason}]), notes ([string]), reference ({status (read | no-baseline), mergeBase})."
+		}
+	},
+	run({ args, rawArgs }) {
+		const targetDir = path.resolve(args.dir ?? ".");
+		const out = createCliOutput(args.json === true);
+		const config = resolveHealthConfig(targetDir);
+		if (!config.enabled) {
+			out.notice("health: disabled (set .tooling.json#health.enabled to true to enable).");
+			out.json({
+				status: "disabled",
+				dryRun: args["dry-run"] === true
+			});
+			return;
+		}
+		const run = measureHealth(targetDir, config, out);
+		if (run.existing === void 0) throw new FatalError("health:raise: no health-baseline.json to widen. Run \"health:check --update-baseline\" first: a raise widens a recorded number, and there is nothing recorded.");
+		const plan = planHealthRaise({
+			comparison: run.existing.result,
+			attribution: run.existing.attribution,
+			baseline: run.existing.baseline,
+			config,
+			tooling: readToolingFile(targetDir),
+			exemptions: collectExemptPairs(rawArgs)
+		});
+		const dryRun = args["dry-run"] === true;
+		const wrote = dryRun ? [] : writePlan(targetDir, plan);
+		for (const line of describePlan(plan)) out.text(line);
+		out.json({
+			status: planHasWrites(plan) ? "raised" : "nothing-to-raise",
+			dryRun,
+			wrote,
+			ceilings: plan.ceilings,
+			sizeBudgets: plan.sizes,
+			exemptions: plan.exemptions,
+			notes: plan.notes,
+			reference: run.referenceFields.reference
+		});
+	}
+});
+function writePlan(targetDir, plan) {
+	const format = formatterFor(targetDir);
+	const wrote = [];
+	if (plan.ceilings.length > 0 || plan.sizes.length > 0) {
+		writeFileSync(path.join(targetDir, "health-baseline.json"), format("health-baseline.json", serializeHealthBaseline(plan.baseline, plan.baseline.moduleCeilings, plan.baseline.sizeBudgets)));
+		wrote.push("health-baseline.json");
+	}
+	if (plan.tooling !== void 0) {
+		writeFileSync(path.join(targetDir, TOOLING_FILE), format(TOOLING_FILE, JSON.stringify(plan.tooling, null, 2)));
+		wrote.push(TOOLING_FILE);
+	}
+	return wrote;
+}
+//#endregion
 //#region src/codebase-health/module-report.ts
 function normalizeModulePath(raw) {
 	let normalized = raw.replace(/\\/g, "/");
@@ -24989,6 +25891,144 @@ const branchPruneCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/docs-check/plan-locate.ts
+const SCORED_STATUS = /^[A-Z][0-9]+$/;
+const RENAME_STATUS = /^R[0-9]*$/;
+const COPY_STATUS = /^C[0-9]*$/;
+function pathCountFor(token) {
+	if (RENAME_STATUS.test(token) || COPY_STATUS.test(token)) return 2;
+	if (SCORED_STATUS.test(token)) return 2;
+	return 1;
+}
+function singlePathStatus(token) {
+	if (token === "A" || token === "M" || token === "D" || token === "T") return token;
+	return null;
+}
+function normalizeRecord(token, paths) {
+	const [source, destination] = paths;
+	if (RENAME_STATUS.test(token)) {
+		if (source === void 0 || destination === void 0) return [];
+		return [{
+			status: "D",
+			path: source
+		}, {
+			status: "A",
+			path: destination
+		}];
+	}
+	if (COPY_STATUS.test(token)) {
+		if (destination === void 0) return [];
+		return [{
+			status: "A",
+			path: destination
+		}];
+	}
+	const status = singlePathStatus(token);
+	if (status === null || source === void 0) return [];
+	return [{
+		status,
+		path: source
+	}];
+}
+function parseNameStatus(stdout) {
+	const fields = stdout.split("\0");
+	while (fields.length > 0 && fields.at(-1) === "") fields.pop();
+	const entries = [];
+	let index = 0;
+	while (index < fields.length) {
+		const token = fields[index] ?? "";
+		const paths = fields.slice(index + 1, index + 1 + pathCountFor(token));
+		index += 1 + paths.length;
+		entries.push(...normalizeRecord(token, paths));
+	}
+	return entries;
+}
+function planDiffArgs(defaultRef) {
+	return [
+		"diff",
+		"--name-status",
+		"-z",
+		`${defaultRef}...HEAD`
+	];
+}
+const ANY_MARKER = /(?<![a-zA-Z0-9_])(?:issue|pr)-[1-9][0-9]*(?![0-9])/;
+function markerFor(ref) {
+	return new RegExp(`(?<![a-zA-Z0-9_])${ref.kind}-${String(ref.number)}(?![0-9])`);
+}
+function matchMarkerPaths(paths, refs) {
+	if (refs === null) return paths.filter((path) => path.startsWith("docs/") && ANY_MARKER.test(path));
+	const markers = refs.map(markerFor);
+	return paths.filter((path) => path.startsWith("docs/") && markers.some((m) => m.test(path)));
+}
+function isPlanPath(path) {
+	const doc = classifyConventionalDoc(path);
+	return doc !== null && doc.kind !== "spec";
+}
+function livePlanPaths(paths) {
+	return paths.filter((path) => isPlanPath(path) && !classifyConventionalDoc(path)?.retired);
+}
+function modifiedLivePlans(entries) {
+	const modified = [];
+	for (const item of entries) {
+		if (item.status !== "M") continue;
+		if (isPlanPath(item.path) && !classifyConventionalDoc(item.path)?.retired) modified.push(item.path);
+	}
+	return modified;
+}
+function addedPlans(entries) {
+	const live = [];
+	const retired = [];
+	for (const item of entries) {
+		if (item.status !== "A") continue;
+		const doc = classifyConventionalDoc(item.path);
+		if (doc === null || doc.kind === "spec") continue;
+		if (doc.retired) retired.push(item.path);
+		else live.push(item.path);
+	}
+	return {
+		live,
+		retired
+	};
+}
+function touchedLivePlans(entries) {
+	const touched = [];
+	for (const item of entries) {
+		if (item.status === "D") continue;
+		if (isPlanPath(item.path) && !classifyConventionalDoc(item.path)?.retired) touched.push(item.path);
+	}
+	return touched;
+}
+function locatePlan(input) {
+	const { entries, trackedPaths, refs, isOpen } = input;
+	const [marked] = matchMarkerPaths(refs === null ? touchedLivePlans(entries) : livePlanPaths(trackedPaths), refs);
+	if (marked !== void 0) return {
+		kind: "found",
+		path: marked
+	};
+	const added = addedPlans(entries);
+	const [firstAdded, secondAdded] = added.live;
+	if (firstAdded !== void 0 && secondAdded === void 0) return {
+		kind: "found",
+		path: firstAdded
+	};
+	if (firstAdded !== void 0 && secondAdded !== void 0) return {
+		kind: "ambiguous",
+		candidates: added.live
+	};
+	if (added.retired.length > 0) return { kind: "none" };
+	const modified = modifiedLivePlans(entries).filter(isOpen);
+	const [firstModified, secondModified] = modified;
+	if (firstModified !== void 0 && secondModified === void 0) return {
+		kind: "found",
+		path: firstModified
+	};
+	if (firstModified !== void 0 && secondModified !== void 0) return {
+		kind: "ambiguous",
+		candidates: modified
+	};
+	return { kind: "none" };
+}
+//#endregion
 //#region src/docs-check/rules.ts
 function claimsPartialDelivery(body) {
 	const status = statusOf(body);
@@ -25033,7 +26073,7 @@ function checkStatus(input, status) {
 		file,
 		rule: "R8 missing-historical-banner",
 		message: "Retired doc has no historical banner saying it is not current state.",
-		fix: "Run `bst docs:delink` on the retired directory -- it inserts the banner and de-links source paths in one pass. Do not hand-write it: the wording is fixed so it stays greppable."
+		fix: "Run `pnpm exec bst docs:delink` on the retired directory -- it inserts the banner and de-links source paths in one pass. Do not hand-write it: the wording is fixed so it stays greppable."
 	});
 	return violations;
 }
@@ -25046,7 +26086,7 @@ function checkLinks(input) {
 				file: input.file,
 				rule: "R7 retired-source-link",
 				message: `Retired doc links out of \`docs/\` (\`${link.raw}\` -> ${link.target}). A file move elsewhere breaks it.`,
-				fix: "Run `bst docs:delink` on the retired directory -- it converts the link to a plain code span. A retired doc records what was decided; it should not track where the code lives now."
+				fix: "Run `pnpm exec bst docs:delink` on the retired directory -- it converts the link to a plain code span. A retired doc records what was decided; it should not track where the code lives now."
 			});
 			continue;
 		}
@@ -25073,7 +26113,7 @@ function checkDoc(input) {
 	if (!input.isRetired && input.staleDays > 0 && input.ageDays !== void 0 && input.ageDays > input.staleDays) violations.push({
 		file: input.file,
 		rule: "R5 stale",
-		message: `Active doc, but git hasn't seen it touched in ${String(input.ageDays)} days (limit ${String(input.staleDays)}).`,
+		message: `Active doc, but its content hasn't changed in ${String(input.ageDays)} days (limit ${String(input.staleDays)}).`,
 		fix: "Check it against the tree. If the work shipped, retire it. If it's still open, edit the doc to say where it stands -- that resets the clock."
 	});
 	return violations;
@@ -25084,14 +26124,14 @@ const MS_PER_DAY$1 = 864e5;
 const SPEC_DIR_BASENAME = "specs";
 const PLAN_DIR_BASENAME = "plans";
 function ageDays(exec, file, now) {
-	const iso = exec.gitLastCommitISO(file);
+	const iso = exec.lastContentChangeISO(file);
 	if (iso === void 0) return void 0;
 	const then = new Date(iso).getTime();
 	if (Number.isNaN(then)) return void 0;
 	return Math.floor((now.getTime() - then) / MS_PER_DAY$1);
 }
 function severityOf(violation, enforced, staleEnforced) {
-	if (violation.rule.startsWith("R7")) return "advisory";
+	if (violation.rule.startsWith("R7") || violation.rule.startsWith("R9")) return "advisory";
 	if (!enforced) return "advisory";
 	if (violation.rule.startsWith("R5") && !staleEnforced) return "advisory";
 	return "fatal";
@@ -25176,7 +26216,7 @@ function collectSpecRetirementViolations(exec, pairs, config, opts) {
 				file: spec,
 				rule: "R6 spec-not-retired",
 				message: `Implementing plan(s) have landed but this spec is still active: ${implementing.map((p) => p.file).join(", ")}.`,
-				fix: "If those plans completed this spec, retire it too: `bst docs:retire <spec> --status <verb> --shipped \"<text>\"`. If further phases are still planned, leave it open -- that is why it stays active."
+				fix: "If those plans completed this spec, retire it too: `pnpm exec bst docs:retire <spec> --status <verb> --shipped \"<text>\"`. If further phases are still planned, leave it open -- that is why it stays active."
 			};
 			violations.push({
 				...raw,
@@ -25186,6 +26226,45 @@ function collectSpecRetirementViolations(exec, pairs, config, opts) {
 	}
 	return violations;
 }
+const R9_FIX = "If this branch works this plan, rename it with `git mv` to a name carrying `issue-<n>` or `pr-<n>`. If it only edits a plan another branch works, ignore this.";
+function collectPlanLocateViolations(exec) {
+	const entries = exec.branchNameStatus();
+	if (entries === void 0) return [];
+	const touched = touchedLivePlans(entries);
+	if (touched.length === 0) return [];
+	const located = locatePlan({
+		entries,
+		trackedPaths: [],
+		refs: null,
+		isOpen: (file) => {
+			const text = exec.readFile(file);
+			return text !== void 0 && countOutstandingBoxes(text) > 0;
+		}
+	});
+	const reports = [];
+	if (located.kind === "none") reports.push(...touched.map((file) => ({
+		file,
+		message: `The execute lookup finds no plan for this branch: ${file} was touched but not added, its name carries no issue-/pr- marker, and either it has no outstanding task or the branch added a retired plan beside it, which the execute lookup works instead.`
+	})));
+	else if (located.kind === "ambiguous") reports.push(...located.candidates.map((file) => ({
+		file,
+		message: `The execute lookup cannot choose a plan for this branch: ${String(located.candidates.length)} live plans carry no issue-/pr- marker.`
+	})));
+	const violations = [];
+	for (const report of reports) {
+		const raw = {
+			file: report.file,
+			rule: "R9 plan-unlocatable",
+			message: report.message,
+			fix: R9_FIX
+		};
+		violations.push({
+			...raw,
+			severity: severityOf(raw, true, true)
+		});
+	}
+	return violations;
+}
 function collectViolations(exec, config, opts) {
 	const pairs = discoverPairs(exec, config);
 	const violations = [];
@@ -25198,6 +26277,7 @@ function collectViolations(exec, config, opts) {
 		retiredCount += result.retired;
 	}
 	violations.push(...collectSpecRetirementViolations(exec, pairs, config, opts));
+	violations.push(...collectPlanLocateViolations(exec));
 	const activeDirs = matchableActiveDirs(exec, config);
 	const unmatchedEnforced = Array.isArray(config.enforced) ? config.enforced.filter((entry) => !activeDirs.includes(entry)) : [];
 	return {
@@ -25211,9 +26291,236 @@ function collectViolations(exec, config, opts) {
 	};
 }
 //#endregion
+//#region src/docs-check/content-age.ts
+const HEX_HASH = /^[0-9a-f]{40}$|^[0-9a-f]{64}$/;
+function parseIgnoreRevs(text) {
+	const hashes = /* @__PURE__ */ new Set();
+	for (const rawLine of text.split("\n")) {
+		const commentStart = rawLine.indexOf("#");
+		const value = (commentStart === -1 ? rawLine : rawLine.slice(0, commentStart)).trim().toLowerCase();
+		if (HEX_HASH.test(value)) hashes.add(value);
+	}
+	return hashes;
+}
+const FOLLOW_LOG_FORMAT = "%x1e%H%x1f%P%x1f%aI";
+function parseStatusLine(body) {
+	for (const line of body.split("\n")) {
+		if (line.trim() === "") continue;
+		const fields = line.split("	");
+		const code = (fields[0] ?? "").charAt(0);
+		const firstPath = fields[1] ?? "";
+		if (code === "" || firstPath === "") return void 0;
+		const secondPath = fields[2];
+		if (code === "R" && secondPath !== void 0) return {
+			code,
+			oldPath: firstPath,
+			newPath: secondPath
+		};
+		return {
+			code,
+			oldPath: firstPath,
+			newPath: firstPath
+		};
+	}
+}
+function parseFollowLog(stdout) {
+	const entries = [];
+	for (const record of stdout.split("")) {
+		if (record.trim() === "") continue;
+		const lineEnd = record.indexOf("\n");
+		const header = lineEnd === -1 ? record : record.slice(0, lineEnd);
+		const body = lineEnd === -1 ? "" : record.slice(lineEnd + 1);
+		const fields = header.split("");
+		const commit = (fields[0] ?? "").trim();
+		if (commit === "") continue;
+		const parentsText = (fields[1] ?? "").trim();
+		const parents = parentsText === "" ? [] : parentsText.split(/\s+/);
+		const authorDate = (fields[2] ?? "").trim();
+		entries.push({
+			commit,
+			parents,
+			authorDate,
+			status: parseStatusLine(body)
+		});
+	}
+	return entries;
+}
+const FIRST_WINDOW = 4;
+const WINDOW_GROWTH = 8;
+function entryOutcome(git, context, entry) {
+	if (entry.parents.length > 1) return {
+		kind: "date",
+		date: entry.authorDate
+	};
+	if (entry.parents.length === 0 || entry.status?.code === "A") {
+		if (context.shallow.has(entry.commit)) return { kind: "unknown" };
+		return {
+			kind: "date",
+			date: entry.authorDate
+		};
+	}
+	if (context.ignore.has(entry.commit)) return { kind: "skip" };
+	const status = entry.status;
+	if (status !== void 0 && (status.code === "M" || status.code === "R")) {
+		const diff = git.blobDiffStatus(entry.commit, status.oldPath, status.newPath);
+		if (diff === 0) return { kind: "skip" };
+		if (diff === 1) return {
+			kind: "date",
+			date: entry.authorDate
+		};
+		return { kind: "unknown" };
+	}
+	return {
+		kind: "date",
+		date: entry.authorDate
+	};
+}
+function lastContentChange(git, rel, context) {
+	let maxCount = FIRST_WINDOW;
+	let walked = 0;
+	for (;;) {
+		const stdout = git.log(rel, maxCount);
+		if (stdout === void 0) return void 0;
+		const entries = parseFollowLog(stdout);
+		for (const entry of entries.slice(walked)) {
+			const outcome = entryOutcome(git, context, entry);
+			if (outcome.kind === "date") return outcome.date;
+			if (outcome.kind === "unknown") return void 0;
+		}
+		if (entries.length < maxCount) return void 0;
+		walked = entries.length;
+		maxCount *= WINDOW_GROWTH;
+	}
+}
+//#endregion
 //#region src/docs-check/executor.ts
+function gitOut$1(rootDir, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: rootDir,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+	} catch (_error) {
+		return;
+	}
+}
+function gitStatus(rootDir, args) {
+	try {
+		execFileSync("git", args, {
+			cwd: rootDir,
+			stdio: [
+				"ignore",
+				"ignore",
+				"ignore"
+			]
+		});
+		return 0;
+	} catch (error) {
+		if (error instanceof Error && "status" in error && typeof error.status === "number") return error.status;
+		return;
+	}
+}
+function readShallowCommits(rootDir) {
+	if (gitOut$1(rootDir, ["rev-parse", "--is-shallow-repository"])?.trim() !== "true") return /* @__PURE__ */ new Set();
+	const listed = gitOut$1(rootDir, [
+		"rev-parse",
+		"--git-path",
+		"shallow"
+	])?.trim();
+	if (listed === void 0 || listed === "") return /* @__PURE__ */ new Set();
+	const file = path.isAbsolute(listed) ? listed : path.resolve(rootDir, listed);
+	let text;
+	try {
+		text = readFileSync(file, "utf-8");
+	} catch (_error) {
+		return /* @__PURE__ */ new Set();
+	}
+	const hashes = /* @__PURE__ */ new Set();
+	for (const line of text.split("\n")) {
+		const hash = line.trim();
+		if (hash !== "") hashes.add(hash);
+	}
+	return hashes;
+}
+function buildContentAgeSource(rootDir) {
+	const topLevel = gitOut$1(rootDir, ["rev-parse", "--show-toplevel"])?.trim();
+	if (topLevel === void 0 || topLevel === "") return void 0;
+	let ignoreText = "";
+	try {
+		ignoreText = readFileSync(path.join(topLevel, ".git-blame-ignore-revs"), "utf-8");
+	} catch (_error) {}
+	return {
+		git: {
+			log: (rel, maxCount) => gitOut$1(rootDir, [
+				"-c",
+				"core.quotePath=false",
+				"log",
+				"--follow",
+				`--max-count=${String(maxCount)}`,
+				`--format=${FOLLOW_LOG_FORMAT}`,
+				"--name-status",
+				"--",
+				rel
+			]),
+			blobDiffStatus: (commit, oldPath, newPath) => gitStatus(rootDir, [
+				"diff",
+				"--quiet",
+				"-w",
+				"--ignore-blank-lines",
+				`${commit}^:${oldPath}`,
+				`${commit}:${newPath}`
+			])
+		},
+		context: {
+			ignore: parseIgnoreRevs(ignoreText),
+			shallow: readShallowCommits(rootDir)
+		}
+	};
+}
+function resolveCommit$1(rootDir, ref) {
+	const commit = gitOut$1(rootDir, [
+		"rev-parse",
+		"--verify",
+		"-q",
+		`${ref}^{commit}`
+	])?.trim();
+	return commit === void 0 || commit === "" ? void 0 : commit;
+}
+function branchNameStatus(rootDir) {
+	let defaultBranch;
+	try {
+		defaultBranch = readConfiguredDefaultBranch(rootDir);
+	} catch (_error) {
+		return;
+	}
+	const ref = [`origin/${defaultBranch}`, defaultBranch].find((candidate) => resolveCommit$1(rootDir, candidate) !== void 0);
+	if (ref === void 0) return void 0;
+	const head = gitOut$1(rootDir, ["rev-parse", "HEAD"])?.trim();
+	if (gitOut$1(rootDir, [
+		"symbolic-ref",
+		"-q",
+		"--short",
+		"HEAD"
+	])?.trim() === defaultBranch) return void 0;
+	if (head === void 0 || head === "") return void 0;
+	if (head === resolveCommit$1(rootDir, ref)) return void 0;
+	if (gitOut$1(rootDir, [
+		"merge-base",
+		ref,
+		"HEAD"
+	]) === void 0) return void 0;
+	const stdout = gitOut$1(rootDir, planDiffArgs(ref));
+	return stdout === void 0 ? void 0 : parseNameStatus(stdout);
+}
 function createRealDocsExecutor(rootDir) {
 	const full = (rel) => path.join(rootDir, ...rel.split("/"));
+	let contentAgeSource;
+	let contentAgeRead = false;
 	return {
 		exists: (rel) => existsSync(full(rel)),
 		readFile(rel) {
@@ -25233,30 +26540,15 @@ function createRealDocsExecutor(rootDir) {
 				return;
 			}
 		},
-		gitLastCommitISO(rel) {
-			let stdout;
-			try {
-				stdout = execFileSync("git", [
-					"log",
-					"-1",
-					"--format=%cI",
-					"--",
-					rel
-				], {
-					cwd: rootDir,
-					encoding: "utf-8",
-					stdio: [
-						"ignore",
-						"pipe",
-						"ignore"
-					]
-				});
-			} catch (_error) {
-				return;
+		lastContentChangeISO(rel) {
+			if (!contentAgeRead) {
+				contentAgeRead = true;
+				contentAgeSource = buildContentAgeSource(rootDir);
 			}
-			const iso = stdout.trim();
-			return iso === "" ? void 0 : iso;
-		}
+			if (contentAgeSource === void 0) return void 0;
+			return lastContentChange(contentAgeSource.git, rel, contentAgeSource.context);
+		},
+		branchNameStatus: () => branchNameStatus(rootDir)
 	};
 }
 //#endregion
@@ -25304,7 +26596,8 @@ function runDocsCheck(exec, config, opts) {
 		return {
 			payload: { enabled: false },
 			text: "",
-			exitCode: 0
+			exitCode: 0,
+			warnCount: 0
 		};
 	}
 	const result = collectViolations(exec, config, {
@@ -25312,21 +26605,24 @@ function runDocsCheck(exec, config, opts) {
 		strict: opts.strict
 	});
 	debug(vc, `docs: ${String(result.pairCount)} pair(s), ${String(result.violations.length)} violation(s)`);
+	const warnCount = result.violations.filter((v) => v.rule.startsWith("R9")).length;
 	if (result.pairCount === 0) return {
 		payload: result,
 		text: "",
-		exitCode: 0
+		exitCode: 0,
+		warnCount
 	};
 	return {
 		payload: result,
 		text: formatReport(result),
-		exitCode: result.pass ? 0 : 1
+		exitCode: result.pass ? 0 : 1,
+		warnCount
 	};
 }
 const docsCheckCommand = defineCommand({
 	meta: {
 		name: "docs:check",
-		description: "Enforce the plan/spec lifecycle: a doc's directory is the source of truth for whether it is done. Checks that statuses agree with directories, retirements are dated and say where the truth went, relative links resolve, and active docs aren't stale. Findings are advisory (exit 0) unless the directory is in .tooling.json#docs.enforced (a list, or true for all) or --strict is passed; staleness stays advisory unless .tooling.json#docs.staleEnforced is set, and a link out of docs/ in a retired doc is always advisory. A retired doc should also carry the historical banner and have no links out of docs/; bst docs:delink fixes both. It CANNOT tell whether the code a plan describes actually shipped -- it verifies that a doc's metadata is self-consistent, not that it is true. Deciding a plan is done still means reading the source it names."
+		description: "Enforce the plan/spec lifecycle: a doc's directory is the source of truth for whether it is done. Checks that statuses agree with directories, retirements are dated and say where the truth went, relative links resolve, and active docs aren't stale. On a branch, it also warns (rule R9) when the branch works a plan that the execute lookup cannot find; that finding is always advisory. Findings are advisory (exit 0) unless the directory is in .tooling.json#docs.enforced (a list, or true for all) or --strict is passed; staleness stays advisory unless .tooling.json#docs.staleEnforced is set, and a link out of docs/ in a retired doc is always advisory. A retired doc should also carry the historical banner and have no links out of docs/; pnpm exec bst docs:delink fixes both. It CANNOT tell whether the code a plan describes actually shipped -- it verifies that a doc's metadata is self-consistent, not that it is true. Deciding a plan is done still means reading the source it names."
 	},
 	args: {
 		dir: {
@@ -25337,7 +26633,7 @@ const docsCheckCommand = defineCommand({
 		},
 		strict: {
 			type: "boolean",
-			description: "Treat every discovered pair as enforced, ignoring .tooling.json#docs.enforced (a retired doc's link out of docs/, rule R7, stays advisory)"
+			description: "Treat every discovered pair as enforced, ignoring .tooling.json#docs.enforced (a retired doc's link out of docs/, rule R7, and an unlocatable plan, rule R9, stay advisory)"
 		},
 		json: {
 			type: "boolean",
@@ -25351,13 +26647,14 @@ const docsCheckCommand = defineCommand({
 	run({ args }) {
 		const targetDir = path.resolve(args.dir ?? ".");
 		const out = createCliOutput(args.json === true);
-		const { payload, text, exitCode } = runDocsCheck(createRealDocsExecutor(targetDir), resolveDocsConfig(targetDir), {
+		const { payload, text, exitCode, warnCount } = runDocsCheck(createRealDocsExecutor(targetDir), resolveDocsConfig(targetDir), {
 			now: /* @__PURE__ */ new Date(),
 			strict: args.strict === true,
 			verbose: args.verbose === true || isEnvVerbose()
 		});
 		out.json(payload);
 		if (text !== "") out.text(text);
+		if (warnCount > 0) out.text(formatWarnMarker(warnCount));
 		process.exitCode = exitCode;
 	}
 });
@@ -25618,7 +26915,7 @@ function runDocsDelink(exec, dirs, opts) {
 const docsDelinkCommand = defineCommand({
 	meta: {
 		name: "docs:delink",
-		description: "Make retired docs inert: convert every markdown link that resolves outside docs/ into a plain code span, and insert the historical banner. Idempotent. It accepts only a retired/ (or legacy completed/) directory. bst docs:delink <retired-dir>..."
+		description: "Make retired docs inert: convert every markdown link that resolves outside docs/ into a plain code span, and insert the historical banner. Idempotent. It accepts only a retired/ (or legacy completed/) directory. pnpm exec bst docs:delink <retired-dir>..."
 	},
 	args: {
 		"dry-run": {
@@ -25820,7 +27117,7 @@ function runDocsRelocate(exec, sources, dest, opts) {
 const docsRelocateCommand = defineCommand({
 	meta: {
 		name: "docs:relocate",
-		description: "Move one or more .md files and rewrite the markdown links that break as a result -- both the moved files' own relative links and every inbound link elsewhere in the repo that pointed at them. Idempotent. Argument grammar mirrors POSIX mv: bst docs:relocate <src>... <dest>."
+		description: "Move one or more .md files and rewrite the markdown links that break as a result -- both the moved files' own relative links and every inbound link elsewhere in the repo that pointed at them. Idempotent. Argument grammar mirrors POSIX mv: pnpm exec bst docs:relocate <src>... <dest>."
 	},
 	args: {
 		"dry-run": {
@@ -25839,9 +27136,9 @@ const docsRelocateCommand = defineCommand({
 	run({ args }) {
 		const out = createCliOutput(args.json === true);
 		const positionals = args._;
-		if (positionals.length < 2) throw new FatalError("Usage: bst docs:relocate <src>... <dest>");
+		if (positionals.length < 2) throw new FatalError("Usage: pnpm exec bst docs:relocate <src>... <dest>");
 		const dest = positionals.at(-1);
-		if (dest === void 0) throw new FatalError("Usage: bst docs:relocate <src>... <dest>");
+		if (dest === void 0) throw new FatalError("Usage: pnpm exec bst docs:relocate <src>... <dest>");
 		const sources = positionals.slice(0, -1);
 		const { payload, text, exitCode } = runDocsRelocate(createRealRelocateExecutor(process.cwd()), sources, dest, {
 			dryRun: args["dry-run"] === true,
@@ -26030,7 +27327,7 @@ function runDocsRetire(exec, src, opts) {
 const docsRetireCommand = defineCommand({
 	meta: {
 		name: "docs:retire",
-		description: "Retire a plan/spec doc: move it to its retired/ location (computed by convention, or --dest), rewrite the markdown links that break as a result, set a dated terminal Status: line, and ensure the retire paragraph. After the lifecycle edits it also de-links links out of docs/ and adds the historical banner, as docs:delink does. bst docs:retire <plan.md> --status <verb> --shipped <text>."
+		description: "Retire a plan/spec doc: move it to its retired/ location (computed by convention, or --dest), rewrite the markdown links that break as a result, set a dated terminal Status: line, and ensure the retire paragraph. After the lifecycle edits it also de-links links out of docs/ and adds the historical banner, as docs:delink does. pnpm exec bst docs:retire <plan.md> --status <verb> --shipped <text>."
 	},
 	args: {
 		status: {
@@ -26066,7 +27363,7 @@ const docsRetireCommand = defineCommand({
 	run({ args }) {
 		const out = createCliOutput(args.json === true);
 		const [src] = args._;
-		if (src === void 0) throw new FatalError("Usage: bst docs:retire <plan.md> --status <verb> --shipped <text>");
+		if (src === void 0) throw new FatalError("Usage: pnpm exec bst docs:retire <plan.md> --status <verb> --shipped <text>");
 		const { payload, text, exitCode } = runDocsRetire(createRealRelocateExecutor(process.cwd()), src, {
 			status: args.status,
 			date: args.date,
@@ -26134,7 +27431,7 @@ async function runIssueView(executor, options) {
 	const resolve = resolverFor(executor, options.cwd, () => {
 		debug(options, `issue:view #${String(parseIssueRef(options.ref).number)}`);
 	});
-	const view = await withNumberExample("bst issue:view 273", () => viewIssue(resolve, {
+	const view = await withNumberExample("pnpm exec bst issue:view 273", () => viewIssue(resolve, {
 		ref: options.ref,
 		...options.repo === void 0 ? {} : { repo: options.repo }
 	}));
@@ -26164,7 +27461,7 @@ async function runIssueComment(executor, options) {
 	const resolve = resolverFor(executor, options.cwd, () => {
 		debug(options, `issue:comment #${String(parseIssueRef(options.ref).number)}`);
 	});
-	return withNumberExample("bst issue:comment 273", () => commentOnIssue(resolve, {
+	return withNumberExample("pnpm exec bst issue:comment 273", () => commentOnIssue(resolve, {
 		ref: options.ref,
 		body: options.body,
 		dryRun: options.dryRun,
@@ -26177,7 +27474,7 @@ async function runIssueUpdate(executor, options) {
 		debug(options, `issue:update #${String(parseIssueRef(options.ref).number)} [${changed.join(", ")}]`);
 	});
 	try {
-		return await withNumberExample("bst issue:update 273 --title '...'", () => updateIssue(resolve, {
+		return await withNumberExample("pnpm exec bst issue:update 273 --title '...'", () => updateIssue(resolve, {
 			ref: options.ref,
 			dryRun: options.dryRun,
 			...options.title === void 0 ? {} : { title: options.title },
@@ -26624,7 +27921,7 @@ async function runIssueDownload(executor, options) {
 			...options.repo === void 0 ? {} : { repo: options.repo }
 		});
 	} catch (error) {
-		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("bst issue:download 273"));
+		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("pnpm exec bst issue:download 273"));
 		if (error instanceof AttachmentExistsError) throw new FatalError(describeAttachmentExists(error, "--force"));
 		throw error;
 	}
@@ -26775,7 +28072,10 @@ async function runIssueLabel(executor, options) {
 			...options.repo === void 0 ? {} : { repo: options.repo }
 		});
 	} catch (error) {
-		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("bst issue:label 273 agent/implement"));
+		if (error instanceof IssueNumberRequiredError) {
+			const command = options.action === "add" ? "issue:label" : "issue:unlabel";
+			throw new FatalError(describeIssueNumberRequired(`pnpm exec bst ${command} 273 agent/implement`));
+		}
 		throw error;
 	}
 }
@@ -26855,7 +28155,7 @@ async function runIssueSetLabels(executor, options) {
 			...options.repo === void 0 ? {} : { repo: options.repo }
 		});
 	} catch (error) {
-		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("bst issue:set-labels 273 agent/plan"));
+		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("pnpm exec bst issue:set-labels 273 agent/plan"));
 		if (error instanceof NoLabelsGivenError) throw new FatalError(describeNoLabelsGiven(error, "--clear"));
 		throw error;
 	}
@@ -27030,7 +28330,7 @@ async function runIssueState(executor, options) {
 			...options.repo === void 0 ? {} : { repo: options.repo }
 		});
 	} catch (error) {
-		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired(`bst issue:${options.action} 273`));
+		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired(`pnpm exec bst issue:${options.action} 273`));
 		if (error instanceof EmptyCommentError) throw new FatalError(describeEmptyComment({
 			text: "--comment",
 			file: "--comment-file"
@@ -27176,7 +28476,7 @@ function resolveBody(bodyFile) {
 const findingsAddCommand = defineCommand({
 	meta: {
 		name: "findings:add",
-		description: "Author one finding into .agent/findings/, correct-by-construction. Usage: bst findings:add --class <nit|pre-existing> --source <pr|issue>#<n> --title <t>. The first finding creates .agent/findings/, which turns on the agent's backlog run for the repo; set .tooling.json#agent.backlog to false to stop it."
+		description: "Author one finding into .agent/findings/, correct-by-construction. Usage: pnpm exec bst findings:add --class <nit|pre-existing> --source <pr|issue>#<n> --title <t>. The first finding creates .agent/findings/, which turns on the agent's backlog run for the repo; set .tooling.json#agent.backlog to false to stop it."
 	},
 	args: {
 		class: {
@@ -27360,7 +28660,7 @@ function runFindingsResolve(rootDir, names, opts) {
 const findingsResolveCommand = defineCommand({
 	meta: {
 		name: "findings:resolve",
-		description: "Delete finding file(s) from .agent/findings/, or --defer to append a note instead. bst findings:resolve <name>... [--defer <note>]."
+		description: "Delete finding file(s) from .agent/findings/, or --defer to append a note instead. pnpm exec bst findings:resolve <name>... [--defer <note>]."
 	},
 	args: {
 		defer: {
@@ -27891,7 +29191,7 @@ async function runCli(config) {
 //#region src/cli-main.ts
 setLogLevel(resolveLogLevel({}));
 setForgejoLogger(log$1);
-const displayVersion = "0.93.1";
+const displayVersion = "0.95.0";
 const bstSubCommands = {
 	"repo:sync": syncCommand,
 	"checks:run": runChecksCommand,
@@ -27921,6 +29221,7 @@ const bstSubCommands = {
 	"coverage:record": coverageRecordCommand,
 	"coverage:status": coverageStatusCommand,
 	"health:check": healthCheckCommand,
+	"health:raise": healthRaiseCommand,
 	"health:summary": healthSummaryCommand,
 	"health:record": healthRecordCommand,
 	"health:status": healthStatusCommand,