@bensandee/tooling 0.94.0 → 0.96.0

package/dist/bin.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { accessSync, appendFileSync, closeSync, constants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import fs, { accessSync, appendFileSync, closeSync, constants, copyFileSync, existsSync, fstatSync, globSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import path, * as path$1 from "node:path";
 import { parseArgs, parseEnv } from "node:util";
 import { FatalError, TransientError, UnexpectedError, describeError, describeError as describeError$1, redact, redact as redact$1 } from "@bensandee/common";
@@ -15,7 +15,7 @@ import { isMap, isScalar, isSeq, parse as parse$1, parseAllDocuments, parseDocum
 import { StringDecoder } from "node:string_decoder";
 import { parse as parse$2 } from "smol-toml";
 import picomatch from "picomatch";
-import { tmpdir } from "node:os";
+import os, { tmpdir } from "node:os";
 import net from "node:net";
 import { createHmac } from "node:crypto";
 import { fileURLToPath } from "node:url";
@@ -175,7 +175,7 @@ function loadEnvFileForBin(rawArgs, bin, io = processIo) {
 //#region src/env-file-preload.ts
 const envFileLoad = loadEnvFileForBin(process.argv.slice(2), {
 	name: "bst",
-	version: "0.94.0"
+	version: "0.96.0"
 });
 //#endregion
 //#region ../cli-kit/src/logger.ts
@@ -690,7 +690,10 @@ const HealthRecordSchema = HealthMetricsSchema.extend(HealthObservationsSchema.s
 });
 const RATCHETED_METRIC_KEY_SET = new Set(RATCHETED_METRIC_KEYS);
 const ModuleCeilingsSchema = z.preprocess((value) => typeof value === "object" && value !== null ? Object.fromEntries(Object.entries(value).filter(([key]) => RATCHETED_METRIC_KEY_SET.has(key))) : value, z.partialRecord(z.enum(RATCHETED_METRIC_KEYS), z.record(z.string(), z.number().int().nonnegative())));
-const HealthBaselineSchema = HealthMetricsSchema.extend({ moduleCeilings: ModuleCeilingsSchema.optional() });
+const HealthBaselineSchema = HealthMetricsSchema.extend({
+	moduleCeilings: ModuleCeilingsSchema.optional(),
+	sizeBudgets: z.record(z.string(), z.number().int().nonnegative()).optional()
+});
 function parseHealthBaseline(raw) {
 	let json;
 	try {
@@ -759,6 +762,18 @@ function formatIssue$1(issue) {
 	}
 	return `  ${loc}: ${issue.message}`;
 }
+const SIZE_BUDGET_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+const SizeBudgetSchema = z.union([
+	z.object({ file: z.string().min(1).meta({ description: "Repo-relative path of the one file whose byte size is measured." }) }).meta({ description: "A size budget measuring the bytes of a single file." }),
+	z.object({
+		glob: z.string().min(1).meta({ description: "Glob matched against repo-relative paths under the target." }),
+		aggregate: z.enum(["total", "largest"]).meta({ description: "How the matched files become one number: the sum of their bytes, or the biggest single file." })
+	}).meta({ description: "A size budget measuring the bytes of every file a glob matches." }),
+	z.object({
+		script: z.string().min(1).meta({ description: "Package script run as `pnpm run --silent <script>`; it reports one number through the reserved measure marker." }),
+		files: z.array(z.string().min(1)).meta({ description: "Globs naming the code that computes the number: a match in the branch's diff marks the measurement as changed by this branch." })
+	}).meta({ description: "A size budget measured by running a package script that prints one number." })
+]);
 const HealthConfigSchema = z.strictObject({
 	enabled: z.boolean().optional().meta({ description: "Opts into the gate (default false; absent and false alike mean off). `health:check` and `health:summary` print a disabled notice and exit 0 rather than failing while off. Read at generation time as well as at check time, so enabling the gate takes a `repo:sync` as well as a config edit. Dominates `history`." }),
 	src: z.array(z.string()).optional().meta({ description: "Repo-relative directory roots the measurement is scoped to (default `[\"packages/*/src\"]` when a `packages/` directory exists at the repo root, else `[\"src\"]`). Scopes both the file-tree walk and the dependency-cruiser globs, but not the same way: for the file-tree walk, an entry is expanded against existing directories (one `*` segment only, nothing else). An entry the expander cannot represent at all (`src/**/*.ts`, any other `**`) and one that is well-formed but names no existing directory (a typo, a directory renamed after the config was written) are both reported by name, classified separately, and a run whose file-tree scope resolves to zero source files fails `health:check` before its baseline is read, created, updated, or reset -- `--no-fail-on-empty-src` downgrades that to a notice. For the dependency-cruiser globs the entry is spliced in verbatim, so a `**` entry like `packages/**/src` still cruises and leaves the graph metrics live even though `crowdedDirectories` and the linesOfCode observation see an empty tree. Use `packages/*/src`. The file-tree walk also drops test files, `.d.ts` declarations and `exclude` matches; the dependency-cruiser half drops only `exclude` matches, so a colocated test file or a `.d.ts` under a `src` root still carries graph edges." }),
@@ -768,11 +783,12 @@ const HealthConfigSchema = z.strictObject({
 	fanInLimit: z.number().int().nonnegative().optional().meta({ description: "A module is a fan-in outlier above this many importers, and only when it also exceeds `moduleSizeLimit` source lines (defaults 10 and 200) -- popularity alone is not coupling. Only value edges are counted: a type-only import is erased before the graph is built and never moves this count, and a third-party import resolves outside the graph entirely. A cross-package import counts unless `crossPackage` is off (default on) -- see that setting. Never duplicate a type or fork a helper to stay under the limit -- prefer a justified `exempt` entry, which names the hub, over raising the limit, which hides it." }),
 	fanOutLimit: z.number().int().nonnegative().optional().meta({ description: "A module is a fan-out outlier above this many first-party dependencies (default 10). Counted on the same value-edge basis as fanInLimit, `crossPackage` included, with the same consequence: an import you were about to inline or copy to protect this budget most likely costs nothing." }),
 	moduleSizeLimit: z.number().int().nonnegative().optional().meta({ description: "Raw source lines a module must exceed before its importer count can make it a fan-in outlier (default 200) -- comments and blanks included, since the question is how big the module is to read, not how much code it holds. A module with many importers and little surface is a leaf, not a junction: it has one job and no reason to change for any of its callers, so counting its importers reports popularity rather than coupling. Applies to fan-in only -- a small module with many dependencies is a barrel, which is a finding." }),
-	crossPackage: z.boolean().optional().meta({ description: "Count dependency edges that cross a workspace package boundary (default true). On by default because the alternative measures the wrong thing: with it off, moving a module into its own package removes its importers from every metric, so extracting a package hides a hub rather than fixing it. A monorepo adopting the default sees fan-in and fan-out rise once, and adopts that rise as a ceiling-only pull request -- a branch whose diff changes nothing but health-baseline.json and .tooling.json, which a person merges; a single-package repo has no workspace siblings to resolve, so no new edge enters its graph. Set it to false only where the package boundary is a curated API surface an edge across genuinely costs less, or to hold a baseline on the old measurement basis." }),
+	crossPackage: z.boolean().optional().meta({ description: "Count dependency edges that cross a workspace package boundary (default true). On by default because the alternative measures the wrong thing: with it off, moving a module into its own package removes its importers from every metric, so extracting a package hides a hub rather than fixing it. A monorepo adopting the default sees fan-in and fan-out rise once, and adopts that rise with `bst health:raise` in the pull request that adopts the setting, which a person merges; a single-package repo has no workspace siblings to resolve, so no new edge enters its graph. Set it to false only where the package boundary is a curated API surface an edge across genuinely costs less, or to hold a baseline on the old measurement basis." }),
 	history: z.enum(["orphan-branch", "none"]).optional().meta({ description: "How history is persisted. \"orphan-branch\" (default) has `health:record` append one JSON line per commit to `historyBranch` and has `repo:sync` emit the CI record and status steps; \"none\" turns both off. Does not disable the gate, since the baseline is a committed file. Ignored when `enabled` is false." }),
 	historyBranch: z.string().optional().meta({ description: "The orphan branch `health:record` appends to and `health:status` reads (default \"bst/health-metrics\"). Never merges into the default branch and holds no source; separate from `coverage.historyBranch` and must not share a branch with it. `branch:prune`'s built-in never-touch list matches the default name exactly, so a custom name should be named in `branchPrune.exclude` as well." }),
 	tolerance: z.number().int().nonnegative().optional().meta({ description: "Slack in offender counts before an increase is a regression: a metric fails when the current count exceeds baseline + tolerance (default 0, so any increase fails). The same allowance applies to every per-module ceiling in health-baseline.json's moduleCeilings, not only the headline metrics. A count, not a percentage -- coverage's percentage-point slack is `coverage.tolerancePp`. Raising it un-tracks every module beneath the new line at once, which is why a justified `exempt` entry is the better answer to one stubborn hub." }),
-	exempt: z.partialRecord(z.enum(EXEMPTABLE_METRIC_KEYS), z.record(z.string(), z.string().min(1).refine((reason) => reason.trim() !== "", { message: "must not be blank" }))).optional().meta({ description: "Per-metric, per-module exemption, keyed first by metric name (fanInOutliers, fanOutOutliers or crowdedDirectories) then by the repo-relative path exactly as `health:summary --explain` prints it: a module path for the two fan metrics, a directory path for crowdedDirectories. Each path maps to a required, non-empty justification string. An exempt module or directory is listed in the summary with its count and reason, carries no ceiling in health-baseline.json, and is counted in no metric -- it is out of the gate, not suppressed inside it. Adding one is a raise: it travels alone in a ceiling-only pull request, never beside code. An exempt module stays fully in the graph -- its edges still count toward every other module's fan-in/fan-out." })
+	sizeBudgets: z.record(z.string().regex(SIZE_BUDGET_ID_PATTERN), SizeBudgetSchema).optional().meta({ description: "Artifact size budgets: id -> what to measure. Each id records one ceiling in health-baseline.json's sizeBudgets, and `health:check` fails when the measured number exceeds it. Absent means no size metric at all. A budget with no recorded value fails as unrecorded until `--update-baseline` records it; a file or glob that measures nothing fails rather than reading as zero. Measured at the working tree only, never at the merge base, so a crossing always names this branch. Raising a recorded value is a raise: write it with `bst health:raise`, in the pull request whose change crossed the budget." }),
+	exempt: z.partialRecord(z.enum(EXEMPTABLE_METRIC_KEYS), z.record(z.string(), z.string().min(1).refine((reason) => reason.trim() !== "", { message: "must not be blank" }))).optional().meta({ description: "Per-metric, per-module exemption, keyed first by metric name (fanInOutliers, fanOutOutliers or crowdedDirectories) then by the repo-relative path exactly as `health:summary --explain` prints it: a module path for the two fan metrics, a directory path for crowdedDirectories. A key may instead be a picomatch glob (e.g. `packages/contract/src/core/**`), matched against the path itself and never its ancestors; an exact key wins over a glob that also matches, and otherwise the first matching glob's reason applies. A glob also covers modules added later, which still show in the summary with their counts. Each path maps to a required, non-empty justification string. An exempt module or directory is listed in the summary with its count and reason, carries no ceiling in health-baseline.json, and is counted in no metric -- it is out of the gate, not suppressed inside it. Adding one is a raise: write it with `bst health:raise --exempt`, in the pull request whose code made the module a hub. An exempt module stays fully in the graph -- its edges still count toward every other module's fan-in/fan-out." })
 });
 const CharsConfigSchema = z.strictObject({
 	enabled: z.boolean().optional().meta({ description: "Run the chars:check gate (default true). Set false to opt out -- the only off-switch: the gate scans tracked text files for LLM-tell punctuation and invisible or deceptive characters, and passes letters in any language." }),
@@ -877,6 +893,9 @@ const JS_EXTENSIONS$1 = /* @__PURE__ */ new Set([
 	".mjs",
 	".cjs"
 ]);
+function sourceGlob(stack, dir = "src") {
+	return `${dir}/**/*.{${[...stack === "typescript" ? TS_EXTENSIONS$1 : JS_EXTENSIONS$1].map((ext) => ext.slice(1)).join(",")}}`;
+}
 function isRootConfigFile(relPath) {
 	if (relPath.includes(path.sep)) return false;
 	return /\.config\.[cm]?[jt]sx?$/.test(relPath) || relPath.startsWith(".");
@@ -1587,12 +1606,15 @@ function createDryRunContext(config, dockerDiscovery) {
 	};
 }
 //#endregion
+//#region src/repo-full-name.ts
+const REPO_FULL_NAME = /^(?!\.\.?\/)[\w.-]+\/(?!\.\.?$)[\w.-]+$/u;
+//#endregion
 //#region src/docs-check/config.ts
 const DEFAULT_STALE_DAYS = 30;
 const DocsConfigSchema = z.strictObject({
 	enforced: z.union([z.boolean(), z.array(z.string())]).optional().meta({ description: "Which discovered pairs fail the build. true = all; an array names active dirs (e.g. [\"docs/plans\"]); default false = every violation is advisory." }),
 	dirs: z.array(z.string()).optional().meta({ description: "Extra active doc dirs beyond convention (e.g. [\"docs/rfcs\"]). Each retires into its own retired/ subdir." }),
-	staleDays: z.number().int().nonnegative().optional().meta({ description: "Days before an untouched active doc is flagged (default 30; 0 disables the rule)." }),
+	staleDays: z.number().int().nonnegative().optional().meta({ description: "Days before an unchanged active doc is flagged (default 30; 0 disables the rule)." }),
 	staleEnforced: z.boolean().optional().meta({ description: "Make the staleness rule fatal inside an enforced pair (default false: staleness is always advisory)." })
 });
 const DEFAULT_DOCS_CONFIG = {
@@ -1724,8 +1746,9 @@ const LintSweepConfigSchema = z.strictObject({
 });
 const AgentEgressConfigSchema = z.strictObject({ browseHosts: z.array(z.string().min(1)).optional().meta({ description: "Host patterns this repo's agent containers may fetch from, on top of the hosts every run needs: an exact host (`fastdl.mongodb.org`) or a wildcard over its leftmost label (`*.example.com`). No ports. These join the browse lane, which serves GET and HEAD only." }) });
 const AgentConfigSchema = z.strictObject({
-	enabled: z.boolean().optional().meta({ description: "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. `bst setup:agent` sets it to true and runs the sync. Provisioning the agent's labels is not consent, and is never gated by this key." }),
-	autonomy: z.boolean().optional().meta({ description: "Opt into interior autonomy (default false). When a phase's latest rationale reports readiness \"ready\" with an empty openQuestions[] and the review phase is clean, the agent applies the existing plan -> implement -> review -> park-at-mergeable advance itself instead of parking for a human. Never applies to the design/spec gate or the final merge from the mergeable terminal -- those always wait on a human. Also arms the trunk-red detector: when this repo's default branch combined status settles red, the agent files a tracking issue naming the failing checks and labels it agent/spec, starting the fix through the ordinary spec/plan/implement/review pipeline. It also closes that issue, with a comment, if the default branch recovers on its own before a human acts on it. Also arms the world-changed retrigger sweep: a pull request labelled agent-flags/autopilot that is parked at a -stuck or -failed terminal is re-queued when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base)." }),
+	enabled: z.boolean().optional().meta({ description: "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. `pnpm exec bst setup:agent` sets it to true and runs the sync. Provisioning the agent's labels is not consent, and is never gated by this key." }),
+	autonomy: z.boolean().optional().meta({ description: "Retired and ignored -- it armed neither the advance rung nor the sweeps it once did. Advance is now the unit's own `agent-flags/advance` or `agent-flags/autopilot` label, and the trunk-red detector and world-changed retrigger sweep read `agent.trunkRed`. The key is still accepted so an existing config keeps syncing; the agent warns once per launch for a repo that still sets it." }),
+	trunkRed: z.boolean().optional().meta({ description: "Whether this repo's trunk-red detector and world-changed retrigger sweep run (default: on). The detector files a tracking issue when the default branch's combined status settles red and labels it agent/spec, and closes that issue with a comment if the branch recovers on its own before a human acts on it. The retrigger sweep re-queues a pull request labelled agent-flags/autopilot parked at a -stuck or -failed terminal when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base). A missing key means on; false disarms both." }),
 	preRunRebase: z.boolean().optional().meta({ description: "Merge the current default branch into the work branch before the container starts (default true) -- for an implement (execute) run, and for a spec or plan rerun on an existing branch. A clean merge or an already-up-to-date branch runs the container as is; a conflicting merge is aborted, recorded on the run's status comment, and the run proceeds on the un-synced branch -- a conflict, timeout or failed merge never fails the run, for any phase. Only the execute phase keeps the two-strike rule: two consecutive conflicting attempts hand the unit to agent/repair before any container runs, while a docs run just tries again on its next slice. Set false to skip the attempt entirely for this repo, in every phase: no fetch, no merge, no abort, and the branch is worked exactly as cloned." }),
 	backlog: z.boolean().optional().meta({ description: "Whether the agent may self-trigger backlog runs consuming this repo's .agent/findings/ ledger (default: on wherever the ledger exists, which only happens in a repo whose own review loop wrote it). A backlog run opens a pull request that fixes or refutes the pending findings; false disarms it, leaving the ledger to accumulate for a human. A run starts only once at least three findings are pending or one is older than seven days." }),
 	lintSweep: LintSweepConfigSchema.optional().meta({ description: "The lint-warning sweep: a periodic agent job that measures this repo's oxlint warnings on its default branch in a container and, past minWarnings, opens a pull request carrying a generated plan for an agent/implement run to work off." }),
@@ -1737,13 +1760,15 @@ const AgentConfigSchema = z.strictObject({
 	])).optional().meta({ description: "Map this repo's own issue-label names onto the agent's four priority levels, e.g. {\"P1\": \"critical\", \"P4\": \"low\"}. The map UNIONS with the built-in priority/<level> names rather than replacing them, and the agent does not create aliased labels -- the repo owns names the agent did not choose. Priority affects claim order only: it never changes a run's model, effort, or any budget." }),
 	triageAnalysis: z.boolean().optional().meta({ description: "Whether the agent may route its own agent-note/human-triage-needed issues through the agent/analyze stage (default: off). Unlike agent.backlog, which defaults on, this defaults off: a backlog run batches every pending finding into one container, while triage routing spends one container per issue -- arming it is the reversible direction, not disarming it." }),
 	egress: AgentEgressConfigSchema.optional().meta({ description: "Extra egress hosts this repo's agent containers may reach. `browseHosts` joins the agent's browse lane (GET and HEAD only) on top of the hosts every run needs; the passthrough lane stays agent-owned. Each entry is a host pattern -- an exact host or a *.host wildcard, never a port. Read from the repo's DEFAULT BRANCH, never off a pull request's own tree, so a run can never widen its own egress: the declaration takes effect on the first container started after a human merges it. An entry whose pattern the agent cannot parse refuses the run rather than being dropped. Changing this block holds the pull request from automerge." }),
-	findingHolds: FindingHoldsConfigSchema.optional().meta({ description: "Which of a pull request's linked open findings withhold its unattended merge. `rules` is ordered and the first `when` that matches decides; no match falls through to `default`; an absent block is { rules: [], default: true }, so every open linked finding holds by default. Read off the repo's DEFAULT BRANCH, never off the pull request's own tree -- a pull request cannot edit the rule deciding whether it is held. In a `mentions` entry a /.../flags pattern is a regular expression, a literal:<text> pattern is the substring <text> (how to name a path such as /src/utils), and anything else is a case-insensitive substring." })
+	findingHolds: FindingHoldsConfigSchema.optional().meta({ description: "Which of a pull request's linked open findings withhold its unattended merge. `rules` is ordered and the first `when` that matches decides; no match falls through to `default`; an absent block is { rules: [], default: true }, so every open linked finding holds by default. Read off the repo's DEFAULT BRANCH, never off the pull request's own tree -- a pull request cannot edit the rule deciding whether it is held. In a `mentions` entry a /.../flags pattern is a regular expression, a literal:<text> pattern is the substring <text> (how to name a path such as /src/utils), and anything else is a case-insensitive substring." }),
+	chatIssueRepos: z.array(z.string().regex(REPO_FULL_NAME)).optional().meta({ description: "Repositories with a DIFFERENT owner that a control-panel chat from this repository may file an issue in, each one a full `owner/name`, never a wildcard. A repository with the same owner needs no entry, and an entry grants nothing on its own: the target must have enabled the agent too. Read from the repo's DEFAULT BRANCH at the moment a card is applied, so a pull request cannot widen the reach of its own chat. Like every other `agent.*` key, this has no effect unless `agent.enabled` is true." })
 });
 const TolerantAgentConfigSchema = z.object({
 	...AgentConfigSchema.shape,
 	lintSweep: tolerantBlock(LintSweepConfigSchema).optional(),
 	findingHolds: z.unknown().optional(),
-	egress: z.unknown().optional()
+	egress: z.unknown().optional(),
+	chatIssueRepos: z.unknown().optional()
 });
 const BranchPruneConfigSchema = z.strictObject({
 	mergedDays: z.number().int().nonnegative().optional().meta({ description: "Days after a work branch's PR merged before bst branch:prune deletes it (default 7). Zero is valid on purpose (an explicit 'delete everything merged already'), matching the --merged-days CLI flag's contract." }),
@@ -1805,7 +1830,7 @@ const ToolingConfigSchema = z.strictObject({
 	]).optional().meta({ description: "What compiles the project. Detected from the package.json build script, then config-file presence. Setting this key pins its value, even one that equals detection, and repo:sync keeps it until the key is deleted." }),
 	checks: ChecksConfigSchema.optional().meta({ description: "Check-pipeline overrides: extra steps to add, and steps to skip (unioned with CI defaults)." }),
 	lint: LintConfigSchema.optional().meta({ description: "bst lint:types (the type-aware oxlint gate) overrides. See lint.strictTypeAware." }),
-	agent: AgentConfigSchema.optional().meta({ description: "agent:start behaviour overrides. Opt-in: see agent.autonomy for the interior-autonomy gate." }),
+	agent: AgentConfigSchema.optional().meta({ description: "agent:start behaviour overrides. Opt-in: agent.enabled is the consent gate -- every other key in the block does nothing without it." }),
 	branchPrune: BranchPruneConfigSchema.optional().meta({ description: "bst branch:prune overrides: mergedDays/backupDays windows, and extra never-touch exclusions layered on top of the hard-coded list." }),
 	issues: IssuesConfigSchema.optional().meta({ description: "Repo-level issue policy -- currently just the default reviewer(s) `bst issue:create` assigns. The natural home for any future issue-policy key." })
 });
@@ -1932,7 +1957,7 @@ function saveToolingConfig(ctx, config) {
 		if (key === "chars" || key === "ascii") {
 			const pruned = pruneCharsDefaults(value);
 			if (pruned === void 0) continue;
-			result[key] = pruned;
+			result["chars"] = pruned;
 			continue;
 		}
 		result[key] = value;
@@ -2589,6 +2614,13 @@ function resolveComposeFileSet(readFile, projectRoot, composeFiles) {
 //#endregion
 //#region ../forgejo/src/fetcher.ts
 const LONG_FETCH_TIMEOUT_MS = 6e5;
+function morePagesFollow(res, pageLength, received, pageSize) {
+	if (pageLength === 0) return false;
+	const raw = res.headers.get("x-total-count")?.trim() ?? "";
+	const total = raw === "" ? NaN : Number(raw);
+	if (!Number.isSafeInteger(total) || total < 0) return pageLength >= pageSize;
+	return received < total;
+}
 //#endregion
 //#region ../forgejo/src/fetch-retry.ts
 const DEFAULT_RETRY_POLICY = {
@@ -4777,7 +4809,7 @@ async function generateDeployCi(ctx) {
 		action: "skipped",
 		description: "Publish workflow not applicable"
 	};
-	return retireManagedWorkflow(ctx, ctx.config.ci === "github" ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml", "run `bst docker:publish` to publish by hand") ?? {
+	return retireManagedWorkflow(ctx, ctx.config.ci === "github" ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml", "run `pnpm exec bst docker:publish` to publish by hand") ?? {
 		filePath,
 		action: "skipped",
 		description: "No publish workflow to retire"
@@ -4822,7 +4854,8 @@ function resolveFromOverrides(overrides, isMonorepo, stack) {
 		historyBranch: o.historyBranch ?? DEFAULT_HEALTH_HISTORY_BRANCH,
 		tolerance: o.tolerance ?? 0,
 		graphMetricsEnabled: stack !== "none",
-		exempt: o.exempt ?? {}
+		exempt: o.exempt ?? {},
+		sizeBudgets: o.sizeBudgets ?? {}
 	};
 }
 function resolveHealthConfigFromContext(reader, opts) {
@@ -5499,9 +5532,9 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.15.0";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.94.0";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.96.0";
 	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.17.0";
-	if (wantsAgentCli(ctx)) devDeps[AGENT_CLI_PACKAGE] = "0.1.2";
+	if (wantsAgentCli(ctx)) devDeps[AGENT_CLI_PACKAGE] = "0.1.3";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
@@ -5667,14 +5700,16 @@ function describeInclude(include) {
 	return `added include: ${formatInclude(include)}`;
 }
 function warnIfNarrowInclude(ctx, filePath, include) {
-	if (!Array.isArray(include) || include.length !== 1 || include[0] !== "src") return;
+	if (!Array.isArray(include) || include.length !== LEGACY_INCLUDE.length || !include.every((entry, index) => entry === LEGACY_INCLUDE[index])) return;
 	const testDir = path.join(path.dirname(filePath), "test");
 	if (!ctx.exists(testDir)) return;
 	log$1.warn(`${filePath}: "include" is ${formatInclude(include)}, so a test/ directory beside it sits outside tsc --noEmit and its types go unchecked. Consider "include": ${formatInclude(DEFAULT_INCLUDE)}.`);
 }
-const NODE_PRESET_SUFFIX = "/node";
+const NODE_PRESET = "@bensandee/config/tsconfig/node";
 function extendsNodePreset(extendsValue) {
-	return extendsValue.endsWith(NODE_PRESET_SUFFIX);
+	if (extendsValue === void 0) return false;
+	if (Array.isArray(extendsValue)) return extendsValue.includes(NODE_PRESET);
+	return extendsValue === NODE_PRESET;
 }
 const VERBATIM_MODULE_SYNTAX_KEY = "verbatimModuleSyntax";
 function buildGeneratedTsconfig(ctx, extendsValue, options = {}) {
@@ -5775,7 +5810,7 @@ function mergeSingleTsconfig(ctx, filePath, extendsValue) {
 		parsed.extends = extendsValue;
 		changes.push(`added extends: ${extendsValue}`);
 	}
-	if (extendsNodePreset(String(parsed.extends)) && parsed.compilerOptions?.[VERBATIM_MODULE_SYNTAX_KEY] === void 0) {
+	if (extendsNodePreset(parsed.extends) && parsed.compilerOptions?.[VERBATIM_MODULE_SYNTAX_KEY] === void 0) {
 		parsed.compilerOptions = {
 			...parsed.compilerOptions,
 			[VERBATIM_MODULE_SYNTAX_KEY]: true
@@ -6254,7 +6289,7 @@ function warnIfMissingJsonSummary(ctx) {
 		if (content === void 0) continue;
 		const issue = findJsonSummaryIssue(content);
 		if (issue === void 0) return;
-		log$1.warn(`${rel}: ${describeIssue(issue)} -- coverage tracking (bst coverage:summary / coverage:check) requires the "json-summary" reporter to read coverage/coverage-summary.json.`);
+		log$1.warn(`${rel}: ${describeIssue(issue)} -- coverage tracking (pnpm exec bst coverage:summary / coverage:check) requires the "json-summary" reporter to read coverage/coverage-summary.json.`);
 		return;
 	}
 }
@@ -6280,7 +6315,7 @@ function warnIfMissingInclude(ctx) {
 		const block = extractCoverageBlock(content);
 		if (block === void 0) return;
 		if (/\binclude\s*:/.test(block)) return;
-		log$1.warn(`${rel}: coverage.include is not set -- Vitest 3+ instruments only files a test imports, so an untested source file is invisible to coverage-baseline.json / bst coverage:check, not just uncovered. Suggested: coverage.include: ${suggestedInclude(ctx.config.structure)}.`);
+		log$1.warn(`${rel}: coverage.include is not set -- Vitest 3+ instruments only files a test imports, so an untested source file is invisible to coverage-baseline.json / pnpm exec bst coverage:check, not just uncovered. Suggested: coverage.include: ${suggestedInclude(ctx.config.structure)}.`);
 		return;
 	}
 }
@@ -7526,7 +7561,7 @@ function ciDefaultBranch(source) {
 function refuseForgeDefaultMismatch(configured, source, command) {
 	const reported = ciDefaultBranch(source);
 	if (reported === void 0 || reported === configured) return;
-	throw new FatalError(`${command}: .tooling.json#defaultBranch is "${configured}", but the forge reports "${reported}" as this repository's default branch. Set .tooling.json#defaultBranch to "${reported}" and run bst repo:sync.`);
+	throw new FatalError(`${command}: .tooling.json#defaultBranch is "${configured}", but the forge reports "${reported}" as this repository's default branch. Set .tooling.json#defaultBranch to "${reported}" and run pnpm exec bst repo:sync.`);
 }
 //#endregion
 //#region src/generators/release-ci.ts
@@ -8055,15 +8090,15 @@ function ignorableDependencies(ctx) {
 function ignoreDependenciesField(dependencies) {
 	return dependencies.length > 0 ? `\n  ignoreDependencies: ${JSON.stringify(dependencies)},` : "";
 }
-function buildKnipConfigSingle(ignoreBinaries, ignoreDependencies) {
+function buildKnipConfigSingle(glob, ignoreBinaries, ignoreDependencies) {
 	return `import type { KnipConfig } from "knip";
 
 export default {
-  project: ["src/**/*.ts"],${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
+  project: ["${glob}"],${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
 } satisfies KnipConfig;
 `;
 }
-function buildKnipConfigMonorepo(ignoreBinaries, ignoreDependencies) {
+function buildKnipConfigMonorepo(glob, ignoreBinaries, ignoreDependencies) {
 	return `import type { KnipConfig } from "knip";
 
 export default {${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
@@ -8073,7 +8108,7 @@ export default {${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(
       project: [],
     },
     "packages/*": {
-      project: ["src/**/*.ts"],
+      project: ["${glob}"],
     },
   },
 } satisfies KnipConfig;
@@ -8241,6 +8276,7 @@ async function generateKnip(ctx) {
 	const isMonorepo = ctx.config.structure === "monorepo";
 	const ignoreBinaries = foreignOwnedBinaries(ctx);
 	const ignoreDependencies = ignorableDependencies(ctx);
+	const glob = sourceGlob(ctx.config.stack);
 	const buildConfig = isMonorepo ? buildKnipConfigMonorepo : buildKnipConfigSingle;
 	const existingPath = KNIP_CONFIG_PATHS.find((p) => ctx.exists(p));
 	if (existingPath) {
@@ -8251,7 +8287,7 @@ async function generateKnip(ctx) {
 			description: "Could not read existing knip config"
 		};
 		if (content.trim() === "") {
-			const blank = isJsonConfig(existingPath) ? ensureIgnorePattern("{}", existingPath, ignoreBinaries, ignoreDependencies) ?? "{}\n" : formattedTemplate(ctx, existingPath, buildConfig(ignoreBinaries, ignoreDependencies));
+			const blank = isJsonConfig(existingPath) ? ensureIgnorePattern("{}", existingPath, ignoreBinaries, ignoreDependencies) ?? "{}\n" : formattedTemplate(ctx, existingPath, buildConfig(glob, ignoreBinaries, ignoreDependencies));
 			ctx.write(existingPath, blank);
 			return {
 				filePath: existingPath,
@@ -8274,7 +8310,7 @@ async function generateKnip(ctx) {
 			description: existingPath === filePath ? "Already configured" : `Existing config found at ${existingPath}`
 		};
 	}
-	ctx.write(filePath, formattedTemplate(ctx, filePath, buildConfig(ignoreBinaries, ignoreDependencies)));
+	ctx.write(filePath, formattedTemplate(ctx, filePath, buildConfig(glob, ignoreBinaries, ignoreDependencies)));
 	return {
 		filePath,
 		action: "created",
@@ -8472,8 +8508,8 @@ function writeEmbedded(ctx, file) {
 }
 const NOT_BUILT = "run `pnpm build` from the repo root";
 async function generateClaudeHooks(ctx, embedded = {
-	hook: "/**\n * bst-hook -- Claude Code PreToolUse hook\n * @bensandee/claude-hooks\n * https://github.com/bensandee/tooling\n *\n * Auto-generated by @bensandee/tooling repo:sync -- do not edit manually.\n */\nimport * as fs from \"node:fs\";\nimport { existsSync, readFileSync, readdirSync, realpathSync, statSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { execFileSync } from \"node:child_process\";\n\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/util.js\nfunction joinValues(array, separator = \"|\") {\n	return array.map((val) => stringifyPrimitive(val)).join(separator);\n}\nfunction jsonStringifyReplacer(_, value) {\n	if (typeof value === \"bigint\") return value.toString();\n	return value;\n}\nvar Cached = class {\n	constructor(getter) {\n		this._getter = getter;\n		this._value = void 0;\n	}\n	get value() {\n		const getter = this._getter;\n		if (getter !== void 0) {\n			this._value = getter();\n			this._getter = void 0;\n		}\n		return this._value;\n	}\n};\nfunction cached(getter) {\n	return new Cached(getter);\n}\nfunction nullish(input) {\n	return input === null || input === void 0;\n}\nfunction cleanRegex(source) {\n	const start = source.startsWith(\"^\") ? 1 : 0;\n	const end = source.endsWith(\"$\") ? source.length - 1 : source.length;\n	return source.slice(start, end);\n}\nfunction assignProp(target, prop, value) {\n	Object.defineProperty(target, prop, {\n		value,\n		writable: true,\n		enumerable: true,\n		configurable: true\n	});\n}\nconst captureStackTrace = \"captureStackTrace\" in Error ? Error.captureStackTrace : (..._args) => {};\nfunction isObject(data) {\n	return typeof data === \"object\" && data !== null && !Array.isArray(data);\n}\nfunction isPlainObject(o) {\n	if (isObject(o) === false) return false;\n	const ctor = o.constructor;\n	if (ctor === void 0) return true;\n	if (typeof ctor !== \"function\") return true;\n	const prot = ctor.prototype;\n	if (isObject(prot) === false) return false;\n	if (Object.prototype.hasOwnProperty.call(prot, \"isPrototypeOf\") === false) return false;\n	return true;\n}\nfunction shallowClone(o) {\n	if (isPlainObject(o)) return { ...o };\n	if (Array.isArray(o)) return [...o];\n	if (o instanceof Map) return new Map(o);\n	if (o instanceof Set) return new Set(o);\n	return o;\n}\nfunction clone(inst, def, params) {\n	const cl = new inst._zod.constr(def ?? inst._zod.def);\n	if (!def || params?.parent) cl._zod.parent = inst;\n	return cl;\n}\nfunction normalizeParams(_params) {\n	const params = _params;\n	if (!params) return {};\n	if (typeof params === \"string\") return { error: () => params };\n	if (params?.message !== void 0) {\n		if (params?.error !== void 0) throw new Error(\"Cannot specify both `message` and `error` params\");\n		params.error = params.message;\n	}\n	delete params.message;\n	if (typeof params.error === \"string\") return {\n		...params,\n		error: () => params.error\n	};\n	return params;\n}\nfunction stringifyPrimitive(value) {\n	if (typeof value === \"bigint\") return value.toString() + \"n\";\n	if (typeof value === \"string\") return `\"${value}\"`;\n	return `${value}`;\n}\nfunction optionalKeys(shape) {\n	return Object.keys(shape).filter((k) => {\n		return shape[k]._zod.optin !== void 0 && shape[k]._zod.optout === \"optional\";\n	});\n}\nfunction aborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue !== true) return true;\n	return false;\n}\nfunction explicitlyAborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue === false) return true;\n	return false;\n}\nfunction prefixIssues(path, issues) {\n	return issues.map((iss) => {\n		var _a;\n		(_a = iss).path ?? (_a.path = []);\n		iss.path.unshift(path);\n		return iss;\n	});\n}\nfunction unwrapMessage(message) {\n	return typeof message === \"string\" ? message : message?.message;\n}\nfunction sizeCaps(defChecks) {\n	const caps = [];\n	for (const ch of defChecks ?? []) {\n		const d = ch._zod.def;\n		if (!/_(length|size)$|_equals$/.test(d.check)) break;\n		const max = d.maximum ?? d.length ?? d.size;\n		if (max >= 0) caps.push([max, ch]);\n	}\n	return caps;\n}\nfunction attachSchema(issues, start, inst) {\n	var _a;\n	for (let i = start; i < issues.length; i++) (_a = issues[i]).schema ?? (_a.schema = inst);\n}\nfunction finalizeIssue(iss, ctx, config) {\n	var _a;\n	const traits = iss.inst?._zod?.traits;\n	if (traits?.has(\"$ZodType\")) {\n		if (traits.has(\"$ZodCheck\")) (_a = iss).schema ?? (_a.schema = iss.inst);\n		else iss.schema = iss.inst;\n	}\n	const schemaError = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;\n	const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config.customError?.(iss)) ?? unwrapMessage(config.localeError?.(iss)) ?? \"Invalid input\";\n	const full = {};\n	for (const k of Object.keys(iss)) {\n		if (k === \"inst\" || k === \"schema\" || k === \"continue\" || k === \"input\" || k === \"__proto__\") continue;\n		full[k] = iss[k];\n	}\n	full.path ?? (full.path = []);\n	full.message = message;\n	if (ctx?.reportInput) full.input = iss.input;\n	return full;\n}\nconst highSurrogate = /[\\uD800-\\uDBFF]/;\nfunction codePointLength(str) {\n	const units = str.length;\n	if (!highSurrogate.test(str)) return units;\n	let count = units;\n	for (let i = 0; i < units - 1; i++) if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {\n		count--;\n		i++;\n	}\n	return count;\n}\nfunction getLengthableOrigin(input) {\n	if (Array.isArray(input)) return \"array\";\n	if (typeof input === \"string\") return \"string\";\n	return \"unknown\";\n}\nfunction parsedType(data) {\n	const t = typeof data;\n	switch (t) {\n		case \"number\": return Number.isNaN(data) ? \"nan\" : \"number\";\n		case \"object\": {\n			if (data === null) return \"null\";\n			if (Array.isArray(data)) return \"array\";\n			const obj = data;\n			if (obj && Object.getPrototypeOf(obj) !== Object.prototype && \"constructor\" in obj && obj.constructor) return obj.constructor.name;\n		}\n	}\n	return t;\n}\nfunction members(proto, table) {\n	for (const key in table) {\n		const desc = Object.getOwnPropertyDescriptor(table, key);\n		if (desc.get) Object.defineProperty(proto, key, {\n			...desc,\n			enumerable: false\n		});\n		else defineBound(proto, key, desc.value);\n	}\n}\nfunction own(inst, key, value, enumerable = true) {\n	Object.defineProperty(inst, key, {\n		configurable: true,\n		writable: true,\n		enumerable,\n		value\n	});\n	return value;\n}\nfunction hide(inst, key, value) {\n	return own(inst, key, value, false);\n}\nfunction defineBound(proto, key, fn) {\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			return this == null ? fn : own(this, key, fn.bind(this));\n		},\n		set(value) {\n			own(this, key, value);\n		}\n	});\n}\nfunction claim(inst, sentinel) {\n	const proto = Object.getPrototypeOf(inst);\n	return sentinel in proto ? void 0 : proto;\n}\nlet installing;\nlet broke = false;\nconst breaker = {\n	configurable: true,\n	get() {\n		broke = true;\n	}\n};\nfunction defineLazyInternal(inst, key, compute) {\n	const proto = Object.getPrototypeOf(inst._zod);\n	if (key in proto && installing !== inst._zod) {\n		installing = void 0;\n		return;\n	}\n	installing = inst._zod;\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			Object.defineProperty(this, key, breaker);\n			const outer = broke;\n			broke = false;\n			try {\n				const value = compute(this);\n				if (broke) delete this[key];\n				else Object.defineProperty(this, key, {\n					configurable: true,\n					writable: true,\n					value\n				});\n				broke = broke || outer;\n				return value;\n			} catch (err) {\n				delete this[key];\n				broke = broke || outer;\n				throw err;\n			}\n		},\n		set(value) {\n			Object.defineProperty(this, key, {\n				configurable: true,\n				writable: true,\n				value\n			});\n		}\n	});\n}\nfunction installLazyProp(inst, key, make, enumerable) {\n	const proto = claim(inst, key);\n	if (!proto) return;\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			const desc = {\n				configurable: true,\n				writable: true,\n				enumerable,\n				value: void 0\n			};\n			Object.defineProperty(this, key, desc);\n			desc.value = make(this);\n			Object.defineProperty(this, key, desc);\n			return desc.value;\n		},\n		set(value) {\n			Object.defineProperty(this, key, {\n				configurable: true,\n				writable: true,\n				enumerable,\n				value\n			});\n		}\n	});\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/core.js\nvar _a;\nconst _zodDesc = {\n	value: void 0,\n	enumerable: false\n};\nlet _E = \"captureStackTrace\" in Error ? Error : null;\nfunction newError(Definition) {\n	const E = _E;\n	if (E) {\n		const saved = E.stackTraceLimit;\n		if (typeof saved === \"number\") {\n			try {\n				E.stackTraceLimit = 0;\n			} catch {\n				_E = null;\n				return new Definition();\n			}\n			try {\n				return new Definition();\n			} finally {\n				E.stackTraceLimit = saved;\n			}\n		}\n	}\n	return new Definition();\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction $constructor(name, initializer, proto, params) {\n	const zodProto = {};\n	function Internals(def) {\n		this.def = def;\n		this.constr = _;\n		this.traits = /* @__PURE__ */ new Set();\n	}\n	Internals.prototype = zodProto;\n	const protoMembers = proto;\n	const initialized = protoMembers && /* @__PURE__ */ new WeakSet();\n	function init(inst, def) {\n		if (!inst._zod) {\n			_zodDesc.value = new Internals(def);\n			try {\n				Object.defineProperty(inst, \"_zod\", _zodDesc);\n			} finally {\n				_zodDesc.value = void 0;\n			}\n		} else if (inst._zod.traits.has(name)) return;\n		inst._zod.traits.add(name);\n		initializer(inst, def);\n		if (initialized) {\n			const own = Object.getPrototypeOf(inst);\n			const ctorProto = inst._zod.constr.prototype;\n			let up = own;\n			while (up && up !== ctorProto) up = Object.getPrototypeOf(up);\n			const target = up ?? own;\n			if (!initialized.has(target)) {\n				initialized.add(target);\n				members(target, protoMembers);\n			}\n		}\n		const proto = _.prototype;\n		for (const k in proto) {\n			if (!Object.prototype.hasOwnProperty.call(proto, k)) continue;\n			if (!(k in inst)) inst[k] = proto[k].bind(inst);\n		}\n	}\n	const Parent = params?.Parent ?? Object;\n	class Definition extends Parent {}\n	Object.defineProperty(Definition, \"name\", { value: name });\n	function _(def) {\n		const inst = params?.Parent ? newError(Definition) : this;\n		init(inst, def);\n		const deferred = inst._zod.deferred;\n		if (deferred) {\n			for (const fn of deferred) fn();\n			inst._zod.deferred = void 0;\n		}\n		const pp = globalThis.__zod_globalConfig?.postProcessor;\n		if (pp) pp(inst);\n		return inst;\n	}\n	Object.defineProperty(_, \"init\", { value: init });\n	Object.defineProperty(_, Symbol.hasInstance, { value: (inst) => {\n		if (params?.Parent && inst instanceof params.Parent) return true;\n		return inst?._zod?.traits?.has(name);\n	} });\n	Object.defineProperty(_, \"name\", { value: name });\n	return _;\n}\nvar $ZodAsyncError = class extends Error {\n	constructor() {\n		super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);\n	}\n};\n(_a = globalThis).__zod_globalConfig ?? (_a.__zod_globalConfig = {});\nconst globalConfig = globalThis.__zod_globalConfig;\nfunction config(newConfig) {\n	if (newConfig) Object.assign(globalConfig, newConfig);\n	return globalConfig;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/errors.js\nfunction _getMessage() {\n	const internals = this._zod;\n	internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));\n	return internals.message;\n}\nfunction _setMessage(value) {\n	this._zod.message = value;\n}\nconst _messageDesc = {\n	get: _getMessage,\n	set: _setMessage,\n	enumerable: true,\n	configurable: true\n};\nconst _issuesDesc = {\n	value: void 0,\n	enumerable: false\n};\nconst _installedToString = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);\nconst initializer = (inst, def) => {\n	inst.name = \"$ZodError\";\n	_issuesDesc.value = def;\n	Object.defineProperty(inst, \"issues\", _issuesDesc);\n	_issuesDesc.value = void 0;\n	Object.defineProperty(inst, \"message\", _messageDesc);\n	const proto = Object.getPrototypeOf(inst);\n	if (!_installedToString.has(proto)) {\n		_installedToString.add(proto);\n		Object.defineProperty(proto, \"toString\", {\n			configurable: true,\n			enumerable: false,\n			get() {\n				const value = () => this.message;\n				Object.defineProperty(this, \"toString\", {\n					value,\n					configurable: true,\n					writable: true\n				});\n				return value;\n			},\n			set(value) {\n				Object.defineProperty(this, \"toString\", {\n					value,\n					configurable: true,\n					writable: true\n				});\n			}\n		});\n	}\n};\nconst $ZodRealError = /* @__PURE__ */ $constructor(\"$ZodError\", initializer, void 0, { Parent: Error });\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/parse.js\nconst _parse = (_Err) => {\n	const fn = (schema, value, _ctx, _params) => {\n		const ctx = _ctx ? {\n			..._ctx,\n			async: false\n		} : { async: false };\n		const result = schema._zod.run({\n			value,\n			issues: []\n		}, ctx);\n		if (result instanceof Promise) throw new $ZodAsyncError();\n		if (result.issues.length) {\n			const e = new ((_params?.Err) ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n			captureStackTrace(e, _params?.callee ?? fn);\n			throw e;\n		}\n		return result.value;\n	};\n	return fn;\n};\nconst parse = /* @__PURE__*/ _parse($ZodRealError);\nconst _parseAsync = (_Err) => {\n	const fn = async (schema, value, _ctx, params) => {\n		const ctx = _ctx ? {\n			..._ctx,\n			async: true\n		} : { async: true };\n		let result = schema._zod.run({\n			value,\n			issues: []\n		}, ctx);\n		if (result instanceof Promise) result = await result;\n		if (result.issues.length) {\n			const e = new ((params?.Err) ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n			captureStackTrace(e, params?.callee ?? fn);\n			throw e;\n		}\n		return result.value;\n	};\n	return fn;\n};\nconst parseAsync = /* @__PURE__*/ _parseAsync($ZodRealError);\nconst _safeParse = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: false\n	} : { async: false };\n	const result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) throw new $ZodAsyncError();\n	return result.issues.length ? failure(_Err, result.issues, ctx) : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParse = /* @__PURE__*/ _safeParse($ZodRealError);\nfunction failure(Err, issues, ctx) {\n	let error;\n	return {\n		success: false,\n		get error() {\n			if (!error) {\n				error = new Err(issues.map((iss) => finalizeIssue(iss, ctx, config())));\n				issues = void 0;\n				ctx = void 0;\n			}\n			return error;\n		},\n		set error(e) {\n			error = e;\n			issues = void 0;\n			ctx = void 0;\n		}\n	};\n}\nconst _safeParseAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: true\n	} : { async: true };\n	let result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) result = await result;\n	return result.issues.length ? failure(_Err, result.issues, ctx) : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParseAsync = /* @__PURE__*/ _safeParseAsync($ZodRealError);\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/regexes.js\nconst anyString = /^[\\s\\S]{0,}$/;\nconst number = /^-?\\d+(?:\\.\\d+)?$/;\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/checks.js\nconst $ZodCheck = /*@__PURE__*/ $constructor(\"$ZodCheck\", (inst, def) => {\n	var _a;\n	inst._zod ?? (inst._zod = {});\n	inst._zod.def = def;\n	(_a = inst._zod).onattach ?? (_a.onattach = []);\n});\nconst _whenHasLength = (payload) => {\n	const val = payload.value;\n	return !nullish(val) && val.length !== void 0;\n};\nconst $ZodCheckMinLength = /*@__PURE__*/ $constructor(\"$ZodCheckMinLength\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = _whenHasLength);\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		const units = input.length;\n		if ((typeof input === \"string\" && units >= def.minimum && units < def.minimum * 2 ? codePointLength(input) : units) >= def.minimum) return;\n		const origin = getLengthableOrigin(input);\n		payload.issues.push({\n			origin,\n			code: \"too_small\",\n			minimum: def.minimum,\n			inclusive: true,\n			input,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/versions.js\nconst version = {\n	major: 4,\n	minor: 6,\n	patch: 7\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/schemas.js\nconst $ZodType = /*@__PURE__*/ $constructor(\"$ZodType\", (inst, def) => {\n	var _a;\n	inst ?? (inst = {});\n	inst._zod.def = def;\n	inst._zod.bag = inst._zod.bag || {};\n	inst._zod.version = version;\n	const defChecks = inst._zod.def.checks;\n	const checks = inst._zod.traits.has(\"$ZodCheck\") ? [inst, ...defChecks ?? []] : defChecks?.length ? [...defChecks] : [];\n	for (const ch of checks) for (const fn of ch._zod.onattach) fn(inst);\n	if (checks.length === 0) {\n		(_a = inst._zod).deferred ?? (_a.deferred = []);\n		inst._zod.deferred?.push(() => {\n			inst._zod.run = inst._zod.parse;\n		});\n	} else {\n		const runChecks = (payload, checks, ctx) => {\n			if (payload.memo) return payload;\n			let isAborted = aborted(payload);\n			let asyncResult;\n			for (const ch of checks) {\n				if (ch._zod.def.when) {\n					if (explicitlyAborted(payload)) continue;\n					if (!ch._zod.def.when(payload)) continue;\n				} else if (isAborted) continue;\n				const currLen = payload.issues.length;\n				const _ = ch._zod.check(payload);\n				if (_ instanceof Promise && ctx?.async === false) throw new $ZodAsyncError();\n				if (asyncResult || _ instanceof Promise) asyncResult = (asyncResult ?? Promise.resolve()).then(async () => {\n					await _;\n					if (payload.issues.length === currLen) return;\n					attachSchema(payload.issues, currLen, inst);\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				});\n				else {\n					if (payload.issues.length === currLen) continue;\n					attachSchema(payload.issues, currLen, inst);\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				}\n			}\n			if (asyncResult) return asyncResult.then(() => {\n				return payload;\n			});\n			return payload;\n		};\n		const handleCanaryResult = (canary, payload, ctx) => {\n			if (aborted(canary)) {\n				canary.aborted = true;\n				return canary;\n			}\n			const checkResult = runChecks(payload, checks, ctx);\n			if (checkResult instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return checkResult.then((checkResult) => inst._zod.parse(checkResult, ctx));\n			}\n			return inst._zod.parse(checkResult, ctx);\n		};\n		inst._zod.run = (payload, ctx) => {\n			if (ctx.skipChecks) return inst._zod.parse(payload, ctx);\n			if (ctx.direction === \"backward\") {\n				const canary = inst._zod.parse({\n					value: payload.value,\n					issues: []\n				}, {\n					...ctx,\n					skipChecks: true\n				});\n				if (canary instanceof Promise) return canary.then((canary) => {\n					return handleCanaryResult(canary, payload, ctx);\n				});\n				return handleCanaryResult(canary, payload, ctx);\n			}\n			const result = inst._zod.parse(payload, ctx);\n			if (result instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return result.then((result) => runChecks(result, checks, ctx));\n			}\n			return runChecks(result, checks, ctx);\n		};\n	}\n}, {\n	get \"~standard\"() {\n		return hide(this, \"~standard\", standardProps(this));\n	},\n	set \"~standard\"(value) {\n		own(this, \"~standard\", value);\n	}\n});\nconst toStandardResult = (r, ctx) => r.issues.length ? { issues: r.issues.map((iss) => finalizeIssue(iss, ctx, config())) } : { value: r.value };\nasync function validateAsync(inst, value) {\n	const ctx = { async: true };\n	return toStandardResult(await inst._zod.run({\n		value,\n		issues: []\n	}, ctx), ctx);\n}\nfunction standardProps(inst) {\n	return {\n		validate: (value) => {\n			const ctx = { async: false };\n			try {\n				const r = inst._zod.run({\n					value,\n					issues: []\n				}, ctx);\n				if (!(r instanceof Promise)) return toStandardResult(r, ctx);\n			} catch (_) {}\n			return validateAsync(inst, value);\n		},\n		vendor: \"zod\",\n		version: 1\n	};\n}\nconst $ZodString = /*@__PURE__*/ $constructor(\"$ZodString\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.pattern = def.pattern ?? anyString;\n	inst._zod.parse = (payload, _) => {\n		if (def.coerce) try {\n			payload.value = String(payload.value);\n		} catch (_) {}\n		if (typeof payload.value === \"string\") return payload;\n		payload.issues.push({\n			expected: \"string\",\n			code: \"invalid_type\",\n			input: payload.value,\n			inst\n		});\n		return payload;\n	};\n});\nconst $ZodUnknown = /*@__PURE__*/ $constructor(\"$ZodUnknown\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload) => payload;\n});\nfunction capSize(inst, size) {\n	const caps = sizeCaps(inst._zod.def.checks);\n	if (!caps.length) return;\n	const cap = Math.min(...caps.map((c) => c[0]));\n	const parse = inst._zod.parse;\n	inst._zod.parse = (payload, ctx) => {\n		const n = size(payload.value);\n		if (n > cap && !ctx?.skipChecks && ctx?.direction !== \"backward\") {\n			for (const [max, ch] of sizeCaps(inst._zod.def.checks)) if (n > max && ch._zod.def.when(payload)) {\n				const start = payload.issues.length;\n				ch._zod.check(payload);\n				payload.issues[start].continue = false;\n				attachSchema(payload.issues, start, inst);\n				return payload;\n			}\n		}\n		return parse(payload, ctx);\n	};\n}\nconst arraySize = (input) => Array.isArray(input) ? input.length : -1;\nfunction handleArrayResult(result, final, index) {\n	if (result.issues.length) final.issues.push(...prefixIssues(index, result.issues));\n	final.value[index] = result.value;\n}\nconst $ZodArray = /*@__PURE__*/ $constructor(\"$ZodArray\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!Array.isArray(input)) {\n			payload.issues.push({\n				expected: \"array\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = memo ? memo.alloc(inst, payload, Array(input.length), ctx) : Array(input.length);\n		const proms = [];\n		const abortEarly = ctx?.abortEarly;\n		for (let i = 0; i < input.length; i++) {\n			const item = input[i];\n			const result = def.element._zod.run({\n				value: item,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) proms.push(result.then((result) => handleArrayResult(result, payload, i)));\n			else {\n				handleArrayResult(result, payload, i);\n				if (abortEarly && result.issues.length !== 0 && aborted(result)) break;\n			}\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n	capSize(inst, arraySize);\n});\nfunction handlePropertyResult(result, final, key, input, optin, optout) {\n	const isPresent = key in input;\n	const isOptionalOut = optout === \"optional\";\n	if (!isPresent && isOptionalOut && optin === \"optional\") return;\n	if (result.issues.length) {\n		if (optin !== void 0 && isOptionalOut && !isPresent) return;\n		final.issues.push(...prefixIssues(key, result.issues));\n	}\n	if (!isPresent && optin === void 0) {\n		if (!result.issues.length) final.issues.push({\n			code: \"invalid_type\",\n			expected: \"nonoptional\",\n			input: void 0,\n			path: [key]\n		});\n		return;\n	}\n	if (result.value === void 0) {\n		if (isPresent || optin === \"defaulted\" && !isOptionalOut) final.value[key] = void 0;\n	} else final.value[key] = result.value;\n}\nconst NO_SYMBOL_KEYS = [];\nfunction normalizeDef(def) {\n	const keys = Object.keys(def.shape);\n	const ownSymbols = Object.getOwnPropertySymbols(def.shape);\n	const symbolKeys = ownSymbols.length ? ownSymbols : NO_SYMBOL_KEYS;\n	const allKeys = symbolKeys.length ? [...keys, ...symbolKeys] : keys;\n	for (const k of allKeys) if (!def.shape?.[k]?._zod?.traits?.has(\"$ZodType\")) throw new Error(`Invalid element at key \"${String(k)}\": expected a Zod schema`);\n	const okeys = optionalKeys(def.shape);\n	return {\n		...def,\n		allKeys,\n		symbolKeys,\n		keySet: new Set(keys),\n		numKeys: keys.length,\n		optionalKeys: new Set(okeys)\n	};\n}\nfunction handleCatchall(proms, input, payload, ctx, def, inst, abortEarly) {\n	const unrecognized = [];\n	const keySet = def.keySet;\n	const _catchall = def.catchall._zod;\n	const t = _catchall.def.type;\n	const optin = _catchall.optin;\n	const optout = _catchall.optout;\n	let seen = 0;\n	for (const key in input) {\n		if (abortEarly && payload.issues.length !== seen) {\n			if (aborted(payload, seen)) break;\n			seen = payload.issues.length;\n		}\n		if (keySet.has(key)) continue;\n		if (key === \"__proto__\") {\n			if (t === \"never\") unrecognized.push(key);\n			continue;\n		}\n		if (t === \"never\") {\n			unrecognized.push(key);\n			continue;\n		}\n		const r = _catchall.run({\n			value: input[key],\n			issues: []\n		}, ctx);\n		if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, optin, optout)));\n		else handlePropertyResult(r, payload, key, input, optin, optout);\n	}\n	if (unrecognized.length) payload.issues.push({\n		code: \"unrecognized_keys\",\n		keys: unrecognized,\n		input,\n		inst,\n		continue: true\n	});\n	if (!proms.length) return payload;\n	return Promise.all(proms).then(() => {\n		return payload;\n	});\n}\nconst $ZodObject = /*@__PURE__*/ $constructor(\"$ZodObject\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const desc = Object.getOwnPropertyDescriptor(def, \"shape\");\n	const sh = desc?.get ? desc.get.raw : def.shape ?? {};\n	if (sh) {\n		const get = () => {\n			const newSh = { ...sh };\n			Object.defineProperty(def, \"shape\", { value: newSh });\n			get.raw = newSh;\n			return newSh;\n		};\n		get.raw = sh;\n		Object.defineProperty(def, \"shape\", { get });\n	}\n	const _normalized = cached(() => normalizeDef(def));\n	defineLazyInternal(inst, \"propValues\", (zod) => {\n		const shape = zod.def.shape;\n		const propValues = {};\n		for (const key in shape) {\n			const field = shape[key]._zod;\n			if (field.values) {\n				if (!Object.prototype.hasOwnProperty.call(propValues, key)) assignProp(propValues, key, /* @__PURE__ */ new Set());\n				for (const v of field.values) propValues[key].add(v);\n				if (field.optin !== void 0) propValues[key].add(void 0);\n			}\n		}\n		return propValues;\n	});\n	const isObject$1 = isObject;\n	const catchall = def.catchall;\n	let value;\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		value ?? (value = _normalized.value);\n		const input = payload.value;\n		if (!isObject$1(input)) {\n			payload.issues.push({\n				expected: \"object\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n		const proms = [];\n		const shape = value.shape;\n		const abortEarly = ctx?.abortEarly;\n		let seen = payload.issues.length;\n		for (const key of value.allKeys) {\n			if (abortEarly && payload.issues.length !== seen) {\n				if (aborted(payload, seen)) break;\n				seen = payload.issues.length;\n			}\n			if (key === \"__proto__\") continue;\n			const el = shape[key];\n			const optin = el._zod.optin;\n			const optout = el._zod.optout;\n			const r = el._zod.run({\n				value: input[key],\n				issues: []\n			}, ctx);\n			if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, optin, optout)));\n			else handlePropertyResult(r, payload, key, input, optin, optout);\n		}\n		if (!catchall) return proms.length ? Promise.all(proms).then(() => payload) : payload;\n		return handleCatchall(proms, input, payload, ctx, _normalized.value, inst, abortEarly === true);\n	};\n});\nconst $ZodRecord = /*@__PURE__*/ $constructor(\"$ZodRecord\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!isPlainObject(input)) {\n			payload.issues.push({\n				expected: \"record\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		const proms = [];\n		const values = def.keyType._zod.values;\n		if (values && !def.partial) {\n			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n			const recordKeys = /* @__PURE__ */ new Set();\n			for (const key of values) if (typeof key === \"string\" || typeof key === \"number\" || typeof key === \"symbol\") {\n				recordKeys.add(typeof key === \"number\" ? key.toString() : key);\n				if (key === \"__proto__\") continue;\n				const keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (keyResult.issues.length) {\n					payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				if (outKey === \"__proto__\") continue;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			let unrecognized;\n			for (const key in input) if (!recordKeys.has(key)) {\n				if (def.mode === \"loose\") {\n					if (key === \"__proto__\") continue;\n					payload.value[key] = input[key];\n				} else {\n					unrecognized = unrecognized ?? [];\n					unrecognized.push(key);\n				}\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized,\n				continue: true\n			});\n		} else {\n			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n			let unrecognized;\n			for (const key of Reflect.ownKeys(input)) {\n				if (key === \"__proto__\") continue;\n				if (!Object.prototype.propertyIsEnumerable.call(input, key)) continue;\n				let keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (typeof key === \"string\" && number.test(key) && keyResult.issues.length) {\n					const retryResult = def.keyType._zod.run({\n						value: Number(key),\n						issues: []\n					}, ctx);\n					if (retryResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n					if (retryResult.issues.length === 0) keyResult = retryResult;\n				}\n				if (keyResult.issues.length) {\n					if (def.mode === \"loose\") payload.value[key] = input[key];\n					else if (values) {\n						unrecognized = unrecognized ?? [];\n						unrecognized.push(key);\n					} else payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				if (outKey === \"__proto__\") continue;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized,\n				continue: true\n			});\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nfunction handleOptionalResult(payload, result) {\n	payload.value = result.issues.length ? void 0 : result.value;\n	return payload;\n}\nconst $ZodOptional = /*@__PURE__*/ $constructor(\"$ZodOptional\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazyInternal(inst, \"optin\", (zod) => zod.def.innerType._zod.optin === \"defaulted\" ? \"defaulted\" : \"optional\");\n	inst._zod.optout = \"optional\";\n	defineLazyInternal(inst, \"values\", (zod) => {\n		const values = zod.def.innerType._zod.values;\n		return values ? /* @__PURE__ */ new Set([...values, void 0]) : void 0;\n	});\n	defineLazyInternal(inst, \"pattern\", (zod) => {\n		const pattern = zod.def.innerType._zod.pattern;\n		return pattern ? new RegExp(`^(${cleanRegex(pattern.source)})?$`) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		if (payload.value === void 0) {\n			if (def.innerType._zod.optin !== \"defaulted\") return payload;\n			const result = def.innerType._zod.run({\n				value: payload.value,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) return result.then((result) => handleOptionalResult(payload, result));\n			return handleOptionalResult(payload, result);\n		}\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodDefault = /*@__PURE__*/ $constructor(\"$ZodDefault\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"defaulted\";\n	defineLazyInternal(inst, \"values\", (zod) => zod.def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		if (payload.value === void 0) {\n			payload.value = def.defaultValue;\n			return payload;\n		}\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => handleDefaultResult(result, def));\n		return handleDefaultResult(result, def);\n	};\n});\nfunction handleDefaultResult(payload, def) {\n	if (payload.value === void 0) payload.value = def.defaultValue;\n	return payload;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/en.js\nconst error = () => {\n	const Sizable = {\n		string: {\n			unit: \"characters\",\n			verb: \"to have\"\n		},\n		file: {\n			unit: \"bytes\",\n			verb: \"to have\"\n		},\n		array: {\n			unit: \"items\",\n			verb: \"to have\"\n		},\n		set: {\n			unit: \"items\",\n			verb: \"to have\"\n		},\n		map: {\n			unit: \"entries\",\n			verb: \"to have\"\n		}\n	};\n	function getSizing(origin) {\n		return Sizable[origin] ?? null;\n	}\n	const FormatDictionary = {\n		regex: \"input\",\n		email: \"email address\",\n		url: \"URL\",\n		emoji: \"emoji\",\n		uuid: \"UUID\",\n		uuidv4: \"UUIDv4\",\n		uuidv6: \"UUIDv6\",\n		nanoid: \"nanoid\",\n		guid: \"GUID\",\n		cuid: \"cuid\",\n		cuid2: \"cuid2\",\n		ulid: \"ULID\",\n		xid: \"XID\",\n		ksuid: \"KSUID\",\n		datetime: \"ISO datetime\",\n		date: \"ISO date\",\n		time: \"ISO time\",\n		duration: \"ISO duration\",\n		ipv4: \"IPv4 address\",\n		ipv6: \"IPv6 address\",\n		mac: \"MAC address\",\n		cidrv4: \"IPv4 range\",\n		cidrv6: \"IPv6 range\",\n		base64: \"base64-encoded string\",\n		base64url: \"base64url-encoded string\",\n		json_string: \"JSON string\",\n		e164: \"E.164 number\",\n		currency_code: \"currency code\",\n		credit_card: \"credit card number\",\n		iban: \"IBAN\",\n		jwt: \"JWT\",\n		template_literal: \"input\"\n	};\n	const TypeDictionary = { nan: \"NaN\" };\n	function getTypeName(type, input) {\n		if (type === \"number\" && typeof input === \"number\" && !Number.isFinite(input)) return String(input);\n		return TypeDictionary[type] ?? type;\n	}\n	return (issue) => {\n		switch (issue.code) {\n			case \"invalid_type\": return `Invalid input: expected ${getTypeName(issue.expected)}, received ${getTypeName(parsedType(issue.input), issue.input)}`;\n			case \"invalid_value\":\n				if (issue.values.length === 1) return `Invalid input: expected ${stringifyPrimitive(issue.values[0])}`;\n				return `Invalid option: expected one of ${joinValues(issue.values, \"|\")}`;\n			case \"too_big\": {\n				const adj = issue.exact ? \"exactly \" : issue.inclusive ? \"<=\" : \"<\";\n				const sizing = getSizing(issue.origin);\n				if (sizing) return `Too big: expected ${issue.origin ?? \"value\"} to have ${adj}${issue.maximum.toString()} ${sizing.unit ?? \"elements\"}`;\n				return `Too big: expected ${issue.origin ?? \"value\"} to be ${adj}${issue.maximum.toString()}`;\n			}\n			case \"too_small\": {\n				const adj = issue.exact ? \"exactly \" : issue.inclusive ? \">=\" : \">\";\n				const sizing = getSizing(issue.origin);\n				if (sizing) return `Too small: expected ${issue.origin} to have ${adj}${issue.minimum.toString()} ${sizing.unit}`;\n				return `Too small: expected ${issue.origin} to be ${adj}${issue.minimum.toString()}`;\n			}\n			case \"invalid_format\": {\n				const _issue = issue;\n				if (_issue.format === \"starts_with\") return `Invalid string: must start with \"${_issue.prefix}\"`;\n				if (_issue.format === \"ends_with\") return `Invalid string: must end with \"${_issue.suffix}\"`;\n				if (_issue.format === \"includes\") return `Invalid string: must include \"${_issue.includes}\"`;\n				if (_issue.format === \"regex\") return `Invalid string: must match pattern ${_issue.pattern}`;\n				return `Invalid ${FormatDictionary[_issue.format] ?? issue.format}`;\n			}\n			case \"not_multiple_of\": return `Invalid number: must be a multiple of ${issue.divisor}`;\n			case \"unrecognized_keys\": return `Unrecognized key${issue.keys.length > 1 ? \"s\" : \"\"}: ${joinValues(issue.keys, \", \")}`;\n			case \"invalid_key\": return `Invalid key in ${issue.origin}`;\n			case \"invalid_union\":\n				if (issue.options && Array.isArray(issue.options) && issue.options.length > 0) return `Invalid discriminator value. Expected ${issue.options.map((o) => `'${o}'`).join(\" | \")}`;\n				if (issue.inclusive === false) return \"Invalid input: more than one option matched\";\n				return \"Invalid input\";\n			case \"invalid_element\": return `Invalid value in ${issue.origin}`;\n			default: return `Invalid input`;\n		}\n	};\n};\nfunction en_default() {\n	return { localeError: error() };\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/api.js\nfunction snapshotChecks(def) {\n	if (def.checks) def.checks = [...def.checks];\n	return def;\n}\n// @__NO_SIDE_EFFECTS__\nfunction _string(Class, params) {\n	return new Class(snapshotChecks({\n		type: \"string\",\n		...normalizeParams(params)\n	}));\n}\n// @__NO_SIDE_EFFECTS__\nfunction _unknown(Class) {\n	return new Class({ type: \"unknown\" });\n}\n// @__NO_SIDE_EFFECTS__\nfunction _minLength(minimum, params) {\n	return new $ZodCheckMinLength({\n		check: \"min_length\",\n		...normalizeParams(params),\n		minimum\n	});\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/mini/schemas.js\nconst ZodMiniType = /*@__PURE__*/ $constructor(\"ZodMiniType\", (inst, def) => {\n	if (!inst._zod) throw new Error(\"Uninitialized schema in ZodMiniType.\");\n	$ZodType.init(inst, def);\n	inst.def = def;\n	inst.type = def.type;\n}, {\n	get with() {\n		return this.check;\n	},\n	set with(value) {\n		own(this, \"with\", value);\n	},\n	parse(data, params) {\n		return parse(this, data, params, { callee: this.parse });\n	},\n	parseAsync(data, params) {\n		return parseAsync(this, data, params, { callee: this.parseAsync });\n	},\n	safeParse(data, params) {\n		return safeParse(this, data, params);\n	},\n	safeParseAsync(data, params) {\n		return safeParseAsync(this, data, params);\n	},\n	check(...checks) {\n		const def = this.def;\n		return this.clone({\n			...def,\n			checks: [...def.checks ?? [], ...checks.map((ch) => typeof ch === \"function\" ? { _zod: {\n				check: ch,\n				def: { check: \"custom\" },\n				onattach: []\n			} } : ch)]\n		}, { parent: true });\n	},\n	clone(_def, params) {\n		return clone(this, _def, params);\n	},\n	brand() {\n		return this;\n	},\n	register(reg, meta) {\n		reg.add(this, meta);\n		return this;\n	},\n	apply(fn, ...args) {\n		return args.length === 0 ? fn(this) : fn(this, ...args);\n	}\n});\nconst ZodMiniString = /*@__PURE__*/ $constructor(\"ZodMiniString\", (inst, def) => {\n	$ZodString.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction string(params) {\n	return _string(ZodMiniString, params);\n}\nconst ZodMiniUnknown = /*@__PURE__*/ $constructor(\"ZodMiniUnknown\", (inst, def) => {\n	$ZodUnknown.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction unknown() {\n	return _unknown(ZodMiniUnknown);\n}\nconst ZodMiniArray = /*@__PURE__*/ $constructor(\"ZodMiniArray\", (inst, def) => {\n	$ZodArray.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction array(element, params) {\n	return new ZodMiniArray({\n		type: \"array\",\n		element,\n		...normalizeParams(params)\n	});\n}\nconst ZodMiniObject = /*@__PURE__*/ $constructor(\"ZodMiniObject\", (inst, def) => {\n	$ZodObject.init(inst, def);\n	ZodMiniType.init(inst, def);\n	installLazyProp(inst, \"shape\", (self) => self._zod.def.shape, false);\n});\n// @__NO_SIDE_EFFECTS__\nfunction object(shape, params) {\n	const def = {\n		type: \"object\",\n		shape: shape ?? {},\n		...normalizeParams(params)\n	};\n	return new ZodMiniObject(def);\n}\nconst ZodMiniRecord = /*@__PURE__*/ $constructor(\"ZodMiniRecord\", (inst, def) => {\n	$ZodRecord.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction record(keyType, valueType, params) {\n	if (!valueType || !valueType._zod) return new ZodMiniRecord({\n		type: \"record\",\n		keyType: /* @__PURE__ */ string(),\n		valueType: keyType,\n		...normalizeParams(valueType)\n	});\n	return new ZodMiniRecord({\n		type: \"record\",\n		keyType,\n		valueType,\n		...normalizeParams(params)\n	});\n}\nconst ZodMiniOptional = /*@__PURE__*/ $constructor(\"ZodMiniOptional\", (inst, def) => {\n	$ZodOptional.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction optional(innerType) {\n	return new ZodMiniOptional({\n		type: \"optional\",\n		innerType\n	});\n}\nconst ZodMiniDefault = /*@__PURE__*/ $constructor(\"ZodMiniDefault\", (inst, def) => {\n	$ZodDefault.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction _default(innerType, defaultValue) {\n	return new ZodMiniDefault({\n		type: \"default\",\n		innerType,\n		get defaultValue() {\n			return typeof defaultValue === \"function\" ? defaultValue() : shallowClone(defaultValue);\n		}\n	});\n}\n\n//#endregion\n//#region src/lib/hook-io.ts\nconfig(en_default());\nconst HookInputSchema = object({\n	session_id: string(),\n	transcript_path: string(),\n	cwd: string(),\n	permission_mode: string(),\n	hook_event_name: string(),\n	tool_name: string(),\n	tool_input: record(string(), unknown())\n});\nasync function readHookInput() {\n	const chunks = [];\n	for await (const chunk of process.stdin) chunks.push(typeof chunk === \"string\" ? chunk : String(chunk));\n	let parsed;\n	try {\n		parsed = JSON.parse(chunks.join(\"\"));\n	} catch (_error) {\n		return {\n			ok: false,\n			raw: chunks.join(\"\").slice(0, 200),\n			error: \"invalid JSON\"\n		};\n	}\n	const result = HookInputSchema.safeParse(parsed);\n	if (!result.success) return {\n		ok: false,\n		raw: parsed,\n		error: result.error.message\n	};\n	return {\n		ok: true,\n		data: result.data\n	};\n}\nconst BashInputSchema = object({\n	command: string(),\n	description: optional(string())\n});\nconst FilePathInputSchema = object({ file_path: string() });\nconst SearchInputSchema = object({\n	pattern: string(),\n	path: optional(string())\n});\nfunction parseBashInput(toolInput) {\n	const result = BashInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction parseFilePathInput(toolInput) {\n	const result = FilePathInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction parseSearchInput(toolInput) {\n	const result = SearchInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction writeDeny(reason) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		permissionDecision: \"deny\",\n		...reason ? { permissionDecisionReason: reason } : {}\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\nfunction writeAdvice(advice) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		additionalContext: advice\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\n\n//#endregion\n//#region src/lib/audit.ts\nconst MAX_LOG_SIZE = 1048576;\nfunction getLogPath() {\n	const hookDir = path.dirname(fileURLToPath(import.meta.url));\n	return path.join(hookDir, \"bst-hook.audit.local.jsonl\");\n}\nfunction rotateIfNeeded(logPath) {\n	try {\n		if (fs.statSync(logPath).size > MAX_LOG_SIZE) {\n			const rotatedPath = `${logPath}.1`;\n			fs.renameSync(logPath, rotatedPath);\n		}\n	} catch (_error) {}\n}\nlet rotationChecked = false;\nfunction audit(entry) {\n	try {\n		const logPath = getLogPath();\n		if (!rotationChecked) {\n			rotateIfNeeded(logPath);\n			rotationChecked = true;\n		}\n		const record = {\n			timestamp: (/* @__PURE__ */ new Date()).toISOString(),\n			...entry\n		};\n		fs.appendFileSync(logPath, JSON.stringify(record) + \"\\n\");\n	} catch (err) {\n		process.stderr.write(`[bst-hook] audit write failed: ${err instanceof Error ? err.message : String(err)}\\n`);\n	}\n}\n\n//#endregion\n//#region src/lib/shell-tokenizer.ts\nfunction scanDoubleQuoted(input, start) {\n	let content = \"\";\n	let i = start;\n	while (i < input.length && input[i] !== \"\\\"\") {\n		if (input[i] === \"\\\\\" && i + 1 < input.length) {\n			const next = input[i + 1];\n			if (next === \"\\\"\" || next === \"\\\\\" || next === \"$\" || next === \"`\") {\n				content += next;\n				i += 2;\n				continue;\n			}\n		}\n		content += input[i];\n		i++;\n	}\n	if (i >= input.length) return null;\n	return {\n		content,\n		next: i + 1\n	};\n}\nfunction tokenize(input) {\n	const tokens = [];\n	let current = \"\";\n	let i = 0;\n	let inToken = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\") {\n			inToken = true;\n			i++;\n			while (i < input.length && input[i] !== \"'\") {\n				current += input[i];\n				i++;\n			}\n			if (i >= input.length) return {\n				ok: false,\n				error: \"unterminated single quote\"\n			};\n			i++;\n		} else if (ch === \"\\\"\") {\n			inToken = true;\n			const scanned = scanDoubleQuoted(input, i + 1);\n			if (!scanned) return {\n				ok: false,\n				error: \"unterminated double quote\"\n			};\n			current += scanned.content;\n			i = scanned.next;\n		} else if (ch === \"\\\\\" && i + 1 < input.length) {\n			inToken = true;\n			current += input[i + 1];\n			i += 2;\n		} else if (ch === \" \" || ch === \"	\") {\n			if (inToken) {\n				tokens.push(current);\n				current = \"\";\n				inToken = false;\n			}\n			i++;\n		} else {\n			inToken = true;\n			current += ch;\n			i++;\n		}\n	}\n	if (inToken) tokens.push(current);\n	return {\n		ok: true,\n		tokens\n	};\n}\nconst SAFE_UNQUOTED_RE = /^[A-Za-z0-9_\\-./=:@%+,]+$/;\nfunction quoteToken(token) {\n	if (token.length > 0 && SAFE_UNQUOTED_RE.test(token)) return token;\n	return \"'\" + token.replace(/'/g, \"'\\\\''\") + \"'\";\n}\nfunction joinTokens(tokens) {\n	return tokens.map(quoteToken).join(\" \");\n}\n\n//#endregion\n//#region src/lib/shell-splitter.ts\nfunction splitCommand(input) {\n	if (!input || !input.trim()) return [];\n	const segments = [];\n	let current = \"\";\n	let i = 0;\n	let inSingleQuote = false;\n	let inDoubleQuote = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\" && !inDoubleQuote) {\n			inSingleQuote = !inSingleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\"\" && !inSingleQuote) {\n			inDoubleQuote = !inDoubleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\\\" && !inSingleQuote && i + 1 < input.length) {\n			current += ch + input[i + 1];\n			i += 2;\n			continue;\n		}\n		if (!inSingleQuote && !inDoubleQuote) {\n			if (ch === \"&\" && i + 1 < input.length && input[i + 1] === \"&\") {\n				pushSegment(segments, current, \"&&\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"&\" && !(i + 1 < input.length && input[i + 1] === \">\") && !(i > 0 && (input[i - 1] === \">\" || input[i - 1] === \"<\"))) {\n				pushSegment(segments, current, \"&\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \"|\" && i + 1 < input.length && input[i + 1] === \"|\") {\n				pushSegment(segments, current, \"||\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"|\") {\n				pushSegment(segments, current, \"|\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \";\") {\n				pushSegment(segments, current, \";\");\n				current = \"\";\n				i++;\n				continue;\n			}\n		}\n		current += ch;\n		i++;\n	}\n	const trimmed = current.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator: null\n	});\n	return segments;\n}\nfunction pushSegment(segments, text, operator) {\n	const trimmed = text.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator\n	});\n}\n\n//#endregion\n//#region src/lib/injection-guard.ts\nfunction hasBraceExpansion(token) {\n	let depth = 0;\n	for (let i = 0; i < token.length; i++) {\n		const ch = token[i];\n		if (ch === \"{\") depth++;\n		else if (ch === \"}\") {\n			if (depth > 0) depth--;\n		} else if (depth >= 1 && (ch === \",\" || ch === \".\" && token[i + 1] === \".\")) return true;\n	}\n	return false;\n}\nfunction checkInjection(tokens, rawSegment) {\n	if (/[\\n\\r]/.test(rawSegment)) return {\n		safe: false,\n		reason: \"unquoted newline in command\"\n	};\n	for (const token of tokens) {\n		if (token === \"`\") return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"`\")) return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"$\")) return {\n			safe: false,\n			reason: \"unresolved dollar-expansion\"\n		};\n		if (hasBraceExpansion(token)) return {\n			safe: false,\n			reason: \"brace expansion\"\n		};\n		if (token.includes(\"<(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n		if (token.includes(\">(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n	}\n	return { safe: true };\n}\n\n//#endregion\n//#region src/lib/env-file.ts\nconst ENV_SAFE_SUFFIXES = [\n	\".sample\",\n	\".example\",\n	\".template\"\n];\nconst ENV_TOOL_OWNED_SUFFIXES = [\".check.env\"];\nconst ENV_FILE_PATTERN = /(^|[/\\\\])(\\.env(\\..*)?|.*\\.env(\\..*)?|\\.env)$/;\nfunction isEnvSafeSuffix(filename) {\n	return [...ENV_SAFE_SUFFIXES, ...ENV_TOOL_OWNED_SUFFIXES].some((suffix) => filename.endsWith(suffix));\n}\nfunction isEnvFile(filePath) {\n	if (isEnvSafeSuffix(path.basename(filePath))) return false;\n	return ENV_FILE_PATTERN.test(filePath);\n}\n\n//#endregion\n//#region src/lib/git-state.ts\nconst GIT_TIMEOUT_MS = 5e3;\nfunction getCurrentBranch(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--abbrev-ref\",\n			\"HEAD\"\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!out || out === \"HEAD\") return null;\n		return out;\n	} catch {\n		return null;\n	}\n}\nfunction getRepoTopLevel(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\"rev-parse\", \"--show-toplevel\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		return out === \"\" ? null : out;\n	} catch {\n		return null;\n	}\n}\nfunction getRemoteDefaultBranch(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\n			\"symbolic-ref\",\n			\"--short\",\n			\"refs/remotes/origin/HEAD\"\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!out) return null;\n		return out.startsWith(\"origin/\") ? out.slice(7) : out;\n	} catch {\n		return null;\n	}\n}\nconst DefaultBranchSchema = object({ defaultBranch: optional(string().check(_minLength(1))) });\nfunction getConfiguredDefaultBranch(topLevel) {\n	let parsed;\n	try {\n		parsed = JSON.parse(readFileSync(join(topLevel, \".tooling.json\"), \"utf-8\"));\n	} catch {\n		return null;\n	}\n	const result = DefaultBranchSchema.safeParse(parsed);\n	return result.success ? result.data.defaultBranch ?? null : null;\n}\nconst ALWAYS_PROTECTED = [\"main\", \"master\"];\nfunction getProtectedBranches(cwd, extra) {\n	const set = new Set(ALWAYS_PROTECTED);\n	const remote = getRemoteDefaultBranch(cwd);\n	if (remote) set.add(remote);\n	for (const b of extra) set.add(b);\n	return set;\n}\nfunction getUpstream(cwd, branch) {\n	try {\n		return execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--abbrev-ref\",\n			`${branch}@{upstream}`\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: 5e3\n		}).toString().trim() || null;\n	} catch {\n		return null;\n	}\n}\nfunction resolveCommit(cwd, rev) {\n	try {\n		return execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--verify\",\n			\"--quiet\",\n			`${rev}^{commit}`\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: 5e3\n		}).toString().trim() || null;\n	} catch {\n		return null;\n	}\n}\nfunction branchCarriesOtherFiles(cwd, allowed) {\n	const toplevel = getRepoTopLevel(cwd);\n	if (toplevel === null) return null;\n	try {\n		const defaultBranch = getConfiguredDefaultBranch(toplevel) ?? getRemoteDefaultBranch(toplevel) ?? \"main\";\n		const mergeBase = execFileSync(\"git\", [\n			\"merge-base\",\n			\"HEAD\",\n			`origin/${defaultBranch}`\n		], {\n			cwd: toplevel,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!mergeBase) return null;\n		const names = (args) => execFileSync(\"git\", args, {\n			cwd: toplevel,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().split(\"\\n\").filter((line) => line.length > 0);\n		return [...names([\n			\"diff\",\n			\"--name-only\",\n			mergeBase\n		]), ...names([\n			\"ls-files\",\n			\"--others\",\n			\"--exclude-standard\"\n		])].some((name) => !allowed.includes(name));\n	} catch {\n		return null;\n	}\n}\nfunction isPrimaryWorktree(cwd) {\n	try {\n		const gitDir = execFileSync(\"git\", [\"rev-parse\", \"--absolute-git-dir\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		const commonRaw = execFileSync(\"git\", [\"rev-parse\", \"--git-common-dir\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!gitDir || !commonRaw) return false;\n		const commonDir = resolve(cwd, commonRaw);\n		return realpathSync(gitDir) === realpathSync(commonDir);\n	} catch {\n		return false;\n	}\n}\n\n//#endregion\n//#region src/lib/git-short-options.ts\nconst VALUE_TAKING_LETTERS = {\n	switch: /* @__PURE__ */ new Set([\"c\", \"C\"]),\n	checkout: /* @__PURE__ */ new Set([\"b\", \"B\"]),\n	branch: /* @__PURE__ */ new Set([\"u\"]),\n	fetch: /* @__PURE__ */ new Set([\"o\", \"j\"])\n};\nfunction splitShortOptionCluster(token, sub) {\n	if (!token.startsWith(\"-\") || token.startsWith(\"--\") || token.length <= 1) return;\n	const valueLetters = VALUE_TAKING_LETTERS[sub];\n	const letters = [];\n	const chars = token.slice(1);\n	for (let i = 0; i < chars.length; i++) {\n		const ch = chars[i];\n		letters.push(ch);\n		if (valueLetters.has(ch)) return {\n			letters,\n			attachedValue: chars.slice(i + 1)\n		};\n	}\n	return { letters };\n}\n\n//#endregion\n//#region src/lib/path-scope.ts\nfunction pathFlavorFor(base) {\n	return /^[a-zA-Z]:[\\\\/]/.test(base) ? path.win32 : path.posix;\n}\nfunction resolveIn(base, target) {\n	return pathFlavorFor(base).resolve(base, target);\n}\nfunction isWithin(dir, target) {\n	const pp = pathFlavorFor(dir);\n	const rel = pp.relative(dir, target);\n	if (rel === \"\") return true;\n	if (rel === \"..\" || rel.startsWith(\"..\" + pp.sep)) return false;\n	return !pp.isAbsolute(rel);\n}\nfunction samePath(a, b) {\n	return pathFlavorFor(a).relative(a, b) === \"\";\n}\nfunction targetsGitDir(filePath, cwd) {\n	const pp = pathFlavorFor(cwd);\n	const resolved = resolveIn(cwd, filePath);\n	if (!isWithin(cwd, resolved)) return false;\n	const rel = pp.relative(cwd, resolved);\n	if (rel === \"\") return false;\n	return rel.split(pp.sep).includes(\".git\");\n}\nfunction targetsNodeModules(filePath, cwd) {\n	return resolveIn(cwd, filePath).split(/[/\\\\]/).includes(\"node_modules\");\n}\n\n//#endregion\n//#region src/rules.ts\nconst GIT_FLAGS_WITH_ARG = /* @__PURE__ */ new Set([\n	\"-C\",\n	\"-c\",\n	\"--git-dir\",\n	\"--work-tree\"\n]);\nfunction getGitSubcommand(tokens) {\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return t;\n	}\n}\nconst WORKTREE_ADVICE = \"You're creating a feature branch in the primary worktree. An isolated worktree keeps this work independent of other windows, and with no commits on this branch yet, converting is cheap -- `git worktree add ../<dir> -b <branch>` (a sibling outside the repo, with its own dependency install). Claude Code keeps this session inside its own working tree, so the work continues in a new session opened in the sibling worktree. If you cannot open a session there, stay in the primary checkout on this branch and check `git branch --show-current` before each commit.\";\nfunction isGitBranchCreation(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"checkout\" && sub !== \"switch\") return false;\n	const after = tokens.slice(tokens.indexOf(sub) + 1);\n	const creationLetters = sub === \"checkout\" ? [\"b\", \"B\"] : [\"c\", \"C\"];\n	return after.some((t) => {\n		const cluster = splitShortOptionCluster(t, sub);\n		return cluster !== void 0 && cluster.letters.some((l) => creationLetters.includes(l));\n	});\n}\nfunction worktreeAdvice(tokens, ctx) {\n	return isGitBranchCreation(tokens) && isPrimaryWorktree(ctx.cwd) ? WORKTREE_ADVICE : void 0;\n}\nconst GIT_FORCE_CREATE_LETTER = {\n	switch: \"C\",\n	checkout: \"B\"\n};\nconst GIT_FORCE_CREATE_LONG = {\n	flag: \"--force-create\",\n	shortest: \"--force-\"\n};\nfunction gitForceCreateTargets(after, letterSub) {\n	const letter = GIT_FORCE_CREATE_LETTER[letterSub];\n	const longFlag = GIT_FORCE_CREATE_LONG;\n	const targets = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (letterSub === \"switch\") {\n			const [flag, ...rest] = t.split(\"=\");\n			if (flag !== void 0 && flag.length >= longFlag.shortest.length && longFlag.flag.startsWith(flag)) {\n				const target = rest.length > 0 ? rest.join(\"=\") : after[i + 1];\n				if (target !== void 0) targets.push(target);\n				continue;\n			}\n		}\n		const cluster = splitShortOptionCluster(t, letterSub);\n		if (cluster === void 0 || !cluster.letters.includes(letter)) continue;\n		if (cluster.attachedValue !== void 0 && cluster.attachedValue !== \"\") {\n			targets.push(cluster.attachedValue);\n			continue;\n		}\n		const next = after[i + 1];\n		if (next !== void 0) targets.push(next);\n	}\n	return targets;\n}\nfunction gitCommandForceCreateTargets(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (sub === \"switch\" || sub === \"checkout\") return gitForceCreateTargets(tokens.slice(tokens.indexOf(sub) + 1), sub);\n	if (sub === \"worktree\") {\n		const worktreeIdx = tokens.indexOf(\"worktree\");\n		if (tokens[worktreeIdx + 1] !== \"add\") return [];\n		return gitForceCreateTargets(tokens.slice(worktreeIdx + 2), \"checkout\");\n	}\n	return [];\n}\nfunction isGitProtectedBranchForceCreate(tokens, ctx) {\n	const targets = gitCommandForceCreateTargets(tokens);\n	if (targets.length === 0) return false;\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	return targets.some((t) => protectedSet.has(t));\n}\nfunction isGitProtectedBranchRefWrite(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"branch\") return false;\n	const { flags, positionals } = splitGitBranchArgs(tokens.slice(tokens.indexOf(sub) + 1));\n	if (positionals.length === 0) return false;\n	let deleteMode = false;\n	let renameMode = false;\n	let copyMode = false;\n	let forceMode = false;\n	for (const flag of flags) {\n		if (flag.letters !== void 0) {\n			if (flag.letters.includes(\"d\") || flag.letters.includes(\"D\")) deleteMode = true;\n			if (flag.letters.includes(\"m\") || flag.letters.includes(\"M\")) renameMode = true;\n			if (flag.letters.includes(\"c\") || flag.letters.includes(\"C\")) copyMode = true;\n			if (flag.letters.includes(\"f\") || flag.letters.includes(\"M\") || flag.letters.includes(\"C\")) forceMode = true;\n			continue;\n		}\n		if (flag.name === \"delete\") deleteMode = true;\n		if (flag.name === \"move\") renameMode = true;\n		if (flag.name === \"copy\") copyMode = true;\n		if (flag.name === \"force\") forceMode = true;\n	}\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	if (deleteMode && positionals.some((p) => protectedSet.has(p))) return true;\n	if (renameMode && positionals.length >= 2 && protectedSet.has(positionals[0])) return true;\n	if (forceMode) {\n		const destination = renameMode || copyMode ? positionals[positionals.length - 1] : positionals[0];\n		if (destination !== void 0 && protectedSet.has(destination)) return true;\n	}\n	return false;\n}\nfunction refspecDestination(refspec) {\n	const spec = refspec.startsWith(\"+\") ? refspec.slice(1) : refspec;\n	const colon = spec.lastIndexOf(\":\");\n	return (colon === -1 ? spec : spec.slice(colon + 1)).replace(/^refs\\/heads\\//, \"\");\n}\nconst GIT_BRANCH_VALUE_FLAG_NAMES = /* @__PURE__ */ new Set([\n	\"contains\",\n	\"no-contains\",\n	\"merged\",\n	\"no-merged\",\n	\"points-at\",\n	\"sort\",\n	\"format\",\n	\"set-upstream-to\"\n]);\nfunction splitGitBranchArgs(after) {\n	const flags = [];\n	const positionals = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (t.startsWith(\"--\") && t !== \"--\") {\n			const eq = t.indexOf(\"=\");\n			const name = eq > 0 ? t.slice(2, eq) : t.slice(2);\n			flags.push({\n				raw: t,\n				name\n			});\n			if (eq < 0 && GIT_BRANCH_VALUE_FLAG_NAMES.has(name)) i++;\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, \"branch\");\n		if (cluster === void 0) {\n			flags.push({ raw: t });\n			continue;\n		}\n		flags.push({\n			raw: t,\n			letters: cluster.letters\n		});\n		if (cluster.attachedValue === \"\") i++;\n	}\n	return {\n		flags,\n		positionals\n	};\n}\nconst GIT_FETCH_VALUE_FLAG_NAMES = /* @__PURE__ */ new Set([\n	\"depth\",\n	\"deepen\",\n	\"shallow-since\",\n	\"shallow-exclude\",\n	\"negotiation-tip\",\n	\"filter\",\n	\"jobs\",\n	\"server-option\",\n	\"upload-pack\",\n	\"refmap\",\n	\"submodule-prefix\",\n	\"recurse-submodules-default\"\n]);\nfunction splitGitFetchArgs(after) {\n	const flags = [];\n	const positionals = [];\n	const refmaps = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (t === \"--\") {\n			flags.push({ raw: t });\n			continue;\n		}\n		if (t.startsWith(\"--\")) {\n			const eq = t.indexOf(\"=\");\n			const name = eq > 0 ? t.slice(2, eq) : t.slice(2);\n			flags.push({\n				raw: t,\n				name\n			});\n			if (name === \"refmap\") {\n				if (eq > 0) refmaps.push(t.slice(eq + 1));\n				else if (after[i + 1] !== void 0) refmaps.push(after[i + 1]);\n			}\n			if (eq < 0 && GIT_FETCH_VALUE_FLAG_NAMES.has(name)) i++;\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, \"fetch\");\n		if (cluster === void 0) {\n			flags.push({ raw: t });\n			continue;\n		}\n		flags.push({\n			raw: t,\n			letters: cluster.letters\n		});\n		if (cluster.attachedValue === \"\") i++;\n	}\n	return {\n		flags,\n		positionals,\n		refmaps\n	};\n}\nfunction fetchRefspecTarget(spec) {\n	const body = spec.startsWith(\"+\") ? spec.slice(1) : spec;\n	if (body.startsWith(\"^\")) return { kind: \"none\" };\n	if (!body.includes(\":\")) return { kind: \"none\" };\n	const destination = refspecDestination(body);\n	if (destination === \"\") return { kind: \"none\" };\n	if (destination.startsWith(\"refs/remotes/\")) return { kind: \"tracking\" };\n	if (destination.startsWith(\"refs/\")) return { kind: \"other\" };\n	return {\n		kind: \"branch\",\n		name: destination\n	};\n}\nfunction globToAnchoredRegex(glob) {\n	const escaped = glob.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n	return new RegExp(`^${escaped.replace(/\\\\\\*/g, \".*\")}$`);\n}\nfunction isProtectedFetchBranch(name, protectedSet) {\n	if (protectedSet.has(name)) return true;\n	if (!name.includes(\"*\")) return false;\n	const pattern = globToAnchoredRegex(name);\n	for (const member of protectedSet) if (pattern.test(member)) return true;\n	return false;\n}\nfunction isGitProtectedBranchFetchWrite(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"fetch\") return false;\n	const { positionals, refmaps } = splitGitFetchArgs(tokens.slice(tokens.indexOf(sub) + 1));\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	return [...positionals, ...refmaps].some((spec) => {\n		const target = fetchRefspecTarget(spec);\n		if (target.kind !== \"branch\" || target.name === void 0) return false;\n		return isProtectedFetchBranch(target.name, protectedSet);\n	});\n}\nfunction isGitProtectedUpdateRef(tokens, ctx) {\n	const after = tokens.slice(tokens.indexOf(\"update-ref\") + 1);\n	let ref;\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === \"-m\") {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		ref = t;\n		break;\n	}\n	if (ref === void 0) return false;\n	return getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []).has(ref.replace(/^refs\\/heads\\//, \"\"));\n}\nfunction gitEffectiveCwd(tokens, cwd) {\n	let dir = cwd;\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (t === \"-C\") {\n			const next = args[i + 1];\n			if (next !== void 0) dir = path.resolve(dir, next);\n			i++;\n			continue;\n		}\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (!t.startsWith(\"-\")) break;\n	}\n	return dir;\n}\nconst GIT_SWITCH_NEUTRAL_FLAGS = /* @__PURE__ */ new Set([\n	\"-q\",\n	\"--quiet\",\n	\"-f\",\n	\"--force\",\n	\"--discard-changes\",\n	\"-m\",\n	\"--merge\",\n	\"--no-track\",\n	\"--progress\",\n	\"--no-progress\",\n	\"--guess\",\n	\"--no-guess\",\n	\"--ignore-other-worktrees\",\n	\"--recurse-submodules\",\n	\"--no-recurse-submodules\"\n]);\nconst GIT_SWITCH_CREATE_FLAGS = /* @__PURE__ */ new Set([\n	\"--create\",\n	\"--force-create\",\n	\"--orphan\"\n]);\nconst GIT_CHECKOUT_PATH_FLAGS = /* @__PURE__ */ new Set([\n	\"--ours\",\n	\"--theirs\",\n	\"-p\",\n	\"--patch\",\n	\"--conflict\",\n	\"--pathspec-from-file\",\n	\"--pathspec-file-nul\",\n	\"--overlay\",\n	\"--no-overlay\"\n]);\nconst GIT_SWITCH_NEUTRAL_LETTERS = /* @__PURE__ */ new Set([\n	\"q\",\n	\"f\",\n	\"m\"\n]);\nfunction switchTarget(after, sub, isCheckoutBranch) {\n	if (sub === \"checkout\" && after.includes(\"--\")) return void 0;\n	const createLetters = sub === \"checkout\" ? [\"b\", \"B\"] : [\"c\", \"C\"];\n	const known = (l) => GIT_SWITCH_NEUTRAL_LETTERS.has(l) || createLetters.includes(l);\n	const positionals = [];\n	let created;\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (GIT_SWITCH_NEUTRAL_FLAGS.has(t)) continue;\n		const eq = t.indexOf(\"=\");\n		if (sub === \"checkout\" && GIT_CHECKOUT_PATH_FLAGS.has(eq === -1 ? t : t.slice(0, eq))) return;\n		if (GIT_SWITCH_CREATE_FLAGS.has(eq === -1 ? t : t.slice(0, eq))) {\n			created = eq === -1 ? after[++i] : t.slice(eq + 1);\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, sub);\n		if (cluster === void 0 || !cluster.letters.every(known)) return null;\n		if (cluster.letters.some((l) => createLetters.includes(l))) created = cluster.attachedValue ? cluster.attachedValue : after[++i];\n	}\n	if (created !== void 0) return created;\n	if (positionals.length !== 1) return void 0;\n	const target = positionals[0];\n	if (target === \"HEAD\" || target === \"@\") return void 0;\n	if (sub === \"checkout\" && !isCheckoutBranch(target)) return void 0;\n	return target;\n}\nfunction branchSwitch(tokens, ctx, resolved) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"switch\" && sub !== \"checkout\") return void 0;\n	const dir = gitEffectiveCwd(tokens, ctx.cwd);\n	const isCheckoutBranch = (name) => !resolved || getProtectedBranches(dir, ctx.repoProtectedBranches ?? []).has(name) || resolveCommit(dir, name) !== null;\n	const target = switchTarget(tokens.slice(tokens.indexOf(sub) + 1), sub, isCheckoutBranch);\n	if (!resolved) return target === void 0 ? void 0 : {\n		dir,\n		branch: null\n	};\n	return target === void 0 ? void 0 : {\n		dir,\n		branch: target\n	};\n}\nconst GIT_CHECKED_OUT_WRITES = /* @__PURE__ */ new Set([\n	\"commit\",\n	\"merge\",\n	\"rebase\",\n	\"cherry-pick\",\n	\"revert\",\n	\"am\",\n	\"pull\"\n]);\nfunction subcommandArgs(tokens, sub, valueFlags = /* @__PURE__ */ new Set()) {\n	const after = tokens.slice(tokens.indexOf(sub) + 1);\n	const flags = [];\n	const positionals = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		flags.push(t);\n		if (valueFlags.has(t)) i++;\n	}\n	return {\n		flags,\n		positionals\n	};\n}\nconst GIT_PUSH_VALUE_FLAGS = /* @__PURE__ */ new Set([\n	\"-o\",\n	\"--push-option\",\n	\"--repo\",\n	\"--receive-pack\",\n	\"--exec\"\n]);\nfunction isMergeFastForwardFromUpstream(tokens, upstream) {\n	const { flags, positionals } = subcommandArgs(tokens, \"merge\");\n	if (!flags.includes(\"--ff-only\") || positionals.length !== 1) return false;\n	const ref = positionals[0];\n	return ref === \"@{u}\" || ref === \"@{upstream}\" || upstream !== null && ref === upstream;\n}\nconst GIT_PULL_NO_REBASE = /* @__PURE__ */ new Set([\n	\"--rebase=false\",\n	\"--rebase=no\",\n	\"--rebase=off\",\n	\"--rebase=0\"\n]);\nfunction isPullFromUpstream(tokens, upstream) {\n	const { flags, positionals } = subcommandArgs(tokens, \"pull\");\n	if (flags.some((t) => t.startsWith(\"--rebase\") && !GIT_PULL_NO_REBASE.has(t) || t === \"--no-ff\" || !t.startsWith(\"--\") && t.slice(1).includes(\"r\"))) return false;\n	if (positionals.length === 0) return true;\n	if (positionals.length !== 2 || upstream === null) return false;\n	const [remote, branch] = positionals;\n	return `${remote}/${branch.replace(/^refs\\/heads\\//, \"\")}` === upstream;\n}\nfunction isRefMovingReset(tokens, cwd, head) {\n	if (tokens.slice(tokens.indexOf(\"reset\") + 1).includes(\"--\")) return false;\n	const { positionals } = subcommandArgs(tokens, \"reset\");\n	if (positionals.length !== 1) return false;\n	if (head !== \"HEAD\" && /^(HEAD|@)/.test(positionals[0])) return false;\n	const target = resolveCommit(cwd, positionals[0]);\n	if (target === null) return false;\n	return target !== resolveCommit(cwd, head);\n}\nfunction pushDestinations(tokens, current) {\n	const { positionals } = subcommandArgs(tokens, \"push\", GIT_PUSH_VALUE_FLAGS);\n	const refspecs = positionals.slice(1);\n	if (refspecs.length === 0) return null;\n	const names = [];\n	for (const spec of refspecs) {\n		const dst = refspecDestination(spec);\n		if (dst === \"HEAD\" || dst === \"@\") {\n			if (current !== null) names.push(current);\n			continue;\n		}\n		names.push(dst);\n	}\n	return names;\n}\nconst GIT_PUSH_EVERY_BRANCH = /* @__PURE__ */ new Set([\n	\"--all\",\n	\"--branches\",\n	\"--mirror\"\n]);\nfunction leavesRefInPlace(tokens, sub) {\n	const { flags } = subcommandArgs(tokens, sub);\n	if (flags.includes(\"--abort\") || flags.includes(\"--quit\")) return true;\n	return sub === \"commit\" && flags.includes(\"--dry-run\");\n}\nfunction movesProtectedRef(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub === void 0) return false;\n	if (sub === \"switch\" || sub === \"checkout\" || sub === \"worktree\") return isGitProtectedBranchForceCreate(tokens, ctx);\n	if (sub === \"branch\") return isGitProtectedBranchRefWrite(tokens, ctx);\n	if (sub === \"fetch\") return isGitProtectedBranchFetchWrite(tokens, ctx);\n	if (sub === \"update-ref\") return isGitProtectedUpdateRef(tokens, ctx);\n	if (sub !== \"push\" && sub !== \"reset\" && !GIT_CHECKED_OUT_WRITES.has(sub)) return false;\n	const cwd = gitEffectiveCwd(tokens, ctx.cwd);\n	const pending = ctx.pendingBranches?.[cwd];\n	const current = pending ? pending.branch : getCurrentBranch(cwd);\n	const protectedSet = getProtectedBranches(cwd, ctx.repoProtectedBranches ?? []);\n	const onProtected = current !== null && protectedSet.has(current);\n	if (sub === \"push\") {\n		const { flags } = subcommandArgs(tokens, \"push\", GIT_PUSH_VALUE_FLAGS);\n		if (flags.some((f) => GIT_PUSH_EVERY_BRANCH.has(f))) return true;\n		const destinations = pushDestinations(tokens, current);\n		if (destinations === null) {\n			if (flags.includes(\"--tags\")) return false;\n			return onProtected;\n		}\n		return destinations.some((d) => protectedSet.has(d));\n	}\n	if (!onProtected) return false;\n	if (leavesRefInPlace(tokens, sub)) return false;\n	if (sub === \"reset\") return isRefMovingReset(tokens, cwd, pending ? current : \"HEAD\");\n	if (sub === \"merge\" || sub === \"pull\") {\n		const upstream = getUpstream(cwd, current);\n		if (sub === \"merge\" && isMergeFastForwardFromUpstream(tokens, upstream)) return false;\n		if (sub === \"pull\" && isPullFromUpstream(tokens, upstream)) return false;\n	}\n	return true;\n}\nconst PNPM_BUILTINS = /* @__PURE__ */ new Set([\n	\"install\",\n	\"i\",\n	\"add\",\n	\"remove\",\n	\"rm\",\n	\"uninstall\",\n	\"un\",\n	\"update\",\n	\"up\",\n	\"upgrade\",\n	\"list\",\n	\"ls\",\n	\"ll\",\n	\"la\",\n	\"why\",\n	\"view\",\n	\"info\",\n	\"show\",\n	\"outdated\",\n	\"audit\",\n	\"licenses\",\n	\"init\",\n	\"create\",\n	\"link\",\n	\"unlink\",\n	\"pack\",\n	\"publish\",\n	\"config\",\n	\"set\",\n	\"get\",\n	\"store\",\n	\"cache\",\n	\"rebuild\",\n	\"rb\",\n	\"prune\",\n	\"dedupe\",\n	\"dlx\",\n	\"exec\",\n	\"run\",\n	\"patch\",\n	\"patch-commit\",\n	\"recursive\",\n	\"-r\"\n]);\nconst NPM_READ_OPS = /* @__PURE__ */ new Set([\n	\"view\",\n	\"info\",\n	\"show\"\n]);\nfunction isNpmReadOp(tokens) {\n	const sub = tokens[1];\n	return sub !== void 0 && NPM_READ_OPS.has(sub);\n}\nfunction getNpmRedirectReason(tokens) {\n	const sub = tokens[1];\n	const BASE = \"This project uses pnpm.\";\n	if (!sub) return `${BASE} Use \\`pnpm\\` instead of npm.`;\n	if (sub === \"install\" || sub === \"i\" || sub === \"ci\") {\n		if (tokens.slice(2).some((t) => !t.startsWith(\"-\"))) return `${BASE} Use \\`pnpm add <pkg>\\` instead of \\`npm install <pkg>\\`.`;\n		return `${BASE} Use \\`pnpm install\\` instead of npm.`;\n	}\n	if (sub === \"add\") return `${BASE} Use \\`pnpm add <pkg>\\` instead of npm.`;\n	if (sub === \"uninstall\" || sub === \"remove\" || sub === \"rm\" || sub === \"un\" || sub === \"r\") return `${BASE} Use \\`pnpm remove <pkg>\\` instead of npm.`;\n	if (sub === \"run\" || sub === \"run-script\") return `${BASE} Use \\`pnpm run <script>\\` or \\`pnpm <script>\\` instead of npm.`;\n	if (sub === \"test\" || sub === \"t\" || sub === \"tst\") return `${BASE} Use \\`pnpm test\\` instead of npm.`;\n	if (sub === \"start\") return `${BASE} Use \\`pnpm start\\` instead of npm.`;\n	if (sub === \"stop\") return `${BASE} Use \\`pnpm stop\\` instead of npm.`;\n	if (sub === \"restart\") return `${BASE} Use \\`pnpm restart\\` instead of npm.`;\n	if (sub === \"exec\") return `${BASE} Use \\`pnpm exec <cmd>\\` instead of npm.`;\n	if (sub === \"list\" || sub === \"ls\" || sub === \"ll\" || sub === \"la\") return `${BASE} Use \\`pnpm list\\` instead of npm.`;\n	if (sub === \"why\") return `${BASE} Use \\`pnpm why\\` instead of npm.`;\n	if (sub === \"outdated\") return `${BASE} Use \\`pnpm outdated\\` instead of npm.`;\n	if (sub === \"audit\") return `${BASE} Use \\`pnpm audit\\` instead of npm.`;\n	if (sub === \"update\" || sub === \"up\" || sub === \"upgrade\") return `${BASE} Use \\`pnpm update\\` instead of npm.`;\n	if (sub === \"init\") return `${BASE} Use \\`pnpm init\\` instead of npm.`;\n	if (sub === \"publish\") return `${BASE} Use \\`pnpm publish\\` instead of npm.`;\n	if (sub === \"link\") return `${BASE} Use \\`pnpm link\\` instead of npm.`;\n	if (sub === \"unlink\") return `${BASE} Use \\`pnpm unlink\\` instead of npm.`;\n	if (sub === \"pack\") return `${BASE} Use \\`pnpm pack\\` instead of npm.`;\n	if (sub === \"cache\") return `${BASE} Use \\`pnpm store\\` instead of \\`npm cache\\`.`;\n	if (sub === \"config\" || sub === \"set\" || sub === \"get\") return `${BASE} Use \\`pnpm config\\` instead of npm.`;\n	return `${BASE} Use the equivalent pnpm command instead of npm.`;\n}\nconst LAST_POSITIONAL_DEST = /* @__PURE__ */ new Set([\n	\"cp\",\n	\"mv\",\n	\"rsync\",\n	\"install\",\n	\"ln\"\n]);\nconst ALL_POSITIONAL_DEST = /* @__PURE__ */ new Set([\"tee\", \"truncate\"]);\nfunction explicitTargetDirectory(rest) {\n	for (const [i, t] of rest.entries()) {\n		if (t === \"-t\" || t === \"--target-directory\") return rest[i + 1] ?? null;\n		if (t.startsWith(\"--target-directory=\")) return t.slice(19);\n	}\n	return null;\n}\nconst OUTPUT_REDIRECT = /^(?:\\d*|&)>{1,2}$/;\nconst OUTPUT_REDIRECT_ATTACHED = /^(?:\\d*|&)>{1,2}(.+)$/;\nconst INPUT_REDIRECT = /^\\d*<$/;\nconst INPUT_REDIRECT_ATTACHED = /^\\d*<([^<].*)$/;\nfunction spacedRedirectDirection(token) {\n	if (OUTPUT_REDIRECT.test(token)) return \"out\";\n	if (INPUT_REDIRECT.test(token)) return \"in\";\n	return null;\n}\nfunction splitRedirects(tokens) {\n	const redirects = [];\n	const rest = [];\n	for (let i = 0; i < tokens.length; i++) {\n		const t = tokens[i];\n		const spaced = spacedRedirectDirection(t);\n		if (spaced !== null) {\n			const next = tokens[i + 1];\n			if (next !== void 0) redirects.push({\n				direction: spaced,\n				target: next\n			});\n			i++;\n			continue;\n		}\n		const out = OUTPUT_REDIRECT_ATTACHED.exec(t);\n		if (out) {\n			redirects.push({\n				direction: \"out\",\n				target: out[1]\n			});\n			continue;\n		}\n		const input = INPUT_REDIRECT_ATTACHED.exec(t);\n		if (input) {\n			redirects.push({\n				direction: \"in\",\n				target: input[1]\n			});\n			continue;\n		}\n		rest.push(t);\n	}\n	return {\n		redirects,\n		rest\n	};\n}\nfunction redirectTargets(tokens, direction) {\n	return splitRedirects(tokens).redirects.filter((r) => r.direction === direction).map((r) => r.target);\n}\nfunction writeDestinations(tokens) {\n	const cmd = path.basename(tokens[0] ?? \"\");\n	const rest = tokens.slice(1);\n	const dests = redirectTargets(tokens, \"out\");\n	if (cmd === \"dd\") dests.push(...rest.filter((t) => t.startsWith(\"of=\")).map((t) => t.slice(3)));\n	else if (cmd === \"sed\") {\n		if (rest.some((t) => t === \"--in-place\" || /^-[a-zA-Z]*i/.test(t))) dests.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	} else if (ALL_POSITIONAL_DEST.has(cmd)) dests.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	else if (LAST_POSITIONAL_DEST.has(cmd)) {\n		if (cmd === \"cp\" && rest.includes(\"--remove-destination\")) return dests;\n		const targetDir = explicitTargetDirectory(rest);\n		if (targetDir !== null) dests.push(targetDir);\n		else {\n			const last = rest.findLast((t) => !t.startsWith(\"-\"));\n			if (last !== void 0) dests.push(last);\n		}\n	}\n	return dests;\n}\nfunction writesIntoNodeModules(tokens, ctx) {\n	return writeDestinations(tokens).some((d) => targetsNodeModules(d, ctx.cwd));\n}\nconst NODE_MODULES_WRITE_REASON = \"Don't write into node_modules/. Its files are hardlinks into pnpm's global store, so overwriting one in place (plain `cp`, `>` redirect, `sed -i`, ...) writes through the link and corrupts that package for every project on this machine -- silently, since the directory you wrote into ends up fine. To test a local build as an installed dependency, run it directly (`node packages/<pkg>/dist/bin.mjs <cmd>`), or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`). If you must replace a file in place, `cp --remove-destination` is safe -- it unlinks the target first. Run `pnpm store status` to check whether the store is already damaged.\";\nfunction isChmod777(tokens) {\n	return tokens.some((t) => t === \"777\" || t === \"0777\");\n}\nfunction isGitForcePush(tokens) {\n	const pushIdx = tokens.indexOf(\"push\");\n	if (pushIdx === -1) return false;\n	return tokens.slice(pushIdx + 1).some((t) => t === \"--force\" || t === \"-f\");\n}\nconst ENV_READ_FILE_COMMANDS = /* @__PURE__ */ new Set([\n	\"cat\",\n	\"head\",\n	\"tail\",\n	\"less\",\n	\"more\",\n	\"source\",\n	\".\"\n]);\nconst GREP_FAMILY_COMMANDS = /* @__PURE__ */ new Set([\n	\"grep\",\n	\"rg\",\n	\"ag\"\n]);\nfunction grepFileOperands(rest) {\n	const files = [];\n	let patternAccountedFor = false;\n	let optionsEnded = false;\n	for (let i = 0; i < rest.length; i++) {\n		const t = rest[i];\n		if (!optionsEnded && t === \"--\") {\n			optionsEnded = true;\n			continue;\n		}\n		if (!optionsEnded) {\n			if (t === \"-f\" || t === \"--file\") {\n				const value = rest[i + 1];\n				if (value !== void 0) {\n					files.push(value);\n					i++;\n				}\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"--file=\")) {\n				files.push(t.slice(7));\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"-f\") && t !== \"-f\" && !t.startsWith(\"--\")) {\n				files.push(t.slice(2));\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t === \"-e\" || t === \"--regexp\") {\n				i++;\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"--regexp=\") || t.startsWith(\"-e\") && t !== \"-e\" && !t.startsWith(\"--\")) {\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"-\")) continue;\n		}\n		if (!patternAccountedFor) {\n			patternAccountedFor = true;\n			continue;\n		}\n		files.push(t);\n	}\n	return files;\n}\nfunction envFileOperands(tokens) {\n	const cmd = path.basename(tokens[0] ?? \"\");\n	const { redirects, rest } = splitRedirects(tokens.slice(1));\n	const operands = redirects.filter((r) => r.direction === \"in\").map((r) => r.target);\n	if (GREP_FAMILY_COMMANDS.has(cmd)) operands.push(...grepFileOperands(rest));\n	else if (ENV_READ_FILE_COMMANDS.has(cmd)) operands.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	return operands;\n}\nconst HEALTH_CEILING_FILES = [\"health-baseline.json\", \".tooling.json\"];\nconst HEALTH_BASELINE_FILE = \"health-baseline.json\";\nconst HEALTH_RAISE_REASON = \"A health ceiling raise travels alone: open a ceiling-only pull request -- only health-baseline.json and .tooling.json changed -- for a human to merge, or split the module. `health:check` refuses the raise beside code either way. To restore the default branch's copy run `git show origin/<default>:health-baseline.json > health-baseline.json`, and to adopt lower counts run `pnpm exec bst health:check --update-baseline`.\";\nfunction writesHealthBaseline(tokens, cwd) {\n	const destinations = writeDestinations(tokens);\n	if (!destinations.some((dest) => baseName(dest) === \"health-baseline.json\")) return false;\n	const root = getRepoTopLevel(cwd) ?? cwd;\n	return destinations.some((dest) => samePath(resolveIn(cwd, dest), path.join(root, HEALTH_BASELINE_FILE)));\n}\nfunction baseName(target) {\n	const segments = target.split(/[/\\\\]/);\n	return segments[segments.length - 1] ?? \"\";\n}\nfunction isBaselineRestore(tokens) {\n	if (path.basename(tokens[0] ?? \"\") !== \"git\") return false;\n	let i = 1;\n	while (tokens[i]?.startsWith(\"-\") === true) i += GIT_FLAGS_WITH_ARG.has(tokens[i] ?? \"\") ? 2 : 1;\n	if (tokens[i] !== \"show\") return false;\n	return tokens.slice(i + 1).some((token) => token.includes(\":\") && baseName(token.slice(token.lastIndexOf(\":\") + 1)) === \"health-baseline.json\");\n}\nfunction isHealthBaselineReset(tokens) {\n	return tokens.includes(\"health:check\") && tokens.includes(\"--update-baseline\") && tokens.includes(\"--reset\");\n}\nfunction raiseTravelsWithCode(cwd) {\n	return branchCarriesOtherFiles(cwd, HEALTH_CEILING_FILES) === true;\n}\nconst denyRules = [\n	{\n		name: \"sudo\",\n		match: /^sudo$/,\n		action: \"deny\",\n		reason: \"Don't use sudo. If you need elevated permissions, ask me to do it manually.\"\n	},\n	{\n		name: \"git-force-push\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitForcePush(tokens),\n		reason: \"Use `git push --force-with-lease` instead of `--force`.\"\n	},\n	{\n		name: \"git-protected-branch-write\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens, ctx) => movesProtectedRef(tokens, ctx),\n		reason: \"This would move a protected branch (main, master, the remote's default branch, or one listed in .claude/hooks/bst-hook.settings.json#protectedBranches). Work on a feature branch in a worktree: `git worktree add ../<repo>-<topic> -b feat/<topic>`, then commit and push there. To bring `main` up to date, use `git pull --ff-only`.\"\n	},\n	{\n		name: \"chmod-777\",\n		match: /^chmod$/,\n		action: \"deny\",\n		when: (tokens) => isChmod777(tokens),\n		reason: \"Don't use 777 permissions. Use more restrictive permissions.\"\n	},\n	{\n		name: \"node-modules-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens, ctx) => writesIntoNodeModules(tokens, ctx),\n		reason: NODE_MODULES_WRITE_REASON\n	},\n	{\n		name: \"env-file-read\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens) => envFileOperands(tokens).some(isEnvFile),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens) => redirectTargets(tokens, \"out\").some(isEnvFile),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"health-baseline-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens, ctx) => writesHealthBaseline(tokens, ctx.cwd) && !isBaselineRestore(tokens) && raiseTravelsWithCode(ctx.cwd),\n		reason: HEALTH_RAISE_REASON\n	},\n	{\n		name: \"health-baseline-reset\",\n		match: /^bst$/,\n		action: \"deny\",\n		when: (tokens, ctx) => isHealthBaselineReset(tokens) && raiseTravelsWithCode(ctx.cwd),\n		reason: HEALTH_RAISE_REASON\n	},\n	{\n		name: \"npx-redirect\",\n		match: /^npx$/,\n		action: \"deny\",\n		reason: \"This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\"\n	},\n	{\n		name: \"mise-self-update\",\n		match: /^mise$/,\n		action: \"deny\",\n		when: (tokens) => tokens[1] === \"self-update\",\n		reason: \"Don't self-update mise. The version is Renovate-managed; ask a human to bump the pin.\"\n	}\n];\n\n//#endregion\n//#region src/lib/script-resolver.ts\nconst PackageJsonSchema = object({ scripts: record(string(), unknown()) });\nfunction resolveScript(scriptName, cwd) {\n	const scripts = readScripts(cwd);\n	if (!scripts) return null;\n	const main = scripts[scriptName];\n	if (typeof main !== \"string\") return null;\n	const pre = scripts[`pre${scriptName}`];\n	const post = scripts[`post${scriptName}`];\n	return {\n		pre: typeof pre === \"string\" ? pre : null,\n		main,\n		post: typeof post === \"string\" ? post : null\n	};\n}\nfunction resolveFilteredScript(scriptName, filterPkg, cwd) {\n	const pkgDir = findWorkspacePackageDir(filterPkg, cwd);\n	if (!pkgDir) return null;\n	const script = resolveScript(scriptName, pkgDir);\n	if (!script) return null;\n	return {\n		...script,\n		pkgDir\n	};\n}\nfunction resolveRecursiveScripts(scriptName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	const results = [];\n	for (const pkgDir of pkgDirs) {\n		const resolved = resolveScript(scriptName, pkgDir);\n		if (resolved) results.push({\n			...resolved,\n			pkgDir\n		});\n	}\n	return results;\n}\nfunction listWorkspacePackageDirs(rootDir) {\n	const patterns = readWorkspacePatterns(rootDir);\n	if (!patterns) return null;\n	const dirs = [];\n	for (const pattern of patterns) {\n		if (!pattern.endsWith(\"/*\")) continue;\n		const baseDir = pattern.slice(0, -2);\n		const parentDir = resolve(rootDir, baseDir);\n		let entries;\n		try {\n			entries = readdirSync(parentDir);\n		} catch {\n			continue;\n		}\n		for (const entry of entries) {\n			const entryDir = join(parentDir, entry);\n			try {\n				if (!statSync(entryDir).isDirectory()) continue;\n			} catch {\n				continue;\n			}\n			dirs.push(entryDir);\n		}\n	}\n	return dirs.length > 0 ? dirs : null;\n}\nfunction findWorkspacePackageDir(pkgName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	for (const entryDir of pkgDirs) {\n		const name = readPackageName(entryDir);\n		if (name === pkgName || name === `@${pkgName}`) return entryDir;\n		if (entryDir.split(\"/\").pop() === pkgName) return entryDir;\n		if (name) {\n			if ((name.startsWith(\"@\") ? name.split(\"/\")[1] : name) === pkgName) return entryDir;\n		}\n	}\n	return null;\n}\nfunction readWorkspacePatterns(rootDir) {\n	try {\n		const lines = readFileSync(join(rootDir, \"pnpm-workspace.yaml\"), \"utf-8\").split(\"\\n\");\n		const packagesIdx = lines.findIndex((l) => /^packages\\s*:/.test(l));\n		if (packagesIdx === -1) return null;\n		const patterns = [];\n		for (let i = packagesIdx + 1; i < lines.length; i++) {\n			const line = lines[i];\n			const match = /^\\s+-\\s+(.+)$/.exec(line);\n			if (!match) break;\n			patterns.push(match[1].trim().replace(/['\"`]/g, \"\"));\n		}\n		return patterns.length > 0 ? patterns : null;\n	} catch {\n		return null;\n	}\n}\nconst PackageNameSchema = object({ name: string() });\nfunction readPackageName(dir) {\n	try {\n		const raw = readFileSync(join(dir, \"package.json\"), \"utf-8\");\n		const result = PackageNameSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.name;\n	} catch {\n		return null;\n	}\n}\nfunction readScripts(cwd) {\n	try {\n		const raw = readFileSync(join(cwd, \"package.json\"), \"utf-8\");\n		const result = PackageJsonSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.scripts;\n	} catch {\n		return null;\n	}\n}\n\n//#endregion\n//#region src/lib/workspace-root.ts\nfunction findWorkspaceRoot(cwd) {\n	let dir = resolve(cwd);\n	while (true) {\n		if (existsSync(join(dir, \"pnpm-workspace.yaml\"))) return dir;\n		const parent = dirname(dir);\n		if (parent === dir) return null;\n		dir = parent;\n	}\n}\n\n//#endregion\n//#region src/evaluate.ts\nconst MAX_EVAL_DEPTH = 5;\nfunction subshellBody(command) {\n	if (!command.startsWith(\"(\") || !command.endsWith(\")\")) return null;\n	let depth = 0;\n	let quote = null;\n	for (let i = 0; i < command.length; i++) {\n		const ch = command[i];\n		if (quote !== null) {\n			if (ch === quote) quote = null;\n			else if (ch === \"\\\\\" && quote === \"\\\"\") i++;\n			continue;\n		}\n		if (ch === \"\\\\\") i++;\n		else if (ch === \"'\" || ch === \"\\\"\") quote = ch;\n		else if (ch === \"(\") depth++;\n		else if (ch === \")\") {\n			depth--;\n			if (depth === 0) return i === command.length - 1 ? command.slice(1, -1) : null;\n		}\n	}\n	return null;\n}\nfunction extractCdDir(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok || tokenResult.tokens.length !== 2) return null;\n	const tokens = tokenResult.tokens;\n	if (tokens[0] !== \"cd\") return null;\n	const dir = tokens[1];\n	if (path.isAbsolute(dir)) return dir;\n	return path.resolve(ctx.cwd, dir);\n}\nfunction extractBranchSwitch(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok) return void 0;\n	let tokens = tokenResult.tokens;\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) envSkipped++;\n	tokens = tokens.slice(envSkipped);\n	if (tokens.length === 0 || path.basename(tokens[0]) !== \"git\") return void 0;\n	return branchSwitch(tokens, ctx, checkInjection(tokens, segment).safe);\n}\nfunction evaluateCommand(command, ctx) {\n	if (ctx.depth >= MAX_EVAL_DEPTH) return {\n		action: \"none\",\n		rule: null,\n		reason: \"max evaluation depth exceeded\"\n	};\n	const trimmed = command.trim();\n	if (!trimmed) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	const body = subshellBody(trimmed);\n	if (body !== null) return evaluateCommand(body, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	const segments = splitCommand(trimmed);\n	if (segments.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	let firstNone = null;\n	const currentCtx = { ...ctx };\n	let unknownAfterNext;\n	for (const segment of segments) {\n		if (segment.operator === \"&&\") {\n			const cdDir = extractCdDir(segment.command, currentCtx);\n			if (cdDir) currentCtx.cwd = cdDir;\n		}\n		const result = evaluateSegment(segment.command, currentCtx);\n		if (result.action === \"deny\") return result;\n		if (!firstNone) firstNone = result;\n		if (unknownAfterNext) {\n			currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[unknownAfterNext.dir]: unknownAfterNext\n			};\n			unknownAfterNext = void 0;\n		}\n		const switched = extractBranchSwitch(segment.command, currentCtx);\n		if (switched) {\n			const unknown = {\n				dir: switched.dir,\n				branch: null\n			};\n			if (segment.operator === \"&&\") currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[switched.dir]: switched\n			};\n			else if (segment.operator === \"||\") unknownAfterNext = unknown;\n			else currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[switched.dir]: unknown\n			};\n		}\n	}\n	return firstNone ?? {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n}\nfunction evaluateResolvedScript(resolved, ctx) {\n	if (resolved.pre) {\n		const preResult = evaluateCommand(resolved.pre, ctx);\n		if (preResult.action === \"deny\") return preResult;\n	}\n	const mainResult = evaluateCommand(resolved.main, ctx);\n	if (mainResult.action === \"deny\") return mainResult;\n	if (resolved.post) {\n		const postResult = evaluateCommand(resolved.post, ctx);\n		if (postResult.action === \"deny\") return postResult;\n	}\n	return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n}\nfunction evaluateSegment(rawSegment, ctx) {\n	const trimmed = rawSegment.trim();\n	const body = subshellBody(trimmed);\n	if (body !== null) return evaluateCommand(body, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (trimmed.startsWith(\"(\") && trimmed.endsWith(\")\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"subshell\"\n	};\n	const tokenResult = tokenize(rawSegment);\n	if (!tokenResult.ok) return {\n		action: \"none\",\n		rule: null,\n		reason: tokenResult.error\n	};\n	let tokens = tokenResult.tokens;\n	if (tokens.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) envSkipped++;\n	if (envSkipped >= tokens.length) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	tokens = tokens.slice(envSkipped);\n	if (writesIntoNodeModules(tokens, ctx)) return {\n		action: \"deny\",\n		rule: \"node-modules-write\",\n		reason: NODE_MODULES_WRITE_REASON\n	};\n	const injection = checkInjection(tokens, rawSegment);\n	if (!injection.safe) return {\n		action: \"none\",\n		rule: null,\n		reason: injection.reason\n	};\n	const SAFE_REDIRECT_TOKENS = /* @__PURE__ */ new Set([\n		\"2>&1\",\n		\"2>/dev/null\",\n		\">/dev/null\",\n		\"1>/dev/null\"\n	]);\n	tokens = tokens.filter((t, i) => {\n		if (SAFE_REDIRECT_TOKENS.has(t)) return false;\n		if ((t === \">\" || t === \">>\") && tokens[i + 1] === \"/dev/null\") return false;\n		if (t === \"/dev/null\" && i > 0 && (tokens[i - 1] === \">\" || tokens[i - 1] === \">>\")) return false;\n		return true;\n	});\n	const cmdName = path.basename(tokens[0]);\n	if (cmdName === \"command\" && tokens.length > 1) return evaluateCommand(joinTokens(tokens.slice(1)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (cmdName === \"env\") {\n		let envIdx = 1;\n		while (envIdx < tokens.length && /^\\w+=/.test(tokens[envIdx])) envIdx++;\n		if (envIdx >= tokens.length) return {\n			action: \"none\",\n			rule: null,\n			reason: null\n		};\n		return evaluateCommand(joinTokens(tokens.slice(envIdx)), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"pnpm\") return evaluatePnpm(tokens, ctx);\n	if (cmdName === \"npm\") return evaluateNpm(tokens);\n	if (cmdName === \"mise\" && tokens[1] === \"exec\") {\n		const inner = miseExecInner(tokens);\n		if (!inner) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare mise exec\"\n		};\n		return evaluateCommand(joinTokens(inner), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"bash\" || cmdName === \"sh\" || cmdName === \"zsh\") return evaluateShellC(tokens, ctx);\n	if (cmdName === \"xargs\") return evaluateXargs(tokens, ctx);\n	if (cmdName === \"node\" && (tokens.includes(\"-e\") || tokens.includes(\"-p\") || tokens.includes(\"--eval\") || tokens.includes(\"--print\"))) return {\n		action: \"none\",\n		rule: null,\n		reason: \"node eval\"\n	};\n	for (const rule of denyRules) if (rule.match.test(cmdName)) {\n		if (!rule.when || rule.when(tokens, ctx)) return {\n			action: \"deny\",\n			rule: rule.name,\n			reason: rule.reason ?? null\n		};\n	}\n	const advice = cmdName === \"git\" ? worktreeAdvice(tokens, ctx) : void 0;\n	return {\n		action: \"none\",\n		rule: null,\n		reason: `no rule matched: ${cmdName}`,\n		...advice ? { advice } : {}\n	};\n}\nfunction miseExecInner(tokens) {\n	const dashIdx = tokens.indexOf(\"--\");\n	if (dashIdx === -1) return void 0;\n	const inner = tokens.slice(dashIdx + 1);\n	return inner.length > 0 ? inner : void 0;\n}\nfunction scanPnpmFlags(subTokens, from, state) {\n	for (let i = from; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t.startsWith(\"--filter=\") || t === \"-F\" || t.startsWith(\"-F=\")) return {\n			name: void 0,\n			filterIdx: i\n		};\n		if (t === \"-r\" || t === \"--recursive\") {\n			state.isRecursive = true;\n			continue;\n		}\n		if (t === \"-w\" || t === \"--workspace-root\") {\n			state.isWorkspaceRoot = true;\n			continue;\n		}\n		if (t === \"-C\" || t === \"--dir\") {\n			state.dirOverride = subTokens[++i];\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			state.dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		return { name: t };\n	}\n	return { name: void 0 };\n}\nfunction evaluatePnpm(tokens, ctx) {\n	const subTokens = tokens.slice(1);\n	const state = {\n		isRecursive: false,\n		isWorkspaceRoot: false,\n		dirOverride: void 0\n	};\n	const scan = scanPnpmFlags(subTokens, 0, state);\n	if (scan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, scan.filterIdx, ctx, state.dirOverride);\n	const subcommand = scan.name;\n	const subcommandIdx = subcommand ? subTokens.indexOf(subcommand) : -1;\n	if (!subcommand) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (subcommand === \"dlx\") return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm dlx\"\n	};\n	if (subcommand === \"add\") return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm add\"\n	};\n	if (subcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcommandIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName;\n	let { isRecursive, isWorkspaceRoot, dirOverride } = state;\n	if (subcommand === \"run\") {\n		const runScan = scanPnpmFlags(subTokens, subcommandIdx + 1, state);\n		({isRecursive, isWorkspaceRoot, dirOverride} = state);\n		if (runScan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, runScan.filterIdx, ctx, state.dirOverride);\n		if (!runScan.name) return {\n			action: \"none\",\n			rule: null,\n			reason: \"pnpm run without script name\"\n		};\n		scriptName = runScan.name;\n	} else if (!PNPM_BUILTINS.has(subcommand)) scriptName = subcommand;\n	else return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (isRecursive) return evaluatePnpmRecursive(scriptName, ctx);\n	if (isWorkspaceRoot) {\n		const root = findWorkspaceRoot(ctx.cwd);\n		if (!root) return {\n			action: \"none\",\n			rule: null,\n			reason: \"workspace root not found\"\n		};\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: root\n		});\n	}\n	if (dirOverride) {\n		const resolved = path.resolve(ctx.cwd, dirOverride);\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: resolved\n		});\n	}\n	return evaluatePnpmScript(scriptName, ctx);\n}\nfunction evaluatePnpmScript(scriptName, ctx) {\n	const resolved = resolveScript(scriptName, ctx.cwd);\n	if (!resolved) return {\n		action: \"none\",\n		rule: null,\n		reason: \"script resolution failed\"\n	};\n	const res = evaluateResolvedScript(resolved, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (res.action === \"deny\") return res;\n	return {\n		action: \"none\",\n		rule: `pnpm-script:${scriptName}`,\n		reason: null\n	};\n}\nfunction evaluatePnpmRecursive(scriptName, ctx) {\n	const resolved = resolveRecursiveScripts(scriptName, ctx.cwd);\n	if (!resolved || resolved.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm recursive\"\n	};\n	for (const pkg of resolved) {\n		const res = evaluateResolvedScript(pkg, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: pkg.pkgDir ?? ctx.cwd\n		});\n		if (res.action === \"deny\") return res;\n	}\n	return {\n		action: \"none\",\n		rule: `pnpm-recursive:${scriptName}`,\n		reason: null\n	};\n}\nfunction evaluateNpm(tokens) {\n	if (isNpmReadOp(tokens)) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	return {\n		action: \"deny\",\n		rule: \"npm-redirect\",\n		reason: getNpmRedirectReason(tokens)\n	};\n}\nfunction collectFiltersAndScan(subTokens, from, filterPkgs) {\n	let dirOverride;\n	for (let i = from; i < subTokens.length; i += 1) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t === \"-F\") {\n			const pkg = subTokens[i + 1];\n			if (pkg === void 0 || pkg.startsWith(\"-\")) return void 0;\n			filterPkgs.push(pkg);\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"--filter=\") || t.startsWith(\"-F=\")) {\n			const pkg = t.startsWith(\"-F=\") ? t.slice(3) : t.slice(9);\n			if (pkg === \"\") return void 0;\n			filterPkgs.push(pkg);\n			continue;\n		}\n		if (t === \"-r\" || t === \"--recursive\" || t === \"-w\" || t === \"--workspace-root\") continue;\n		if (t === \"-C\" || t === \"--dir\") {\n			dirOverride = subTokens[i + 1];\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return {\n			name: t,\n			index: i,\n			dirOverride\n		};\n	}\n	return {\n		name: void 0,\n		index: -1,\n		dirOverride\n	};\n}\nfunction evaluatePnpmFilter(_tokens, subTokens, filterIdx, ctx, stateDir) {\n	const filterPkgs = [];\n	const scan = collectFiltersAndScan(subTokens, filterIdx, filterPkgs);\n	if (scan === void 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	let dirOverride = scan.dirOverride ?? stateDir;\n	if (filterPkgs.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	const filterSubcommand = scan.name;\n	const subcmdIdx = scan.index;\n	if (filterSubcommand === void 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without subcommand\"\n	};\n	if (PNPM_BUILTINS.has(filterSubcommand) && filterSubcommand !== \"run\" && filterSubcommand !== \"exec\") return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (filterSubcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcmdIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName = filterSubcommand;\n	if (filterSubcommand === \"run\") {\n		const runScan = collectFiltersAndScan(subTokens, subcmdIdx + 1, filterPkgs);\n		if (runScan === void 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"pnpm --filter without package\"\n		};\n		scriptName = runScan.name;\n		if (runScan.dirOverride !== void 0) dirOverride = runScan.dirOverride;\n	}\n	if (scriptName === void 0 || scriptName.startsWith(\"-\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter run without script name\"\n	};\n	if (PNPM_BUILTINS.has(scriptName) && scriptName !== \"run\") return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	const baseDir = dirOverride ? path.resolve(ctx.cwd, dirOverride) : ctx.cwd;\n	for (const pkg of filterPkgs) {\n		const resolved = resolveFilteredScript(scriptName, pkg, baseDir);\n		if (!resolved) return {\n			action: \"none\",\n			rule: null,\n			reason: \"filtered script resolution failed\"\n		};\n		const res = evaluateResolvedScript(resolved, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: resolved.pkgDir ?? baseDir\n		});\n		if (res.action === \"deny\") return res;\n	}\n	return {\n		action: \"none\",\n		rule: `pnpm-filter:${filterPkgs.join(\",\")}:${scriptName}`,\n		reason: null\n	};\n}\nconst SHELL_LOGIN_FLAGS = /* @__PURE__ */ new Set([\"-l\", \"--login\"]);\nfunction evaluateShellC(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length && SHELL_LOGIN_FLAGS.has(tokens[i])) i++;\n	const flag = tokens[i];\n	if (flag === void 0 || !/^-[lc]+$/.test(flag) || !flag.includes(\"c\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell without a plain -c\"\n	};\n	const cmdArg = tokens[i + 1];\n	if (!cmdArg) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell -c without command\"\n	};\n	if (tokens.length > i + 2) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell -c with positional args\"\n	};\n	return evaluateCommand(cmdArg, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\nconst XARGS_ARG_FLAGS = /* @__PURE__ */ new Set([\n	\"-I\",\n	\"-d\",\n	\"-n\",\n	\"-P\",\n	\"-s\",\n	\"-L\",\n	\"-E\",\n	\"-a\",\n	\"--max-args\",\n	\"--max-procs\",\n	\"--delimiter\",\n	\"--replace\",\n	\"--max-lines\",\n	\"--max-chars\",\n	\"--arg-file\",\n	\"--process-slot-var\"\n]);\nconst XARGS_BOOL_FLAGS = /* @__PURE__ */ new Set([\n	\"-0\",\n	\"--null\",\n	\"-t\",\n	\"--verbose\",\n	\"-r\",\n	\"--no-run-if-empty\",\n	\"-p\",\n	\"--interactive\",\n	\"-x\",\n	\"--exit\",\n	\"--show-limits\"\n]);\nfunction evaluateXargs(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length) {\n		const t = tokens[i];\n		if (!t.startsWith(\"-\")) break;\n		if (XARGS_ARG_FLAGS.has(t)) {\n			i += 2;\n			continue;\n		}\n		const eqIdx = t.indexOf(\"=\");\n		if (eqIdx !== -1) {\n			const flagName = t.slice(0, eqIdx);\n			if (XARGS_ARG_FLAGS.has(flagName)) {\n				i++;\n				continue;\n			}\n		}\n		if (t.length > 2 && XARGS_ARG_FLAGS.has(t.slice(0, 2))) {\n			i++;\n			continue;\n		}\n		if (XARGS_BOOL_FLAGS.has(t)) {\n			i++;\n			continue;\n		}\n		return {\n			action: \"none\",\n			rule: null,\n			reason: \"xargs with unrecognised flags\"\n		};\n	}\n	if (i >= tokens.length) return {\n		action: \"none\",\n		rule: null,\n		reason: \"xargs without command\"\n	};\n	return evaluateCommand(joinTokens(tokens.slice(i)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\n\n//#endregion\n//#region src/file-rules.ts\nconst READ_TOOLS = /* @__PURE__ */ new Set([\n	\"Read\",\n	\"Glob\",\n	\"Grep\"\n]);\nconst WRITE_TOOLS = /* @__PURE__ */ new Set([\"Write\", \"Edit\"]);\nconst fileDenyRules = [\n	{\n		name: \"env-file-read\",\n		tools: READ_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"hooks-folder-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			const hooksDir = path.join(ctx.cwd, \".claude\", \"hooks\");\n			return isWithin(hooksDir, resolved);\n		},\n		reason: \"Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"git-dir-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => targetsGitDir(filePath, ctx.cwd),\n		reason: \"Don't write into .git/ directly. Its internals (config, hooks, refs) are not plain project files -- a config edit can redirect remotes or push destinations that other rules trust, and a hooks/ script runs automatically on the next commit/push. Use git subcommands instead, or ask the user.\"\n	},\n	{\n		name: \"node-modules-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => targetsNodeModules(filePath, ctx.cwd),\n		reason: \"Don't write into node_modules/. Its files are hardlinks into pnpm's global store -- editing one in place corrupts that package for every project on this machine. Edit the source package and rebuild, or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`).\"\n	},\n	{\n		name: \"claude-settings-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			return samePath(resolved, path.join(ctx.cwd, \".claude\", \"settings.json\"));\n		},\n		reason: \"Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"health-baseline-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx, toolInput) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			if (path.basename(resolved) !== \"health-baseline.json\") return false;\n			const root = getRepoTopLevel(ctx.cwd) ?? ctx.cwd;\n			if (!samePath(resolved, path.join(root, \"health-baseline.json\"))) return false;\n			if (!writeRaisesBaseline(resolved, toolInput)) return false;\n			return branchCarriesOtherFiles(ctx.cwd, HEALTH_CEILING_FILES) === true;\n		},\n		reason: HEALTH_RAISE_REASON\n	}\n];\nfunction writeRaisesBaseline(file, toolInput) {\n	let before;\n	try {\n		before = readFileSync(file, \"utf8\");\n	} catch (_error) {\n		return false;\n	}\n	const after = textAfterWrite(before, toolInput);\n	if (after === void 0) return false;\n	const beforeJson = parseJson(before);\n	const afterJson = parseJson(after);\n	if (beforeJson === void 0 || afterJson === void 0) return false;\n	return numberRises(beforeJson, afterJson);\n}\nfunction textAfterWrite(before, toolInput) {\n	const { content, old_string: oldText, new_string: newText, replace_all: all } = toolInput;\n	if (typeof content === \"string\") return content;\n	if (typeof oldText !== \"string\" || typeof newText !== \"string\" || oldText === \"\") return void 0;\n	const at = before.indexOf(oldText);\n	if (at === -1) return void 0;\n	if (all === true) return before.split(oldText).join(newText);\n	return before.slice(0, at) + newText + before.slice(at + oldText.length);\n}\nfunction parseJson(text) {\n	try {\n		const result = record(string(), unknown()).safeParse(JSON.parse(text));\n		return result.success ? result.data : void 0;\n	} catch (_error) {\n		return;\n	}\n}\nfunction numberRises(before, after) {\n	if (typeof after === \"number\") return typeof before !== \"number\" || after > before;\n	if (typeof after !== \"object\" || after === null) return false;\n	const beforeObject = typeof before === \"object\" && before !== null ? before : {};\n	return Object.entries(after).some(([key, value]) => numberRises(Object.entries(beforeObject).find(([k]) => k === key)?.[1], value));\n}\n\n//#endregion\n//#region src/evaluate-tool.ts\nconst FILE_PATH_TOOLS = /* @__PURE__ */ new Set([\n	\"Read\",\n	\"Write\",\n	\"Edit\"\n]);\nconst SEARCH_TOOLS = /* @__PURE__ */ new Set([\"Glob\", \"Grep\"]);\nfunction extractPath(toolName, toolInput, cwd) {\n	if (FILE_PATH_TOOLS.has(toolName)) return parseFilePathInput(toolInput)?.file_path ?? null;\n	if (SEARCH_TOOLS.has(toolName)) return parseSearchInput(toolInput)?.path ?? cwd;\n	return null;\n}\nfunction evaluateToolUse(toolName, toolInput, ctx) {\n	const filePath = extractPath(toolName, toolInput, ctx.cwd);\n	if (filePath === null) return {\n		action: \"none\",\n		rule: null,\n		reason: \"unknown tool input shape\"\n	};\n	for (const rule of fileDenyRules) if (rule.tools.has(toolName) && rule.when(filePath, ctx, toolInput)) return {\n		action: \"deny\",\n		rule: rule.name,\n		reason: rule.reason ?? null\n	};\n	return {\n		action: \"none\",\n		rule: null,\n		reason: \"no file rule matched\"\n	};\n}\n\n//#endregion\n//#region src/lib/settings.ts\nconst SETTINGS_PATH = \".claude/hooks/bst-hook.settings.json\";\nconst BstHookSettingsSchema = object({ protectedBranches: _default(array(string().check(_minLength(1))), []) });\nfunction isFileClean(cwd, relativePath) {\n	try {\n		execFileSync(\"git\", [\n			\"ls-files\",\n			\"--error-unmatch\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\",\n			timeout: GIT_TIMEOUT_MS\n		});\n		execFileSync(\"git\", [\n			\"diff\",\n			\"--quiet\",\n			\"HEAD\",\n			\"--\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\",\n			timeout: GIT_TIMEOUT_MS\n		});\n		return true;\n	} catch {\n		return false;\n	}\n}\nfunction loadRepoSettings(cwd) {\n	const root = findWorkspaceRoot(cwd) ?? cwd;\n	const settingsFile = join(root, SETTINGS_PATH);\n	const empty = { protectedBranches: [] };\n	if (!existsSync(settingsFile)) return empty;\n	if (!isFileClean(root, SETTINGS_PATH)) return empty;\n	try {\n		const raw = readFileSync(settingsFile, \"utf-8\");\n		const parsed = JSON.parse(raw);\n		const result = BstHookSettingsSchema.safeParse(parsed);\n		if (!result.success) return empty;\n		return { protectedBranches: result.data.protectedBranches };\n	} catch {\n		return empty;\n	}\n}\n\n//#endregion\n//#region src/index.ts\nconst inputResult = await readHookInput();\nif (!inputResult.ok) {\n	process.stderr.write(`[bst-hook] invalid hook input: ${inputResult.error}\\n`);\n	audit({\n		sessionId: \"unknown\",\n		cwd: \"unknown\",\n		command: `<invalid input: ${inputResult.error}>`,\n		decision: \"none\",\n		rule: null,\n		reason: `validation failed: ${inputResult.error}`,\n		permissionMode: void 0\n	});\n	process.exit(0);\n}\nconst input = inputResult.data;\nif (input.hook_event_name !== \"PreToolUse\") process.exit(0);\nif (!(/* @__PURE__ */ new Set([\n	\"Bash\",\n	\"Read\",\n	\"Write\",\n	\"Edit\",\n	\"Glob\",\n	\"Grep\"\n])).has(input.tool_name)) process.exit(0);\nconst repoSettings = loadRepoSettings(input.cwd);\nlet decision;\nlet auditCommand;\nif (input.tool_name === \"Bash\") {\n	const bashInput = parseBashInput(input.tool_input);\n	if (!bashInput) {\n		audit({\n			sessionId: input.session_id,\n			cwd: input.cwd,\n			toolName: input.tool_name,\n			command: `<invalid Bash input: ${JSON.stringify(input.tool_input).slice(0, 200)}>`,\n			decision: \"none\",\n			rule: null,\n			reason: \"Bash tool_input missing or invalid 'command' field\",\n			permissionMode: input.permission_mode\n		});\n		process.exit(0);\n	}\n	decision = evaluateCommand(bashInput.command, {\n		cwd: input.cwd,\n		depth: 0,\n		repoProtectedBranches: repoSettings.protectedBranches\n	});\n	auditCommand = bashInput.command;\n} else {\n	const projectDir = findWorkspaceRoot(input.cwd) ?? process.env[\"CLAUDE_PROJECT_DIR\"] ?? input.cwd;\n	decision = evaluateToolUse(input.tool_name, input.tool_input, {\n		cwd: projectDir,\n		sessionId: input.session_id\n	});\n	const filePath = String(input.tool_input[\"file_path\"] ?? input.tool_input[\"path\"] ?? \"\");\n	auditCommand = `${input.tool_name} ${filePath}`;\n}\naudit({\n	sessionId: input.session_id,\n	cwd: input.cwd,\n	toolName: input.tool_name,\n	command: auditCommand,\n	decision: decision.action,\n	rule: decision.rule,\n	reason: decision.reason,\n	permissionMode: input.permission_mode\n});\nif (decision.action === \"deny\") writeDeny(decision.reason);\nelse if (decision.advice) writeAdvice(decision.advice);\n\n//#endregion\nexport {  };",
-	guide: "# bst-hook Permission Guide\n\nThis project uses a PreToolUse hook (`bst-hook`) that checks each Bash command\nand file tool call before it runs. The hook only ever blocks a command; it does\nnot approve anything on its own. A command that matches a rule below is denied,\nwith a message that says what to do instead.\n\n## Denied commands\n\nThese are blocked. The hook tells you what to do instead.\n\n### Bash\n\n- **sudo**: Don't use sudo. If you need elevated permissions, ask me to do it manually.\n- **git-force-push**: Use `git push --force-with-lease` instead of `--force`.\n- **git-protected-branch-write**: This would move a protected branch (main, master, the remote's default branch, or one listed in .claude/hooks/bst-hook.settings.json#protectedBranches). Work on a feature branch in a worktree: `git worktree add ../<repo>-<topic> -b feat/<topic>`, then commit and push there. To bring `main` up to date, use `git pull --ff-only`.\n- **chmod-777**: Don't use 777 permissions. Use more restrictive permissions.\n- **node-modules-write**: Don't write into node_modules/. Its files are hardlinks into pnpm's global store, so overwriting one in place (plain `cp`, `>` redirect, `sed -i`, ...) writes through the link and corrupts that package for every project on this machine -- silently, since the directory you wrote into ends up fine. To test a local build as an installed dependency, run it directly (`node packages/<pkg>/dist/bin.mjs <cmd>`), or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`). If you must replace a file in place, `cp --remove-destination` is safe -- it unlinks the target first. Run `pnpm store status` to check whether the store is already damaged.\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **health-baseline-write**: A health ceiling raise travels alone: open a ceiling-only pull request -- only health-baseline.json and .tooling.json changed -- for a human to merge, or split the module. `health:check` refuses the raise beside code either way. To restore the default branch's copy run `git show origin/<default>:health-baseline.json > health-baseline.json`, and to adopt lower counts run `pnpm exec bst health:check --update-baseline`.\n- **health-baseline-reset**: A health ceiling raise travels alone: open a ceiling-only pull request -- only health-baseline.json and .tooling.json changed -- for a human to merge, or split the module. `health:check` refuses the raise beside code either way. To restore the default branch's copy run `git show origin/<default>:health-baseline.json > health-baseline.json`, and to adopt lower counts run `pnpm exec bst health:check --update-baseline`.\n- **npx-redirect**: This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\n- **mise-self-update**: Don't self-update mise. The version is Renovate-managed; ask a human to bump the pin.\n\n### File tools (Read, Write, Edit, Glob, Grep)\n\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **hooks-folder-write**: Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\n- **git-dir-write**: Don't write into .git/ directly. Its internals (config, hooks, refs) are not plain project files -- a config edit can redirect remotes or push destinations that other rules trust, and a hooks/ script runs automatically on the next commit/push. Use git subcommands instead, or ask the user.\n- **node-modules-write**: Don't write into node_modules/. Its files are hardlinks into pnpm's global store -- editing one in place corrupts that package for every project on this machine. Edit the source package and rebuild, or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`).\n- **claude-settings-write**: Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\n- **health-baseline-write**: A health ceiling raise travels alone: open a ceiling-only pull request -- only health-baseline.json and .tooling.json changed -- for a human to merge, or split the module. `health:check` refuses the raise beside code either way. To restore the default branch's copy run `git show origin/<default>:health-baseline.json > health-baseline.json`, and to adopt lower counts run `pnpm exec bst health:check --update-baseline`.\n\n## How commands are evaluated\n\n- **Pipelines and chains**: every segment is checked; a deny on any segment blocks the whole command.\n- **pnpm scripts**: `pnpm <script>` resolves against `package.json` (including pre/post hooks and `--filter` workspaces) and evaluates the resolved command recursively.\n- **cd propagation**: `cd dir && cmd` evaluates `cmd` relative to the new directory.\n- **Branch switch propagation**: `git switch <branch> && cmd` (or `git checkout <branch>`) evaluates a git write in `cmd` against the branch it switched to, not the one checked out before. This holds only across `&&` and only in the same directory.\n- **Audit log**: all decisions are logged to `.claude/hooks/bst-hook.audit.local.jsonl`.\n\n## Everything else\n\nA command that matches none of the rules above is judged by Claude Code's own\nauto mode, not by this hook.\n"
+	hook: "/**\n * bst-hook -- Claude Code PreToolUse hook\n * @bensandee/claude-hooks\n * https://github.com/bensandee/tooling\n *\n * Auto-generated by @bensandee/tooling repo:sync -- do not edit manually.\n */\nimport * as fs from \"node:fs\";\nimport { existsSync, readFileSync, readdirSync, realpathSync, statSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { execFileSync } from \"node:child_process\";\n\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/util.js\nfunction joinValues(array, separator = \"|\") {\n	return array.map((val) => stringifyPrimitive(val)).join(separator);\n}\nfunction jsonStringifyReplacer(_, value) {\n	if (typeof value === \"bigint\") return value.toString();\n	return value;\n}\nvar Cached = class {\n	constructor(getter) {\n		this._getter = getter;\n		this._value = void 0;\n	}\n	get value() {\n		const getter = this._getter;\n		if (getter !== void 0) {\n			this._value = getter();\n			this._getter = void 0;\n		}\n		return this._value;\n	}\n};\nfunction cached(getter) {\n	return new Cached(getter);\n}\nfunction nullish(input) {\n	return input === null || input === void 0;\n}\nfunction cleanRegex(source) {\n	const start = source.startsWith(\"^\") ? 1 : 0;\n	const end = source.endsWith(\"$\") ? source.length - 1 : source.length;\n	return source.slice(start, end);\n}\nfunction assignProp(target, prop, value) {\n	Object.defineProperty(target, prop, {\n		value,\n		writable: true,\n		enumerable: true,\n		configurable: true\n	});\n}\nconst captureStackTrace = \"captureStackTrace\" in Error ? Error.captureStackTrace : (..._args) => {};\nfunction isObject(data) {\n	return typeof data === \"object\" && data !== null && !Array.isArray(data);\n}\nfunction isPlainObject(o) {\n	if (isObject(o) === false) return false;\n	const ctor = o.constructor;\n	if (ctor === void 0) return true;\n	if (typeof ctor !== \"function\") return true;\n	const prot = ctor.prototype;\n	if (isObject(prot) === false) return false;\n	if (Object.prototype.hasOwnProperty.call(prot, \"isPrototypeOf\") === false) return false;\n	return true;\n}\nfunction shallowClone(o) {\n	if (isPlainObject(o)) return { ...o };\n	if (Array.isArray(o)) return [...o];\n	if (o instanceof Map) return new Map(o);\n	if (o instanceof Set) return new Set(o);\n	return o;\n}\nfunction clone(inst, def, params) {\n	const cl = new inst._zod.constr(def ?? inst._zod.def);\n	if (!def || params?.parent) cl._zod.parent = inst;\n	return cl;\n}\nfunction normalizeParams(_params) {\n	const params = _params;\n	if (!params) return {};\n	if (typeof params === \"string\") return { error: () => params };\n	if (params?.message !== void 0) {\n		if (params?.error !== void 0) throw new Error(\"Cannot specify both `message` and `error` params\");\n		params.error = params.message;\n	}\n	delete params.message;\n	if (typeof params.error === \"string\") return {\n		...params,\n		error: () => params.error\n	};\n	return params;\n}\nfunction stringifyPrimitive(value) {\n	if (typeof value === \"bigint\") return value.toString() + \"n\";\n	if (typeof value === \"string\") return `\"${value}\"`;\n	return `${value}`;\n}\nfunction optionalKeys(shape) {\n	return Object.keys(shape).filter((k) => {\n		return shape[k]._zod.optin !== void 0 && shape[k]._zod.optout === \"optional\";\n	});\n}\nfunction aborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue !== true) return true;\n	return false;\n}\nfunction explicitlyAborted(x, startIndex = 0) {\n	if (x.aborted === true) return true;\n	for (let i = startIndex; i < x.issues.length; i++) if (x.issues[i]?.continue === false) return true;\n	return false;\n}\nfunction prefixIssues(path, issues) {\n	return issues.map((iss) => {\n		var _a;\n		(_a = iss).path ?? (_a.path = []);\n		iss.path.unshift(path);\n		return iss;\n	});\n}\nfunction unwrapMessage(message) {\n	return typeof message === \"string\" ? message : message?.message;\n}\nfunction sizeCaps(defChecks) {\n	const caps = [];\n	for (const ch of defChecks ?? []) {\n		const d = ch._zod.def;\n		if (!/_(length|size)$|_equals$/.test(d.check)) break;\n		const max = d.maximum ?? d.length ?? d.size;\n		if (max >= 0) caps.push([max, ch]);\n	}\n	return caps;\n}\nfunction attachSchema(issues, start, inst) {\n	var _a;\n	for (let i = start; i < issues.length; i++) (_a = issues[i]).schema ?? (_a.schema = inst);\n}\nfunction finalizeIssue(iss, ctx, config) {\n	var _a;\n	const traits = iss.inst?._zod?.traits;\n	if (traits?.has(\"$ZodType\")) {\n		if (traits.has(\"$ZodCheck\")) (_a = iss).schema ?? (_a.schema = iss.inst);\n		else iss.schema = iss.inst;\n	}\n	const schemaError = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;\n	const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config.customError?.(iss)) ?? unwrapMessage(config.localeError?.(iss)) ?? \"Invalid input\";\n	const full = {};\n	for (const k of Object.keys(iss)) {\n		if (k === \"inst\" || k === \"schema\" || k === \"continue\" || k === \"input\" || k === \"__proto__\") continue;\n		full[k] = iss[k];\n	}\n	full.path ?? (full.path = []);\n	full.message = message;\n	if (ctx?.reportInput) full.input = iss.input;\n	return full;\n}\nconst highSurrogate = /[\\uD800-\\uDBFF]/;\nfunction codePointLength(str) {\n	const units = str.length;\n	if (!highSurrogate.test(str)) return units;\n	let count = units;\n	for (let i = 0; i < units - 1; i++) if ((str.charCodeAt(i) & 64512) === 55296 && (str.charCodeAt(i + 1) & 64512) === 56320) {\n		count--;\n		i++;\n	}\n	return count;\n}\nfunction getLengthableOrigin(input) {\n	if (Array.isArray(input)) return \"array\";\n	if (typeof input === \"string\") return \"string\";\n	return \"unknown\";\n}\nfunction parsedType(data) {\n	const t = typeof data;\n	switch (t) {\n		case \"number\": return Number.isNaN(data) ? \"nan\" : \"number\";\n		case \"object\": {\n			if (data === null) return \"null\";\n			if (Array.isArray(data)) return \"array\";\n			const obj = data;\n			if (obj && Object.getPrototypeOf(obj) !== Object.prototype && \"constructor\" in obj && obj.constructor) return obj.constructor.name;\n		}\n	}\n	return t;\n}\nfunction members(proto, table) {\n	for (const key in table) {\n		const desc = Object.getOwnPropertyDescriptor(table, key);\n		if (desc.get) Object.defineProperty(proto, key, {\n			...desc,\n			enumerable: false\n		});\n		else defineBound(proto, key, desc.value);\n	}\n}\nfunction own(inst, key, value, enumerable = true) {\n	Object.defineProperty(inst, key, {\n		configurable: true,\n		writable: true,\n		enumerable,\n		value\n	});\n	return value;\n}\nfunction hide(inst, key, value) {\n	return own(inst, key, value, false);\n}\nfunction defineBound(proto, key, fn) {\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			return this == null ? fn : own(this, key, fn.bind(this));\n		},\n		set(value) {\n			own(this, key, value);\n		}\n	});\n}\nfunction claim(inst, sentinel) {\n	const proto = Object.getPrototypeOf(inst);\n	return sentinel in proto ? void 0 : proto;\n}\nlet installing;\nlet broke = false;\nconst breaker = {\n	configurable: true,\n	get() {\n		broke = true;\n	}\n};\nfunction defineLazyInternal(inst, key, compute) {\n	const proto = Object.getPrototypeOf(inst._zod);\n	if (key in proto && installing !== inst._zod) {\n		installing = void 0;\n		return;\n	}\n	installing = inst._zod;\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			Object.defineProperty(this, key, breaker);\n			const outer = broke;\n			broke = false;\n			try {\n				const value = compute(this);\n				if (broke) delete this[key];\n				else Object.defineProperty(this, key, {\n					configurable: true,\n					writable: true,\n					value\n				});\n				broke = broke || outer;\n				return value;\n			} catch (err) {\n				delete this[key];\n				broke = broke || outer;\n				throw err;\n			}\n		},\n		set(value) {\n			Object.defineProperty(this, key, {\n				configurable: true,\n				writable: true,\n				value\n			});\n		}\n	});\n}\nfunction installLazyProp(inst, key, make, enumerable) {\n	const proto = claim(inst, key);\n	if (!proto) return;\n	Object.defineProperty(proto, key, {\n		configurable: true,\n		get() {\n			const desc = {\n				configurable: true,\n				writable: true,\n				enumerable,\n				value: void 0\n			};\n			Object.defineProperty(this, key, desc);\n			desc.value = make(this);\n			Object.defineProperty(this, key, desc);\n			return desc.value;\n		},\n		set(value) {\n			Object.defineProperty(this, key, {\n				configurable: true,\n				writable: true,\n				enumerable,\n				value\n			});\n		}\n	});\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/core.js\nvar _a;\nconst _zodDesc = {\n	value: void 0,\n	enumerable: false\n};\nlet _E = \"captureStackTrace\" in Error ? Error : null;\nfunction newError(Definition) {\n	const E = _E;\n	if (E) {\n		const saved = E.stackTraceLimit;\n		if (typeof saved === \"number\") {\n			try {\n				E.stackTraceLimit = 0;\n			} catch {\n				_E = null;\n				return new Definition();\n			}\n			try {\n				return new Definition();\n			} finally {\n				E.stackTraceLimit = saved;\n			}\n		}\n	}\n	return new Definition();\n}\n/* @__NO_SIDE_EFFECTS__ */\nfunction $constructor(name, initializer, proto, params) {\n	const zodProto = {};\n	function Internals(def) {\n		this.def = def;\n		this.constr = _;\n		this.traits = /* @__PURE__ */ new Set();\n	}\n	Internals.prototype = zodProto;\n	const protoMembers = proto;\n	const initialized = protoMembers && /* @__PURE__ */ new WeakSet();\n	function init(inst, def) {\n		if (!inst._zod) {\n			_zodDesc.value = new Internals(def);\n			try {\n				Object.defineProperty(inst, \"_zod\", _zodDesc);\n			} finally {\n				_zodDesc.value = void 0;\n			}\n		} else if (inst._zod.traits.has(name)) return;\n		inst._zod.traits.add(name);\n		initializer(inst, def);\n		if (initialized) {\n			const own = Object.getPrototypeOf(inst);\n			const ctorProto = inst._zod.constr.prototype;\n			let up = own;\n			while (up && up !== ctorProto) up = Object.getPrototypeOf(up);\n			const target = up ?? own;\n			if (!initialized.has(target)) {\n				initialized.add(target);\n				members(target, protoMembers);\n			}\n		}\n		const proto = _.prototype;\n		for (const k in proto) {\n			if (!Object.prototype.hasOwnProperty.call(proto, k)) continue;\n			if (!(k in inst)) inst[k] = proto[k].bind(inst);\n		}\n	}\n	const Parent = params?.Parent ?? Object;\n	class Definition extends Parent {}\n	Object.defineProperty(Definition, \"name\", { value: name });\n	function _(def) {\n		const inst = params?.Parent ? newError(Definition) : this;\n		init(inst, def);\n		const deferred = inst._zod.deferred;\n		if (deferred) {\n			for (const fn of deferred) fn();\n			inst._zod.deferred = void 0;\n		}\n		const pp = globalThis.__zod_globalConfig?.postProcessor;\n		if (pp) pp(inst);\n		return inst;\n	}\n	Object.defineProperty(_, \"init\", { value: init });\n	Object.defineProperty(_, Symbol.hasInstance, { value: (inst) => {\n		if (params?.Parent && inst instanceof params.Parent) return true;\n		return inst?._zod?.traits?.has(name);\n	} });\n	Object.defineProperty(_, \"name\", { value: name });\n	return _;\n}\nvar $ZodAsyncError = class extends Error {\n	constructor() {\n		super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);\n	}\n};\n(_a = globalThis).__zod_globalConfig ?? (_a.__zod_globalConfig = {});\nconst globalConfig = globalThis.__zod_globalConfig;\nfunction config(newConfig) {\n	if (newConfig) Object.assign(globalConfig, newConfig);\n	return globalConfig;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/errors.js\nfunction _getMessage() {\n	const internals = this._zod;\n	internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));\n	return internals.message;\n}\nfunction _setMessage(value) {\n	this._zod.message = value;\n}\nconst _messageDesc = {\n	get: _getMessage,\n	set: _setMessage,\n	enumerable: true,\n	configurable: true\n};\nconst _issuesDesc = {\n	value: void 0,\n	enumerable: false\n};\nconst _installedToString = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);\nconst initializer = (inst, def) => {\n	inst.name = \"$ZodError\";\n	_issuesDesc.value = def;\n	Object.defineProperty(inst, \"issues\", _issuesDesc);\n	_issuesDesc.value = void 0;\n	Object.defineProperty(inst, \"message\", _messageDesc);\n	const proto = Object.getPrototypeOf(inst);\n	if (!_installedToString.has(proto)) {\n		_installedToString.add(proto);\n		Object.defineProperty(proto, \"toString\", {\n			configurable: true,\n			enumerable: false,\n			get() {\n				const value = () => this.message;\n				Object.defineProperty(this, \"toString\", {\n					value,\n					configurable: true,\n					writable: true\n				});\n				return value;\n			},\n			set(value) {\n				Object.defineProperty(this, \"toString\", {\n					value,\n					configurable: true,\n					writable: true\n				});\n			}\n		});\n	}\n};\nconst $ZodRealError = /* @__PURE__ */ $constructor(\"$ZodError\", initializer, void 0, { Parent: Error });\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/parse.js\nconst _parse = (_Err) => {\n	const fn = (schema, value, _ctx, _params) => {\n		const ctx = _ctx ? {\n			..._ctx,\n			async: false\n		} : { async: false };\n		const result = schema._zod.run({\n			value,\n			issues: []\n		}, ctx);\n		if (result instanceof Promise) throw new $ZodAsyncError();\n		if (result.issues.length) {\n			const e = new ((_params?.Err) ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n			captureStackTrace(e, _params?.callee ?? fn);\n			throw e;\n		}\n		return result.value;\n	};\n	return fn;\n};\nconst parse = /* @__PURE__*/ _parse($ZodRealError);\nconst _parseAsync = (_Err) => {\n	const fn = async (schema, value, _ctx, params) => {\n		const ctx = _ctx ? {\n			..._ctx,\n			async: true\n		} : { async: true };\n		let result = schema._zod.run({\n			value,\n			issues: []\n		}, ctx);\n		if (result instanceof Promise) result = await result;\n		if (result.issues.length) {\n			const e = new ((params?.Err) ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));\n			captureStackTrace(e, params?.callee ?? fn);\n			throw e;\n		}\n		return result.value;\n	};\n	return fn;\n};\nconst parseAsync = /* @__PURE__*/ _parseAsync($ZodRealError);\nconst _safeParse = (_Err) => (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: false\n	} : { async: false };\n	const result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) throw new $ZodAsyncError();\n	return result.issues.length ? failure(_Err, result.issues, ctx) : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParse = /* @__PURE__*/ _safeParse($ZodRealError);\nfunction failure(Err, issues, ctx) {\n	let error;\n	return {\n		success: false,\n		get error() {\n			if (!error) {\n				error = new Err(issues.map((iss) => finalizeIssue(iss, ctx, config())));\n				issues = void 0;\n				ctx = void 0;\n			}\n			return error;\n		},\n		set error(e) {\n			error = e;\n			issues = void 0;\n			ctx = void 0;\n		}\n	};\n}\nconst _safeParseAsync = (_Err) => async (schema, value, _ctx) => {\n	const ctx = _ctx ? {\n		..._ctx,\n		async: true\n	} : { async: true };\n	let result = schema._zod.run({\n		value,\n		issues: []\n	}, ctx);\n	if (result instanceof Promise) result = await result;\n	return result.issues.length ? failure(_Err, result.issues, ctx) : {\n		success: true,\n		data: result.value\n	};\n};\nconst safeParseAsync = /* @__PURE__*/ _safeParseAsync($ZodRealError);\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/regexes.js\nconst anyString = /^[\\s\\S]{0,}$/;\nconst number = /^-?\\d+(?:\\.\\d+)?$/;\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/checks.js\nconst $ZodCheck = /*@__PURE__*/ $constructor(\"$ZodCheck\", (inst, def) => {\n	var _a;\n	inst._zod ?? (inst._zod = {});\n	inst._zod.def = def;\n	(_a = inst._zod).onattach ?? (_a.onattach = []);\n});\nconst _whenHasLength = (payload) => {\n	const val = payload.value;\n	return !nullish(val) && val.length !== void 0;\n};\nconst $ZodCheckMinLength = /*@__PURE__*/ $constructor(\"$ZodCheckMinLength\", (inst, def) => {\n	var _a;\n	$ZodCheck.init(inst, def);\n	(_a = inst._zod.def).when ?? (_a.when = _whenHasLength);\n	inst._zod.check = (payload) => {\n		const input = payload.value;\n		const units = input.length;\n		if ((typeof input === \"string\" && units >= def.minimum && units < def.minimum * 2 ? codePointLength(input) : units) >= def.minimum) return;\n		const origin = getLengthableOrigin(input);\n		payload.issues.push({\n			origin,\n			code: \"too_small\",\n			minimum: def.minimum,\n			inclusive: true,\n			input,\n			inst,\n			continue: !def.abort\n		});\n	};\n});\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/versions.js\nconst version = {\n	major: 4,\n	minor: 6,\n	patch: 7\n};\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/schemas.js\nconst $ZodType = /*@__PURE__*/ $constructor(\"$ZodType\", (inst, def) => {\n	var _a;\n	inst ?? (inst = {});\n	inst._zod.def = def;\n	inst._zod.bag = inst._zod.bag || {};\n	inst._zod.version = version;\n	const defChecks = inst._zod.def.checks;\n	const checks = inst._zod.traits.has(\"$ZodCheck\") ? [inst, ...defChecks ?? []] : defChecks?.length ? [...defChecks] : [];\n	for (const ch of checks) for (const fn of ch._zod.onattach) fn(inst);\n	if (checks.length === 0) {\n		(_a = inst._zod).deferred ?? (_a.deferred = []);\n		inst._zod.deferred?.push(() => {\n			inst._zod.run = inst._zod.parse;\n		});\n	} else {\n		const runChecks = (payload, checks, ctx) => {\n			if (payload.memo) return payload;\n			let isAborted = aborted(payload);\n			let asyncResult;\n			for (const ch of checks) {\n				if (ch._zod.def.when) {\n					if (explicitlyAborted(payload)) continue;\n					if (!ch._zod.def.when(payload)) continue;\n				} else if (isAborted) continue;\n				const currLen = payload.issues.length;\n				const _ = ch._zod.check(payload);\n				if (_ instanceof Promise && ctx?.async === false) throw new $ZodAsyncError();\n				if (asyncResult || _ instanceof Promise) asyncResult = (asyncResult ?? Promise.resolve()).then(async () => {\n					await _;\n					if (payload.issues.length === currLen) return;\n					attachSchema(payload.issues, currLen, inst);\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				});\n				else {\n					if (payload.issues.length === currLen) continue;\n					attachSchema(payload.issues, currLen, inst);\n					if (!isAborted) isAborted = aborted(payload, currLen);\n				}\n			}\n			if (asyncResult) return asyncResult.then(() => {\n				return payload;\n			});\n			return payload;\n		};\n		const handleCanaryResult = (canary, payload, ctx) => {\n			if (aborted(canary)) {\n				canary.aborted = true;\n				return canary;\n			}\n			const checkResult = runChecks(payload, checks, ctx);\n			if (checkResult instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return checkResult.then((checkResult) => inst._zod.parse(checkResult, ctx));\n			}\n			return inst._zod.parse(checkResult, ctx);\n		};\n		inst._zod.run = (payload, ctx) => {\n			if (ctx.skipChecks) return inst._zod.parse(payload, ctx);\n			if (ctx.direction === \"backward\") {\n				const canary = inst._zod.parse({\n					value: payload.value,\n					issues: []\n				}, {\n					...ctx,\n					skipChecks: true\n				});\n				if (canary instanceof Promise) return canary.then((canary) => {\n					return handleCanaryResult(canary, payload, ctx);\n				});\n				return handleCanaryResult(canary, payload, ctx);\n			}\n			const result = inst._zod.parse(payload, ctx);\n			if (result instanceof Promise) {\n				if (ctx.async === false) throw new $ZodAsyncError();\n				return result.then((result) => runChecks(result, checks, ctx));\n			}\n			return runChecks(result, checks, ctx);\n		};\n	}\n}, {\n	get \"~standard\"() {\n		return hide(this, \"~standard\", standardProps(this));\n	},\n	set \"~standard\"(value) {\n		own(this, \"~standard\", value);\n	}\n});\nconst toStandardResult = (r, ctx) => r.issues.length ? { issues: r.issues.map((iss) => finalizeIssue(iss, ctx, config())) } : { value: r.value };\nasync function validateAsync(inst, value) {\n	const ctx = { async: true };\n	return toStandardResult(await inst._zod.run({\n		value,\n		issues: []\n	}, ctx), ctx);\n}\nfunction standardProps(inst) {\n	return {\n		validate: (value) => {\n			const ctx = { async: false };\n			try {\n				const r = inst._zod.run({\n					value,\n					issues: []\n				}, ctx);\n				if (!(r instanceof Promise)) return toStandardResult(r, ctx);\n			} catch (_) {}\n			return validateAsync(inst, value);\n		},\n		vendor: \"zod\",\n		version: 1\n	};\n}\nconst $ZodString = /*@__PURE__*/ $constructor(\"$ZodString\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.pattern = def.pattern ?? anyString;\n	inst._zod.parse = (payload, _) => {\n		if (def.coerce) try {\n			payload.value = String(payload.value);\n		} catch (_) {}\n		if (typeof payload.value === \"string\") return payload;\n		payload.issues.push({\n			expected: \"string\",\n			code: \"invalid_type\",\n			input: payload.value,\n			inst\n		});\n		return payload;\n	};\n});\nconst $ZodUnknown = /*@__PURE__*/ $constructor(\"$ZodUnknown\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.parse = (payload) => payload;\n});\nfunction capSize(inst, size) {\n	const caps = sizeCaps(inst._zod.def.checks);\n	if (!caps.length) return;\n	const cap = Math.min(...caps.map((c) => c[0]));\n	const parse = inst._zod.parse;\n	inst._zod.parse = (payload, ctx) => {\n		const n = size(payload.value);\n		if (n > cap && !ctx?.skipChecks && ctx?.direction !== \"backward\") {\n			for (const [max, ch] of sizeCaps(inst._zod.def.checks)) if (n > max && ch._zod.def.when(payload)) {\n				const start = payload.issues.length;\n				ch._zod.check(payload);\n				payload.issues[start].continue = false;\n				attachSchema(payload.issues, start, inst);\n				return payload;\n			}\n		}\n		return parse(payload, ctx);\n	};\n}\nconst arraySize = (input) => Array.isArray(input) ? input.length : -1;\nfunction handleArrayResult(result, final, index) {\n	if (result.issues.length) final.issues.push(...prefixIssues(index, result.issues));\n	final.value[index] = result.value;\n}\nconst $ZodArray = /*@__PURE__*/ $constructor(\"$ZodArray\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!Array.isArray(input)) {\n			payload.issues.push({\n				expected: \"array\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = memo ? memo.alloc(inst, payload, Array(input.length), ctx) : Array(input.length);\n		const proms = [];\n		const abortEarly = ctx?.abortEarly;\n		for (let i = 0; i < input.length; i++) {\n			const item = input[i];\n			const result = def.element._zod.run({\n				value: item,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) proms.push(result.then((result) => handleArrayResult(result, payload, i)));\n			else {\n				handleArrayResult(result, payload, i);\n				if (abortEarly && result.issues.length !== 0 && aborted(result)) break;\n			}\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n	capSize(inst, arraySize);\n});\nfunction handlePropertyResult(result, final, key, input, optin, optout) {\n	const isPresent = key in input;\n	const isOptionalOut = optout === \"optional\";\n	if (!isPresent && isOptionalOut && optin === \"optional\") return;\n	if (result.issues.length) {\n		if (optin !== void 0 && isOptionalOut && !isPresent) return;\n		final.issues.push(...prefixIssues(key, result.issues));\n	}\n	if (!isPresent && optin === void 0) {\n		if (!result.issues.length) final.issues.push({\n			code: \"invalid_type\",\n			expected: \"nonoptional\",\n			input: void 0,\n			path: [key]\n		});\n		return;\n	}\n	if (result.value === void 0) {\n		if (isPresent || optin === \"defaulted\" && !isOptionalOut) final.value[key] = void 0;\n	} else final.value[key] = result.value;\n}\nconst NO_SYMBOL_KEYS = [];\nfunction normalizeDef(def) {\n	const keys = Object.keys(def.shape);\n	const ownSymbols = Object.getOwnPropertySymbols(def.shape);\n	const symbolKeys = ownSymbols.length ? ownSymbols : NO_SYMBOL_KEYS;\n	const allKeys = symbolKeys.length ? [...keys, ...symbolKeys] : keys;\n	for (const k of allKeys) if (!def.shape?.[k]?._zod?.traits?.has(\"$ZodType\")) throw new Error(`Invalid element at key \"${String(k)}\": expected a Zod schema`);\n	const okeys = optionalKeys(def.shape);\n	return {\n		...def,\n		allKeys,\n		symbolKeys,\n		keySet: new Set(keys),\n		numKeys: keys.length,\n		optionalKeys: new Set(okeys)\n	};\n}\nfunction handleCatchall(proms, input, payload, ctx, def, inst, abortEarly) {\n	const unrecognized = [];\n	const keySet = def.keySet;\n	const _catchall = def.catchall._zod;\n	const t = _catchall.def.type;\n	const optin = _catchall.optin;\n	const optout = _catchall.optout;\n	let seen = 0;\n	for (const key in input) {\n		if (abortEarly && payload.issues.length !== seen) {\n			if (aborted(payload, seen)) break;\n			seen = payload.issues.length;\n		}\n		if (keySet.has(key)) continue;\n		if (key === \"__proto__\") {\n			if (t === \"never\") unrecognized.push(key);\n			continue;\n		}\n		if (t === \"never\") {\n			unrecognized.push(key);\n			continue;\n		}\n		const r = _catchall.run({\n			value: input[key],\n			issues: []\n		}, ctx);\n		if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, optin, optout)));\n		else handlePropertyResult(r, payload, key, input, optin, optout);\n	}\n	if (unrecognized.length) payload.issues.push({\n		code: \"unrecognized_keys\",\n		keys: unrecognized,\n		input,\n		inst,\n		continue: true\n	});\n	if (!proms.length) return payload;\n	return Promise.all(proms).then(() => {\n		return payload;\n	});\n}\nconst $ZodObject = /*@__PURE__*/ $constructor(\"$ZodObject\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const desc = Object.getOwnPropertyDescriptor(def, \"shape\");\n	const sh = desc?.get ? desc.get.raw : def.shape ?? {};\n	if (sh) {\n		const get = () => {\n			const newSh = { ...sh };\n			Object.defineProperty(def, \"shape\", { value: newSh });\n			get.raw = newSh;\n			return newSh;\n		};\n		get.raw = sh;\n		Object.defineProperty(def, \"shape\", { get });\n	}\n	const _normalized = cached(() => normalizeDef(def));\n	defineLazyInternal(inst, \"propValues\", (zod) => {\n		const shape = zod.def.shape;\n		const propValues = {};\n		for (const key in shape) {\n			const field = shape[key]._zod;\n			if (field.values) {\n				if (!Object.prototype.hasOwnProperty.call(propValues, key)) assignProp(propValues, key, /* @__PURE__ */ new Set());\n				for (const v of field.values) propValues[key].add(v);\n				if (field.optin !== void 0) propValues[key].add(void 0);\n			}\n		}\n		return propValues;\n	});\n	const isObject$1 = isObject;\n	const catchall = def.catchall;\n	let value;\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		value ?? (value = _normalized.value);\n		const input = payload.value;\n		if (!isObject$1(input)) {\n			payload.issues.push({\n				expected: \"object\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n		const proms = [];\n		const shape = value.shape;\n		const abortEarly = ctx?.abortEarly;\n		let seen = payload.issues.length;\n		for (const key of value.allKeys) {\n			if (abortEarly && payload.issues.length !== seen) {\n				if (aborted(payload, seen)) break;\n				seen = payload.issues.length;\n			}\n			if (key === \"__proto__\") continue;\n			const el = shape[key];\n			const optin = el._zod.optin;\n			const optout = el._zod.optout;\n			const r = el._zod.run({\n				value: input[key],\n				issues: []\n			}, ctx);\n			if (r instanceof Promise) proms.push(r.then((r) => handlePropertyResult(r, payload, key, input, optin, optout)));\n			else handlePropertyResult(r, payload, key, input, optin, optout);\n		}\n		if (!catchall) return proms.length ? Promise.all(proms).then(() => payload) : payload;\n		return handleCatchall(proms, input, payload, ctx, _normalized.value, inst, abortEarly === true);\n	};\n});\nconst $ZodRecord = /*@__PURE__*/ $constructor(\"$ZodRecord\", (inst, def) => {\n	$ZodType.init(inst, def);\n	const memo = globalConfig.memoizer;\n	memo?.attach(inst);\n	inst._zod.parse = (payload, ctx) => {\n		const input = payload.value;\n		if (!isPlainObject(input)) {\n			payload.issues.push({\n				expected: \"record\",\n				code: \"invalid_type\",\n				input,\n				inst\n			});\n			return payload;\n		}\n		const proms = [];\n		const values = def.keyType._zod.values;\n		if (values && !def.partial) {\n			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n			const recordKeys = /* @__PURE__ */ new Set();\n			for (const key of values) if (typeof key === \"string\" || typeof key === \"number\" || typeof key === \"symbol\") {\n				recordKeys.add(typeof key === \"number\" ? key.toString() : key);\n				if (key === \"__proto__\") continue;\n				const keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (keyResult.issues.length) {\n					payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				if (outKey === \"__proto__\") continue;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			let unrecognized;\n			for (const key in input) if (!recordKeys.has(key)) {\n				if (def.mode === \"loose\") {\n					if (key === \"__proto__\") continue;\n					payload.value[key] = input[key];\n				} else {\n					unrecognized = unrecognized ?? [];\n					unrecognized.push(key);\n				}\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized,\n				continue: true\n			});\n		} else {\n			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};\n			let unrecognized;\n			for (const key of Reflect.ownKeys(input)) {\n				if (key === \"__proto__\") continue;\n				if (!Object.prototype.propertyIsEnumerable.call(input, key)) continue;\n				let keyResult = def.keyType._zod.run({\n					value: key,\n					issues: []\n				}, ctx);\n				if (keyResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n				if (typeof key === \"string\" && number.test(key) && keyResult.issues.length) {\n					const retryResult = def.keyType._zod.run({\n						value: Number(key),\n						issues: []\n					}, ctx);\n					if (retryResult instanceof Promise) throw new Error(\"Async schemas not supported in object keys currently\");\n					if (retryResult.issues.length === 0) keyResult = retryResult;\n				}\n				if (keyResult.issues.length) {\n					if (def.mode === \"loose\") payload.value[key] = input[key];\n					else if (values) {\n						unrecognized = unrecognized ?? [];\n						unrecognized.push(key);\n					} else payload.issues.push({\n						code: \"invalid_key\",\n						origin: \"record\",\n						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),\n						input: key,\n						path: [key],\n						inst\n					});\n					continue;\n				}\n				const outKey = keyResult.value;\n				if (outKey === \"__proto__\") continue;\n				const result = def.valueType._zod.run({\n					value: input[key],\n					issues: []\n				}, ctx);\n				if (result instanceof Promise) proms.push(result.then((result) => {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}));\n				else {\n					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));\n					payload.value[outKey] = result.value;\n				}\n			}\n			if (unrecognized && unrecognized.length > 0) payload.issues.push({\n				code: \"unrecognized_keys\",\n				input,\n				inst,\n				keys: unrecognized,\n				continue: true\n			});\n		}\n		if (proms.length) return Promise.all(proms).then(() => payload);\n		return payload;\n	};\n});\nfunction handleOptionalResult(payload, result) {\n	payload.value = result.issues.length ? void 0 : result.value;\n	return payload;\n}\nconst $ZodOptional = /*@__PURE__*/ $constructor(\"$ZodOptional\", (inst, def) => {\n	$ZodType.init(inst, def);\n	defineLazyInternal(inst, \"optin\", (zod) => zod.def.innerType._zod.optin === \"defaulted\" ? \"defaulted\" : \"optional\");\n	inst._zod.optout = \"optional\";\n	defineLazyInternal(inst, \"values\", (zod) => {\n		const values = zod.def.innerType._zod.values;\n		return values ? /* @__PURE__ */ new Set([...values, void 0]) : void 0;\n	});\n	defineLazyInternal(inst, \"pattern\", (zod) => {\n		const pattern = zod.def.innerType._zod.pattern;\n		return pattern ? new RegExp(`^(${cleanRegex(pattern.source)})?$`) : void 0;\n	});\n	inst._zod.parse = (payload, ctx) => {\n		if (payload.value === void 0) {\n			if (def.innerType._zod.optin !== \"defaulted\") return payload;\n			const result = def.innerType._zod.run({\n				value: payload.value,\n				issues: []\n			}, ctx);\n			if (result instanceof Promise) return result.then((result) => handleOptionalResult(payload, result));\n			return handleOptionalResult(payload, result);\n		}\n		return def.innerType._zod.run(payload, ctx);\n	};\n});\nconst $ZodDefault = /*@__PURE__*/ $constructor(\"$ZodDefault\", (inst, def) => {\n	$ZodType.init(inst, def);\n	inst._zod.optin = \"defaulted\";\n	defineLazyInternal(inst, \"values\", (zod) => zod.def.innerType._zod.values);\n	inst._zod.parse = (payload, ctx) => {\n		if (ctx.direction === \"backward\") return def.innerType._zod.run(payload, ctx);\n		if (payload.value === void 0) {\n			payload.value = def.defaultValue;\n			return payload;\n		}\n		const result = def.innerType._zod.run(payload, ctx);\n		if (result instanceof Promise) return result.then((result) => handleDefaultResult(result, def));\n		return handleDefaultResult(result, def);\n	};\n});\nfunction handleDefaultResult(payload, def) {\n	if (payload.value === void 0) payload.value = def.defaultValue;\n	return payload;\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/en.js\nconst error = () => {\n	const Sizable = {\n		string: {\n			unit: \"characters\",\n			verb: \"to have\"\n		},\n		file: {\n			unit: \"bytes\",\n			verb: \"to have\"\n		},\n		array: {\n			unit: \"items\",\n			verb: \"to have\"\n		},\n		set: {\n			unit: \"items\",\n			verb: \"to have\"\n		},\n		map: {\n			unit: \"entries\",\n			verb: \"to have\"\n		}\n	};\n	function getSizing(origin) {\n		return Sizable[origin] ?? null;\n	}\n	const FormatDictionary = {\n		regex: \"input\",\n		email: \"email address\",\n		url: \"URL\",\n		emoji: \"emoji\",\n		uuid: \"UUID\",\n		uuidv4: \"UUIDv4\",\n		uuidv6: \"UUIDv6\",\n		nanoid: \"nanoid\",\n		guid: \"GUID\",\n		cuid: \"cuid\",\n		cuid2: \"cuid2\",\n		ulid: \"ULID\",\n		xid: \"XID\",\n		ksuid: \"KSUID\",\n		datetime: \"ISO datetime\",\n		date: \"ISO date\",\n		time: \"ISO time\",\n		duration: \"ISO duration\",\n		ipv4: \"IPv4 address\",\n		ipv6: \"IPv6 address\",\n		mac: \"MAC address\",\n		cidrv4: \"IPv4 range\",\n		cidrv6: \"IPv6 range\",\n		base64: \"base64-encoded string\",\n		base64url: \"base64url-encoded string\",\n		json_string: \"JSON string\",\n		e164: \"E.164 number\",\n		currency_code: \"currency code\",\n		credit_card: \"credit card number\",\n		iban: \"IBAN\",\n		jwt: \"JWT\",\n		template_literal: \"input\"\n	};\n	const TypeDictionary = { nan: \"NaN\" };\n	function getTypeName(type, input) {\n		if (type === \"number\" && typeof input === \"number\" && !Number.isFinite(input)) return String(input);\n		return TypeDictionary[type] ?? type;\n	}\n	return (issue) => {\n		switch (issue.code) {\n			case \"invalid_type\": return `Invalid input: expected ${getTypeName(issue.expected)}, received ${getTypeName(parsedType(issue.input), issue.input)}`;\n			case \"invalid_value\":\n				if (issue.values.length === 1) return `Invalid input: expected ${stringifyPrimitive(issue.values[0])}`;\n				return `Invalid option: expected one of ${joinValues(issue.values, \"|\")}`;\n			case \"too_big\": {\n				const adj = issue.exact ? \"exactly \" : issue.inclusive ? \"<=\" : \"<\";\n				const sizing = getSizing(issue.origin);\n				if (sizing) return `Too big: expected ${issue.origin ?? \"value\"} to have ${adj}${issue.maximum.toString()} ${sizing.unit ?? \"elements\"}`;\n				return `Too big: expected ${issue.origin ?? \"value\"} to be ${adj}${issue.maximum.toString()}`;\n			}\n			case \"too_small\": {\n				const adj = issue.exact ? \"exactly \" : issue.inclusive ? \">=\" : \">\";\n				const sizing = getSizing(issue.origin);\n				if (sizing) return `Too small: expected ${issue.origin} to have ${adj}${issue.minimum.toString()} ${sizing.unit}`;\n				return `Too small: expected ${issue.origin} to be ${adj}${issue.minimum.toString()}`;\n			}\n			case \"invalid_format\": {\n				const _issue = issue;\n				if (_issue.format === \"starts_with\") return `Invalid string: must start with \"${_issue.prefix}\"`;\n				if (_issue.format === \"ends_with\") return `Invalid string: must end with \"${_issue.suffix}\"`;\n				if (_issue.format === \"includes\") return `Invalid string: must include \"${_issue.includes}\"`;\n				if (_issue.format === \"regex\") return `Invalid string: must match pattern ${_issue.pattern}`;\n				return `Invalid ${FormatDictionary[_issue.format] ?? issue.format}`;\n			}\n			case \"not_multiple_of\": return `Invalid number: must be a multiple of ${issue.divisor}`;\n			case \"unrecognized_keys\": return `Unrecognized key${issue.keys.length > 1 ? \"s\" : \"\"}: ${joinValues(issue.keys, \", \")}`;\n			case \"invalid_key\": return `Invalid key in ${issue.origin}`;\n			case \"invalid_union\":\n				if (issue.options && Array.isArray(issue.options) && issue.options.length > 0) return `Invalid discriminator value. Expected ${issue.options.map((o) => `'${o}'`).join(\" | \")}`;\n				if (issue.inclusive === false) return \"Invalid input: more than one option matched\";\n				return \"Invalid input\";\n			case \"invalid_element\": return `Invalid value in ${issue.origin}`;\n			default: return `Invalid input`;\n		}\n	};\n};\nfunction en_default() {\n	return { localeError: error() };\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/api.js\nfunction snapshotChecks(def) {\n	if (def.checks) def.checks = [...def.checks];\n	return def;\n}\n// @__NO_SIDE_EFFECTS__\nfunction _string(Class, params) {\n	return new Class(snapshotChecks({\n		type: \"string\",\n		...normalizeParams(params)\n	}));\n}\n// @__NO_SIDE_EFFECTS__\nfunction _unknown(Class) {\n	return new Class({ type: \"unknown\" });\n}\n// @__NO_SIDE_EFFECTS__\nfunction _minLength(minimum, params) {\n	return new $ZodCheckMinLength({\n		check: \"min_length\",\n		...normalizeParams(params),\n		minimum\n	});\n}\n\n//#endregion\n//#region ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/mini/schemas.js\nconst ZodMiniType = /*@__PURE__*/ $constructor(\"ZodMiniType\", (inst, def) => {\n	if (!inst._zod) throw new Error(\"Uninitialized schema in ZodMiniType.\");\n	$ZodType.init(inst, def);\n	inst.def = def;\n	inst.type = def.type;\n}, {\n	get with() {\n		return this.check;\n	},\n	set with(value) {\n		own(this, \"with\", value);\n	},\n	parse(data, params) {\n		return parse(this, data, params, { callee: this.parse });\n	},\n	parseAsync(data, params) {\n		return parseAsync(this, data, params, { callee: this.parseAsync });\n	},\n	safeParse(data, params) {\n		return safeParse(this, data, params);\n	},\n	safeParseAsync(data, params) {\n		return safeParseAsync(this, data, params);\n	},\n	check(...checks) {\n		const def = this.def;\n		return this.clone({\n			...def,\n			checks: [...def.checks ?? [], ...checks.map((ch) => typeof ch === \"function\" ? { _zod: {\n				check: ch,\n				def: { check: \"custom\" },\n				onattach: []\n			} } : ch)]\n		}, { parent: true });\n	},\n	clone(_def, params) {\n		return clone(this, _def, params);\n	},\n	brand() {\n		return this;\n	},\n	register(reg, meta) {\n		reg.add(this, meta);\n		return this;\n	},\n	apply(fn, ...args) {\n		return args.length === 0 ? fn(this) : fn(this, ...args);\n	}\n});\nconst ZodMiniString = /*@__PURE__*/ $constructor(\"ZodMiniString\", (inst, def) => {\n	$ZodString.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction string(params) {\n	return _string(ZodMiniString, params);\n}\nconst ZodMiniUnknown = /*@__PURE__*/ $constructor(\"ZodMiniUnknown\", (inst, def) => {\n	$ZodUnknown.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction unknown() {\n	return _unknown(ZodMiniUnknown);\n}\nconst ZodMiniArray = /*@__PURE__*/ $constructor(\"ZodMiniArray\", (inst, def) => {\n	$ZodArray.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction array(element, params) {\n	return new ZodMiniArray({\n		type: \"array\",\n		element,\n		...normalizeParams(params)\n	});\n}\nconst ZodMiniObject = /*@__PURE__*/ $constructor(\"ZodMiniObject\", (inst, def) => {\n	$ZodObject.init(inst, def);\n	ZodMiniType.init(inst, def);\n	installLazyProp(inst, \"shape\", (self) => self._zod.def.shape, false);\n});\n// @__NO_SIDE_EFFECTS__\nfunction object(shape, params) {\n	const def = {\n		type: \"object\",\n		shape: shape ?? {},\n		...normalizeParams(params)\n	};\n	return new ZodMiniObject(def);\n}\nconst ZodMiniRecord = /*@__PURE__*/ $constructor(\"ZodMiniRecord\", (inst, def) => {\n	$ZodRecord.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction record(keyType, valueType, params) {\n	if (!valueType || !valueType._zod) return new ZodMiniRecord({\n		type: \"record\",\n		keyType: /* @__PURE__ */ string(),\n		valueType: keyType,\n		...normalizeParams(valueType)\n	});\n	return new ZodMiniRecord({\n		type: \"record\",\n		keyType,\n		valueType,\n		...normalizeParams(params)\n	});\n}\nconst ZodMiniOptional = /*@__PURE__*/ $constructor(\"ZodMiniOptional\", (inst, def) => {\n	$ZodOptional.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction optional(innerType) {\n	return new ZodMiniOptional({\n		type: \"optional\",\n		innerType\n	});\n}\nconst ZodMiniDefault = /*@__PURE__*/ $constructor(\"ZodMiniDefault\", (inst, def) => {\n	$ZodDefault.init(inst, def);\n	ZodMiniType.init(inst, def);\n});\n// @__NO_SIDE_EFFECTS__\nfunction _default(innerType, defaultValue) {\n	return new ZodMiniDefault({\n		type: \"default\",\n		innerType,\n		get defaultValue() {\n			return typeof defaultValue === \"function\" ? defaultValue() : shallowClone(defaultValue);\n		}\n	});\n}\n\n//#endregion\n//#region src/lib/hook-io.ts\nconfig(en_default());\nconst HookInputSchema = object({\n	session_id: string(),\n	transcript_path: string(),\n	cwd: string(),\n	permission_mode: string(),\n	hook_event_name: string(),\n	tool_name: string(),\n	tool_input: record(string(), unknown())\n});\nasync function readHookInput() {\n	const chunks = [];\n	for await (const chunk of process.stdin) chunks.push(typeof chunk === \"string\" ? chunk : String(chunk));\n	let parsed;\n	try {\n		parsed = JSON.parse(chunks.join(\"\"));\n	} catch (_error) {\n		return {\n			ok: false,\n			raw: chunks.join(\"\").slice(0, 200),\n			error: \"invalid JSON\"\n		};\n	}\n	const result = HookInputSchema.safeParse(parsed);\n	if (!result.success) return {\n		ok: false,\n		raw: parsed,\n		error: result.error.message\n	};\n	return {\n		ok: true,\n		data: result.data\n	};\n}\nconst BashInputSchema = object({\n	command: string(),\n	description: optional(string())\n});\nconst FilePathInputSchema = object({ file_path: string() });\nconst SearchInputSchema = object({\n	pattern: string(),\n	path: optional(string())\n});\nfunction parseBashInput(toolInput) {\n	const result = BashInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction parseFilePathInput(toolInput) {\n	const result = FilePathInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction parseSearchInput(toolInput) {\n	const result = SearchInputSchema.safeParse(toolInput);\n	return result.success ? result.data : null;\n}\nfunction writeDeny(reason) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		permissionDecision: \"deny\",\n		...reason ? { permissionDecisionReason: reason } : {}\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\nfunction writeAdvice(advice) {\n	const decision = { hookSpecificOutput: {\n		hookEventName: \"PreToolUse\",\n		additionalContext: advice\n	} };\n	process.stdout.write(JSON.stringify(decision));\n}\n\n//#endregion\n//#region src/lib/audit.ts\nconst MAX_LOG_SIZE = 1048576;\nfunction getLogPath() {\n	const hookDir = path.dirname(fileURLToPath(import.meta.url));\n	return path.join(hookDir, \"bst-hook.audit.local.jsonl\");\n}\nfunction rotateIfNeeded(logPath) {\n	try {\n		if (fs.statSync(logPath).size > MAX_LOG_SIZE) {\n			const rotatedPath = `${logPath}.1`;\n			fs.renameSync(logPath, rotatedPath);\n		}\n	} catch (_error) {}\n}\nlet rotationChecked = false;\nfunction audit(entry) {\n	try {\n		const logPath = getLogPath();\n		if (!rotationChecked) {\n			rotateIfNeeded(logPath);\n			rotationChecked = true;\n		}\n		const record = {\n			timestamp: (/* @__PURE__ */ new Date()).toISOString(),\n			...entry\n		};\n		fs.appendFileSync(logPath, JSON.stringify(record) + \"\\n\");\n	} catch (err) {\n		process.stderr.write(`[bst-hook] audit write failed: ${err instanceof Error ? err.message : String(err)}\\n`);\n	}\n}\n\n//#endregion\n//#region src/lib/shell-tokenizer.ts\nfunction scanDoubleQuoted(input, start) {\n	let content = \"\";\n	let i = start;\n	while (i < input.length && input[i] !== \"\\\"\") {\n		if (input[i] === \"\\\\\" && i + 1 < input.length) {\n			const next = input[i + 1];\n			if (next === \"\\\"\" || next === \"\\\\\" || next === \"$\" || next === \"`\") {\n				content += next;\n				i += 2;\n				continue;\n			}\n		}\n		content += input[i];\n		i++;\n	}\n	if (i >= input.length) return null;\n	return {\n		content,\n		next: i + 1\n	};\n}\nfunction tokenize(input) {\n	const tokens = [];\n	let current = \"\";\n	let i = 0;\n	let inToken = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\") {\n			inToken = true;\n			i++;\n			while (i < input.length && input[i] !== \"'\") {\n				current += input[i];\n				i++;\n			}\n			if (i >= input.length) return {\n				ok: false,\n				error: \"unterminated single quote\"\n			};\n			i++;\n		} else if (ch === \"\\\"\") {\n			inToken = true;\n			const scanned = scanDoubleQuoted(input, i + 1);\n			if (!scanned) return {\n				ok: false,\n				error: \"unterminated double quote\"\n			};\n			current += scanned.content;\n			i = scanned.next;\n		} else if (ch === \"\\\\\" && i + 1 < input.length) {\n			inToken = true;\n			current += input[i + 1];\n			i += 2;\n		} else if (ch === \" \" || ch === \"	\") {\n			if (inToken) {\n				tokens.push(current);\n				current = \"\";\n				inToken = false;\n			}\n			i++;\n		} else {\n			inToken = true;\n			current += ch;\n			i++;\n		}\n	}\n	if (inToken) tokens.push(current);\n	return {\n		ok: true,\n		tokens\n	};\n}\nconst SAFE_UNQUOTED_RE = /^[A-Za-z0-9_\\-./=:@%+,]+$/;\nfunction quoteToken(token) {\n	if (token.length > 0 && SAFE_UNQUOTED_RE.test(token)) return token;\n	return \"'\" + token.replace(/'/g, \"'\\\\''\") + \"'\";\n}\nfunction joinTokens(tokens) {\n	return tokens.map(quoteToken).join(\" \");\n}\n\n//#endregion\n//#region src/lib/shell-splitter.ts\nfunction splitCommand(input) {\n	if (!input || !input.trim()) return [];\n	const segments = [];\n	let current = \"\";\n	let i = 0;\n	let inSingleQuote = false;\n	let inDoubleQuote = false;\n	while (i < input.length) {\n		const ch = input[i];\n		if (ch === \"'\" && !inDoubleQuote) {\n			inSingleQuote = !inSingleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\"\" && !inSingleQuote) {\n			inDoubleQuote = !inDoubleQuote;\n			current += ch;\n			i++;\n			continue;\n		}\n		if (ch === \"\\\\\" && !inSingleQuote && i + 1 < input.length) {\n			current += ch + input[i + 1];\n			i += 2;\n			continue;\n		}\n		if (!inSingleQuote && !inDoubleQuote) {\n			if (ch === \"&\" && i + 1 < input.length && input[i + 1] === \"&\") {\n				pushSegment(segments, current, \"&&\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"&\" && !(i + 1 < input.length && input[i + 1] === \">\") && !(i > 0 && (input[i - 1] === \">\" || input[i - 1] === \"<\"))) {\n				pushSegment(segments, current, \"&\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \"|\" && i + 1 < input.length && input[i + 1] === \"|\") {\n				pushSegment(segments, current, \"||\");\n				current = \"\";\n				i += 2;\n				continue;\n			}\n			if (ch === \"|\") {\n				pushSegment(segments, current, \"|\");\n				current = \"\";\n				i++;\n				continue;\n			}\n			if (ch === \";\") {\n				pushSegment(segments, current, \";\");\n				current = \"\";\n				i++;\n				continue;\n			}\n		}\n		current += ch;\n		i++;\n	}\n	const trimmed = current.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator: null\n	});\n	return segments;\n}\nfunction pushSegment(segments, text, operator) {\n	const trimmed = text.trim();\n	if (trimmed) segments.push({\n		command: trimmed,\n		operator\n	});\n}\n\n//#endregion\n//#region src/lib/injection-guard.ts\nfunction hasBraceExpansion(token) {\n	let depth = 0;\n	for (let i = 0; i < token.length; i++) {\n		const ch = token[i];\n		if (ch === \"{\") depth++;\n		else if (ch === \"}\") {\n			if (depth > 0) depth--;\n		} else if (depth >= 1 && (ch === \",\" || ch === \".\" && token[i + 1] === \".\")) return true;\n	}\n	return false;\n}\nfunction checkInjection(tokens, rawSegment) {\n	if (/[\\n\\r]/.test(rawSegment)) return {\n		safe: false,\n		reason: \"unquoted newline in command\"\n	};\n	for (const token of tokens) {\n		if (token === \"`\") return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"`\")) return {\n			safe: false,\n			reason: \"backtick command substitution\"\n		};\n		if (token.includes(\"$\")) return {\n			safe: false,\n			reason: \"unresolved dollar-expansion\"\n		};\n		if (hasBraceExpansion(token)) return {\n			safe: false,\n			reason: \"brace expansion\"\n		};\n		if (token.includes(\"<(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n		if (token.includes(\">(\")) return {\n			safe: false,\n			reason: \"process substitution\"\n		};\n	}\n	return { safe: true };\n}\n\n//#endregion\n//#region src/lib/env-file.ts\nconst ENV_SAFE_SUFFIXES = [\n	\".sample\",\n	\".example\",\n	\".template\"\n];\nconst ENV_TOOL_OWNED_SUFFIXES = [\".check.env\"];\nconst ENV_FILE_PATTERN = /(^|[/\\\\])(\\.env(\\..*)?|.*\\.env(\\..*)?|\\.env)$/;\nfunction isEnvSafeSuffix(filename) {\n	return [...ENV_SAFE_SUFFIXES, ...ENV_TOOL_OWNED_SUFFIXES].some((suffix) => filename.endsWith(suffix));\n}\nfunction isEnvFile(filePath) {\n	if (isEnvSafeSuffix(path.basename(filePath))) return false;\n	return ENV_FILE_PATTERN.test(filePath);\n}\n\n//#endregion\n//#region src/lib/git-state.ts\nconst GIT_TIMEOUT_MS = 5e3;\nfunction getCurrentBranch(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--abbrev-ref\",\n			\"HEAD\"\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!out || out === \"HEAD\") return null;\n		return out;\n	} catch {\n		return null;\n	}\n}\nfunction getRepoTopLevel(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\"rev-parse\", \"--show-toplevel\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		return out === \"\" ? null : out;\n	} catch {\n		return null;\n	}\n}\nfunction getRemoteDefaultBranch(cwd) {\n	try {\n		const out = execFileSync(\"git\", [\n			\"symbolic-ref\",\n			\"--short\",\n			\"refs/remotes/origin/HEAD\"\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!out) return null;\n		return out.startsWith(\"origin/\") ? out.slice(7) : out;\n	} catch {\n		return null;\n	}\n}\nconst DefaultBranchSchema = object({ defaultBranch: optional(string().check(_minLength(1))) });\nfunction getConfiguredDefaultBranch(topLevel) {\n	let parsed;\n	try {\n		parsed = JSON.parse(readFileSync(join(topLevel, \".tooling.json\"), \"utf-8\"));\n	} catch {\n		return null;\n	}\n	const result = DefaultBranchSchema.safeParse(parsed);\n	return result.success ? result.data.defaultBranch ?? null : null;\n}\nconst ALWAYS_PROTECTED = [\"main\", \"master\"];\nfunction getProtectedBranches(cwd, extra) {\n	const set = new Set(ALWAYS_PROTECTED);\n	const remote = getRemoteDefaultBranch(cwd);\n	if (remote) set.add(remote);\n	for (const b of extra) set.add(b);\n	return set;\n}\nfunction getUpstream(cwd, branch) {\n	try {\n		return execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--abbrev-ref\",\n			`${branch}@{upstream}`\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: 5e3\n		}).toString().trim() || null;\n	} catch {\n		return null;\n	}\n}\nfunction resolveCommit(cwd, rev) {\n	try {\n		return execFileSync(\"git\", [\n			\"rev-parse\",\n			\"--verify\",\n			\"--quiet\",\n			`${rev}^{commit}`\n		], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: 5e3\n		}).toString().trim() || null;\n	} catch {\n		return null;\n	}\n}\nfunction branchCarriesOtherFiles(cwd, allowed) {\n	const toplevel = getRepoTopLevel(cwd);\n	if (toplevel === null) return null;\n	try {\n		const defaultBranch = getConfiguredDefaultBranch(toplevel) ?? getRemoteDefaultBranch(toplevel) ?? \"main\";\n		const mergeBase = execFileSync(\"git\", [\n			\"merge-base\",\n			\"HEAD\",\n			`origin/${defaultBranch}`\n		], {\n			cwd: toplevel,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!mergeBase) return null;\n		const names = (args) => execFileSync(\"git\", args, {\n			cwd: toplevel,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().split(\"\\n\").filter((line) => line.length > 0);\n		return [...names([\n			\"diff\",\n			\"--name-only\",\n			mergeBase\n		]), ...names([\n			\"ls-files\",\n			\"--others\",\n			\"--exclude-standard\"\n		])].some((name) => !allowed.includes(name));\n	} catch {\n		return null;\n	}\n}\nfunction isPrimaryWorktree(cwd) {\n	try {\n		const gitDir = execFileSync(\"git\", [\"rev-parse\", \"--absolute-git-dir\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		const commonRaw = execFileSync(\"git\", [\"rev-parse\", \"--git-common-dir\"], {\n			cwd,\n			stdio: [\n				\"ignore\",\n				\"pipe\",\n				\"ignore\"\n			],\n			timeout: GIT_TIMEOUT_MS\n		}).toString().trim();\n		if (!gitDir || !commonRaw) return false;\n		const commonDir = resolve(cwd, commonRaw);\n		return realpathSync(gitDir) === realpathSync(commonDir);\n	} catch {\n		return false;\n	}\n}\n\n//#endregion\n//#region src/lib/git-short-options.ts\nconst VALUE_TAKING_LETTERS = {\n	switch: /* @__PURE__ */ new Set([\"c\", \"C\"]),\n	checkout: /* @__PURE__ */ new Set([\"b\", \"B\"]),\n	branch: /* @__PURE__ */ new Set([\"u\"]),\n	fetch: /* @__PURE__ */ new Set([\"o\", \"j\"])\n};\nfunction splitShortOptionCluster(token, sub) {\n	if (!token.startsWith(\"-\") || token.startsWith(\"--\") || token.length <= 1) return;\n	const valueLetters = VALUE_TAKING_LETTERS[sub];\n	const letters = [];\n	const chars = token.slice(1);\n	for (let i = 0; i < chars.length; i++) {\n		const ch = chars[i];\n		letters.push(ch);\n		if (valueLetters.has(ch)) return {\n			letters,\n			attachedValue: chars.slice(i + 1)\n		};\n	}\n	return { letters };\n}\n\n//#endregion\n//#region src/lib/path-scope.ts\nfunction pathFlavorFor(base) {\n	return /^[a-zA-Z]:[\\\\/]/.test(base) ? path.win32 : path.posix;\n}\nfunction resolveIn(base, target) {\n	return pathFlavorFor(base).resolve(base, target);\n}\nfunction isWithin(dir, target) {\n	const pp = pathFlavorFor(dir);\n	const rel = pp.relative(dir, target);\n	if (rel === \"\") return true;\n	if (rel === \"..\" || rel.startsWith(\"..\" + pp.sep)) return false;\n	return !pp.isAbsolute(rel);\n}\nfunction samePath(a, b) {\n	return pathFlavorFor(a).relative(a, b) === \"\";\n}\nfunction targetsGitDir(filePath, cwd) {\n	const pp = pathFlavorFor(cwd);\n	const resolved = resolveIn(cwd, filePath);\n	if (!isWithin(cwd, resolved)) return false;\n	const rel = pp.relative(cwd, resolved);\n	if (rel === \"\") return false;\n	return rel.split(pp.sep).includes(\".git\");\n}\nfunction targetsNodeModules(filePath, cwd) {\n	return resolveIn(cwd, filePath).split(/[/\\\\]/).includes(\"node_modules\");\n}\n\n//#endregion\n//#region src/rules.ts\nconst GIT_FLAGS_WITH_ARG = /* @__PURE__ */ new Set([\n	\"-C\",\n	\"-c\",\n	\"--git-dir\",\n	\"--work-tree\"\n]);\nfunction getGitSubcommand(tokens) {\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return t;\n	}\n}\nconst WORKTREE_ADVICE = \"You're creating a feature branch in the primary worktree. An isolated worktree keeps this work independent of other windows, and with no commits on this branch yet, converting is cheap -- `git worktree add ../<dir> -b <branch>` (a sibling outside the repo, with its own dependency install). Claude Code keeps this session inside its own working tree, so the work continues in a new session opened in the sibling worktree. If you cannot open a session there, stay in the primary checkout on this branch and check `git branch --show-current` before each commit.\";\nfunction isGitBranchCreation(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"checkout\" && sub !== \"switch\") return false;\n	const after = tokens.slice(tokens.indexOf(sub) + 1);\n	const creationLetters = sub === \"checkout\" ? [\"b\", \"B\"] : [\"c\", \"C\"];\n	return after.some((t) => {\n		const cluster = splitShortOptionCluster(t, sub);\n		return cluster !== void 0 && cluster.letters.some((l) => creationLetters.includes(l));\n	});\n}\nfunction worktreeAdvice(tokens, ctx) {\n	return isGitBranchCreation(tokens) && isPrimaryWorktree(ctx.cwd) ? WORKTREE_ADVICE : void 0;\n}\nconst GIT_FORCE_CREATE_LETTER = {\n	switch: \"C\",\n	checkout: \"B\"\n};\nconst GIT_FORCE_CREATE_LONG = {\n	flag: \"--force-create\",\n	shortest: \"--force-\"\n};\nfunction gitForceCreateTargets(after, letterSub) {\n	const letter = GIT_FORCE_CREATE_LETTER[letterSub];\n	const longFlag = GIT_FORCE_CREATE_LONG;\n	const targets = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (letterSub === \"switch\") {\n			const [flag, ...rest] = t.split(\"=\");\n			if (flag !== void 0 && flag.length >= longFlag.shortest.length && longFlag.flag.startsWith(flag)) {\n				const target = rest.length > 0 ? rest.join(\"=\") : after[i + 1];\n				if (target !== void 0) targets.push(target);\n				continue;\n			}\n		}\n		const cluster = splitShortOptionCluster(t, letterSub);\n		if (cluster === void 0 || !cluster.letters.includes(letter)) continue;\n		if (cluster.attachedValue !== void 0 && cluster.attachedValue !== \"\") {\n			targets.push(cluster.attachedValue);\n			continue;\n		}\n		const next = after[i + 1];\n		if (next !== void 0) targets.push(next);\n	}\n	return targets;\n}\nfunction gitCommandForceCreateTargets(tokens) {\n	const sub = getGitSubcommand(tokens);\n	if (sub === \"switch\" || sub === \"checkout\") return gitForceCreateTargets(tokens.slice(tokens.indexOf(sub) + 1), sub);\n	if (sub === \"worktree\") {\n		const worktreeIdx = tokens.indexOf(\"worktree\");\n		if (tokens[worktreeIdx + 1] !== \"add\") return [];\n		return gitForceCreateTargets(tokens.slice(worktreeIdx + 2), \"checkout\");\n	}\n	return [];\n}\nfunction isGitProtectedBranchForceCreate(tokens, ctx) {\n	const targets = gitCommandForceCreateTargets(tokens);\n	if (targets.length === 0) return false;\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	return targets.some((t) => protectedSet.has(t));\n}\nfunction isGitProtectedBranchRefWrite(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"branch\") return false;\n	const { flags, positionals } = splitGitBranchArgs(tokens.slice(tokens.indexOf(sub) + 1));\n	if (positionals.length === 0) return false;\n	let deleteMode = false;\n	let renameMode = false;\n	let copyMode = false;\n	let forceMode = false;\n	for (const flag of flags) {\n		if (flag.letters !== void 0) {\n			if (flag.letters.includes(\"d\") || flag.letters.includes(\"D\")) deleteMode = true;\n			if (flag.letters.includes(\"m\") || flag.letters.includes(\"M\")) renameMode = true;\n			if (flag.letters.includes(\"c\") || flag.letters.includes(\"C\")) copyMode = true;\n			if (flag.letters.includes(\"f\") || flag.letters.includes(\"M\") || flag.letters.includes(\"C\")) forceMode = true;\n			continue;\n		}\n		if (flag.name === \"delete\") deleteMode = true;\n		if (flag.name === \"move\") renameMode = true;\n		if (flag.name === \"copy\") copyMode = true;\n		if (flag.name === \"force\") forceMode = true;\n	}\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	if (deleteMode && positionals.some((p) => protectedSet.has(p))) return true;\n	if (renameMode && positionals.length >= 2 && protectedSet.has(positionals[0])) return true;\n	if (forceMode) {\n		const destination = renameMode || copyMode ? positionals[positionals.length - 1] : positionals[0];\n		if (destination !== void 0 && protectedSet.has(destination)) return true;\n	}\n	return false;\n}\nfunction refspecDestination(refspec) {\n	const spec = refspec.startsWith(\"+\") ? refspec.slice(1) : refspec;\n	const colon = spec.lastIndexOf(\":\");\n	return (colon === -1 ? spec : spec.slice(colon + 1)).replace(/^refs\\/heads\\//, \"\");\n}\nconst GIT_BRANCH_VALUE_FLAG_NAMES = /* @__PURE__ */ new Set([\n	\"contains\",\n	\"no-contains\",\n	\"merged\",\n	\"no-merged\",\n	\"points-at\",\n	\"sort\",\n	\"format\",\n	\"set-upstream-to\"\n]);\nfunction splitGitBranchArgs(after) {\n	const flags = [];\n	const positionals = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (t.startsWith(\"--\") && t !== \"--\") {\n			const eq = t.indexOf(\"=\");\n			const name = eq > 0 ? t.slice(2, eq) : t.slice(2);\n			flags.push({\n				raw: t,\n				name\n			});\n			if (eq < 0 && GIT_BRANCH_VALUE_FLAG_NAMES.has(name)) i++;\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, \"branch\");\n		if (cluster === void 0) {\n			flags.push({ raw: t });\n			continue;\n		}\n		flags.push({\n			raw: t,\n			letters: cluster.letters\n		});\n		if (cluster.attachedValue === \"\") i++;\n	}\n	return {\n		flags,\n		positionals\n	};\n}\nconst GIT_FETCH_VALUE_FLAG_NAMES = /* @__PURE__ */ new Set([\n	\"depth\",\n	\"deepen\",\n	\"shallow-since\",\n	\"shallow-exclude\",\n	\"negotiation-tip\",\n	\"filter\",\n	\"jobs\",\n	\"server-option\",\n	\"upload-pack\",\n	\"refmap\",\n	\"submodule-prefix\",\n	\"recurse-submodules-default\"\n]);\nfunction splitGitFetchArgs(after) {\n	const flags = [];\n	const positionals = [];\n	const refmaps = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === void 0) continue;\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (t === \"--\") {\n			flags.push({ raw: t });\n			continue;\n		}\n		if (t.startsWith(\"--\")) {\n			const eq = t.indexOf(\"=\");\n			const name = eq > 0 ? t.slice(2, eq) : t.slice(2);\n			flags.push({\n				raw: t,\n				name\n			});\n			if (name === \"refmap\") {\n				if (eq > 0) refmaps.push(t.slice(eq + 1));\n				else if (after[i + 1] !== void 0) refmaps.push(after[i + 1]);\n			}\n			if (eq < 0 && GIT_FETCH_VALUE_FLAG_NAMES.has(name)) i++;\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, \"fetch\");\n		if (cluster === void 0) {\n			flags.push({ raw: t });\n			continue;\n		}\n		flags.push({\n			raw: t,\n			letters: cluster.letters\n		});\n		if (cluster.attachedValue === \"\") i++;\n	}\n	return {\n		flags,\n		positionals,\n		refmaps\n	};\n}\nfunction fetchRefspecTarget(spec) {\n	const body = spec.startsWith(\"+\") ? spec.slice(1) : spec;\n	if (body.startsWith(\"^\")) return { kind: \"none\" };\n	if (!body.includes(\":\")) return { kind: \"none\" };\n	const destination = refspecDestination(body);\n	if (destination === \"\") return { kind: \"none\" };\n	if (destination.startsWith(\"refs/remotes/\")) return { kind: \"tracking\" };\n	if (destination.startsWith(\"refs/\")) return { kind: \"other\" };\n	return {\n		kind: \"branch\",\n		name: destination\n	};\n}\nfunction globToAnchoredRegex(glob) {\n	const escaped = glob.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n	return new RegExp(`^${escaped.replace(/\\\\\\*/g, \".*\")}$`);\n}\nfunction isProtectedFetchBranch(name, protectedSet) {\n	if (protectedSet.has(name)) return true;\n	if (!name.includes(\"*\")) return false;\n	const pattern = globToAnchoredRegex(name);\n	for (const member of protectedSet) if (pattern.test(member)) return true;\n	return false;\n}\nfunction isGitProtectedBranchFetchWrite(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"fetch\") return false;\n	const { positionals, refmaps } = splitGitFetchArgs(tokens.slice(tokens.indexOf(sub) + 1));\n	const protectedSet = getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []);\n	return [...positionals, ...refmaps].some((spec) => {\n		const target = fetchRefspecTarget(spec);\n		if (target.kind !== \"branch\" || target.name === void 0) return false;\n		return isProtectedFetchBranch(target.name, protectedSet);\n	});\n}\nfunction isGitProtectedUpdateRef(tokens, ctx) {\n	const after = tokens.slice(tokens.indexOf(\"update-ref\") + 1);\n	let ref;\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (t === \"-m\") {\n			i++;\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		ref = t;\n		break;\n	}\n	if (ref === void 0) return false;\n	return getProtectedBranches(ctx.cwd, ctx.repoProtectedBranches ?? []).has(ref.replace(/^refs\\/heads\\//, \"\"));\n}\nfunction gitEffectiveCwd(tokens, cwd) {\n	let dir = cwd;\n	const args = tokens.slice(1);\n	for (let i = 0; i < args.length; i++) {\n		const t = args[i];\n		if (t === \"-C\") {\n			const next = args[i + 1];\n			if (next !== void 0) dir = path.resolve(dir, next);\n			i++;\n			continue;\n		}\n		if (GIT_FLAGS_WITH_ARG.has(t)) {\n			i++;\n			continue;\n		}\n		if (!t.startsWith(\"-\")) break;\n	}\n	return dir;\n}\nconst GIT_SWITCH_NEUTRAL_FLAGS = /* @__PURE__ */ new Set([\n	\"-q\",\n	\"--quiet\",\n	\"-f\",\n	\"--force\",\n	\"--discard-changes\",\n	\"-m\",\n	\"--merge\",\n	\"--no-track\",\n	\"--progress\",\n	\"--no-progress\",\n	\"--guess\",\n	\"--no-guess\",\n	\"--ignore-other-worktrees\",\n	\"--recurse-submodules\",\n	\"--no-recurse-submodules\"\n]);\nconst GIT_SWITCH_CREATE_FLAGS = /* @__PURE__ */ new Set([\n	\"--create\",\n	\"--force-create\",\n	\"--orphan\"\n]);\nconst GIT_CHECKOUT_PATH_FLAGS = /* @__PURE__ */ new Set([\n	\"--ours\",\n	\"--theirs\",\n	\"-p\",\n	\"--patch\",\n	\"--conflict\",\n	\"--pathspec-from-file\",\n	\"--pathspec-file-nul\",\n	\"--overlay\",\n	\"--no-overlay\"\n]);\nconst GIT_SWITCH_NEUTRAL_LETTERS = /* @__PURE__ */ new Set([\n	\"q\",\n	\"f\",\n	\"m\"\n]);\nfunction switchTarget(after, sub, isCheckoutBranch) {\n	if (sub === \"checkout\" && after.includes(\"--\")) return void 0;\n	const createLetters = sub === \"checkout\" ? [\"b\", \"B\"] : [\"c\", \"C\"];\n	const known = (l) => GIT_SWITCH_NEUTRAL_LETTERS.has(l) || createLetters.includes(l);\n	const positionals = [];\n	let created;\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		if (GIT_SWITCH_NEUTRAL_FLAGS.has(t)) continue;\n		const eq = t.indexOf(\"=\");\n		if (sub === \"checkout\" && GIT_CHECKOUT_PATH_FLAGS.has(eq === -1 ? t : t.slice(0, eq))) return;\n		if (GIT_SWITCH_CREATE_FLAGS.has(eq === -1 ? t : t.slice(0, eq))) {\n			created = eq === -1 ? after[++i] : t.slice(eq + 1);\n			continue;\n		}\n		const cluster = splitShortOptionCluster(t, sub);\n		if (cluster === void 0 || !cluster.letters.every(known)) return null;\n		if (cluster.letters.some((l) => createLetters.includes(l))) created = cluster.attachedValue ? cluster.attachedValue : after[++i];\n	}\n	if (created !== void 0) return created;\n	if (positionals.length !== 1) return void 0;\n	const target = positionals[0];\n	if (target === \"HEAD\" || target === \"@\") return void 0;\n	if (sub === \"checkout\" && !isCheckoutBranch(target)) return void 0;\n	return target;\n}\nfunction branchSwitch(tokens, ctx, resolved) {\n	const sub = getGitSubcommand(tokens);\n	if (sub !== \"switch\" && sub !== \"checkout\") return void 0;\n	const dir = gitEffectiveCwd(tokens, ctx.cwd);\n	const isCheckoutBranch = (name) => !resolved || getProtectedBranches(dir, ctx.repoProtectedBranches ?? []).has(name) || resolveCommit(dir, name) !== null;\n	const target = switchTarget(tokens.slice(tokens.indexOf(sub) + 1), sub, isCheckoutBranch);\n	if (!resolved) return target === void 0 ? void 0 : {\n		dir,\n		branch: null\n	};\n	return target === void 0 ? void 0 : {\n		dir,\n		branch: target\n	};\n}\nconst GIT_CHECKED_OUT_WRITES = /* @__PURE__ */ new Set([\n	\"commit\",\n	\"merge\",\n	\"rebase\",\n	\"cherry-pick\",\n	\"revert\",\n	\"am\",\n	\"pull\"\n]);\nfunction subcommandArgs(tokens, sub, valueFlags = /* @__PURE__ */ new Set()) {\n	const after = tokens.slice(tokens.indexOf(sub) + 1);\n	const flags = [];\n	const positionals = [];\n	for (let i = 0; i < after.length; i++) {\n		const t = after[i];\n		if (!t.startsWith(\"-\")) {\n			positionals.push(t);\n			continue;\n		}\n		flags.push(t);\n		if (valueFlags.has(t)) i++;\n	}\n	return {\n		flags,\n		positionals\n	};\n}\nconst GIT_PUSH_VALUE_FLAGS = /* @__PURE__ */ new Set([\n	\"-o\",\n	\"--push-option\",\n	\"--repo\",\n	\"--receive-pack\",\n	\"--exec\"\n]);\nfunction isMergeFastForwardFromUpstream(tokens, upstream) {\n	const { flags, positionals } = subcommandArgs(tokens, \"merge\");\n	if (!flags.includes(\"--ff-only\") || positionals.length !== 1) return false;\n	const ref = positionals[0];\n	return ref === \"@{u}\" || ref === \"@{upstream}\" || upstream !== null && ref === upstream;\n}\nconst GIT_PULL_NO_REBASE = /* @__PURE__ */ new Set([\n	\"--rebase=false\",\n	\"--rebase=no\",\n	\"--rebase=off\",\n	\"--rebase=0\"\n]);\nfunction isPullFromUpstream(tokens, upstream) {\n	const { flags, positionals } = subcommandArgs(tokens, \"pull\");\n	if (flags.some((t) => t.startsWith(\"--rebase\") && !GIT_PULL_NO_REBASE.has(t) || t === \"--no-ff\" || !t.startsWith(\"--\") && t.slice(1).includes(\"r\"))) return false;\n	if (positionals.length === 0) return true;\n	if (positionals.length !== 2 || upstream === null) return false;\n	const [remote, branch] = positionals;\n	return `${remote}/${branch.replace(/^refs\\/heads\\//, \"\")}` === upstream;\n}\nfunction isRefMovingReset(tokens, cwd, head) {\n	if (tokens.slice(tokens.indexOf(\"reset\") + 1).includes(\"--\")) return false;\n	const { positionals } = subcommandArgs(tokens, \"reset\");\n	if (positionals.length !== 1) return false;\n	if (head !== \"HEAD\" && /^(HEAD|@)/.test(positionals[0])) return false;\n	const target = resolveCommit(cwd, positionals[0]);\n	if (target === null) return false;\n	return target !== resolveCommit(cwd, head);\n}\nfunction pushDestinations(tokens, current) {\n	const { positionals } = subcommandArgs(tokens, \"push\", GIT_PUSH_VALUE_FLAGS);\n	const refspecs = positionals.slice(1);\n	if (refspecs.length === 0) return null;\n	const names = [];\n	for (const spec of refspecs) {\n		const dst = refspecDestination(spec);\n		if (dst === \"HEAD\" || dst === \"@\") {\n			if (current !== null) names.push(current);\n			continue;\n		}\n		names.push(dst);\n	}\n	return names;\n}\nconst GIT_PUSH_EVERY_BRANCH = /* @__PURE__ */ new Set([\n	\"--all\",\n	\"--branches\",\n	\"--mirror\"\n]);\nfunction leavesRefInPlace(tokens, sub) {\n	const { flags } = subcommandArgs(tokens, sub);\n	if (flags.includes(\"--abort\") || flags.includes(\"--quit\")) return true;\n	return sub === \"commit\" && flags.includes(\"--dry-run\");\n}\nfunction movesProtectedRef(tokens, ctx) {\n	const sub = getGitSubcommand(tokens);\n	if (sub === void 0) return false;\n	if (sub === \"switch\" || sub === \"checkout\" || sub === \"worktree\") return isGitProtectedBranchForceCreate(tokens, ctx);\n	if (sub === \"branch\") return isGitProtectedBranchRefWrite(tokens, ctx);\n	if (sub === \"fetch\") return isGitProtectedBranchFetchWrite(tokens, ctx);\n	if (sub === \"update-ref\") return isGitProtectedUpdateRef(tokens, ctx);\n	if (sub !== \"push\" && sub !== \"reset\" && !GIT_CHECKED_OUT_WRITES.has(sub)) return false;\n	const cwd = gitEffectiveCwd(tokens, ctx.cwd);\n	const pending = ctx.pendingBranches?.[cwd];\n	const current = pending ? pending.branch : getCurrentBranch(cwd);\n	const protectedSet = getProtectedBranches(cwd, ctx.repoProtectedBranches ?? []);\n	const onProtected = current !== null && protectedSet.has(current);\n	if (sub === \"push\") {\n		const { flags } = subcommandArgs(tokens, \"push\", GIT_PUSH_VALUE_FLAGS);\n		if (flags.some((f) => GIT_PUSH_EVERY_BRANCH.has(f))) return true;\n		const destinations = pushDestinations(tokens, current);\n		if (destinations === null) {\n			if (flags.includes(\"--tags\")) return false;\n			return onProtected;\n		}\n		return destinations.some((d) => protectedSet.has(d));\n	}\n	if (!onProtected) return false;\n	if (leavesRefInPlace(tokens, sub)) return false;\n	if (sub === \"reset\") return isRefMovingReset(tokens, cwd, pending ? current : \"HEAD\");\n	if (sub === \"merge\" || sub === \"pull\") {\n		const upstream = getUpstream(cwd, current);\n		if (sub === \"merge\" && isMergeFastForwardFromUpstream(tokens, upstream)) return false;\n		if (sub === \"pull\" && isPullFromUpstream(tokens, upstream)) return false;\n	}\n	return true;\n}\nconst PNPM_BUILTINS = /* @__PURE__ */ new Set([\n	\"install\",\n	\"i\",\n	\"add\",\n	\"remove\",\n	\"rm\",\n	\"uninstall\",\n	\"un\",\n	\"update\",\n	\"up\",\n	\"upgrade\",\n	\"list\",\n	\"ls\",\n	\"ll\",\n	\"la\",\n	\"why\",\n	\"view\",\n	\"info\",\n	\"show\",\n	\"outdated\",\n	\"audit\",\n	\"licenses\",\n	\"init\",\n	\"create\",\n	\"link\",\n	\"unlink\",\n	\"pack\",\n	\"publish\",\n	\"config\",\n	\"set\",\n	\"get\",\n	\"store\",\n	\"cache\",\n	\"rebuild\",\n	\"rb\",\n	\"prune\",\n	\"dedupe\",\n	\"dlx\",\n	\"exec\",\n	\"run\",\n	\"patch\",\n	\"patch-commit\",\n	\"recursive\",\n	\"-r\"\n]);\nconst NPM_READ_OPS = /* @__PURE__ */ new Set([\n	\"view\",\n	\"info\",\n	\"show\"\n]);\nfunction isNpmReadOp(tokens) {\n	const sub = tokens[1];\n	return sub !== void 0 && NPM_READ_OPS.has(sub);\n}\nfunction getNpmRedirectReason(tokens) {\n	const sub = tokens[1];\n	const BASE = \"This project uses pnpm.\";\n	if (!sub) return `${BASE} Use \\`pnpm\\` instead of npm.`;\n	if (sub === \"install\" || sub === \"i\" || sub === \"ci\") {\n		if (tokens.slice(2).some((t) => !t.startsWith(\"-\"))) return `${BASE} Use \\`pnpm add <pkg>\\` instead of \\`npm install <pkg>\\`.`;\n		return `${BASE} Use \\`pnpm install\\` instead of npm.`;\n	}\n	if (sub === \"add\") return `${BASE} Use \\`pnpm add <pkg>\\` instead of npm.`;\n	if (sub === \"uninstall\" || sub === \"remove\" || sub === \"rm\" || sub === \"un\" || sub === \"r\") return `${BASE} Use \\`pnpm remove <pkg>\\` instead of npm.`;\n	if (sub === \"run\" || sub === \"run-script\") return `${BASE} Use \\`pnpm run <script>\\` or \\`pnpm <script>\\` instead of npm.`;\n	if (sub === \"test\" || sub === \"t\" || sub === \"tst\") return `${BASE} Use \\`pnpm test\\` instead of npm.`;\n	if (sub === \"start\") return `${BASE} Use \\`pnpm start\\` instead of npm.`;\n	if (sub === \"stop\") return `${BASE} Use \\`pnpm stop\\` instead of npm.`;\n	if (sub === \"restart\") return `${BASE} Use \\`pnpm restart\\` instead of npm.`;\n	if (sub === \"exec\") return `${BASE} Use \\`pnpm exec <cmd>\\` instead of npm.`;\n	if (sub === \"list\" || sub === \"ls\" || sub === \"ll\" || sub === \"la\") return `${BASE} Use \\`pnpm list\\` instead of npm.`;\n	if (sub === \"why\") return `${BASE} Use \\`pnpm why\\` instead of npm.`;\n	if (sub === \"outdated\") return `${BASE} Use \\`pnpm outdated\\` instead of npm.`;\n	if (sub === \"audit\") return `${BASE} Use \\`pnpm audit\\` instead of npm.`;\n	if (sub === \"update\" || sub === \"up\" || sub === \"upgrade\") return `${BASE} Use \\`pnpm update\\` instead of npm.`;\n	if (sub === \"init\") return `${BASE} Use \\`pnpm init\\` instead of npm.`;\n	if (sub === \"publish\") return `${BASE} Use \\`pnpm publish\\` instead of npm.`;\n	if (sub === \"link\") return `${BASE} Use \\`pnpm link\\` instead of npm.`;\n	if (sub === \"unlink\") return `${BASE} Use \\`pnpm unlink\\` instead of npm.`;\n	if (sub === \"pack\") return `${BASE} Use \\`pnpm pack\\` instead of npm.`;\n	if (sub === \"cache\") return `${BASE} Use \\`pnpm store\\` instead of \\`npm cache\\`.`;\n	if (sub === \"config\" || sub === \"set\" || sub === \"get\") return `${BASE} Use \\`pnpm config\\` instead of npm.`;\n	return `${BASE} Use the equivalent pnpm command instead of npm.`;\n}\nconst LAST_POSITIONAL_DEST = /* @__PURE__ */ new Set([\n	\"cp\",\n	\"mv\",\n	\"rsync\",\n	\"install\",\n	\"ln\"\n]);\nconst ALL_POSITIONAL_DEST = /* @__PURE__ */ new Set([\"tee\", \"truncate\"]);\nfunction explicitTargetDirectory(rest) {\n	for (const [i, t] of rest.entries()) {\n		if (t === \"-t\" || t === \"--target-directory\") return rest[i + 1] ?? null;\n		if (t.startsWith(\"--target-directory=\")) return t.slice(19);\n	}\n	return null;\n}\nconst OUTPUT_REDIRECT = /^(?:\\d*|&)>{1,2}$/;\nconst OUTPUT_REDIRECT_ATTACHED = /^(?:\\d*|&)>{1,2}(.+)$/;\nconst INPUT_REDIRECT = /^\\d*<$/;\nconst INPUT_REDIRECT_ATTACHED = /^\\d*<([^<].*)$/;\nfunction spacedRedirectDirection(token) {\n	if (OUTPUT_REDIRECT.test(token)) return \"out\";\n	if (INPUT_REDIRECT.test(token)) return \"in\";\n	return null;\n}\nfunction splitRedirects(tokens) {\n	const redirects = [];\n	const rest = [];\n	for (let i = 0; i < tokens.length; i++) {\n		const t = tokens[i];\n		const spaced = spacedRedirectDirection(t);\n		if (spaced !== null) {\n			const next = tokens[i + 1];\n			if (next !== void 0) redirects.push({\n				direction: spaced,\n				target: next\n			});\n			i++;\n			continue;\n		}\n		const out = OUTPUT_REDIRECT_ATTACHED.exec(t);\n		if (out) {\n			redirects.push({\n				direction: \"out\",\n				target: out[1]\n			});\n			continue;\n		}\n		const input = INPUT_REDIRECT_ATTACHED.exec(t);\n		if (input) {\n			redirects.push({\n				direction: \"in\",\n				target: input[1]\n			});\n			continue;\n		}\n		rest.push(t);\n	}\n	return {\n		redirects,\n		rest\n	};\n}\nfunction redirectTargets(tokens, direction) {\n	return splitRedirects(tokens).redirects.filter((r) => r.direction === direction).map((r) => r.target);\n}\nfunction writeDestinations(tokens) {\n	const cmd = path.basename(tokens[0] ?? \"\");\n	const rest = tokens.slice(1);\n	const dests = redirectTargets(tokens, \"out\");\n	if (cmd === \"dd\") dests.push(...rest.filter((t) => t.startsWith(\"of=\")).map((t) => t.slice(3)));\n	else if (cmd === \"sed\") {\n		if (rest.some((t) => t === \"--in-place\" || /^-[a-zA-Z]*i/.test(t))) dests.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	} else if (ALL_POSITIONAL_DEST.has(cmd)) dests.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	else if (LAST_POSITIONAL_DEST.has(cmd)) {\n		if (cmd === \"cp\" && rest.includes(\"--remove-destination\")) return dests;\n		const targetDir = explicitTargetDirectory(rest);\n		if (targetDir !== null) dests.push(targetDir);\n		else {\n			const last = rest.findLast((t) => !t.startsWith(\"-\"));\n			if (last !== void 0) dests.push(last);\n		}\n	}\n	return dests;\n}\nfunction writesIntoNodeModules(tokens, ctx) {\n	return writeDestinations(tokens).some((d) => targetsNodeModules(d, ctx.cwd));\n}\nconst NODE_MODULES_WRITE_REASON = \"Don't write into node_modules/. Its files are hardlinks into pnpm's global store, so overwriting one in place (plain `cp`, `>` redirect, `sed -i`, ...) writes through the link and corrupts that package for every project on this machine -- silently, since the directory you wrote into ends up fine. To test a local build as an installed dependency, run it directly (`node packages/<pkg>/dist/bin.mjs <cmd>`), or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`). If you must replace a file in place, `cp --remove-destination` is safe -- it unlinks the target first. Run `pnpm store status` to check whether the store is already damaged.\";\nfunction isChmod777(tokens) {\n	return tokens.some((t) => t === \"777\" || t === \"0777\");\n}\nfunction isGitForcePush(tokens) {\n	const pushIdx = tokens.indexOf(\"push\");\n	if (pushIdx === -1) return false;\n	return tokens.slice(pushIdx + 1).some((t) => t === \"--force\" || t === \"-f\");\n}\nconst ENV_READ_FILE_COMMANDS = /* @__PURE__ */ new Set([\n	\"cat\",\n	\"head\",\n	\"tail\",\n	\"less\",\n	\"more\",\n	\"source\",\n	\".\"\n]);\nconst GREP_FAMILY_COMMANDS = /* @__PURE__ */ new Set([\n	\"grep\",\n	\"rg\",\n	\"ag\"\n]);\nfunction grepFileOperands(rest) {\n	const files = [];\n	let patternAccountedFor = false;\n	let optionsEnded = false;\n	for (let i = 0; i < rest.length; i++) {\n		const t = rest[i];\n		if (!optionsEnded && t === \"--\") {\n			optionsEnded = true;\n			continue;\n		}\n		if (!optionsEnded) {\n			if (t === \"-f\" || t === \"--file\") {\n				const value = rest[i + 1];\n				if (value !== void 0) {\n					files.push(value);\n					i++;\n				}\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"--file=\")) {\n				files.push(t.slice(7));\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"-f\") && t !== \"-f\" && !t.startsWith(\"--\")) {\n				files.push(t.slice(2));\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t === \"-e\" || t === \"--regexp\") {\n				i++;\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"--regexp=\") || t.startsWith(\"-e\") && t !== \"-e\" && !t.startsWith(\"--\")) {\n				patternAccountedFor = true;\n				continue;\n			}\n			if (t.startsWith(\"-\")) continue;\n		}\n		if (!patternAccountedFor) {\n			patternAccountedFor = true;\n			continue;\n		}\n		files.push(t);\n	}\n	return files;\n}\nfunction envFileOperands(tokens) {\n	const cmd = path.basename(tokens[0] ?? \"\");\n	const { redirects, rest } = splitRedirects(tokens.slice(1));\n	const operands = redirects.filter((r) => r.direction === \"in\").map((r) => r.target);\n	if (GREP_FAMILY_COMMANDS.has(cmd)) operands.push(...grepFileOperands(rest));\n	else if (ENV_READ_FILE_COMMANDS.has(cmd)) operands.push(...rest.filter((t) => !t.startsWith(\"-\")));\n	return operands;\n}\nconst HEALTH_CEILING_FILES = [\"health-baseline.json\", \".tooling.json\"];\nconst HEALTH_RAISE_REASON = \"Run `pnpm exec bst health:raise` to raise only what this branch crossed. `--update-baseline --reset` records every outlier, including the ones already on the default branch.\";\nfunction isHealthBaselineReset(tokens) {\n	return tokens.includes(\"health:check\") && tokens.includes(\"--update-baseline\") && tokens.includes(\"--reset\");\n}\nfunction raiseTravelsWithCode(cwd) {\n	return branchCarriesOtherFiles(cwd, HEALTH_CEILING_FILES) === true;\n}\nconst denyRules = [\n	{\n		name: \"sudo\",\n		match: /^sudo$/,\n		action: \"deny\",\n		reason: \"Don't use sudo. If you need elevated permissions, ask me to do it manually.\"\n	},\n	{\n		name: \"git-force-push\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens) => isGitForcePush(tokens),\n		reason: \"Use `git push --force-with-lease` instead of `--force`.\"\n	},\n	{\n		name: \"git-protected-branch-write\",\n		match: /^git$/,\n		action: \"deny\",\n		when: (tokens, ctx) => movesProtectedRef(tokens, ctx),\n		reason: \"This would move a protected branch (main, master, the remote's default branch, or one listed in .claude/hooks/bst-hook.settings.json#protectedBranches). Work on a feature branch in a worktree: `git worktree add ../<repo>-<topic> -b feat/<topic>`, then commit and push there. To bring `main` up to date, use `git pull --ff-only`.\"\n	},\n	{\n		name: \"chmod-777\",\n		match: /^chmod$/,\n		action: \"deny\",\n		when: (tokens) => isChmod777(tokens),\n		reason: \"Don't use 777 permissions. Use more restrictive permissions.\"\n	},\n	{\n		name: \"node-modules-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens, ctx) => writesIntoNodeModules(tokens, ctx),\n		reason: NODE_MODULES_WRITE_REASON\n	},\n	{\n		name: \"env-file-read\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens) => envFileOperands(tokens).some(isEnvFile),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		match: /./,\n		action: \"deny\",\n		when: (tokens) => redirectTargets(tokens, \"out\").some(isEnvFile),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"health-baseline-reset\",\n		match: /^bst$/,\n		action: \"deny\",\n		when: (tokens, ctx) => isHealthBaselineReset(tokens) && raiseTravelsWithCode(ctx.cwd),\n		reason: HEALTH_RAISE_REASON\n	},\n	{\n		name: \"npx-redirect\",\n		match: /^npx$/,\n		action: \"deny\",\n		reason: \"This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\"\n	},\n	{\n		name: \"mise-self-update\",\n		match: /^mise$/,\n		action: \"deny\",\n		when: (tokens) => tokens[1] === \"self-update\",\n		reason: \"Don't self-update mise. The version is Renovate-managed; ask a human to bump the pin.\"\n	}\n];\n\n//#endregion\n//#region src/lib/script-resolver.ts\nconst PackageJsonSchema = object({ scripts: record(string(), unknown()) });\nfunction resolveScript(scriptName, cwd) {\n	const scripts = readScripts(cwd);\n	if (!scripts) return null;\n	const main = scripts[scriptName];\n	if (typeof main !== \"string\") return null;\n	const pre = scripts[`pre${scriptName}`];\n	const post = scripts[`post${scriptName}`];\n	return {\n		pre: typeof pre === \"string\" ? pre : null,\n		main,\n		post: typeof post === \"string\" ? post : null\n	};\n}\nfunction resolveFilteredScript(scriptName, filterPkg, cwd) {\n	const pkgDir = findWorkspacePackageDir(filterPkg, cwd);\n	if (!pkgDir) return null;\n	const script = resolveScript(scriptName, pkgDir);\n	if (!script) return null;\n	return {\n		...script,\n		pkgDir\n	};\n}\nfunction resolveRecursiveScripts(scriptName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	const results = [];\n	for (const pkgDir of pkgDirs) {\n		const resolved = resolveScript(scriptName, pkgDir);\n		if (resolved) results.push({\n			...resolved,\n			pkgDir\n		});\n	}\n	return results;\n}\nfunction listWorkspacePackageDirs(rootDir) {\n	const patterns = readWorkspacePatterns(rootDir);\n	if (!patterns) return null;\n	const dirs = [];\n	for (const pattern of patterns) {\n		if (!pattern.endsWith(\"/*\")) continue;\n		const baseDir = pattern.slice(0, -2);\n		const parentDir = resolve(rootDir, baseDir);\n		let entries;\n		try {\n			entries = readdirSync(parentDir);\n		} catch {\n			continue;\n		}\n		for (const entry of entries) {\n			const entryDir = join(parentDir, entry);\n			try {\n				if (!statSync(entryDir).isDirectory()) continue;\n			} catch {\n				continue;\n			}\n			dirs.push(entryDir);\n		}\n	}\n	return dirs.length > 0 ? dirs : null;\n}\nfunction findWorkspacePackageDir(pkgName, rootDir) {\n	const pkgDirs = listWorkspacePackageDirs(rootDir);\n	if (!pkgDirs) return null;\n	for (const entryDir of pkgDirs) {\n		const name = readPackageName(entryDir);\n		if (name === pkgName || name === `@${pkgName}`) return entryDir;\n		if (entryDir.split(\"/\").pop() === pkgName) return entryDir;\n		if (name) {\n			if ((name.startsWith(\"@\") ? name.split(\"/\")[1] : name) === pkgName) return entryDir;\n		}\n	}\n	return null;\n}\nfunction readWorkspacePatterns(rootDir) {\n	try {\n		const lines = readFileSync(join(rootDir, \"pnpm-workspace.yaml\"), \"utf-8\").split(\"\\n\");\n		const packagesIdx = lines.findIndex((l) => /^packages\\s*:/.test(l));\n		if (packagesIdx === -1) return null;\n		const patterns = [];\n		for (let i = packagesIdx + 1; i < lines.length; i++) {\n			const line = lines[i];\n			const match = /^\\s+-\\s+(.+)$/.exec(line);\n			if (!match) break;\n			patterns.push(match[1].trim().replace(/['\"`]/g, \"\"));\n		}\n		return patterns.length > 0 ? patterns : null;\n	} catch {\n		return null;\n	}\n}\nconst PackageNameSchema = object({ name: string() });\nfunction readPackageName(dir) {\n	try {\n		const raw = readFileSync(join(dir, \"package.json\"), \"utf-8\");\n		const result = PackageNameSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.name;\n	} catch {\n		return null;\n	}\n}\nfunction readScripts(cwd) {\n	try {\n		const raw = readFileSync(join(cwd, \"package.json\"), \"utf-8\");\n		const result = PackageJsonSchema.safeParse(JSON.parse(raw));\n		if (!result.success) return null;\n		return result.data.scripts;\n	} catch {\n		return null;\n	}\n}\n\n//#endregion\n//#region src/lib/workspace-root.ts\nfunction findWorkspaceRoot(cwd) {\n	let dir = resolve(cwd);\n	while (true) {\n		if (existsSync(join(dir, \"pnpm-workspace.yaml\"))) return dir;\n		const parent = dirname(dir);\n		if (parent === dir) return null;\n		dir = parent;\n	}\n}\n\n//#endregion\n//#region src/evaluate.ts\nconst MAX_EVAL_DEPTH = 5;\nfunction subshellBody(command) {\n	if (!command.startsWith(\"(\") || !command.endsWith(\")\")) return null;\n	let depth = 0;\n	let quote = null;\n	for (let i = 0; i < command.length; i++) {\n		const ch = command[i];\n		if (quote !== null) {\n			if (ch === quote) quote = null;\n			else if (ch === \"\\\\\" && quote === \"\\\"\") i++;\n			continue;\n		}\n		if (ch === \"\\\\\") i++;\n		else if (ch === \"'\" || ch === \"\\\"\") quote = ch;\n		else if (ch === \"(\") depth++;\n		else if (ch === \")\") {\n			depth--;\n			if (depth === 0) return i === command.length - 1 ? command.slice(1, -1) : null;\n		}\n	}\n	return null;\n}\nfunction extractCdDir(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok || tokenResult.tokens.length !== 2) return null;\n	const tokens = tokenResult.tokens;\n	if (tokens[0] !== \"cd\") return null;\n	const dir = tokens[1];\n	if (path.isAbsolute(dir)) return dir;\n	return path.resolve(ctx.cwd, dir);\n}\nfunction extractBranchSwitch(segment, ctx) {\n	const tokenResult = tokenize(segment);\n	if (!tokenResult.ok) return void 0;\n	let tokens = tokenResult.tokens;\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) envSkipped++;\n	tokens = tokens.slice(envSkipped);\n	if (tokens.length === 0 || path.basename(tokens[0]) !== \"git\") return void 0;\n	return branchSwitch(tokens, ctx, checkInjection(tokens, segment).safe);\n}\nfunction evaluateCommand(command, ctx) {\n	if (ctx.depth >= MAX_EVAL_DEPTH) return {\n		action: \"none\",\n		rule: null,\n		reason: \"max evaluation depth exceeded\"\n	};\n	const trimmed = command.trim();\n	if (!trimmed) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	const body = subshellBody(trimmed);\n	if (body !== null) return evaluateCommand(body, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	const segments = splitCommand(trimmed);\n	if (segments.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	let firstNone = null;\n	const currentCtx = { ...ctx };\n	let unknownAfterNext;\n	for (const segment of segments) {\n		if (segment.operator === \"&&\") {\n			const cdDir = extractCdDir(segment.command, currentCtx);\n			if (cdDir) currentCtx.cwd = cdDir;\n		}\n		const result = evaluateSegment(segment.command, currentCtx);\n		if (result.action === \"deny\") return result;\n		if (!firstNone) firstNone = result;\n		if (unknownAfterNext) {\n			currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[unknownAfterNext.dir]: unknownAfterNext\n			};\n			unknownAfterNext = void 0;\n		}\n		const switched = extractBranchSwitch(segment.command, currentCtx);\n		if (switched) {\n			const unknown = {\n				dir: switched.dir,\n				branch: null\n			};\n			if (segment.operator === \"&&\") currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[switched.dir]: switched\n			};\n			else if (segment.operator === \"||\") unknownAfterNext = unknown;\n			else currentCtx.pendingBranches = {\n				...currentCtx.pendingBranches,\n				[switched.dir]: unknown\n			};\n		}\n	}\n	return firstNone ?? {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n}\nfunction evaluateResolvedScript(resolved, ctx) {\n	if (resolved.pre) {\n		const preResult = evaluateCommand(resolved.pre, ctx);\n		if (preResult.action === \"deny\") return preResult;\n	}\n	const mainResult = evaluateCommand(resolved.main, ctx);\n	if (mainResult.action === \"deny\") return mainResult;\n	if (resolved.post) {\n		const postResult = evaluateCommand(resolved.post, ctx);\n		if (postResult.action === \"deny\") return postResult;\n	}\n	return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n}\nfunction evaluateSegment(rawSegment, ctx) {\n	const trimmed = rawSegment.trim();\n	const body = subshellBody(trimmed);\n	if (body !== null) return evaluateCommand(body, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (trimmed.startsWith(\"(\") && trimmed.endsWith(\")\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"subshell\"\n	};\n	const tokenResult = tokenize(rawSegment);\n	if (!tokenResult.ok) return {\n		action: \"none\",\n		rule: null,\n		reason: tokenResult.error\n	};\n	let tokens = tokenResult.tokens;\n	if (tokens.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	let envSkipped = 0;\n	while (envSkipped < tokens.length && /^\\w+=/.test(tokens[envSkipped])) envSkipped++;\n	if (envSkipped >= tokens.length) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	tokens = tokens.slice(envSkipped);\n	if (writesIntoNodeModules(tokens, ctx)) return {\n		action: \"deny\",\n		rule: \"node-modules-write\",\n		reason: NODE_MODULES_WRITE_REASON\n	};\n	const injection = checkInjection(tokens, rawSegment);\n	if (!injection.safe) return {\n		action: \"none\",\n		rule: null,\n		reason: injection.reason\n	};\n	const SAFE_REDIRECT_TOKENS = /* @__PURE__ */ new Set([\n		\"2>&1\",\n		\"2>/dev/null\",\n		\">/dev/null\",\n		\"1>/dev/null\"\n	]);\n	tokens = tokens.filter((t, i) => {\n		if (SAFE_REDIRECT_TOKENS.has(t)) return false;\n		if ((t === \">\" || t === \">>\") && tokens[i + 1] === \"/dev/null\") return false;\n		if (t === \"/dev/null\" && i > 0 && (tokens[i - 1] === \">\" || tokens[i - 1] === \">>\")) return false;\n		return true;\n	});\n	const cmdName = path.basename(tokens[0]);\n	if (cmdName === \"command\" && tokens.length > 1) return evaluateCommand(joinTokens(tokens.slice(1)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (cmdName === \"env\") {\n		let envIdx = 1;\n		while (envIdx < tokens.length && /^\\w+=/.test(tokens[envIdx])) envIdx++;\n		if (envIdx >= tokens.length) return {\n			action: \"none\",\n			rule: null,\n			reason: null\n		};\n		return evaluateCommand(joinTokens(tokens.slice(envIdx)), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"pnpm\") return evaluatePnpm(tokens, ctx);\n	if (cmdName === \"npm\") return evaluateNpm(tokens);\n	if (cmdName === \"mise\" && tokens[1] === \"exec\") {\n		const inner = miseExecInner(tokens);\n		if (!inner) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare mise exec\"\n		};\n		return evaluateCommand(joinTokens(inner), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	if (cmdName === \"bash\" || cmdName === \"sh\" || cmdName === \"zsh\") return evaluateShellC(tokens, ctx);\n	if (cmdName === \"xargs\") return evaluateXargs(tokens, ctx);\n	if (cmdName === \"node\" && (tokens.includes(\"-e\") || tokens.includes(\"-p\") || tokens.includes(\"--eval\") || tokens.includes(\"--print\"))) return {\n		action: \"none\",\n		rule: null,\n		reason: \"node eval\"\n	};\n	for (const rule of denyRules) if (rule.match.test(cmdName)) {\n		if (!rule.when || rule.when(tokens, ctx)) return {\n			action: \"deny\",\n			rule: rule.name,\n			reason: rule.reason ?? null\n		};\n	}\n	const advice = cmdName === \"git\" ? worktreeAdvice(tokens, ctx) : void 0;\n	return {\n		action: \"none\",\n		rule: null,\n		reason: `no rule matched: ${cmdName}`,\n		...advice ? { advice } : {}\n	};\n}\nfunction miseExecInner(tokens) {\n	const dashIdx = tokens.indexOf(\"--\");\n	if (dashIdx === -1) return void 0;\n	const inner = tokens.slice(dashIdx + 1);\n	return inner.length > 0 ? inner : void 0;\n}\nfunction scanPnpmFlags(subTokens, from, state) {\n	for (let i = from; i < subTokens.length; i++) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t.startsWith(\"--filter=\") || t === \"-F\" || t.startsWith(\"-F=\")) return {\n			name: void 0,\n			filterIdx: i\n		};\n		if (t === \"-r\" || t === \"--recursive\") {\n			state.isRecursive = true;\n			continue;\n		}\n		if (t === \"-w\" || t === \"--workspace-root\") {\n			state.isWorkspaceRoot = true;\n			continue;\n		}\n		if (t === \"-C\" || t === \"--dir\") {\n			state.dirOverride = subTokens[++i];\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			state.dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\") && !PNPM_BUILTINS.has(t)) continue;\n		return { name: t };\n	}\n	return { name: void 0 };\n}\nfunction evaluatePnpm(tokens, ctx) {\n	const subTokens = tokens.slice(1);\n	const state = {\n		isRecursive: false,\n		isWorkspaceRoot: false,\n		dirOverride: void 0\n	};\n	const scan = scanPnpmFlags(subTokens, 0, state);\n	if (scan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, scan.filterIdx, ctx, state.dirOverride);\n	const subcommand = scan.name;\n	const subcommandIdx = subcommand ? subTokens.indexOf(subcommand) : -1;\n	if (!subcommand) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (subcommand === \"dlx\") return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm dlx\"\n	};\n	if (subcommand === \"add\") return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm add\"\n	};\n	if (subcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcommandIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName;\n	let { isRecursive, isWorkspaceRoot, dirOverride } = state;\n	if (subcommand === \"run\") {\n		const runScan = scanPnpmFlags(subTokens, subcommandIdx + 1, state);\n		({isRecursive, isWorkspaceRoot, dirOverride} = state);\n		if (runScan.filterIdx !== void 0) return evaluatePnpmFilter(tokens, subTokens, runScan.filterIdx, ctx, state.dirOverride);\n		if (!runScan.name) return {\n			action: \"none\",\n			rule: null,\n			reason: \"pnpm run without script name\"\n		};\n		scriptName = runScan.name;\n	} else if (!PNPM_BUILTINS.has(subcommand)) scriptName = subcommand;\n	else return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (isRecursive) return evaluatePnpmRecursive(scriptName, ctx);\n	if (isWorkspaceRoot) {\n		const root = findWorkspaceRoot(ctx.cwd);\n		if (!root) return {\n			action: \"none\",\n			rule: null,\n			reason: \"workspace root not found\"\n		};\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: root\n		});\n	}\n	if (dirOverride) {\n		const resolved = path.resolve(ctx.cwd, dirOverride);\n		return evaluatePnpmScript(scriptName, {\n			...ctx,\n			cwd: resolved\n		});\n	}\n	return evaluatePnpmScript(scriptName, ctx);\n}\nfunction evaluatePnpmScript(scriptName, ctx) {\n	const resolved = resolveScript(scriptName, ctx.cwd);\n	if (!resolved) return {\n		action: \"none\",\n		rule: null,\n		reason: \"script resolution failed\"\n	};\n	const res = evaluateResolvedScript(resolved, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n	if (res.action === \"deny\") return res;\n	return {\n		action: \"none\",\n		rule: `pnpm-script:${scriptName}`,\n		reason: null\n	};\n}\nfunction evaluatePnpmRecursive(scriptName, ctx) {\n	const resolved = resolveRecursiveScripts(scriptName, ctx.cwd);\n	if (!resolved || resolved.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm recursive\"\n	};\n	for (const pkg of resolved) {\n		const res = evaluateResolvedScript(pkg, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: pkg.pkgDir ?? ctx.cwd\n		});\n		if (res.action === \"deny\") return res;\n	}\n	return {\n		action: \"none\",\n		rule: `pnpm-recursive:${scriptName}`,\n		reason: null\n	};\n}\nfunction evaluateNpm(tokens) {\n	if (isNpmReadOp(tokens)) return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	return {\n		action: \"deny\",\n		rule: \"npm-redirect\",\n		reason: getNpmRedirectReason(tokens)\n	};\n}\nfunction collectFiltersAndScan(subTokens, from, filterPkgs) {\n	let dirOverride;\n	for (let i = from; i < subTokens.length; i += 1) {\n		const t = subTokens[i];\n		if (t === \"--filter\" || t === \"-F\") {\n			const pkg = subTokens[i + 1];\n			if (pkg === void 0 || pkg.startsWith(\"-\")) return void 0;\n			filterPkgs.push(pkg);\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"--filter=\") || t.startsWith(\"-F=\")) {\n			const pkg = t.startsWith(\"-F=\") ? t.slice(3) : t.slice(9);\n			if (pkg === \"\") return void 0;\n			filterPkgs.push(pkg);\n			continue;\n		}\n		if (t === \"-r\" || t === \"--recursive\" || t === \"-w\" || t === \"--workspace-root\") continue;\n		if (t === \"-C\" || t === \"--dir\") {\n			dirOverride = subTokens[i + 1];\n			i += 1;\n			continue;\n		}\n		if (t.startsWith(\"-C=\") || t.startsWith(\"--dir=\")) {\n			dirOverride = t.split(\"=\", 2)[1];\n			continue;\n		}\n		if (t.startsWith(\"-\")) continue;\n		return {\n			name: t,\n			index: i,\n			dirOverride\n		};\n	}\n	return {\n		name: void 0,\n		index: -1,\n		dirOverride\n	};\n}\nfunction evaluatePnpmFilter(_tokens, subTokens, filterIdx, ctx, stateDir) {\n	const filterPkgs = [];\n	const scan = collectFiltersAndScan(subTokens, filterIdx, filterPkgs);\n	if (scan === void 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	let dirOverride = scan.dirOverride ?? stateDir;\n	if (filterPkgs.length === 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without package\"\n	};\n	const filterSubcommand = scan.name;\n	const subcmdIdx = scan.index;\n	if (filterSubcommand === void 0) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter without subcommand\"\n	};\n	if (PNPM_BUILTINS.has(filterSubcommand) && filterSubcommand !== \"run\" && filterSubcommand !== \"exec\") return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	if (filterSubcommand === \"exec\") {\n		const execArgs = subTokens.slice(subcmdIdx + 1);\n		if (execArgs.length === 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"bare pnpm exec\"\n		};\n		return evaluateCommand(joinTokens(execArgs), {\n			...ctx,\n			depth: ctx.depth + 1\n		});\n	}\n	let scriptName = filterSubcommand;\n	if (filterSubcommand === \"run\") {\n		const runScan = collectFiltersAndScan(subTokens, subcmdIdx + 1, filterPkgs);\n		if (runScan === void 0) return {\n			action: \"none\",\n			rule: null,\n			reason: \"pnpm --filter without package\"\n		};\n		scriptName = runScan.name;\n		if (runScan.dirOverride !== void 0) dirOverride = runScan.dirOverride;\n	}\n	if (scriptName === void 0 || scriptName.startsWith(\"-\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"pnpm --filter run without script name\"\n	};\n	if (PNPM_BUILTINS.has(scriptName) && scriptName !== \"run\") return {\n		action: \"none\",\n		rule: null,\n		reason: null\n	};\n	const baseDir = dirOverride ? path.resolve(ctx.cwd, dirOverride) : ctx.cwd;\n	for (const pkg of filterPkgs) {\n		const resolved = resolveFilteredScript(scriptName, pkg, baseDir);\n		if (!resolved) return {\n			action: \"none\",\n			rule: null,\n			reason: \"filtered script resolution failed\"\n		};\n		const res = evaluateResolvedScript(resolved, {\n			...ctx,\n			depth: ctx.depth + 1,\n			cwd: resolved.pkgDir ?? baseDir\n		});\n		if (res.action === \"deny\") return res;\n	}\n	return {\n		action: \"none\",\n		rule: `pnpm-filter:${filterPkgs.join(\",\")}:${scriptName}`,\n		reason: null\n	};\n}\nconst SHELL_LOGIN_FLAGS = /* @__PURE__ */ new Set([\"-l\", \"--login\"]);\nfunction evaluateShellC(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length && SHELL_LOGIN_FLAGS.has(tokens[i])) i++;\n	const flag = tokens[i];\n	if (flag === void 0 || !/^-[lc]+$/.test(flag) || !flag.includes(\"c\")) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell without a plain -c\"\n	};\n	const cmdArg = tokens[i + 1];\n	if (!cmdArg) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell -c without command\"\n	};\n	if (tokens.length > i + 2) return {\n		action: \"none\",\n		rule: null,\n		reason: \"shell -c with positional args\"\n	};\n	return evaluateCommand(cmdArg, {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\nconst XARGS_ARG_FLAGS = /* @__PURE__ */ new Set([\n	\"-I\",\n	\"-d\",\n	\"-n\",\n	\"-P\",\n	\"-s\",\n	\"-L\",\n	\"-E\",\n	\"-a\",\n	\"--max-args\",\n	\"--max-procs\",\n	\"--delimiter\",\n	\"--replace\",\n	\"--max-lines\",\n	\"--max-chars\",\n	\"--arg-file\",\n	\"--process-slot-var\"\n]);\nconst XARGS_BOOL_FLAGS = /* @__PURE__ */ new Set([\n	\"-0\",\n	\"--null\",\n	\"-t\",\n	\"--verbose\",\n	\"-r\",\n	\"--no-run-if-empty\",\n	\"-p\",\n	\"--interactive\",\n	\"-x\",\n	\"--exit\",\n	\"--show-limits\"\n]);\nfunction evaluateXargs(tokens, ctx) {\n	let i = 1;\n	while (i < tokens.length) {\n		const t = tokens[i];\n		if (!t.startsWith(\"-\")) break;\n		if (XARGS_ARG_FLAGS.has(t)) {\n			i += 2;\n			continue;\n		}\n		const eqIdx = t.indexOf(\"=\");\n		if (eqIdx !== -1) {\n			const flagName = t.slice(0, eqIdx);\n			if (XARGS_ARG_FLAGS.has(flagName)) {\n				i++;\n				continue;\n			}\n		}\n		if (t.length > 2 && XARGS_ARG_FLAGS.has(t.slice(0, 2))) {\n			i++;\n			continue;\n		}\n		if (XARGS_BOOL_FLAGS.has(t)) {\n			i++;\n			continue;\n		}\n		return {\n			action: \"none\",\n			rule: null,\n			reason: \"xargs with unrecognised flags\"\n		};\n	}\n	if (i >= tokens.length) return {\n		action: \"none\",\n		rule: null,\n		reason: \"xargs without command\"\n	};\n	return evaluateCommand(joinTokens(tokens.slice(i)), {\n		...ctx,\n		depth: ctx.depth + 1\n	});\n}\n\n//#endregion\n//#region src/file-rules.ts\nconst READ_TOOLS = /* @__PURE__ */ new Set([\n	\"Read\",\n	\"Glob\",\n	\"Grep\"\n]);\nconst WRITE_TOOLS = /* @__PURE__ */ new Set([\"Write\", \"Edit\"]);\nconst fileDenyRules = [\n	{\n		name: \"env-file-read\",\n		tools: READ_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't read .env files. These contain secrets that should not appear in the conversation.\"\n	},\n	{\n		name: \"env-file-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath) => isEnvFile(filePath),\n		reason: \"Don't write to .env files. These contain secrets.\"\n	},\n	{\n		name: \"hooks-folder-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			const hooksDir = path.join(ctx.cwd, \".claude\", \"hooks\");\n			return isWithin(hooksDir, resolved);\n		},\n		reason: \"Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\"\n	},\n	{\n		name: \"git-dir-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => targetsGitDir(filePath, ctx.cwd),\n		reason: \"Don't write into .git/ directly. Its internals (config, hooks, refs) are not plain project files -- a config edit can redirect remotes or push destinations that other rules trust, and a hooks/ script runs automatically on the next commit/push. Use git subcommands instead, or ask the user.\"\n	},\n	{\n		name: \"node-modules-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => targetsNodeModules(filePath, ctx.cwd),\n		reason: \"Don't write into node_modules/. Its files are hardlinks into pnpm's global store -- editing one in place corrupts that package for every project on this machine. Edit the source package and rebuild, or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`).\"\n	},\n	{\n		name: \"claude-settings-write\",\n		tools: WRITE_TOOLS,\n		action: \"deny\",\n		when: (filePath, ctx) => {\n			const resolved = resolveIn(ctx.cwd, filePath);\n			return samePath(resolved, path.join(ctx.cwd, \".claude\", \"settings.json\"));\n		},\n		reason: \"Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\"\n	}\n];\n\n//#endregion\n//#region src/evaluate-tool.ts\nconst FILE_PATH_TOOLS = /* @__PURE__ */ new Set([\n	\"Read\",\n	\"Write\",\n	\"Edit\"\n]);\nconst SEARCH_TOOLS = /* @__PURE__ */ new Set([\"Glob\", \"Grep\"]);\nfunction extractPath(toolName, toolInput, cwd) {\n	if (FILE_PATH_TOOLS.has(toolName)) return parseFilePathInput(toolInput)?.file_path ?? null;\n	if (SEARCH_TOOLS.has(toolName)) return parseSearchInput(toolInput)?.path ?? cwd;\n	return null;\n}\nfunction evaluateToolUse(toolName, toolInput, ctx) {\n	const filePath = extractPath(toolName, toolInput, ctx.cwd);\n	if (filePath === null) return {\n		action: \"none\",\n		rule: null,\n		reason: \"unknown tool input shape\"\n	};\n	for (const rule of fileDenyRules) if (rule.tools.has(toolName) && rule.when(filePath, ctx, toolInput)) return {\n		action: \"deny\",\n		rule: rule.name,\n		reason: rule.reason ?? null\n	};\n	return {\n		action: \"none\",\n		rule: null,\n		reason: \"no file rule matched\"\n	};\n}\n\n//#endregion\n//#region src/lib/settings.ts\nconst SETTINGS_PATH = \".claude/hooks/bst-hook.settings.json\";\nconst BstHookSettingsSchema = object({ protectedBranches: _default(array(string().check(_minLength(1))), []) });\nfunction isFileClean(cwd, relativePath) {\n	try {\n		execFileSync(\"git\", [\n			\"ls-files\",\n			\"--error-unmatch\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\",\n			timeout: GIT_TIMEOUT_MS\n		});\n		execFileSync(\"git\", [\n			\"diff\",\n			\"--quiet\",\n			\"HEAD\",\n			\"--\",\n			relativePath\n		], {\n			cwd,\n			stdio: \"ignore\",\n			timeout: GIT_TIMEOUT_MS\n		});\n		return true;\n	} catch {\n		return false;\n	}\n}\nfunction loadRepoSettings(cwd) {\n	const root = findWorkspaceRoot(cwd) ?? cwd;\n	const settingsFile = join(root, SETTINGS_PATH);\n	const empty = { protectedBranches: [] };\n	if (!existsSync(settingsFile)) return empty;\n	if (!isFileClean(root, SETTINGS_PATH)) return empty;\n	try {\n		const raw = readFileSync(settingsFile, \"utf-8\");\n		const parsed = JSON.parse(raw);\n		const result = BstHookSettingsSchema.safeParse(parsed);\n		if (!result.success) return empty;\n		return { protectedBranches: result.data.protectedBranches };\n	} catch {\n		return empty;\n	}\n}\n\n//#endregion\n//#region src/index.ts\nconst inputResult = await readHookInput();\nif (!inputResult.ok) {\n	process.stderr.write(`[bst-hook] invalid hook input: ${inputResult.error}\\n`);\n	audit({\n		sessionId: \"unknown\",\n		cwd: \"unknown\",\n		command: `<invalid input: ${inputResult.error}>`,\n		decision: \"none\",\n		rule: null,\n		reason: `validation failed: ${inputResult.error}`,\n		permissionMode: void 0\n	});\n	process.exit(0);\n}\nconst input = inputResult.data;\nif (input.hook_event_name !== \"PreToolUse\") process.exit(0);\nif (!(/* @__PURE__ */ new Set([\n	\"Bash\",\n	\"Read\",\n	\"Write\",\n	\"Edit\",\n	\"Glob\",\n	\"Grep\"\n])).has(input.tool_name)) process.exit(0);\nconst repoSettings = loadRepoSettings(input.cwd);\nlet decision;\nlet auditCommand;\nif (input.tool_name === \"Bash\") {\n	const bashInput = parseBashInput(input.tool_input);\n	if (!bashInput) {\n		audit({\n			sessionId: input.session_id,\n			cwd: input.cwd,\n			toolName: input.tool_name,\n			command: `<invalid Bash input: ${JSON.stringify(input.tool_input).slice(0, 200)}>`,\n			decision: \"none\",\n			rule: null,\n			reason: \"Bash tool_input missing or invalid 'command' field\",\n			permissionMode: input.permission_mode\n		});\n		process.exit(0);\n	}\n	decision = evaluateCommand(bashInput.command, {\n		cwd: input.cwd,\n		depth: 0,\n		repoProtectedBranches: repoSettings.protectedBranches\n	});\n	auditCommand = bashInput.command;\n} else {\n	const projectDir = findWorkspaceRoot(input.cwd) ?? process.env[\"CLAUDE_PROJECT_DIR\"] ?? input.cwd;\n	decision = evaluateToolUse(input.tool_name, input.tool_input, {\n		cwd: projectDir,\n		sessionId: input.session_id\n	});\n	const filePath = String(input.tool_input[\"file_path\"] ?? input.tool_input[\"path\"] ?? \"\");\n	auditCommand = `${input.tool_name} ${filePath}`;\n}\naudit({\n	sessionId: input.session_id,\n	cwd: input.cwd,\n	toolName: input.tool_name,\n	command: auditCommand,\n	decision: decision.action,\n	rule: decision.rule,\n	reason: decision.reason,\n	permissionMode: input.permission_mode\n});\nif (decision.action === \"deny\") writeDeny(decision.reason);\nelse if (decision.advice) writeAdvice(decision.advice);\n\n//#endregion\nexport {  };",
+	guide: "# bst-hook Permission Guide\n\nThis project uses a PreToolUse hook (`bst-hook`) that checks each Bash command\nand file tool call before it runs. The hook only ever blocks a command; it does\nnot approve anything on its own. A command that matches a rule below is denied,\nwith a message that says what to do instead.\n\n## Denied commands\n\nThese are blocked. The hook tells you what to do instead.\n\n### Bash\n\n- **sudo**: Don't use sudo. If you need elevated permissions, ask me to do it manually.\n- **git-force-push**: Use `git push --force-with-lease` instead of `--force`.\n- **git-protected-branch-write**: This would move a protected branch (main, master, the remote's default branch, or one listed in .claude/hooks/bst-hook.settings.json#protectedBranches). Work on a feature branch in a worktree: `git worktree add ../<repo>-<topic> -b feat/<topic>`, then commit and push there. To bring `main` up to date, use `git pull --ff-only`.\n- **chmod-777**: Don't use 777 permissions. Use more restrictive permissions.\n- **node-modules-write**: Don't write into node_modules/. Its files are hardlinks into pnpm's global store, so overwriting one in place (plain `cp`, `>` redirect, `sed -i`, ...) writes through the link and corrupts that package for every project on this machine -- silently, since the directory you wrote into ends up fine. To test a local build as an installed dependency, run it directly (`node packages/<pkg>/dist/bin.mjs <cmd>`), or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`). If you must replace a file in place, `cp --remove-destination` is safe -- it unlinks the target first. Run `pnpm store status` to check whether the store is already damaged.\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **health-baseline-reset**: Run `pnpm exec bst health:raise` to raise only what this branch crossed. `--update-baseline --reset` records every outlier, including the ones already on the default branch.\n- **npx-redirect**: This project uses pnpm. Use `pnpm dlx <pkg>` or `pnpm exec <cmd>` instead of npx.\n- **mise-self-update**: Don't self-update mise. The version is Renovate-managed; ask a human to bump the pin.\n\n### File tools (Read, Write, Edit, Glob, Grep)\n\n- **env-file-read**: Don't read .env files. These contain secrets that should not appear in the conversation.\n- **env-file-write**: Don't write to .env files. These contain secrets.\n- **hooks-folder-write**: Don't write to .claude/hooks/. These files are managed by the project and should not be modified directly.\n- **git-dir-write**: Don't write into .git/ directly. Its internals (config, hooks, refs) are not plain project files -- a config edit can redirect remotes or push destinations that other rules trust, and a hooks/ script runs automatically on the next commit/push. Use git subcommands instead, or ask the user.\n- **node-modules-write**: Don't write into node_modules/. Its files are hardlinks into pnpm's global store -- editing one in place corrupts that package for every project on this machine. Edit the source package and rebuild, or install into a scratch tree with an isolated store (`pnpm add --store-dir <scratch> <pkg>`).\n- **claude-settings-write**: Don't write to .claude/settings.json. This file is managed by the project and should not be modified directly.\n\n## How commands are evaluated\n\n- **Pipelines and chains**: every segment is checked; a deny on any segment blocks the whole command.\n- **pnpm scripts**: `pnpm <script>` resolves against `package.json` (including pre/post hooks and `--filter` workspaces) and evaluates the resolved command recursively.\n- **cd propagation**: `cd dir && cmd` evaluates `cmd` relative to the new directory.\n- **Branch switch propagation**: `git switch <branch> && cmd` (or `git checkout <branch>`) evaluates a git write in `cmd` against the branch it switched to, not the one checked out before. This holds only across `&&` and only in the same directory.\n- **Audit log**: all decisions are logged to `.claude/hooks/bst-hook.audit.local.jsonl`.\n\n## Everything else\n\nA command that matches none of the rules above is judged by Claude Code's own\nauto mode, not by this hook.\n"
 }) {
 	const results = [{
 		filePath: HOOK_PATH,
@@ -9450,7 +9486,7 @@ const GIT_GUIDE_BODY = [
 	"",
 	"**A merge with no conflicts is not yet a merge that works.** Read the incoming diff for what your branch builds on -- a field made required, a shared schema, a size budget -- and run the full check before you push the merge. Fix what it finds in the merge commit itself, so that commit passes on its own.",
 	"",
-	"**Never trust git's merge of a baseline file** (`health-baseline.json`, `coverage-baseline.json`): a merge that reports no conflict can still drop the default branch's own entries. Take the default branch's copy, re-measure the merged tree, and adopt only what your branch changed."
+	"**Never trust git's merge of a baseline file** (`health-baseline.json`, `coverage-baseline.json`): a merge that reports no conflict can still drop the default branch's own entries. Take the default branch's copy, then re-measure: `pnpm exec bst health:raise` for `health-baseline.json`, the coverage command for the other. Adopt only what your branch changed."
 ].join("\n");
 const PLAN_LIFECYCLE_GUIDE_BODY = [
 	"# Plan lifecycle",
@@ -9493,6 +9529,7 @@ const PLANNING_GUIDE_BODY = [
 	"### Writing the plan",
 	"",
 	"- Check the plan's premises against the tree before building on them. \"Today X is broken\" is a claim: read the code that handles X, not just the line that throws.",
+	"- A plan or spec that must mention a character `chars:check` denies names it by its code point (`U+202E`) or by the escape its context uses, and never pastes the glyph: an active doc is inside the gate's scope and holds the branch red until it retires.",
 	"- Label each task `Task <n>:` at the start of its heading or checkbox, numbered from 1, so `plan:brief` can find it. To split a task after the plan is written, give the parts one lowercase letter (`Task 18a:`, `Task 18b:`) rather than renumbering, so later tasks and every cross-reference keep their numbers. A checkbox's first sentence is the task's name on the control panel: end it with a period inside one short line, and put the files, commands, and checks in the sentences after it.",
 	`- Give each task what makes it unambiguous and nothing more: a test's name and its assertions with the spec's exact values and why that test fails before the change, a code change's exact signature and file, a command with the output that means it passed. Write out a body only for an algorithm the signature and tests do not determine. Work that uses another task's result names that task's interfaces, never repeats its code. A task with no test to write says \`${TEST_EVIDENCE_PREFIXES.noTest} <reason>\` in the plan, so the executor inherits the call instead of making it cold.`,
 	"- Keep tasks small. Each one runs its own test cycle and ends in a result that can be checked on its own: write the failing test, watch it fail, make it pass, commit. A run cut off partway then loses one task, not the plan. A large plan is fine; a large task is not.",
@@ -9506,11 +9543,12 @@ const PLANNING_GUIDE_BODY = [
 	"",
 	"## Working through a plan",
 	"",
-	`Do the tasks in order, commit after each, and tick a box only once its result is verified. Each task starts red -- write its test, watch it fail, make it pass -- and its commit body carries the testing guide's \`${TEST_EVIDENCE_PREFIXES.red}\` or \`${TEST_EVIDENCE_PREFIXES.noTest}\` line. A box you cannot finish keeps its text exactly as written and gets one note underneath:`,
+	`Do the tasks in order, commit after each, and tick a box only once its result is verified. Each task starts red -- write its test, watch it fail, make it pass -- and its commit body carries the testing guide's \`${TEST_EVIDENCE_PREFIXES.red}\` or \`${TEST_EVIDENCE_PREFIXES.noTest}\` line. A box you cannot finish, or cannot finish in full, keeps its text exactly as written and gets one of four notes underneath:`,
 	"",
 	"- `**Progress:**` -- partly done: what landed, what remains, where to pick up. The next pass resumes it.",
 	"- `**Blocked:**` -- tried and failing: the error. The next pass retries it.",
 	"- `**Declined:**` -- must not be done, with the reason: a standing rule, a repo convention, or a check that found it moot. No pass touches it again. \"Too hard\" or \"out of budget\" is Progress, not Declined.",
+	"- `**Deferred:** Task <n> -- <reason>` -- part of the box waits on a later task. Split that box first, so the work that waits is a box of its own, and defer only that one; deferring the whole box drops the part that does not wait. The note says which task and what in it the box waits on, both on that one line. The same plan-only commit adds `- [ ] **Carried from Task <source>:** <the work>` to that task, which is the work going on there; the target cannot be the retire task. The deferral then resolves the box: it says \"later\", not \"never\". With no carried box in the target, nothing is deferred and the box stays outstanding, counted against every later pass.",
 	"",
 	"To run a plan through subagents, see the subagents guide."
 ].join("\n");
@@ -9666,11 +9704,13 @@ const HEALTH_RULE_TAIL = [
 	"",
 	"So never duplicate a type, or fork a helper, to protect a fan budget -- import it. Nor move a module out of its home directory to dodge crowding. The converse holds: turning a type-only import into a value import adds an edge, so a module that already imports another for its types gains a real edge the first time it imports a value from it.",
 	"",
-	"**An exemption takes a module or directory out of the gate.** It is listed with its count and reason in `health:summary --explain`, carries no ceiling, and is counted in no metric. `crowdedDirectories` is exemptable by directory path. Adding one is a raise too.",
+	"**An exemption takes a module or directory out of the gate.** It is listed with its count and reason in `health:summary --explain`, carries no ceiling, and is counted in no metric. `crowdedDirectories` is exemptable by directory path. A key may be a glob. Adding one is a raise too.",
+	"",
+	"**A raise travels with the code that caused it.** A raise is a higher count or ceiling, a ceiling for a module that has none, a new exemption, or a higher limit. Write it with `pnpm exec bst health:raise` in the pull request whose code crossed the budget; say in the commit why, and a person merges it. Its `--exempt <leaf> --reason \"<text>\"` is for a hub by construction. Never raise a limit to pass. `--update-baseline --reset` rebuilds a baseline, never one branch.",
 	"",
-	"**A raise travels alone.** A raise is a higher count or ceiling, a ceiling for a module that has none, a new exemption, or a higher limit. It lands only as a ceiling-only pull request -- one whose diff changes nothing but `health-baseline.json` and `.tooling.json` -- which a human merges. When `health:check` refuses, split the module or open that pull request, and stop. Never run `pnpm exec bst health:check --update-baseline --reset` on a branch that carries code.",
+	"Prefer an exemption to raising `fanInLimit` or `fanOutLimit`: an exemption names the hub in `health:summary --explain`, while a higher limit silently un-tracks every module beneath it. A per-module ceiling has no such shadow -- it ratchets one module at one count and fails again one edge later.",
 	"",
-	"Prefer an exemption to raising `fanInLimit` or `fanOutLimit`: an exemption names the hub in `health:summary --explain`, while a higher limit silently un-tracks every module beneath it. A per-module ceiling has no such shadow -- it ratchets one module at one count and fails again one edge later."
+	"**Never contort code to meet a budget.** Write the correct solution, then adjust the budget to match: a health ceiling as the raise rule above says, and a bundle or other size budget by a full 1%, rounded up, never to the byte."
 ];
 function healthRuleBody(config) {
 	const lines = [...HEALTH_RULE_HEAD];
@@ -9805,7 +9845,7 @@ function agentGuides(config, coverageEnabled, healthEnabled, webUiEnabled) {
 		},
 		{
 			name: "health.md",
-			trigger: "add a cross-module import, or when `health:check` fails",
+			trigger: "add a cross-module import, or when `health:check` or a size budget fails",
 			body: healthRuleBody(config),
 			enabled: healthEnabled
 		}
@@ -10132,7 +10172,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.94.0 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.96.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -10932,6 +10972,21 @@ function parseWarnMarkerLine(line) {
 	const count = Number.parseInt(match[1] ?? "", 10);
 	return Number.isNaN(count) ? null : count;
 }
+const MEASURE_LINE = new RegExp(`^::bst-health:: measure (\\d+)\\s*$`);
+function parseMeasureMarkerLine(line) {
+	const match = MEASURE_LINE.exec(line);
+	if (match === null) return void 0;
+	const value = Number.parseInt(match[1] ?? "", 10);
+	return Number.isNaN(value) ? void 0 : value;
+}
+function readMeasureMarker(stdout) {
+	let found;
+	for (const line of stdout.split("\n")) {
+		const parsed = parseMeasureMarkerLine(line);
+		if (parsed !== void 0) found = parsed;
+	}
+	return found;
+}
 //#endregion
 //#region src/checks/step-exec.ts
 function execStep(cmd, cwd, sink = process.stdout) {
@@ -11080,17 +11135,13 @@ function createRealHealthExecutor(rootDir) {
 }
 //#endregion
 //#region src/codebase-health/reference.ts
-const HEALTH_CEILING_FILES = ["health-baseline.json", ".tooling.json"];
 const BASELINE_FILE$2 = "health-baseline.json";
-const TOOLING_FILE = ".tooling.json";
+const TOOLING_FILE$1 = ".tooling.json";
 function repoPrefix(executor, cwd) {
 	const result = executor.exec("git", ["rev-parse", "--show-prefix"], { cwd });
 	if (result.exitCode !== 0) return "";
 	return result.stdout.trim();
 }
-function ceilingFileNamesAt(prefix) {
-	return HEALTH_CEILING_FILES.map((name) => `${prefix}${name}`);
-}
 const DefaultBranchSchema = z.object({ defaultBranch: z.string().optional() });
 function parseDefaultBranchOverride(raw) {
 	if (raw === void 0 || raw.trim() === "") return void 0;
@@ -11114,9 +11165,9 @@ function resolveReferenceBranch(executor, cwd, prefix, ciEvent) {
 		"--quiet",
 		ref
 	], cwd) !== void 0) {
-		const branch = parseDefaultBranchOverride(showAt(executor, cwd, ref, `${prefix}${TOOLING_FILE}`)) ?? chosen;
+		const branch = parseDefaultBranchOverride(showAt(executor, cwd, ref, `${prefix}${TOOLING_FILE$1}`)) ?? chosen;
 		if (anchor !== void 0) return { branch };
-		const namedElsewhere = parseDefaultBranchOverride(executor.readFile(TOOLING_FILE));
+		const namedElsewhere = parseDefaultBranchOverride(executor.readFile(TOOLING_FILE$1));
 		if (namedElsewhere === void 0 || namedElsewhere === branch) return { branch };
 		return {
 			branch,
@@ -11124,7 +11175,7 @@ function resolveReferenceBranch(executor, cwd, prefix, ciEvent) {
 		};
 	}
 	if (anchor !== void 0) return { branch: chosen };
-	return { branch: parseDefaultBranchOverride(executor.readFile(TOOLING_FILE)) ?? "main" };
+	return { branch: parseDefaultBranchOverride(executor.readFile(TOOLING_FILE$1)) ?? "main" };
 }
 function originHeadBranch(git, cwd) {
 	const head = git([
@@ -11166,10 +11217,10 @@ function readReference(executor, opts) {
 		reason: `health: cannot read the reference at the merge base with origin/${branch}. Run \`git fetch origin ${branch}\` so the default branch is present (a shallow clone or a missing remote-tracking ref makes it absent), or set .tooling.json#defaultBranch on the default branch if it has another name -- once that branch is fetched, its own copy of the setting decides, not this branch's. health:check fails closed without a reference.`
 	};
 	const baselineText = showAt(executor, opts.cwd, sha, `${prefix}${BASELINE_FILE$2}`);
-	const toolingText = showAt(executor, opts.cwd, sha, `${prefix}${TOOLING_FILE}`);
+	const toolingText = showAt(executor, opts.cwd, sha, `${prefix}${TOOLING_FILE$1}`);
 	const health = resolveHealthConfigFromContext({
-		exists: (rel) => rel === TOOLING_FILE && toolingText !== void 0,
-		read: (rel) => rel === TOOLING_FILE ? toolingText : void 0,
+		exists: (rel) => rel === TOOLING_FILE$1 && toolingText !== void 0,
+		read: (rel) => rel === TOOLING_FILE$1 ? toolingText : void 0,
 		config: { stack: opts.stack }
 	}, { isMonorepo: opts.isMonorepo });
 	const reference = {
@@ -11208,8 +11259,67 @@ const RAISABLE_LIMITS = [
 	"moduleSizeLimit",
 	"tolerance"
 ];
+const GATE_SWITCHES = ["enabled", "crossPackage"];
+const EXCLUDE_LEAF_PREFIX = "health.exclude.";
+function canonicalJson(value) {
+	return JSON.stringify(sortKeys(value));
+}
+const JsonObjectSchema$1 = z.record(z.string(), z.unknown());
+function sortKeys(value) {
+	if (Array.isArray(value)) return value.map(sortKeys);
+	const object = JsonObjectSchema$1.safeParse(value);
+	if (object.success) {
+		const keys = Object.keys(object.data).toSorted();
+		const sorted = {};
+		for (const key of keys) sorted[key] = sortKeys(object.data[key]);
+		return sorted;
+	}
+	return value;
+}
+function sizeRaises(reference, current) {
+	const raises = [];
+	for (const [id, base] of Object.entries(reference.baseline?.sizeBudgets ?? {})) {
+		if (current.baseline === void 0) continue;
+		const now = current.baseline.sizeBudgets?.[id];
+		if (now === void 0) {
+			if (current.health.sizeBudgets[id] !== void 0) raises.push({
+				leaf: `sizeBudgets.${id}`,
+				reference: String(base),
+				current: "absent"
+			});
+			continue;
+		}
+		if (now > base) raises.push({
+			leaf: `sizeBudgets.${id}`,
+			reference: String(base),
+			current: String(now)
+		});
+	}
+	for (const [id, base] of Object.entries(reference.health.sizeBudgets)) {
+		const now = current.health.sizeBudgets[id];
+		if (now === void 0) {
+			raises.push({
+				leaf: `health.sizeBudgets.${id}`,
+				reference: "present",
+				current: "absent"
+			});
+			continue;
+		}
+		const baseJson = canonicalJson(base);
+		if (baseJson !== canonicalJson(now)) raises.push({
+			leaf: `health.sizeBudgets.${id}`,
+			reference: baseJson,
+			current: canonicalJson(now)
+		});
+	}
+	return raises;
+}
 function findRaises(reference, current) {
-	return [...baselineRaises(reference, current), ...configRaises(reference.health, current.health)];
+	return [
+		...baselineRaises(reference, current),
+		...sizeRaises(reference, current),
+		...configRaises(reference.health, current.health)
+	];
 }
 function baselineRaises(reference, current) {
 	const raises = [];
@@ -11221,7 +11331,7 @@ function baselineRaises(reference, current) {
 			reference: String(base),
 			current: String(now)
 		});
-		else if (base !== void 0 && now === void 0 && current.baseline !== void 0 && current.measured?.metrics[key] !== void 0) raises.push({
+		else if (base !== void 0 && now === void 0 && current.baseline !== void 0 && (current.measured === void 0 || current.measured.metrics[key] !== void 0)) raises.push({
 			leaf: key,
 			reference: String(base),
 			current: "absent"
@@ -11232,7 +11342,7 @@ function baselineRaises(reference, current) {
 		for (const [module, base] of Object.entries(reference.baseline?.moduleCeilings?.[key] ?? {})) {
 			if (current.baseline === void 0) continue;
 			if (current.baseline.moduleCeilings?.[key]?.[module] !== void 0) continue;
-			if (measured[module] === void 0) continue;
+			if (current.measured !== void 0 && measured[module] === void 0) continue;
 			raises.push({
 				leaf: `moduleCeilings.${key}.${module}`,
 				reference: String(base),
@@ -11286,11 +11396,11 @@ function configRaises(reference, current) {
 		});
 	}
 	for (const pattern of current.exclude) if (!reference.exclude.includes(pattern)) raises.push({
-		leaf: `health.exclude.${pattern}`,
+		leaf: `${EXCLUDE_LEAF_PREFIX}${pattern}`,
 		reference: "absent",
 		current: "present"
 	});
-	for (const name of ["enabled", "crossPackage"]) if (reference[name] && !current[name]) raises.push({
+	for (const name of GATE_SWITCHES) if (reference[name] && !current[name]) raises.push({
 		leaf: `health.${name}`,
 		reference: "true",
 		current: "false"
@@ -11318,11 +11428,6 @@ function branchDiffNames(executor, cwd, mergeBase) {
 	}
 	return [...names].toSorted();
 }
-function isCeilingOnly(names, prefix = "") {
-	if (names.length === 0) return false;
-	const files = ceilingFileNamesAt(prefix);
-	return names.every((name) => files.includes(name));
-}
 //#endregion
 //#region ../forgejo/src/git.ts
 const GIT_LOCAL_TIMEOUT_MS = 6e4;
@@ -12275,7 +12380,7 @@ function findInertAgentKeys(saved) {
 function runInertAgentSettingsGate(saved) {
 	const keys = findInertAgentKeys(saved);
 	if (keys.length === 0) return [];
-	log$1.warn(`.tooling.json sets ${keys.map((key) => `agent.${key}`).join(", ")}, but agent.enabled is not true, so the agent ignores them. Run \`bst setup:agent\` to enable the agent, or remove those keys.`);
+	log$1.warn(`.tooling.json sets ${keys.map((key) => `agent.${key}`).join(", ")}, but agent.enabled is not true, so the agent ignores them. Run \`pnpm exec bst setup:agent\` to enable the agent, or remove those keys.`);
 	return keys;
 }
 function runPublishConfigGate(config, targetDir) {
@@ -12333,7 +12438,7 @@ function warnUnconfiguredDefaultBranch(targetDir, saved, git = defaultGitRunner)
 	if (head === void 0) return;
 	const name = head.startsWith("origin/") ? head.slice(7) : head;
 	if (name === "" || name === "main") return;
-	log$1.warn(`origin/HEAD names "${name}", but .tooling.json sets no defaultBranch, so the generated CI workflow triggers on "${DEFAULT_BRANCH}" and gates its release steps there. Set .tooling.json#defaultBranch to "${name}" and run bst repo:sync.`);
+	log$1.warn(`origin/HEAD names "${name}", but .tooling.json sets no defaultBranch, so the generated CI workflow triggers on "${DEFAULT_BRANCH}" and gates its release steps there. Set .tooling.json#defaultBranch to "${name}" and run pnpm exec bst repo:sync.`);
 }
 function warnCoveredChecksAdd(config, targetDir) {
 	const covered = coveredChecksAddEntries(config, readPackageJson(targetDir)?.scripts ?? {});
@@ -12545,7 +12650,7 @@ async function runUpdateReport(targetDir, flags = {}, options = {}) {
 	const dockerDiscovery = createDockerDiscoveryMemo();
 	const saved = loadToolingConfigStrict(targetDir);
 	if (!saved) {
-		log$1.error("No .tooling.json found. Run `bst repo:sync` first to initialize the project.");
+		log$1.error("No .tooling.json found. Run `pnpm exec bst repo:sync` first to initialize the project.");
 		process.exitCode = 1;
 		return {
 			status: "stopped",
@@ -14043,7 +14148,7 @@ const LabelSchema$1 = z.object({
 	exclusive: z.boolean().optional()
 });
 const LabelListSchema = z.array(LabelSchema$1);
-const LABELS_PAGE_SIZE = 100;
+const LABELS_PAGE_SIZE = 50;
 const LABELS_MAX_PAGES = 20;
 async function fetchAllForgejoLabels(executor, conn) {
 	const labels = [];
@@ -14056,7 +14161,7 @@ async function fetchAllForgejoLabels(executor, conn) {
 		const parsed = LabelListSchema.safeParse(await res.json());
 		if (!parsed.success) throw new UnexpectedError(`Unexpected label-list response: ${parsed.error.message}`);
 		labels.push(...parsed.data);
-		if (parsed.data.length < LABELS_PAGE_SIZE) break;
+		if (!morePagesFollow(res, parsed.data.length, labels.length, LABELS_PAGE_SIZE)) break;
 	}
 	return labels;
 }
@@ -14180,7 +14285,7 @@ async function listForgejoComments(executor, conn, number, options = {}) {
 		}, issueNotFoundMessage(conn, number));
 		const parsed = parseCommentListOrThrow(await res.json());
 		comments.push(...parsed.map(normalizeComment));
-		if (parsed.length < COMMENTS_PAGE_SIZE) break;
+		if (!morePagesFollow(res, parsed.length, comments.length, COMMENTS_PAGE_SIZE)) break;
 		if (page === COMMENTS_MAX_PAGES) {
 			log.warn(`Comment listing for #${String(number)} hit the ${String(COMMENTS_MAX_PAGES)}-page cap; results may be truncated`);
 			options.onPageCap?.();
@@ -14296,7 +14401,10 @@ async function fetchIssueListPage(executor, conn, params) {
 		verb: "list issues",
 		resource: conn.repository
 	}, repoNotFoundMessage(conn));
-	return parseIssueListOrThrow(await res.json());
+	return {
+		raw: parseIssueListOrThrow(await res.json()),
+		res
+	};
 }
 function normalizeDetailedIssues(raw, type) {
 	const normalized = raw.map(normalizeIssue);
@@ -14307,7 +14415,7 @@ const DETAILED_LIST_MAX_PAGES = 20;
 async function listForgejoIssuesDetailedPaged(executor, conn, query, options) {
 	const issues = [];
 	for (let page = 1; page <= DETAILED_LIST_MAX_PAGES; page++) {
-		const raw = await fetchIssueListPage(executor, conn, issueListParams(query.type, {
+		const { raw } = await fetchIssueListPage(executor, conn, issueListParams(query.type, {
 			...query,
 			limit: DETAILED_LIST_PAGE_SIZE,
 			page
@@ -14714,7 +14822,7 @@ function ownerOf(names) {
 }
 //#endregion
 //#region src/work-status/claim.ts
-const HANDOVER_ROUTES = "Claim it from the control panel's \"Claim for hand work\", or remove the agent label by hand and run bst work:start again.";
+const HANDOVER_ROUTES = "Claim it from the control panel's \"Claim for hand work\", or remove the agent label by hand and run pnpm exec bst work:start again.";
 function decideClaim(report, enabled) {
 	if (!enabled) return {
 		kind: "answer",
@@ -14789,7 +14897,7 @@ async function writeClaim(executor, cwd, target, number) {
 		const flag = (await fetchAllForgejoLabels(executor, conn)).find((label) => label.name === HAND_AUTHORED_LABEL);
 		if (flag === void 0) return {
 			outcome: "failed",
-			reason: `The forge has no label named ${HAND_AUTHORED_LABEL}. Provision the agent's labels first with bst-agent agent:labels --repo ${conn.repository}, or the control panel's Provision labels.`
+			reason: `The forge has no label named ${HAND_AUTHORED_LABEL}. Provision the agent's labels first with pnpm exec bst-agent agent:labels --repo ${conn.repository}, or the control panel's Provision labels.`
 		};
 		await addForgejoIssueLabel(executor, conn, number, HAND_AUTHORED_LABEL, /* @__PURE__ */ new Map([[HAND_AUTHORED_LABEL, flag.id]]));
 		return {
@@ -18220,22 +18328,90 @@ function taskLabelId(text) {
 	return `${digits}${match?.[2] ?? ""}`;
 }
 //#endregion
+//#region src/plan-workspace/plan-units.ts
+const AFTER_LABEL = /^[ \t]*(?::|\.|--?)?[ \t]*/;
+function planTask(headingText, label) {
+	const unwrapped = headingText.replace(/^(\*\*|__)/, "").replace(/(\*\*|__)$/, "");
+	return {
+		label,
+		title: unwrapped.slice(unwrapped.indexOf(label) + label.length).replace(AFTER_LABEL, "").trim()
+	};
+}
+function groupPlanUnits(text, boxes) {
+	const lines = text.split("\n");
+	const fenced = fencedLines(lines);
+	const boxAtLine = /* @__PURE__ */ new Map();
+	for (const box of boxes) boxAtLine.set(box.line, box);
+	const units = [];
+	const open = [];
+	for (const [index, rawLine] of lines.entries()) {
+		if (fenced[index] === true) continue;
+		const line = rawLine ?? "";
+		const heading = HEADING.exec(line);
+		if (heading !== null) {
+			const level = (heading[1] ?? "").length;
+			while (open.length > 0 && (open[open.length - 1]?.level ?? 0) >= level) open.pop();
+			const headingText = (heading[2] ?? "").trim();
+			const label = taskLabelId(headingText);
+			if (label === null) continue;
+			const unit = {
+				key: headingText,
+				task: planTask(headingText, label),
+				boxes: []
+			};
+			units.push(unit);
+			open.push({
+				level,
+				unit
+			});
+			continue;
+		}
+		const box = boxAtLine.get(index);
+		if (box === void 0) continue;
+		const section = open[open.length - 1];
+		if (section !== void 0) {
+			section.unit.boxes.push(box);
+			continue;
+		}
+		units.push({
+			key: box.title,
+			task: null,
+			boxes: [box]
+		});
+	}
+	return units;
+}
+//#endregion
 //#region src/plan-workspace/plan-boxes.ts
 const BOX_LINE_REGEX = /^[ \t]*[-*] \[([ xX])\][ \t]*(.*)$/;
 const HEADING_REGEX = /^#{1,6} /;
 const DECLINED_LINE_REGEX = /^[ \t]*(?:[-*][ \t]+)?\*\*Declined:\*\*[ \t]*(.*)$/;
-const NOTE_LINE_REGEX = /^[ \t]*(?:[-*][ \t]+)?\*\*(Progress|Blocked|Declined):\*\*[ \t]*(.*)$/;
+const NOTE_LINE_REGEX = /^[ \t]*(?:[-*][ \t]+)?\*\*(Progress|Blocked|Declined|Deferred):\*\*[ \t]*(.*)$/;
+const DEFERRED_LINE_REGEX = /^[ \t]*(?:[-*][ \t]+)?\*\*Deferred:\*\*[ \t]*(.*)$/;
+const DEFERRAL_SEPARATOR_REGEX = /^[ \t]*(?::|\.|--|-)?[ \t]*/;
 const RETIRE_TASK_REGEX = /^(?:\*\*|__)?Retire this plan(?![A-Za-z0-9])/;
+function describeDeferralCheck(check) {
+	switch (check) {
+		case "empty-reason": return "the note names no reason";
+		case "no-target-label": return "the note names no target task";
+		case "no-own-task": return "the box names no task of its own";
+		case "target-not-found": return "no task in the plan carries that label";
+		case "target-not-later": return "the target task does not come later in the plan";
+		case "target-is-retire": return "the target is the retire task";
+		case "no-carried-box": return "the target task holds no box carried from this one";
+	}
+}
 function isOutstanding(box, options) {
-	if (box.checked || box.declined) return false;
+	if (box.checked || box.declined || box.deferred) return false;
 	return !(box.retireTask && options?.planRetired === true);
 }
 function noteKind(label) {
 	if (label === "Progress") return "progress";
 	if (label === "Blocked") return "blocked";
+	if (label === "Deferred") return "deferred";
 	return "declined";
 }
-const PARAGRAPH_BREAK_REGEX = /^[ \t]*(?:[-*+][ \t]|[0-9]+[.)][ \t]|\*\*(?:Progress|Blocked|Declined):\*\*|<!--)/;
+const PARAGRAPH_BREAK_REGEX = /^[ \t]*(?:[-*+][ \t]|[0-9]+[.)][ \t]|\*\*(?:Progress|Blocked|Declined|Deferred):\*\*|<!--)/;
 const ABBREVIATION_REGEX = /(?:^|[^A-Za-z])(?:e\.g|i\.e|etc|vs|cf)$/i;
 function boxParagraph(lines, fenced, start, end, first) {
 	const parts = [first];
@@ -18269,6 +18445,100 @@ function unwrapEmphasis(rawTitle) {
 	if (emphasis === void 0 || !rawTitle.endsWith(emphasis)) return rawTitle;
 	return rawTitle.slice(emphasis.length, -emphasis.length).trim();
 }
+function deferredLineOf(lines, fenced, start, blockEnd) {
+	for (let index = start + 1; index < blockEnd; index++) {
+		if (fenced[index] === true) continue;
+		const match = DEFERRED_LINE_REGEX.exec(lines[index] ?? "");
+		if (match === null) continue;
+		return (match[1] ?? "").trim();
+	}
+	return null;
+}
+function readDeferralNote(text) {
+	if (text === "") return {
+		target: null,
+		reason: "",
+		failed: "empty-reason"
+	};
+	const target = taskLabelId(text);
+	if (target === null) return {
+		target: null,
+		reason: "",
+		failed: "no-target-label"
+	};
+	const reason = text.slice(text.indexOf(target) + target.length).replace(DEFERRAL_SEPARATOR_REGEX, "").trim();
+	if (reason === "") return {
+		target,
+		reason: "",
+		failed: "empty-reason"
+	};
+	return {
+		target,
+		reason,
+		failed: null
+	};
+}
+function ownTaskLabel(box, units) {
+	const unit = units.find((candidate) => candidate.boxes.some((other) => other.line === box.line));
+	const fromSection = unit?.task?.label ?? null;
+	if (fromSection !== null) return fromSection;
+	return unit?.task === void 0 ? null : taskLabelId(box.title);
+}
+function holdsCarriedBox(unit, sourceLabel) {
+	const escaped = sourceLabel.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	const carried = new RegExp(`^Carried from Task ${escaped}(?![0-9A-Za-z]):`);
+	return unit.boxes.some((box) => carried.test(box.title));
+}
+function resolveDeferrals(boxes, units) {
+	for (const { box, deferredLine } of boxes) {
+		if (deferredLine === null || box.checked || box.declined) continue;
+		const deferral = readDeferralNote(deferredLine);
+		box.deferral = deferral;
+		if (deferral.failed !== null || deferral.target === null) continue;
+		const ownIndex = units.findIndex((unit) => unit.boxes.some((other) => other.line === box.line));
+		const sourceLabel = ownTaskLabel(box, units);
+		if (sourceLabel === null) {
+			box.deferral = {
+				...deferral,
+				failed: "no-own-task"
+			};
+			continue;
+		}
+		const targetIndexes = units.flatMap((unit, index) => unit.task?.label === deferral.target ? [index] : []);
+		if (targetIndexes.length !== 1) {
+			box.deferral = {
+				...deferral,
+				failed: "target-not-found"
+			};
+			continue;
+		}
+		const targetIndex = targetIndexes[0] ?? -1;
+		if (targetIndex <= ownIndex) {
+			box.deferral = {
+				...deferral,
+				failed: "target-not-later"
+			};
+			continue;
+		}
+		const target = units[targetIndex];
+		if (target === void 0) continue;
+		if (target.boxes.some((other) => other.retireTask) || target.task !== null && RETIRE_TASK_REGEX.test(target.task.title)) {
+			box.deferral = {
+				...deferral,
+				failed: "target-is-retire"
+			};
+			continue;
+		}
+		if (!holdsCarriedBox(target, sourceLabel)) {
+			box.deferral = {
+				...deferral,
+				failed: "no-carried-box"
+			};
+			continue;
+		}
+		box.deferred = true;
+	}
+}
 function parsePlanBoxes(planText) {
 	const lines = planText.split("\n");
 	const fenced = fencedLines(lines);
@@ -18283,7 +18553,7 @@ function parsePlanBoxes(planText) {
 			rawTitle: (match[2] ?? "").trim()
 		});
 	}
-	return boxStarts.map((box, position) => {
+	const built = boxStarts.map((box, position) => {
 		const nextBoxIndex = boxStarts[position + 1]?.index ?? lines.length;
 		let blockEnd = nextBoxIndex;
 		for (let index = box.index + 1; index < nextBoxIndex; index++) {
@@ -18296,13 +18566,18 @@ function parsePlanBoxes(planText) {
 		const title = stripStrong(unwrapEmphasis(firstSentence$1(boxParagraph(lines, fenced, box.index, blockEnd, box.rawTitle))));
 		const retireTask = RETIRE_TASK_REGEX.test(title);
 		if (box.checked) return {
-			line: box.index,
-			checked: true,
-			declined: false,
-			reason: null,
-			title,
-			retireTask,
-			notes: []
+			box: {
+				line: box.index,
+				checked: true,
+				declined: false,
+				reason: null,
+				title,
+				retireTask,
+				notes: [],
+				deferred: false,
+				deferral: null
+			},
+			deferredLine: null
 		};
 		const notes = [];
 		for (let index = box.index + 1; index < blockEnd; index++) {
@@ -18327,15 +18602,22 @@ function parsePlanBoxes(planText) {
 			}
 		}
 		return {
-			line: box.index,
-			checked: false,
-			declined: reason !== null,
-			reason,
-			title,
-			retireTask,
-			notes
+			box: {
+				line: box.index,
+				checked: false,
+				declined: reason !== null,
+				reason,
+				title,
+				retireTask,
+				notes,
+				deferred: false,
+				deferral: null
+			},
+			deferredLine: deferredLineOf(lines, fenced, box.index, blockEnd)
 		};
 	});
+	if (built.some((entry) => entry.deferredLine !== null)) resolveDeferrals(built, groupPlanUnits(planText, built.map((entry) => entry.box)));
+	return built.map((entry) => entry.box);
 }
 function countOutstandingBoxes(planText, options) {
 	return parsePlanBoxes(planText).filter((box) => isOutstanding(box, options)).length;
@@ -18366,6 +18648,11 @@ function planStatus(planText, planPath) {
 		kind: note.kind,
 		text: note.text
 	})));
+	const deferrals = boxes.flatMap((box) => box.deferral === null ? [] : [{
+		task: box.title,
+		target: box.deferral.target,
+		failed: box.deferral.failed
+	}]);
 	const nextBox = open[0];
 	return {
 		plan: planPath,
@@ -18373,6 +18660,8 @@ function planStatus(planText, planPath) {
 		checked: boxes.filter((box) => box.checked).length,
 		outstanding: open.length,
 		declined: boxes.filter((box) => box.declined).length,
+		deferred: boxes.filter((box) => box.deferred).length,
+		deferrals,
 		next: nextBox === void 0 || nextBox.title === "" ? null : nextBox.title,
 		nextTask: nextBox === void 0 ? null : enclosingTaskLabel(planText, nextBox.line),
 		onlyRetireLeft: open.length > 0 && open.every((box) => box.retireTask),
@@ -18477,14 +18766,14 @@ function unavailableWith(reason) {
 		reason
 	};
 }
-function unavailable(error) {
+function unavailable$1(error) {
 	return unavailableWith(reasonText(error));
 }
 async function section(build) {
 	try {
 		return await build();
 	} catch (error) {
-		return unavailable(error);
+		return unavailable$1(error);
 	}
 }
 function reasonText(error) {
@@ -18725,7 +19014,7 @@ async function docsSection({ git, docsExtraDirs, resolved }) {
 			path,
 			status: {
 				...status,
-				total: status.checked + status.outstanding + status.declined
+				total: status.checked + status.outstanding + status.declined + status.deferred
 			}
 		});
 	}
@@ -18890,7 +19179,7 @@ function renderWorkStatus(report, options) {
 	if (report.heldByHand === true) lines.push("HELD BY HAND: agent-flags/hand-authored -- a human claimed this one; do not drive it.");
 	if (options?.agentEnabled === true && report.owner === "unclaimed") {
 		const number = claimableNumber(report);
-		if (number !== null) lines.push(`UNCLAIMED: no agent label and no hand claim -- run \`bst work:start ${String(number)}\` before you work this.`);
+		if (number !== null) lines.push(`UNCLAIMED: no agent label and no hand claim -- run \`pnpm exec bst work:start ${String(number)}\` before you work this.`);
 	}
 	lines.push(...block("object", report.object, objectRows));
 	lines.push(...block("docs", report.docs, docsRows));
@@ -18955,7 +19244,7 @@ const workStartCommand = defineCommand({
 	async run({ args }) {
 		const { ref, executor, git, forge } = await prepareWorkStatus(typeof args.ref === "string" ? args.ref.trim() : "", process.cwd());
 		const number = ref?.number;
-		if (number === void 0) throw new FatalError("Usage: bst work:start needs an issue or pull request number or URL");
+		if (number === void 0) throw new FatalError("Usage: pnpm exec bst work:start needs an issue or pull request number or URL");
 		const docs = resolveDocsConfig(git.topLevel);
 		const defaultBranch = resolveDefaultBranch({ cwd: git.topLevel });
 		const report = await buildWorkStatus({
@@ -19721,8 +20010,8 @@ function formatPrUpdate(result, rewrites, flags) {
 //#endregion
 //#region src/release/pull-request.ts
 const BST_COMMANDS = {
-	create: "bst pr:create",
-	update: "bst pr:update"
+	create: "pnpm exec bst pr:create",
+	update: "pnpm exec bst pr:update"
 };
 const BST_FLAGS = {
 	body: "--body",
@@ -20836,7 +21125,7 @@ function requireDockerCredentials(registryHost) {
 	};
 	const missing = [...username ? [] : ["DOCKER_USERNAME"], ...password ? [] : ["DOCKER_PASSWORD"]].join(" / ");
 	const { username: secretUsername, password: secretPassword } = dockerSecretNames(registryHost);
-	throw new FatalError(`Missing required environment variable(s): ${missing}. On CI, these env vars are populated from registry-specific secrets -- for registry "${registryHost}", that's secrets.${secretUsername} / secrets.${secretPassword}. Set those on the repository (try \`bst setup:secrets\`), or export DOCKER_USERNAME / DOCKER_PASSWORD locally.`);
+	throw new FatalError(`Missing required environment variable(s): ${missing}. On CI, these env vars are populated from registry-specific secrets -- for registry "${registryHost}", that's secrets.${secretUsername} / secrets.${secretPassword}. Set those on the repository (try \`pnpm exec bst setup:secrets\`), or export DOCKER_USERNAME / DOCKER_PASSWORD locally.`);
 }
 function resolveRegistryConfig(cwd) {
 	const envHost = process.env["DOCKER_REGISTRY_HOST"];
@@ -21915,7 +22204,7 @@ const CHANGE_ACTIONS = /* @__PURE__ */ new Set([
 ]);
 async function runSetupAgent(targetDir, options) {
 	const saved = loadToolingConfigStrict(targetDir);
-	if (saved === void 0) throw new FatalError(`No .tooling.json in ${targetDir}. Run bst repo:sync first to create one, so the repo's own conventions are chosen before the agent is enabled.`);
+	if (saved === void 0) throw new FatalError(`No .tooling.json in ${targetDir}. Run pnpm exec bst repo:sync first to create one, so the repo's own conventions are chosen before the agent is enabled.`);
 	const previous = previousState(saved);
 	let consent = "already-enabled";
 	if (previous !== "true") {
@@ -21947,7 +22236,7 @@ async function runSetupAgent(targetDir, options) {
 	if (report.status === "stopped" || failed.length > 0) status = "failed";
 	else if (changed.length > 0) status = "changed";
 	else status = "up-to-date";
-	if (status === "failed") log$1.error("The sync failed. Fix what it reported, then run bst setup:agent again.");
+	if (status === "failed") log$1.error("The sync failed. Fix what it reported, then run pnpm exec bst setup:agent again.");
 	else log$1.info("Commit these changes and land them on the default branch; the agent reads consent there within about a minute.");
 	return {
 		dir: targetDir,
@@ -22792,7 +23081,7 @@ function serializeBaseline(baseline) {
 //#region src/commands/coverage-check.ts
 const COVERAGE_SUMMARY_FILE$1 = "coverage/coverage-summary.json";
 const BASELINE_FILE$1 = "coverage-baseline.json";
-const MIGRATION_NOTICE = `${BASELINE_FILE$1} predates coverage.include scoping (no scope marker). Totals may have shifted because previously-untested files entered the denominator for the first time -- that is not necessarily a regression. This comparison is advisory only until the baseline is migrated: run \`pnpm test:coverage && bst coverage:check --update-baseline --reset\` once to adopt the honest, marked baseline. Normal gating resumes after that.`;
+const MIGRATION_NOTICE = `${BASELINE_FILE$1} predates coverage.include scoping (no scope marker). Totals may have shifted because previously-untested files entered the denominator for the first time -- that is not necessarily a regression. This comparison is advisory only until the baseline is migrated: run \`pnpm test:coverage && pnpm exec bst coverage:check --update-baseline --reset\` once to adopt the honest, marked baseline. Normal gating resumes after that.`;
 function applyBaselineUpdate$1(out, baselinePath, baseline, current, options) {
 	const { reset, floorPp } = options;
 	if (reset) {
@@ -22829,7 +23118,7 @@ const coverageCheckCommand = defineCommand({
 		},
 		reset: {
 			type: "boolean",
-			description: "With --update-baseline, rewrite coverage-baseline.json unconditionally, even when totals dropped. The one-shot migration to adopt an honest coverage.include-scoped baseline: pnpm test:coverage && bst coverage:check --update-baseline --reset."
+			description: "With --update-baseline, rewrite coverage-baseline.json unconditionally, even when totals dropped. The one-shot migration to adopt an honest coverage.include-scoped baseline: pnpm test:coverage && pnpm exec bst coverage:check --update-baseline --reset."
 		},
 		"fail-on-missing-baseline": {
 			type: "boolean",
@@ -23014,13 +23303,14 @@ const coverageStatusCommand = defineCommand({
 });
 //#endregion
 //#region src/codebase-health/baseline.ts
-function serializeHealthBaseline(metrics, ceilings) {
+function serializeHealthBaseline(metrics, ceilings, sizeBudgets) {
 	const ordered = {};
 	for (const key of METRIC_KEYS) {
 		const value = metrics[key];
 		if (value !== void 0) ordered[key] = value;
 	}
 	if (ceilings !== void 0 && Object.keys(ceilings).length > 0) ordered["moduleCeilings"] = ceilings;
+	if (sizeBudgets !== void 0 && Object.keys(sizeBudgets).length > 0) ordered["sizeBudgets"] = sizeBudgets;
 	return JSON.stringify(ordered, null, 2) + "\n";
 }
 //#endregion
@@ -23050,6 +23340,20 @@ function createExcludeMatcher(patterns) {
 	};
 }
 //#endregion
+//#region src/codebase-health/exempt-match.ts
+function exemptKeyMatcher(key) {
+	if (!picomatch.scan(key).isGlob) return (path) => path === key;
+	const isMatch = picomatch(key, { dot: true });
+	return (path) => isMatch(path);
+}
+function createExemptLookup(reasons) {
+	const globs = Object.entries(reasons).filter(([key]) => picomatch.scan(key).isGlob).map(([key, reason]) => ({
+		matches: exemptKeyMatcher(key),
+		reason
+	}));
+	return (path) => reasons[path] ?? globs.find((glob) => glob.matches(path))?.reason;
+}
+//#endregion
 //#region src/codebase-health/depcruise.ts
 const DependencySchema = z.object({
 	module: z.string(),
@@ -23073,10 +23377,11 @@ function partitionExempt(list, reasons) {
 		kept: list,
 		exempt: []
 	};
+	const reasonFor = createExemptLookup(reasons);
 	const kept = [];
 	const exempt = [];
 	for (const entry of list) {
-		const reason = reasons[entry.module];
+		const reason = reasonFor(entry.module);
 		if (reason === void 0) kept.push(entry);
 		else exempt.push({
 			...entry,
@@ -23656,7 +23961,40 @@ function offenderEntries(details, key) {
 //#endregion
 //#region src/codebase-health/compare.ts
 const DEFAULT_TOLERANCE = 0;
-function compareMetrics(baseline, current, tolerance = DEFAULT_TOLERANCE, currentCeilings = {}) {
+function compareSizeBudgets(baseline, measurements) {
+	const results = [];
+	for (const measurement of measurements) {
+		const ceiling = baseline.sizeBudgets?.[measurement.id];
+		if (measurement.measured === void 0) {
+			results.push({
+				id: measurement.id,
+				ceiling,
+				pass: false,
+				reason: measurement.unmeasured ?? "not measured"
+			});
+			continue;
+		}
+		if (ceiling === void 0) {
+			results.push({
+				id: measurement.id,
+				measured: measurement.measured,
+				pass: false,
+				reason: "unrecorded",
+				measurerChanged: measurement.measurerChanged
+			});
+			continue;
+		}
+		results.push({
+			id: measurement.id,
+			ceiling,
+			measured: measurement.measured,
+			pass: measurement.measured <= ceiling,
+			measurerChanged: measurement.measurerChanged
+		});
+	}
+	return results;
+}
+function compareMetrics(baseline, current, tolerance = DEFAULT_TOLERANCE, currentCeilings = {}, sizes = []) {
 	const metrics = METRIC_KEYS.map((key) => {
 		const b = baseline[key];
 		const c = current[key];
@@ -23691,23 +24029,65 @@ function compareMetrics(baseline, current, tolerance = DEFAULT_TOLERANCE, curren
 			});
 		}
 	}
-	const newOutliers = [];
+	const uncoveredOutliers = [];
 	if (baseline.moduleCeilings !== void 0) {
-		for (const key of RATCHETED_METRIC_KEYS) for (const [module, count] of Object.entries(currentCeilings[key] ?? {})) if (baseline.moduleCeilings[key]?.[module] === void 0) newOutliers.push({
+		for (const key of RATCHETED_METRIC_KEYS) for (const [module, count] of Object.entries(currentCeilings[key] ?? {})) if (baseline.moduleCeilings[key]?.[module] === void 0) uncoveredOutliers.push({
 			key,
 			module,
 			current: count
 		});
 	}
+	const sizeResults = compareSizeBudgets(baseline, sizes);
 	return {
-		pass: metrics.every((m) => m.pass) && ceilings.every((c) => c.pass),
+		pass: metrics.every((m) => m.pass) && ceilings.every((c) => c.pass) && sizeResults.every((s) => s.pass),
 		tolerance,
 		metrics,
 		ceilings,
-		newOutliers
+		uncoveredOutliers,
+		sizeResults
+	};
+}
+function needsBaseMeasurement(result) {
+	const failedKeys = new Set(result.metrics.filter((m) => m.pass === false).map((m) => m.key));
+	return RATCHETED_METRIC_KEYS.some((key) => failedKeys.has(key) && result.uncoveredOutliers.some((o) => o.key === key));
+}
+function attributeOutliers(uncovered, base) {
+	if (base.status !== "measured") return {
+		outlierBase: base.status === "unavailable" ? {
+			status: "unavailable",
+			mergeBase: base.mergeBase,
+			reason: base.reason
+		} : { status: "not-needed" },
+		newOutliers: [],
+		baseOutliers: [],
+		unattributedOutliers: [...uncovered]
+	};
+	const newOutliers = [];
+	const baseOutliers = [];
+	for (const outlier of uncovered) {
+		const baseCount = base.ceilings[outlier.key]?.[outlier.module];
+		if (baseCount === void 0) {
+			newOutliers.push(outlier);
+			continue;
+		}
+		baseOutliers.push({
+			key: outlier.key,
+			module: outlier.module,
+			base: baseCount,
+			current: outlier.current
+		});
+	}
+	return {
+		outlierBase: {
+			status: "measured",
+			mergeBase: base.mergeBase
+		},
+		newOutliers,
+		baseOutliers,
+		unattributedOutliers: []
 	};
 }
-function isFlatOrBetter(baseline, current, currentCeilings = {}) {
+function isFlatOrBetter(baseline, current, currentCeilings = {}, sizes = []) {
 	const metricsFlat = METRIC_KEYS.every((key) => {
 		const b = baseline[key];
 		const c = current[key];
@@ -23723,7 +24103,133 @@ function isFlatOrBetter(baseline, current, currentCeilings = {}) {
 			return curr <= base;
 		});
 	});
-	return metricsFlat && ceilingsFlat;
+	const sizesFlat = sizes.every((s) => {
+		const recorded = baseline.sizeBudgets?.[s.id];
+		if (recorded === void 0) return true;
+		if (s.measured === void 0) return false;
+		return s.measured <= recorded;
+	});
+	return metricsFlat && ceilingsFlat && sizesFlat;
+}
+//#endregion
+//#region src/codebase-health/base-checkout.ts
+const TEMP_PREFIX = "bst-health-base-";
+function withMergeBaseCheckout(executor, targetDir, mergeBase, use) {
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), TEMP_PREFIX));
+	const tree = path.join(tmp, "tree");
+	const index = path.join(tmp, "index");
+	try {
+		fs.mkdirSync(tree, { recursive: true });
+		const gitDir = gitOutput(executor.exec("git", ["rev-parse", "--absolute-git-dir"], { cwd: targetDir }), "git rev-parse --absolute-git-dir").trim();
+		const workRoot = gitOutput(executor.exec("git", ["rev-parse", "--show-toplevel"], { cwd: targetDir }), "git rev-parse --show-toplevel").trim();
+		const intoCheckout = (args) => executor.exec("git", [
+			`--git-dir=${gitDir}`,
+			`--work-tree=${tree}`,
+			...args
+		], {
+			cwd: tree,
+			env: { GIT_INDEX_FILE: index }
+		});
+		gitOutput(intoCheckout(["read-tree", mergeBase]), `git read-tree ${mergeBase.slice(0, 12)}`);
+		gitOutput(intoCheckout(["checkout-index", "-a"]), "git checkout-index -a");
+		mirrorNodeModules(workRoot, tree);
+		return use(tree);
+	} finally {
+		fs.rmSync(tmp, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function gitOutput(result, command) {
+	if (result.exitCode === 0) return result.stdout;
+	const detail = result.stderr.trim().split("\n")[0] ?? "";
+	throw new TransientError(`${command} failed: ${detail === "" ? `exit ${String(result.exitCode)}` : detail}`);
+}
+function mirrorNodeModules(workingRoot, checkoutRoot) {
+	mirrorTree(workingRoot, checkoutRoot, "");
+}
+function mirrorTree(workingRoot, checkoutRoot, rel) {
+	mirrorEntries(path.join(workingRoot, rel, "node_modules"), path.join(checkoutRoot, rel, "node_modules"));
+	let entries;
+	try {
+		entries = fs.readdirSync(path.join(checkoutRoot, rel), { withFileTypes: true });
+	} catch (_error) {
+		return;
+	}
+	for (const entry of entries) {
+		if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+		if (entry.name === ".git" || entry.name === "node_modules") continue;
+		mirrorTree(workingRoot, checkoutRoot, path.join(rel, entry.name));
+	}
+}
+function mirrorEntries(source, dest) {
+	let entries;
+	try {
+		entries = fs.readdirSync(source, { withFileTypes: true });
+	} catch (_error) {
+		return;
+	}
+	fs.mkdirSync(dest, { recursive: true });
+	for (const entry of entries) {
+		const src = path.join(source, entry.name);
+		const target = path.join(dest, entry.name);
+		if (entry.isSymbolicLink()) {
+			const link = safeReadlink(src);
+			if (link !== void 0 && !path.isAbsolute(link)) {
+				linkRelative(link, target);
+				continue;
+			}
+		} else if (entry.isDirectory() && entry.name.startsWith("@")) {
+			mirrorEntries(src, target);
+			continue;
+		}
+		try {
+			fs.symlinkSync(src, target, entry.isDirectory() ? "dir" : "file");
+		} catch (_error) {}
+	}
+}
+function safeReadlink(file) {
+	try {
+		return fs.readlinkSync(file);
+	} catch (_error) {
+		return;
+	}
+}
+function linkRelative(link, target) {
+	try {
+		fs.symlinkSync(link, target);
+	} catch (_error) {}
+}
+//#endregion
+//#region src/codebase-health/base-outliers.ts
+function unavailable(reason) {
+	return {
+		status: "unavailable",
+		reason: firstLine(reason)
+	};
+}
+function firstLine(text) {
+	return text.trim().split("\n")[0] ?? "";
+}
+function measureBaseOutliers(opts) {
+	const collect = opts.collect ?? collectDetails;
+	try {
+		return withMergeBaseCheckout(opts.executor, opts.targetDir, opts.mergeBase, (checkoutRoot) => {
+			const baseTarget = path.join(checkoutRoot, opts.prefix);
+			const collectConfig = buildCollectConfig(opts.config, { tsConfig: existsSync(path.join(baseTarget, "tsconfig.json")) ? "tsconfig.json" : void 0 });
+			const details = collect(createRealHealthExecutor(baseTarget), collectConfig);
+			const unresolved = details.unresolvedFirstParty;
+			if (unresolved !== void 0 && unresolved.length > 0) return unavailable(`the base cruise could not resolve ${String(unresolved.length)} first-party imports`);
+			if (opts.config.graphMetricsEnabled && details.circularDependencies === void 0) return unavailable("the base cruise produced no graph metrics");
+			return {
+				status: "measured",
+				ceilings: ceilingsFromDetails(details)
+			};
+		});
+	} catch (error) {
+		return unavailable(describeError$1(error));
+	}
 }
 //#endregion
 //#region src/codebase-health/render.ts
@@ -23811,7 +24317,7 @@ function formatExplain(details) {
 	}
 	return lines.join("\n");
 }
-function formatCompareDiff(result, details) {
+function formatCompareDiff(result, details, attribution) {
 	const lines = [];
 	for (const m of result.metrics) {
 		if (m.baseline === void 0 && m.current === void 0) continue;
@@ -23829,10 +24335,34 @@ function formatCompareDiff(result, details) {
 		if (c.pass) continue;
 		lines.push(`  ${CEILING_LABELS[c.key]}: ${c.module} ${c.baseline} -> ${c.current} (ceiling)`);
 	}
+	for (const s of result.sizeResults) if (!s.pass) {
+		let line;
+		if (s.measured === void 0) line = `  size: ${s.id} unmeasured (${s.reason ?? "not measured"})`;
+		else if (s.ceiling === void 0) line = `  size: ${s.id} -- -> ${s.measured} (unrecorded)`;
+		else line = `  size: ${s.id} ${s.ceiling} -> ${s.measured} (ceiling)`;
+		lines.push(line);
+		if (s.measurerChanged === true) lines.push(`  size: ${s.id} measured by code this branch changed`);
+	}
 	const failedKeys = new Set(result.metrics.filter((m) => m.pass === false).map((m) => m.key));
-	for (const o of result.newOutliers) {
+	let printedAttribution = false;
+	for (const o of attribution.newOutliers) {
 		if (!failedKeys.has(o.key)) continue;
 		lines.push(`  ${CEILING_LABELS[o.key]}: ${o.module} -- -> ${o.current} (new)`);
+		printedAttribution = true;
+	}
+	for (const o of attribution.baseOutliers) {
+		if (!failedKeys.has(o.key)) continue;
+		lines.push(`  ${CEILING_LABELS[o.key]}: ${o.module} ${o.base} -> ${o.current} (on base)`);
+		printedAttribution = true;
+	}
+	for (const o of attribution.unattributedOutliers) {
+		if (!failedKeys.has(o.key)) continue;
+		lines.push(`  ${CEILING_LABELS[o.key]}: ${o.module} -- -> ${o.current} (no ceiling)`);
+		printedAttribution = true;
+	}
+	if (printedAttribution) {
+		if (attribution.outlierBase.status === "measured") lines.push(`  outliers attributed against the merge base ${attribution.outlierBase.mergeBase}`);
+		else if (attribution.outlierBase.status === "unavailable") lines.push(`  outliers not attributed: the merge base ${attribution.outlierBase.mergeBase} could not be measured (${attribution.outlierBase.reason})`);
 	}
 	lines.push(result.pass ? "health: PASS" : "health: FAIL");
 	return lines.join("\n");
@@ -23853,7 +24383,7 @@ function formatGraphUnavailableForSummary(details, graphMetricsEnabled, diagnost
 }
 function formatStaleEntries(stale) {
 	return stale.map((entry) => {
-		if (entry.kind === "exemption") return `health.exempt: "${entry.path}" is not a module or directory this run measured, so it suppresses nothing. Delete the entry, or repoint it at wherever ${entry.path} moved to.`;
+		if (entry.kind === "exemption") return `health.exempt: "${entry.path}" names no module or directory this run measured, so it suppresses nothing. Delete the entry, or repoint it at wherever ${entry.path} moved to.`;
 		return `health-baseline: the recorded ${CEILING_LABELS[entry.metric] ?? entry.metric} ceiling for "${entry.path}" (ceiling ${String(entry.count ?? 0)}) names a path this run did not measure, so that ratchet is switched off. If the path moved, re-baseline it; if it is gone, --update-baseline drops it.`;
 	});
 }
@@ -23881,7 +24411,7 @@ function formatSourceDiagnosis(sources, graphMetricsEnabled) {
 			`Resolved roots: ${resolvedRoots}.`,
 			graphClause,
 			filtersClause,
-			`Run "bst health:summary --explain" for the full breakdown.`
+			`Run "pnpm exec bst health:summary --explain" for the full breakdown.`
 		].filter((part) => part.length > 0).join(" ")
 	};
 }
@@ -23890,69 +24420,90 @@ function formatUnresolvedFirstParty(entries) {
 	lines.push(`  An unresolved first-party import leaves the dependency graph, improving every health`, `  metric. Fix the import, or the resolve options that were supposed to follow it.`);
 	return lines.join("\n");
 }
-const REFUSAL_FILE_CAP = 8;
-function formatRaiseRefusal(raises, otherFiles) {
-	const lines = [`health: refused -- a health ceiling raise cannot travel with code.`, ...raises.map((r) => `  ${r.leaf}: ${r.reference} -> ${r.current}`)];
-	const shown = otherFiles.slice(0, REFUSAL_FILE_CAP);
-	if (shown.length > 0) {
-		const more = otherFiles.length - shown.length;
-		const suffix = more > 0 ? ` (+${String(more)} more)` : "";
-		lines.push(`  this branch also changes: ${shown.join(", ")}${suffix}`);
-	}
-	lines.push(`  Split the module so the graph does not grow, or open a ceiling-only pull request --`, `  only health-baseline.json and .tooling.json changed -- for a human to merge.`);
-	return lines.join("\n");
+const CARRIED_RAISES_FIRST_LINE = "raises carried by this branch:";
+function formatCarriedRaises(raises) {
+	return [CARRIED_RAISES_FIRST_LINE, ...raises.map((r) => `  ${r.leaf}: ${r.reference} -> ${r.current}`)].join("\n");
 }
 //#endregion
-//#region src/codebase-health/staleness.ts
-function wasMeasured(metric, path, details) {
-	if (metric === "crowdedDirectories") return details.directories.has(path);
-	return details.graphModules?.has(path) ?? true;
-}
-function findStaleEntries(baseline, details, exempt) {
-	const stale = [];
-	for (const key of RATCHETED_METRIC_KEYS) {
-		const recorded = baseline.moduleCeilings?.[key];
-		if (recorded === void 0) continue;
-		for (const [path, count] of Object.entries(recorded)) {
-			if (wasMeasured(key, path, details)) continue;
-			stale.push({
-				kind: "ceiling",
-				metric: key,
-				path,
-				count
-			});
-		}
-	}
-	for (const key of EXEMPTABLE_METRIC_KEYS) for (const path of Object.keys(exempt[key] ?? {})) {
-		if (wasMeasured(key, path, details)) continue;
-		stale.push({
-			kind: "exemption",
-			metric: key,
-			path
-		});
+//#region src/codebase-health/size.ts
+function byteLength(absolute) {
+	try {
+		const stats = statSync(absolute);
+		return stats.isFile() ? stats.size : void 0;
+	} catch (_error) {
+		return;
 	}
-	return stale;
 }
-//#endregion
-//#region src/commands/health-check.ts
-const BASELINE_FILE = "health-baseline.json";
-function assessRaises(executor, targetDir, current, out) {
-	const read = readTargetReference(executor, targetDir, out);
-	if (read.kind === "unavailable") throw new FatalError(read.reason);
-	const reference = read.reference;
-	if (reference.baseline === void 0) {
-		out.notice(`${BASELINE_FILE} has no counterpart on the default branch yet, so there is nothing to raise against.`);
+function measurerChanged(budget, changedNames) {
+	const patterns = [...budget.files, "package.json"];
+	const matches = picomatch(patterns, { dot: true });
+	return changedNames.some((name) => matches(name));
+}
+function measureSizeBudgets(targetDir, budgets, options) {
+	const measurements = [];
+	for (const [id, budget] of Object.entries(budgets).toSorted(([a], [b]) => a.localeCompare(b))) measurements.push(measureOne(targetDir, id, budget, options));
+	return measurements;
+}
+function measureOne(targetDir, id, budget, options) {
+	if ("file" in budget) {
+		const bytes = byteLength(path.join(targetDir, budget.file));
+		if (bytes === void 0) return {
+			id,
+			unmeasured: `no file at ${budget.file}`
+		};
 		return {
-			reference: {
-				status: "no-baseline",
-				mergeBase: reference.mergeBase
-			},
-			raises: [],
-			raiseRefused: false
+			id,
+			measured: bytes
+		};
+	}
+	if ("glob" in budget) {
+		const sizes = [];
+		for (const match of globSync(budget.glob, { cwd: targetDir })) {
+			const bytes = byteLength(path.join(targetDir, match));
+			if (bytes !== void 0) sizes.push(bytes);
+		}
+		if (sizes.length === 0) return {
+			id,
+			unmeasured: `glob ${budget.glob} matched no files`
+		};
+		let total = 0;
+		let largest = 0;
+		for (const bytes of sizes) {
+			total += bytes;
+			if (bytes > largest) largest = bytes;
+		}
+		return {
+			id,
+			measured: budget.aggregate === "largest" ? largest : total
 		};
 	}
-	return refuseBesideCode(executor, targetDir, reference, findRaises(reference, current), out);
+	const result = options.executor.exec("pnpm", [
+		"run",
+		"--silent",
+		budget.script
+	], { cwd: targetDir });
+	if (result.exitCode !== 0) return {
+		id,
+		unmeasured: `script ${budget.script} exited ${String(result.exitCode)}`
+	};
+	const reported = readMeasureMarker(result.stdout);
+	if (reported === void 0) return {
+		id,
+		unmeasured: `script ${budget.script} printed no measure marker`
+	};
+	if (!measurerChanged(budget, options.changedNames)) return {
+		id,
+		measured: reported
+	};
+	return {
+		id,
+		measured: reported,
+		measurerChanged: true
+	};
 }
+//#endregion
+//#region src/codebase-health/measure.ts
+const BASELINE_FILE = "health-baseline.json";
 function readTargetReference(executor, targetDir, out) {
 	const context = detectHealthContext(targetDir);
 	const read = readReference(executor, {
@@ -23964,32 +24515,171 @@ function readTargetReference(executor, targetDir, out) {
 	if (read.kind === "read" && read.warning !== void 0) out.notice(read.warning);
 	return read;
 }
-function refuseBesideCode(executor, targetDir, reference, raises, out) {
-	if (raises.length === 0) return {
-		reference: {
-			status: "read",
-			mergeBase: reference.mergeBase
-		},
-		raises,
-		raiseRefused: false
-	};
-	const names = branchDiffNames(executor, targetDir, reference.mergeBase);
-	const raiseRefused = !isCeilingOnly(names, reference.prefix);
-	if (raiseRefused) {
-		const ceilingFiles = ceilingFileNamesAt(reference.prefix);
-		const otherFiles = names.filter((name) => !ceilingFiles.includes(name));
-		out.text(formatRaiseRefusal(raises, otherFiles));
-		process.exitCode = 1;
+function reportCarriedRaises(raises, out) {
+	if (raises.length === 0) return;
+	out.text(formatCarriedRaises(raises));
+	out.text(formatWarnMarker(raises.length));
+}
+function assessRaises(executor, targetDir, current, out) {
+	const read = readTargetReference(executor, targetDir, out);
+	if (read.kind === "unavailable") throw new FatalError(read.reason);
+	const reference = read.reference;
+	if (reference.baseline === void 0) {
+		out.notice(`${BASELINE_FILE} has no counterpart on the default branch yet, so there is nothing to raise against.`);
+		return {
+			fields: {
+				reference: {
+					status: "no-baseline",
+					mergeBase: reference.mergeBase
+				},
+				raises: []
+			},
+			prefix: reference.prefix
+		};
 	}
 	return {
-		reference: {
-			status: "read",
-			mergeBase: reference.mergeBase
+		fields: {
+			reference: {
+				status: "read",
+				mergeBase: reference.mergeBase
+			},
+			raises: findRaises(reference, current)
 		},
-		raises,
-		raiseRefused
+		prefix: reference.prefix
 	};
 }
+function attributeRun(run) {
+	const { result, executor, targetDir, fields, prefix, config } = run;
+	if (!needsBaseMeasurement(result)) return attributeOutliers(result.uncoveredOutliers, { status: "not-needed" });
+	const mergeBase = fields.reference.mergeBase;
+	const measurement = measureBaseOutliers({
+		executor,
+		targetDir,
+		mergeBase,
+		prefix,
+		config
+	});
+	const base = measurement.status === "measured" ? {
+		status: "measured",
+		mergeBase,
+		ceilings: measurement.ceilings
+	} : {
+		status: "unavailable",
+		mergeBase,
+		reason: measurement.reason
+	};
+	return attributeOutliers(result.uncoveredOutliers, base);
+}
+function changedPathsForMeasurers(executor, targetDir, sizeBudgets, mergeBase, prefix) {
+	if (!Object.values(sizeBudgets).some((budget) => "script" in budget)) return [];
+	return branchDiffNames(executor, targetDir, mergeBase).filter((name) => name.startsWith(prefix)).map((name) => name.slice(prefix.length)).filter((name) => name !== "");
+}
+function refuseUnresolvedImports(details) {
+	const entries = details.unresolvedFirstParty;
+	if (entries !== void 0 && entries.length > 0) throw new FatalError(formatUnresolvedFirstParty(entries));
+}
+function refuseEmptyScope(details, config, failOnEmptySrc, out) {
+	const { warnings, emptyScope } = formatSourceDiagnosis(details.sources, config.graphMetricsEnabled);
+	for (const warning of warnings) out.notice(warning);
+	if (emptyScope !== void 0 && failOnEmptySrc !== false) throw new FatalError(emptyScope);
+	if (emptyScope !== void 0) out.notice(emptyScope);
+}
+function measureHealth(targetDir, config, out, opts = {}) {
+	const executor = createRealHealthExecutor(targetDir);
+	const details = collectDetails(executor, buildCollectConfig(config, { tsConfig: existsSync(path.join(targetDir, "tsconfig.json")) ? "tsconfig.json" : void 0 }));
+	const current = metricsFromDetails(details);
+	const ceilings = ceilingsFromDetails(details);
+	refuseUnresolvedImports(details);
+	refuseEmptyScope(details, config, opts.failOnEmptySrc, out);
+	const baselinePath = path.join(targetDir, BASELINE_FILE);
+	const treeBaseline = existsSync(baselinePath) ? parseHealthBaseline(readFileSync(baselinePath, "utf-8")) : void 0;
+	const raiseAssessment = assessRaises(executor, targetDir, {
+		baseline: treeBaseline,
+		health: config,
+		measured: {
+			metrics: current,
+			ceilings
+		}
+	}, out);
+	const sizes = measureSizeBudgets(targetDir, config.sizeBudgets, {
+		executor,
+		changedNames: changedPathsForMeasurers(executor, targetDir, config.sizeBudgets, raiseAssessment.fields.reference.mergeBase, raiseAssessment.prefix)
+	});
+	if (treeBaseline === void 0) return {
+		executor,
+		details,
+		current,
+		ceilings,
+		sizes,
+		baselinePath,
+		referenceFields: raiseAssessment.fields,
+		prefix: raiseAssessment.prefix,
+		existing: void 0
+	};
+	const result = compareMetrics(treeBaseline, current, config.tolerance, ceilings, sizes);
+	const attribution = attributeRun({
+		result,
+		executor,
+		targetDir,
+		fields: raiseAssessment.fields,
+		prefix: raiseAssessment.prefix,
+		config
+	});
+	return {
+		executor,
+		details,
+		current,
+		ceilings,
+		sizes,
+		baselinePath,
+		referenceFields: raiseAssessment.fields,
+		prefix: raiseAssessment.prefix,
+		existing: {
+			baseline: treeBaseline,
+			result,
+			attribution
+		}
+	};
+}
+//#endregion
+//#region src/codebase-health/staleness.ts
+function wasMeasured(metric, path, details) {
+	if (metric === "crowdedDirectories") return details.directories.has(path);
+	return details.graphModules?.has(path) ?? true;
+}
+function exemptionWasMeasured(metric, key, details) {
+	const measured = metric === "crowdedDirectories" ? details.directories : details.graphModules;
+	if (measured === void 0) return true;
+	const matches = exemptKeyMatcher(key);
+	return [...measured].some(matches);
+}
+function findStaleEntries(baseline, details, exempt) {
+	const stale = [];
+	for (const key of RATCHETED_METRIC_KEYS) {
+		const recorded = baseline.moduleCeilings?.[key];
+		if (recorded === void 0) continue;
+		for (const [path, count] of Object.entries(recorded)) {
+			if (wasMeasured(key, path, details)) continue;
+			stale.push({
+				kind: "ceiling",
+				metric: key,
+				path,
+				count
+			});
+		}
+	}
+	for (const key of EXEMPTABLE_METRIC_KEYS) for (const path of Object.keys(exempt[key] ?? {})) {
+		if (exemptionWasMeasured(key, path, details)) continue;
+		stale.push({
+			kind: "exemption",
+			metric: key,
+			path
+		});
+	}
+	return stale;
+}
+//#endregion
+//#region src/commands/health-check.ts
 function assessSwitchOff(executor, targetDir, config, out) {
 	const read = readTargetReference(executor, targetDir, out);
 	if (read.kind === "unavailable") return void 0;
@@ -24000,17 +24690,28 @@ function assessSwitchOff(executor, targetDir, config, out) {
 	const named = healthOverridesAt(targetDir);
 	const limitsOver = { ...config };
 	for (const name of RAISABLE_LIMITS) if (named?.[name] === void 0) limitsOver[name] = reference.health[name];
-	return refuseBesideCode(executor, targetDir, reference, findRaises(reference, {
-		baseline: treeBaseline,
-		health: limitsOver
-	}), out);
+	return {
+		reference: {
+			status: "read",
+			mergeBase: reference.mergeBase
+		},
+		raises: findRaises(reference, {
+			baseline: treeBaseline,
+			health: limitsOver
+		})
+	};
 }
-function refuseUnresolvedImports(details) {
-	const entries = details.unresolvedFirstParty;
-	if (entries !== void 0 && entries.length > 0) throw new FatalError(formatUnresolvedFirstParty(entries));
+function sizeValuesToRecord(baseline, sizes, reset) {
+	const recorded = { ...baseline?.sizeBudgets };
+	for (const measurement of sizes) {
+		if (measurement.measured === void 0) continue;
+		if (!reset && recorded[measurement.id] !== void 0) continue;
+		recorded[measurement.id] = measurement.measured;
+	}
+	return Object.keys(recorded).length > 0 ? recorded : void 0;
 }
 function handleMissingBaseline(state, updateBaseline, failOnMissingBaseline) {
-	const { baselinePath, config, details, current, ceilings, out } = state;
+	const { baselinePath, config, details, current, ceilings, sizes, out } = state;
 	if (updateBaseline === true) {
 		if (config.graphMetricsEnabled && details.circularDependencies === void 0) {
 			out.notice(`Skipped baseline creation: graph metrics are unavailable this run. Fix the cruise before creating ${BASELINE_FILE}.`);
@@ -24023,7 +24724,7 @@ function handleMissingBaseline(state, updateBaseline, failOnMissingBaseline) {
 			process.exitCode = 1;
 			return;
 		}
-		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings));
+		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings, sizeValuesToRecord(void 0, sizes, false)));
 		out.notice(`Created ${BASELINE_FILE} (no prior baseline).`);
 		out.json({
 			status: "baseline-created",
@@ -24047,18 +24748,23 @@ function handleMissingBaseline(state, updateBaseline, failOnMissingBaseline) {
 	throw new FatalError(message);
 }
 function applyBaselineUpdate(state, baseline, reset) {
-	const { baselinePath, config, details, current, ceilings, out } = state;
+	const { baselinePath, config, details, current, ceilings, sizes, out } = state;
 	if (config.graphMetricsEnabled && details.circularDependencies === void 0) {
 		out.notice(`Skipped baseline update: graph metrics are unavailable this run. Fix the cruise before updating.`);
 		process.exitCode = 1;
 	} else if (reset === true) {
-		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings));
+		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings, sizeValuesToRecord(baseline, sizes, true)));
 		out.notice(`Reset ${BASELINE_FILE} to the current run.`);
-	} else if (isFlatOrBetter(baseline, current, ceilings)) {
-		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings));
+	} else if (isFlatOrBetter(baseline, current, ceilings, sizes)) {
+		writeFileSync(baselinePath, serializeHealthBaseline(current, ceilings, sizeValuesToRecord(baseline, sizes, false)));
 		out.notice(`Updated ${BASELINE_FILE} (no regressions).`);
 	} else out.notice(`Skipped baseline update: a metric or ceiling regressed. Fix the regression before updating.`);
 }
+function collectRegressions(result, details) {
+	const regressions = {};
+	for (const m of result.metrics) if (!m.pass) regressions[m.key] = offenderEntries(details, m.key);
+	return regressions;
+}
 const healthCheckCommand = defineCommand({
 	meta: {
 		name: "health:check",
@@ -24091,7 +24797,7 @@ const healthCheckCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: status (compared | disabled | baseline-created | missing-baseline | graph-unavailable). disabled carries reference, raises and raiseRefused only when the default branch has health enabled -- switching it off is a raise -- and nothing otherwise. Every other status carries reference ({status (read | no-baseline), mergeBase}), raises ([{leaf, reference, current}]) and raiseRefused (whether the branch carries anything besides the two health files beside a raise; it is the refusal, and a raise with raiseRefused true still reports the comparison below). baseline-created, missing-baseline and graph-unavailable carry metrics ({crowdedDirectories, circularDependencies?, fanInOutliers?, fanOutOutliers?}) and sources. compared carries pass, tolerance, metrics (a list: [{key (crowdedDirectories | circularDependencies | fanInOutliers | fanOutOutliers), baseline?, current?, delta?, pass}]), ceilings ([{key (fanInOutliers | fanOutOutliers | crowdedDirectories), module, baseline, current, pass}]), graphMetricsEnabled, graphMetricsMissing, staleEntries ([{kind (ceiling | exemption), metric, path, count?}]), regressions ({<failing metric key>: [{module, count} | {from, to}]}) and sources. sources is {entries ([{pattern, roots, status (resolved | unmatched | unrepresentable)}]), roots, fileCount}."
+			description: "Emit one JSON document: status (compared | disabled | baseline-created | missing-baseline | graph-unavailable). disabled carries reference and raises only when the default branch has health enabled -- switching it off is a raise -- and nothing otherwise. Every other status carries reference ({status (read | no-baseline), mergeBase}) and raises ([{leaf, reference, current}]: every way this branch's two health files are higher than the default branch's, which it carries with its own code and a person merges). baseline-created, missing-baseline and graph-unavailable carry metrics ({crowdedDirectories, circularDependencies?, fanInOutliers?, fanOutOutliers?}) and sources. compared carries pass, tolerance, metrics (a list: [{key (crowdedDirectories | circularDependencies | fanInOutliers | fanOutOutliers), baseline?, current?, delta?, pass}]), ceilings ([{key (fanInOutliers | fanOutOutliers | crowdedDirectories), module, baseline, current, pass}]), sizeBudgets ([{id, ceiling?, measured?, pass, reason?}] -- every budget .tooling.json#health.sizeBudgets declares; reason is `unrecorded` for a declared budget with no recorded value, or the measurer's own explanation when it measured nothing), outlierBase ({status (measured | not-needed | unavailable), mergeBase?, reason?}), newOutliers ([{key, module, current}], outliers not on the merge base; empty unless measured), baseOutliers ([{key, module, base, current}]) and unattributedOutliers ([{key, module, current}], every outlier with no ceiling when the base was not measured), graphMetricsEnabled, graphMetricsMissing, staleEntries ([{kind (ceiling | exemption), metric, path, count?}]), regressions ({<failing metric key>: [{module, count} | {from, to}]}) and sources. sources is {entries ([{pattern, roots, status (resolved | unmatched | unrepresentable)}]), roots, fileCount}."
 		}
 	},
 	run({ args }) {
@@ -24100,69 +24806,365 @@ const healthCheckCommand = defineCommand({
 		const config = resolveHealthConfig(targetDir);
 		if (!config.enabled) {
 			out.notice("health: disabled (set .tooling.json#health.enabled to true to enable).");
+			const switchOff = assessSwitchOff(createRealHealthExecutor(targetDir), targetDir, config, out);
 			out.json({
 				status: "disabled",
-				...assessSwitchOff(createRealHealthExecutor(targetDir), targetDir, config, out)
+				...switchOff
 			});
+			reportCarriedRaises(switchOff?.raises ?? [], out);
 			return;
 		}
 		if (!config.graphMetricsEnabled) out.notice("health: graph metrics disabled (no JS/TS source to cruise) -- crowdedDirectories only.");
-		const executor = createRealHealthExecutor(targetDir);
-		const details = collectDetails(executor, buildCollectConfig(config, { tsConfig: existsSync(path.join(targetDir, "tsconfig.json")) ? "tsconfig.json" : void 0 }));
-		const current = metricsFromDetails(details);
-		const ceilings = ceilingsFromDetails(details);
-		refuseUnresolvedImports(details);
-		const { warnings, emptyScope } = formatSourceDiagnosis(details.sources, config.graphMetricsEnabled);
-		for (const warning of warnings) out.notice(warning);
-		if (emptyScope !== void 0 && args["fail-on-empty-src"] !== false) throw new FatalError(emptyScope);
-		if (emptyScope !== void 0) out.notice(emptyScope);
-		const baselinePath = path.join(targetDir, BASELINE_FILE);
-		const treeBaseline = existsSync(baselinePath) ? parseHealthBaseline(readFileSync(baselinePath, "utf-8")) : void 0;
-		const referenceFields = assessRaises(executor, targetDir, {
-			baseline: treeBaseline,
-			health: config,
-			measured: {
-				metrics: current,
-				ceilings
-			}
-		}, out);
+		const run = measureHealth(targetDir, config, out, { failOnEmptySrc: args["fail-on-empty-src"] });
 		const state = {
-			baselinePath,
+			baselinePath: run.baselinePath,
 			config,
-			details,
-			current,
-			ceilings,
+			details: run.details,
+			current: run.current,
+			ceilings: run.ceilings,
+			sizes: run.sizes,
 			out,
-			referenceFields
+			referenceFields: run.referenceFields
 		};
-		if (treeBaseline === void 0) {
+		if (run.existing === void 0) {
 			handleMissingBaseline(state, args["update-baseline"], args["fail-on-missing-baseline"]);
 			return;
 		}
-		const baseline = treeBaseline;
-		const result = compareMetrics(baseline, current, config.tolerance, ceilings);
-		out.text(formatCompareDiff(result, details));
-		const regressions = {};
-		for (const m of result.metrics) if (!m.pass) regressions[m.key] = offenderEntries(details, m.key);
-		const graphUnavailable = formatGraphUnavailable(baseline, details, config.graphMetricsEnabled, details.graphDiagnostic);
+		const { baseline, result, attribution } = run.existing;
+		out.text(formatCompareDiff(result, run.details, attribution));
+		reportCarriedRaises(run.referenceFields.raises, out);
+		const regressions = collectRegressions(result, run.details);
+		const graphUnavailable = formatGraphUnavailable(baseline, run.details, config.graphMetricsEnabled, run.details.graphDiagnostic);
 		if (graphUnavailable !== void 0) out.notice(graphUnavailable);
-		const stale = findStaleEntries(baseline, details, config.exempt);
+		const stale = findStaleEntries(baseline, run.details, config.exempt);
 		for (const warning of formatStaleEntries(stale)) out.notice(warning);
 		out.json({
 			status: "compared",
-			...referenceFields,
-			...result,
+			...run.referenceFields,
+			pass: result.pass,
+			tolerance: result.tolerance,
+			metrics: result.metrics,
+			ceilings: result.ceilings,
+			sizeBudgets: result.sizeResults,
+			outlierBase: attribution.outlierBase,
+			newOutliers: attribution.newOutliers,
+			baseOutliers: attribution.baseOutliers,
+			unattributedOutliers: attribution.unattributedOutliers,
 			graphMetricsEnabled: config.graphMetricsEnabled,
 			graphMetricsMissing: graphUnavailable !== void 0,
 			staleEntries: stale,
 			regressions,
-			sources: details.sources
+			sources: run.details.sources
 		});
 		if (args["update-baseline"] === true) applyBaselineUpdate(state, baseline, args.reset);
 		if (!result.pass || graphUnavailable !== void 0) process.exitCode = 1;
 	}
 });
 //#endregion
+//#region src/codebase-health/raise.ts
+const SIZE_RAISE_FACTOR = 1.01;
+function sizeRaiseValue(measured) {
+	return Math.floor(measured * SIZE_RAISE_FACTOR) + 1;
+}
+const JsonObjectSchema = z.record(z.string(), z.unknown());
+const EXEMPT_LEAF_KEYS = [
+	{
+		prefix: "fan-in",
+		key: "fanInOutliers"
+	},
+	{
+		prefix: "fan-out",
+		key: "fanOutOutliers"
+	},
+	{
+		prefix: "crowding",
+		key: "crowdedDirectories"
+	}
+];
+function refuseDeniableReason(leaf, reason) {
+	const fixed = fixText(`// ${reason}`, {
+		offenders: resolveOffenders(),
+		path: "health-raise.ts"
+	});
+	const refused = fixed.decisions.find((decision) => !decision.applied);
+	if (refused !== void 0) throw new FatalError(`health:raise: the reason for --exempt "${leaf}" carries ${refused.hit.offender.codepoint} (${refused.hit.offender.name}): ${refused.reason ?? "this gate denies it"}. Rewrite it in ASCII.`);
+	return fixed.text.slice(3);
+}
+function parseExemptLeaf(leaf) {
+	const separator = leaf.indexOf(":");
+	const prefix = separator < 0 ? "" : leaf.slice(0, separator).trim();
+	const path = separator < 0 ? "" : leaf.slice(separator + 1).trim();
+	if (prefix === "size") throw new FatalError(`health:raise: --exempt "${leaf}" names a size budget, which has no module to exempt. Run without --exempt: "health:raise" widens a grown size budget by measurement.`);
+	const named = EXEMPT_LEAF_KEYS.find((entry) => entry.prefix === prefix);
+	if (named === void 0 || path === "") throw new FatalError(`health:raise: --exempt "${leaf}" names no exemptable leaf. Pass one "health:check" printed: "fan-in: <path>", "fan-out: <path>", "crowding: <path>".`);
+	return {
+		key: named.key,
+		path
+	};
+}
+function copyCeilings(ceilings) {
+	const copy = {};
+	for (const key of RATCHETED_METRIC_KEYS) {
+		const byModule = ceilings?.[key];
+		if (byModule !== void 0) copy[key] = { ...byModule };
+	}
+	return copy;
+}
+function writeCeiling(ceilings, key, module, to) {
+	const byModule = ceilings[key] ?? {};
+	byModule[module] = to;
+	ceilings[key] = byModule;
+}
+function headlineFor(baseline, comparison, key, exemptCount) {
+	const measured = comparison.metrics.find((metric) => metric.key === key)?.current;
+	if (measured === void 0) return void 0;
+	const remaining = Math.max(0, measured - exemptCount);
+	return baseline[key] === void 0 ? remaining : Math.max(baseline[key] ?? 0, remaining);
+}
+function exemptionWrites(input) {
+	const writes = [];
+	const notes = [];
+	for (const request of input.exemptions) {
+		const parsed = parseExemptLeaf(request.leaf);
+		if (parsed === void 0) continue;
+		const recorded = input.config.exempt[parsed.key]?.[parsed.path];
+		if (recorded !== void 0) {
+			notes.push(`health.exempt.${parsed.key}.${parsed.path} already reads "${recorded}"; the reason was not overwritten.`);
+			continue;
+		}
+		writes.push({
+			key: parsed.key,
+			path: parsed.path,
+			reason: refuseDeniableReason(request.leaf, request.reason)
+		});
+	}
+	return {
+		writes,
+		notes
+	};
+}
+function objectAt(parent, key, where) {
+	const existing = parent[key];
+	if (existing === void 0) return {};
+	const parsed = JsonObjectSchema.safeParse(existing);
+	if (!parsed.success) throw new FatalError(`health:raise: ${where}#${key} is not an object, so an exemption cannot be written there.`);
+	return { ...parsed.data };
+}
+function applyExemptions(tooling, writes) {
+	if (writes.length === 0) return void 0;
+	const file = JsonObjectSchema.safeParse(tooling ?? {});
+	if (!file.success) throw new FatalError(`health:raise: .tooling.json is not a JSON object, so no exemption can be written.`);
+	const result = { ...file.data };
+	for (const write of writes) {
+		const health = objectAt(result, "health", ".tooling.json");
+		const exempt = objectAt(health, "exempt", ".tooling.json#health");
+		const table = objectAt(exempt, write.key, ".tooling.json#health.exempt");
+		table[write.path] = write.reason;
+		exempt[write.key] = table;
+		health["exempt"] = exempt;
+		result["health"] = health;
+	}
+	return result;
+}
+function planHealthRaise(input) {
+	const ceilings = copyCeilings(input.baseline.moduleCeilings);
+	const ceilingWrites = [];
+	const headlines = {};
+	const notes = [];
+	const exemptions = exemptionWrites(input);
+	notes.push(...exemptions.notes);
+	const isExcused = (key, module) => exemptions.writes.some((write) => write.key === key && exemptKeyMatcher(write.path)(module));
+	const exemptedCount = /* @__PURE__ */ new Map();
+	const countExcused = (key, module) => {
+		if (isExcused(key, module)) exemptedCount.set(key, (exemptedCount.get(key) ?? 0) + 1);
+	};
+	for (const outlier of input.attribution.newOutliers) countExcused(outlier.key, outlier.module);
+	for (const ceiling of input.comparison.ceilings) if (!ceiling.pass) countExcused(ceiling.key, ceiling.module);
+	const outlierBase = input.attribution.outlierBase;
+	if (outlierBase.status === "unavailable") notes.push(`no "(new)" ceiling was written: the merge base ${outlierBase.mergeBase} could not be measured (${outlierBase.reason}), so nothing could be called a first crossing.`);
+	for (const outlier of input.attribution.newOutliers) {
+		if (isExcused(outlier.key, outlier.module)) continue;
+		writeCeiling(ceilings, outlier.key, outlier.module, outlier.current);
+		const headline = headlineFor(input.baseline, input.comparison, outlier.key, exemptedCount.get(outlier.key) ?? 0);
+		if (headline !== void 0) headlines[outlier.key] = headline;
+		ceilingWrites.push({
+			key: outlier.key,
+			module: outlier.module,
+			value: outlier.current,
+			...headline === void 0 ? {} : { headline }
+		});
+	}
+	for (const ceiling of input.comparison.ceilings) {
+		if (ceiling.pass) continue;
+		if (isExcused(ceiling.key, ceiling.module)) continue;
+		writeCeiling(ceilings, ceiling.key, ceiling.module, ceiling.current);
+		ceilingWrites.push({
+			key: ceiling.key,
+			module: ceiling.module,
+			value: ceiling.current
+		});
+	}
+	const sizeBudgets = { ...input.baseline.sizeBudgets };
+	const sizeWrites = [];
+	for (const size of input.comparison.sizeResults) {
+		if (size.pass || size.measured === void 0 || size.ceiling === void 0) continue;
+		if (size.measured <= size.ceiling) continue;
+		const value = sizeRaiseValue(size.measured);
+		sizeBudgets[size.id] = value;
+		sizeWrites.push({
+			id: size.id,
+			value
+		});
+	}
+	return {
+		baseline: widenedBaseline(input.baseline, headlines, ceilings, sizeBudgets),
+		tooling: applyExemptions(input.tooling, exemptions.writes),
+		ceilings: ceilingWrites,
+		sizes: sizeWrites,
+		exemptions: exemptions.writes,
+		notes
+	};
+}
+function widenedBaseline(baseline, headlines, ceilings, sizeBudgets) {
+	const widened = { ...baseline };
+	for (const key of METRIC_KEYS) {
+		const headline = headlines[key];
+		if (headline !== void 0) widened[key] = headline;
+	}
+	widened.moduleCeilings = Object.keys(ceilings).length > 0 ? ceilings : void 0;
+	widened.sizeBudgets = Object.keys(sizeBudgets).length > 0 ? sizeBudgets : void 0;
+	return widened;
+}
+function planHasWrites(plan) {
+	return plan.ceilings.length > 0 || plan.sizes.length > 0 || plan.exemptions.length > 0;
+}
+//#endregion
+//#region src/commands/health-raise.ts
+const JsonValueSchema = z.json();
+const TOOLING_FILE = ".tooling.json";
+function collectExemptPairs(rawArgs) {
+	const leaves = collectFlagValues(rawArgs, "--exempt");
+	const reasons = collectFlagValues(rawArgs, "--reason");
+	if (leaves.length === 0 && reasons.length > 0) throw new FatalError(`health:raise: ${String(reasons.length)} --reason given with no --exempt to explain.`);
+	if (reasons.length < leaves.length) throw new FatalError(`health:raise: ${String(leaves.length)} --exempt given with only ${String(reasons.length)} --reason. Every exemption owes its own reason: it is the line a later reader judges.`);
+	return leaves.map((leaf, index) => ({
+		leaf,
+		reason: reasons[index] ?? ""
+	}));
+}
+function formatterFor(targetDir) {
+	const detected = computeDefaults(targetDir);
+	return createContentFormatter({
+		targetDir,
+		formatter: loadToolingConfig(targetDir)?.formatter ?? detected.formatter
+	});
+}
+function readToolingFile(targetDir) {
+	const full = path.join(targetDir, TOOLING_FILE);
+	if (!existsSync(full)) return void 0;
+	const text = readFileSync(full, "utf-8");
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : "unknown error";
+		throw new FatalError(`health:raise: ${TOOLING_FILE} is not JSON: ${reason}. Fix the file and re-run.`);
+	}
+	const parsed = JsonValueSchema.safeParse(json);
+	if (!parsed.success) throw new FatalError(`health:raise: ${TOOLING_FILE} is not JSON: ${parsed.error.message}`);
+	return parsed.data;
+}
+function describePlan(plan) {
+	const lines = [];
+	for (const ceiling of plan.ceilings) {
+		const headline = ceiling.headline === void 0 ? "" : `, ${ceiling.key} set to ${String(ceiling.headline)}`;
+		lines.push(`health-baseline: ${ceiling.key} ${ceiling.module} ceiling ${String(ceiling.value)}${headline}`);
+	}
+	for (const size of plan.sizes) lines.push(`health-baseline: size budget ${size.id} widened to ${String(size.value)}`);
+	for (const exemption of plan.exemptions) lines.push(`${TOOLING_FILE}: health.exempt.${exemption.key}.${exemption.path} exempted -- ${exemption.reason}`);
+	for (const note of plan.notes) lines.push(`health: ${note}`);
+	return lines;
+}
+const healthRaiseCommand = defineCommand({
+	meta: {
+		name: "health:raise",
+		description: "Widen the health budgets this branch crossed, by measurement: no number is an argument. Writes health-baseline.json (a new outlier's ceiling plus its headline count, a grown module ceiling, a grown size budget) and, for --exempt pairs, .tooling.json#health.exempt. Does nothing unless .tooling.json#health.enabled is true."
+	},
+	args: {
+		dir: {
+			type: "positional",
+			valueHint: "dir",
+			description: "Project directory (default: current directory)",
+			required: false
+		},
+		"dry-run": {
+			type: "boolean",
+			description: "Print what would be written and write nothing"
+		},
+		exempt: {
+			type: "string",
+			description: "Exempt this leaf instead of recording a ceiling (repeatable), as \"health:check\" printed it: \"fan-in: src/a.ts\""
+		},
+		reason: {
+			type: "string",
+			description: "Why this exemption is justified (repeatable; one per --exempt)"
+		},
+		json: {
+			type: "boolean",
+			description: "Emit one JSON document: status (raised | nothing-to-raise | disabled), dryRun, wrote ([path]), ceilings ([{key, module, value, headline?}]), sizeBudgets ([{id, value}]), exemptions ([{key, path, reason}]), notes ([string]), reference ({status (read | no-baseline), mergeBase})."
+		}
+	},
+	run({ args, rawArgs }) {
+		const targetDir = path.resolve(args.dir ?? ".");
+		const out = createCliOutput(args.json === true);
+		const config = resolveHealthConfig(targetDir);
+		if (!config.enabled) {
+			out.notice("health: disabled (set .tooling.json#health.enabled to true to enable).");
+			out.json({
+				status: "disabled",
+				dryRun: args["dry-run"] === true
+			});
+			return;
+		}
+		const run = measureHealth(targetDir, config, out);
+		if (run.existing === void 0) throw new FatalError("health:raise: no health-baseline.json to widen. Run \"health:check --update-baseline\" first: a raise widens a recorded number, and there is nothing recorded.");
+		const plan = planHealthRaise({
+			comparison: run.existing.result,
+			attribution: run.existing.attribution,
+			baseline: run.existing.baseline,
+			config,
+			tooling: readToolingFile(targetDir),
+			exemptions: collectExemptPairs(rawArgs)
+		});
+		const dryRun = args["dry-run"] === true;
+		const wrote = dryRun ? [] : writePlan(targetDir, plan);
+		for (const line of describePlan(plan)) out.text(line);
+		out.json({
+			status: planHasWrites(plan) ? "raised" : "nothing-to-raise",
+			dryRun,
+			wrote,
+			ceilings: plan.ceilings,
+			sizeBudgets: plan.sizes,
+			exemptions: plan.exemptions,
+			notes: plan.notes,
+			reference: run.referenceFields.reference
+		});
+	}
+});
+function writePlan(targetDir, plan) {
+	const format = formatterFor(targetDir);
+	const wrote = [];
+	if (plan.ceilings.length > 0 || plan.sizes.length > 0) {
+		writeFileSync(path.join(targetDir, "health-baseline.json"), format("health-baseline.json", serializeHealthBaseline(plan.baseline, plan.baseline.moduleCeilings, plan.baseline.sizeBudgets)));
+		wrote.push("health-baseline.json");
+	}
+	if (plan.tooling !== void 0) {
+		writeFileSync(path.join(targetDir, TOOLING_FILE), format(TOOLING_FILE, JSON.stringify(plan.tooling, null, 2)));
+		wrote.push(TOOLING_FILE);
+	}
+	return wrote;
+}
+//#endregion
 //#region src/codebase-health/module-report.ts
 function normalizeModulePath(raw) {
 	let normalized = raw.replace(/\\/g, "/");
@@ -25196,16 +26198,17 @@ function locatePlan(input) {
 		kind: "found",
 		path: marked
 	};
-	const added = addedPlans(entries).live;
-	const [firstAdded, secondAdded] = added;
+	const added = addedPlans(entries);
+	const [firstAdded, secondAdded] = added.live;
 	if (firstAdded !== void 0 && secondAdded === void 0) return {
 		kind: "found",
 		path: firstAdded
 	};
 	if (firstAdded !== void 0 && secondAdded !== void 0) return {
 		kind: "ambiguous",
-		candidates: added
+		candidates: added.live
 	};
+	if (added.retired.length > 0) return { kind: "none" };
 	const modified = modifiedLivePlans(entries).filter(isOpen);
 	const [firstModified, secondModified] = modified;
 	if (firstModified !== void 0 && secondModified === void 0) return {
@@ -25263,7 +26266,7 @@ function checkStatus(input, status) {
 		file,
 		rule: "R8 missing-historical-banner",
 		message: "Retired doc has no historical banner saying it is not current state.",
-		fix: "Run `bst docs:delink` on the retired directory -- it inserts the banner and de-links source paths in one pass. Do not hand-write it: the wording is fixed so it stays greppable."
+		fix: "Run `pnpm exec bst docs:delink` on the retired directory -- it inserts the banner and de-links source paths in one pass. Do not hand-write it: the wording is fixed so it stays greppable."
 	});
 	return violations;
 }
@@ -25276,7 +26279,7 @@ function checkLinks(input) {
 				file: input.file,
 				rule: "R7 retired-source-link",
 				message: `Retired doc links out of \`docs/\` (\`${link.raw}\` -> ${link.target}). A file move elsewhere breaks it.`,
-				fix: "Run `bst docs:delink` on the retired directory -- it converts the link to a plain code span. A retired doc records what was decided; it should not track where the code lives now."
+				fix: "Run `pnpm exec bst docs:delink` on the retired directory -- it converts the link to a plain code span. A retired doc records what was decided; it should not track where the code lives now."
 			});
 			continue;
 		}
@@ -25303,7 +26306,7 @@ function checkDoc(input) {
 	if (!input.isRetired && input.staleDays > 0 && input.ageDays !== void 0 && input.ageDays > input.staleDays) violations.push({
 		file: input.file,
 		rule: "R5 stale",
-		message: `Active doc, but git hasn't seen it touched in ${String(input.ageDays)} days (limit ${String(input.staleDays)}).`,
+		message: `Active doc, but its content hasn't changed in ${String(input.ageDays)} days (limit ${String(input.staleDays)}).`,
 		fix: "Check it against the tree. If the work shipped, retire it. If it's still open, edit the doc to say where it stands -- that resets the clock."
 	});
 	return violations;
@@ -25314,7 +26317,7 @@ const MS_PER_DAY$1 = 864e5;
 const SPEC_DIR_BASENAME = "specs";
 const PLAN_DIR_BASENAME = "plans";
 function ageDays(exec, file, now) {
-	const iso = exec.gitLastCommitISO(file);
+	const iso = exec.lastContentChangeISO(file);
 	if (iso === void 0) return void 0;
 	const then = new Date(iso).getTime();
 	if (Number.isNaN(then)) return void 0;
@@ -25406,7 +26409,7 @@ function collectSpecRetirementViolations(exec, pairs, config, opts) {
 				file: spec,
 				rule: "R6 spec-not-retired",
 				message: `Implementing plan(s) have landed but this spec is still active: ${implementing.map((p) => p.file).join(", ")}.`,
-				fix: "If those plans completed this spec, retire it too: `bst docs:retire <spec> --status <verb> --shipped \"<text>\"`. If further phases are still planned, leave it open -- that is why it stays active."
+				fix: "If those plans completed this spec, retire it too: `pnpm exec bst docs:retire <spec> --status <verb> --shipped \"<text>\"`. If further phases are still planned, leave it open -- that is why it stays active."
 			};
 			violations.push({
 				...raw,
@@ -25434,7 +26437,7 @@ function collectPlanLocateViolations(exec) {
 	const reports = [];
 	if (located.kind === "none") reports.push(...touched.map((file) => ({
 		file,
-		message: `The execute lookup finds no plan for this branch: ${file} was touched but not added, its name carries no issue-/pr- marker, and it has no outstanding task for the tier that reads a modified plan.`
+		message: `The execute lookup finds no plan for this branch: ${file} was touched but not added, its name carries no issue-/pr- marker, and either it has no outstanding task or the branch added a retired plan beside it, which the execute lookup works instead.`
 	})));
 	else if (located.kind === "ambiguous") reports.push(...located.candidates.map((file) => ({
 		file,
@@ -25481,6 +26484,108 @@ function collectViolations(exec, config, opts) {
 	};
 }
 //#endregion
+//#region src/docs-check/content-age.ts
+const HEX_HASH = /^[0-9a-f]{40}$|^[0-9a-f]{64}$/;
+function parseIgnoreRevs(text) {
+	const hashes = /* @__PURE__ */ new Set();
+	for (const rawLine of text.split("\n")) {
+		const commentStart = rawLine.indexOf("#");
+		const value = (commentStart === -1 ? rawLine : rawLine.slice(0, commentStart)).trim().toLowerCase();
+		if (HEX_HASH.test(value)) hashes.add(value);
+	}
+	return hashes;
+}
+const FOLLOW_LOG_FORMAT = "%x1e%H%x1f%P%x1f%aI";
+function parseStatusLine(body) {
+	for (const line of body.split("\n")) {
+		if (line.trim() === "") continue;
+		const fields = line.split("	");
+		const code = (fields[0] ?? "").charAt(0);
+		const firstPath = fields[1] ?? "";
+		if (code === "" || firstPath === "") return void 0;
+		const secondPath = fields[2];
+		if (code === "R" && secondPath !== void 0) return {
+			code,
+			oldPath: firstPath,
+			newPath: secondPath
+		};
+		return {
+			code,
+			oldPath: firstPath,
+			newPath: firstPath
+		};
+	}
+}
+function parseFollowLog(stdout) {
+	const entries = [];
+	for (const record of stdout.split("")) {
+		if (record.trim() === "") continue;
+		const lineEnd = record.indexOf("\n");
+		const header = lineEnd === -1 ? record : record.slice(0, lineEnd);
+		const body = lineEnd === -1 ? "" : record.slice(lineEnd + 1);
+		const fields = header.split("");
+		const commit = (fields[0] ?? "").trim();
+		if (commit === "") continue;
+		const parentsText = (fields[1] ?? "").trim();
+		const parents = parentsText === "" ? [] : parentsText.split(/\s+/);
+		const authorDate = (fields[2] ?? "").trim();
+		entries.push({
+			commit,
+			parents,
+			authorDate,
+			status: parseStatusLine(body)
+		});
+	}
+	return entries;
+}
+const FIRST_WINDOW = 4;
+const WINDOW_GROWTH = 8;
+function entryOutcome(git, context, entry) {
+	if (entry.parents.length > 1) return {
+		kind: "date",
+		date: entry.authorDate
+	};
+	if (entry.parents.length === 0 || entry.status?.code === "A") {
+		if (context.shallow.has(entry.commit)) return { kind: "unknown" };
+		return {
+			kind: "date",
+			date: entry.authorDate
+		};
+	}
+	if (context.ignore.has(entry.commit)) return { kind: "skip" };
+	const status = entry.status;
+	if (status !== void 0 && (status.code === "M" || status.code === "R")) {
+		const diff = git.blobDiffStatus(entry.commit, status.oldPath, status.newPath);
+		if (diff === 0) return { kind: "skip" };
+		if (diff === 1) return {
+			kind: "date",
+			date: entry.authorDate
+		};
+		return { kind: "unknown" };
+	}
+	return {
+		kind: "date",
+		date: entry.authorDate
+	};
+}
+function lastContentChange(git, rel, context) {
+	let maxCount = FIRST_WINDOW;
+	let walked = 0;
+	for (;;) {
+		const stdout = git.log(rel, maxCount);
+		if (stdout === void 0) return void 0;
+		const entries = parseFollowLog(stdout);
+		for (const entry of entries.slice(walked)) {
+			const outcome = entryOutcome(git, context, entry);
+			if (outcome.kind === "date") return outcome.date;
+			if (outcome.kind === "unknown") return void 0;
+		}
+		if (entries.length < maxCount) return void 0;
+		walked = entries.length;
+		maxCount *= WINDOW_GROWTH;
+	}
+}
+//#endregion
 //#region src/docs-check/executor.ts
 function gitOut$1(rootDir, args) {
 	try {
@@ -25497,6 +26602,79 @@ function gitOut$1(rootDir, args) {
 		return;
 	}
 }
+function gitStatus(rootDir, args) {
+	try {
+		execFileSync("git", args, {
+			cwd: rootDir,
+			stdio: [
+				"ignore",
+				"ignore",
+				"ignore"
+			]
+		});
+		return 0;
+	} catch (error) {
+		if (error instanceof Error && "status" in error && typeof error.status === "number") return error.status;
+		return;
+	}
+}
+function readShallowCommits(rootDir) {
+	if (gitOut$1(rootDir, ["rev-parse", "--is-shallow-repository"])?.trim() !== "true") return /* @__PURE__ */ new Set();
+	const listed = gitOut$1(rootDir, [
+		"rev-parse",
+		"--git-path",
+		"shallow"
+	])?.trim();
+	if (listed === void 0 || listed === "") return /* @__PURE__ */ new Set();
+	const file = path.isAbsolute(listed) ? listed : path.resolve(rootDir, listed);
+	let text;
+	try {
+		text = readFileSync(file, "utf-8");
+	} catch (_error) {
+		return /* @__PURE__ */ new Set();
+	}
+	const hashes = /* @__PURE__ */ new Set();
+	for (const line of text.split("\n")) {
+		const hash = line.trim();
+		if (hash !== "") hashes.add(hash);
+	}
+	return hashes;
+}
+function buildContentAgeSource(rootDir) {
+	const topLevel = gitOut$1(rootDir, ["rev-parse", "--show-toplevel"])?.trim();
+	if (topLevel === void 0 || topLevel === "") return void 0;
+	let ignoreText = "";
+	try {
+		ignoreText = readFileSync(path.join(topLevel, ".git-blame-ignore-revs"), "utf-8");
+	} catch (_error) {}
+	return {
+		git: {
+			log: (rel, maxCount) => gitOut$1(rootDir, [
+				"-c",
+				"core.quotePath=false",
+				"log",
+				"--follow",
+				`--max-count=${String(maxCount)}`,
+				`--format=${FOLLOW_LOG_FORMAT}`,
+				"--name-status",
+				"--",
+				rel
+			]),
+			blobDiffStatus: (commit, oldPath, newPath) => gitStatus(rootDir, [
+				"diff",
+				"--quiet",
+				"-w",
+				"--ignore-blank-lines",
+				`${commit}^:${oldPath}`,
+				`${commit}:${newPath}`
+			])
+		},
+		context: {
+			ignore: parseIgnoreRevs(ignoreText),
+			shallow: readShallowCommits(rootDir)
+		}
+	};
+}
 function resolveCommit$1(rootDir, ref) {
 	const commit = gitOut$1(rootDir, [
 		"rev-parse",
@@ -25534,6 +26712,8 @@ function branchNameStatus(rootDir) {
 }
 function createRealDocsExecutor(rootDir) {
 	const full = (rel) => path.join(rootDir, ...rel.split("/"));
+	let contentAgeSource;
+	let contentAgeRead = false;
 	return {
 		exists: (rel) => existsSync(full(rel)),
 		readFile(rel) {
@@ -25553,29 +26733,13 @@ function createRealDocsExecutor(rootDir) {
 				return;
 			}
 		},
-		gitLastCommitISO(rel) {
-			let stdout;
-			try {
-				stdout = execFileSync("git", [
-					"log",
-					"-1",
-					"--format=%cI",
-					"--",
-					rel
-				], {
-					cwd: rootDir,
-					encoding: "utf-8",
-					stdio: [
-						"ignore",
-						"pipe",
-						"ignore"
-					]
-				});
-			} catch (_error) {
-				return;
+		lastContentChangeISO(rel) {
+			if (!contentAgeRead) {
+				contentAgeRead = true;
+				contentAgeSource = buildContentAgeSource(rootDir);
 			}
-			const iso = stdout.trim();
-			return iso === "" ? void 0 : iso;
+			if (contentAgeSource === void 0) return void 0;
+			return lastContentChange(contentAgeSource.git, rel, contentAgeSource.context);
 		},
 		branchNameStatus: () => branchNameStatus(rootDir)
 	};
@@ -25651,7 +26815,7 @@ function runDocsCheck(exec, config, opts) {
 const docsCheckCommand = defineCommand({
 	meta: {
 		name: "docs:check",
-		description: "Enforce the plan/spec lifecycle: a doc's directory is the source of truth for whether it is done. Checks that statuses agree with directories, retirements are dated and say where the truth went, relative links resolve, and active docs aren't stale. On a branch, it also warns (rule R9) when the branch works a plan that the execute lookup cannot find; that finding is always advisory. Findings are advisory (exit 0) unless the directory is in .tooling.json#docs.enforced (a list, or true for all) or --strict is passed; staleness stays advisory unless .tooling.json#docs.staleEnforced is set, and a link out of docs/ in a retired doc is always advisory. A retired doc should also carry the historical banner and have no links out of docs/; bst docs:delink fixes both. It CANNOT tell whether the code a plan describes actually shipped -- it verifies that a doc's metadata is self-consistent, not that it is true. Deciding a plan is done still means reading the source it names."
+		description: "Enforce the plan/spec lifecycle: a doc's directory is the source of truth for whether it is done. Checks that statuses agree with directories, retirements are dated and say where the truth went, relative links resolve, and active docs aren't stale. On a branch, it also warns (rule R9) when the branch works a plan that the execute lookup cannot find; that finding is always advisory. Findings are advisory (exit 0) unless the directory is in .tooling.json#docs.enforced (a list, or true for all) or --strict is passed; staleness stays advisory unless .tooling.json#docs.staleEnforced is set, and a link out of docs/ in a retired doc is always advisory. A retired doc should also carry the historical banner and have no links out of docs/; pnpm exec bst docs:delink fixes both. It CANNOT tell whether the code a plan describes actually shipped -- it verifies that a doc's metadata is self-consistent, not that it is true. Deciding a plan is done still means reading the source it names."
 	},
 	args: {
 		dir: {
@@ -25944,7 +27108,7 @@ function runDocsDelink(exec, dirs, opts) {
 const docsDelinkCommand = defineCommand({
 	meta: {
 		name: "docs:delink",
-		description: "Make retired docs inert: convert every markdown link that resolves outside docs/ into a plain code span, and insert the historical banner. Idempotent. It accepts only a retired/ (or legacy completed/) directory. bst docs:delink <retired-dir>..."
+		description: "Make retired docs inert: convert every markdown link that resolves outside docs/ into a plain code span, and insert the historical banner. Idempotent. It accepts only a retired/ (or legacy completed/) directory. pnpm exec bst docs:delink <retired-dir>..."
 	},
 	args: {
 		"dry-run": {
@@ -26146,7 +27310,7 @@ function runDocsRelocate(exec, sources, dest, opts) {
 const docsRelocateCommand = defineCommand({
 	meta: {
 		name: "docs:relocate",
-		description: "Move one or more .md files and rewrite the markdown links that break as a result -- both the moved files' own relative links and every inbound link elsewhere in the repo that pointed at them. Idempotent. Argument grammar mirrors POSIX mv: bst docs:relocate <src>... <dest>."
+		description: "Move one or more .md files and rewrite the markdown links that break as a result -- both the moved files' own relative links and every inbound link elsewhere in the repo that pointed at them. Idempotent. Argument grammar mirrors POSIX mv: pnpm exec bst docs:relocate <src>... <dest>."
 	},
 	args: {
 		"dry-run": {
@@ -26165,9 +27329,9 @@ const docsRelocateCommand = defineCommand({
 	run({ args }) {
 		const out = createCliOutput(args.json === true);
 		const positionals = args._;
-		if (positionals.length < 2) throw new FatalError("Usage: bst docs:relocate <src>... <dest>");
+		if (positionals.length < 2) throw new FatalError("Usage: pnpm exec bst docs:relocate <src>... <dest>");
 		const dest = positionals.at(-1);
-		if (dest === void 0) throw new FatalError("Usage: bst docs:relocate <src>... <dest>");
+		if (dest === void 0) throw new FatalError("Usage: pnpm exec bst docs:relocate <src>... <dest>");
 		const sources = positionals.slice(0, -1);
 		const { payload, text, exitCode } = runDocsRelocate(createRealRelocateExecutor(process.cwd()), sources, dest, {
 			dryRun: args["dry-run"] === true,
@@ -26356,7 +27520,7 @@ function runDocsRetire(exec, src, opts) {
 const docsRetireCommand = defineCommand({
 	meta: {
 		name: "docs:retire",
-		description: "Retire a plan/spec doc: move it to its retired/ location (computed by convention, or --dest), rewrite the markdown links that break as a result, set a dated terminal Status: line, and ensure the retire paragraph. After the lifecycle edits it also de-links links out of docs/ and adds the historical banner, as docs:delink does. bst docs:retire <plan.md> --status <verb> --shipped <text>."
+		description: "Retire a plan/spec doc: move it to its retired/ location (computed by convention, or --dest), rewrite the markdown links that break as a result, set a dated terminal Status: line, and ensure the retire paragraph. After the lifecycle edits it also de-links links out of docs/ and adds the historical banner, as docs:delink does. pnpm exec bst docs:retire <plan.md> --status <verb> --shipped <text>."
 	},
 	args: {
 		status: {
@@ -26392,7 +27556,7 @@ const docsRetireCommand = defineCommand({
 	run({ args }) {
 		const out = createCliOutput(args.json === true);
 		const [src] = args._;
-		if (src === void 0) throw new FatalError("Usage: bst docs:retire <plan.md> --status <verb> --shipped <text>");
+		if (src === void 0) throw new FatalError("Usage: pnpm exec bst docs:retire <plan.md> --status <verb> --shipped <text>");
 		const { payload, text, exitCode } = runDocsRetire(createRealRelocateExecutor(process.cwd()), src, {
 			status: args.status,
 			date: args.date,
@@ -26460,7 +27624,7 @@ async function runIssueView(executor, options) {
 	const resolve = resolverFor(executor, options.cwd, () => {
 		debug(options, `issue:view #${String(parseIssueRef(options.ref).number)}`);
 	});
-	const view = await withNumberExample("bst issue:view 273", () => viewIssue(resolve, {
+	const view = await withNumberExample("pnpm exec bst issue:view 273", () => viewIssue(resolve, {
 		ref: options.ref,
 		...options.repo === void 0 ? {} : { repo: options.repo }
 	}));
@@ -26490,7 +27654,7 @@ async function runIssueComment(executor, options) {
 	const resolve = resolverFor(executor, options.cwd, () => {
 		debug(options, `issue:comment #${String(parseIssueRef(options.ref).number)}`);
 	});
-	return withNumberExample("bst issue:comment 273", () => commentOnIssue(resolve, {
+	return withNumberExample("pnpm exec bst issue:comment 273", () => commentOnIssue(resolve, {
 		ref: options.ref,
 		body: options.body,
 		dryRun: options.dryRun,
@@ -26503,7 +27667,7 @@ async function runIssueUpdate(executor, options) {
 		debug(options, `issue:update #${String(parseIssueRef(options.ref).number)} [${changed.join(", ")}]`);
 	});
 	try {
-		return await withNumberExample("bst issue:update 273 --title '...'", () => updateIssue(resolve, {
+		return await withNumberExample("pnpm exec bst issue:update 273 --title '...'", () => updateIssue(resolve, {
 			ref: options.ref,
 			dryRun: options.dryRun,
 			...options.title === void 0 ? {} : { title: options.title },
@@ -26950,7 +28114,7 @@ async function runIssueDownload(executor, options) {
 			...options.repo === void 0 ? {} : { repo: options.repo }
 		});
 	} catch (error) {
-		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("bst issue:download 273"));
+		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("pnpm exec bst issue:download 273"));
 		if (error instanceof AttachmentExistsError) throw new FatalError(describeAttachmentExists(error, "--force"));
 		throw error;
 	}
@@ -27103,7 +28267,7 @@ async function runIssueLabel(executor, options) {
 	} catch (error) {
 		if (error instanceof IssueNumberRequiredError) {
 			const command = options.action === "add" ? "issue:label" : "issue:unlabel";
-			throw new FatalError(describeIssueNumberRequired(`bst ${command} 273 agent/implement`));
+			throw new FatalError(describeIssueNumberRequired(`pnpm exec bst ${command} 273 agent/implement`));
 		}
 		throw error;
 	}
@@ -27184,7 +28348,7 @@ async function runIssueSetLabels(executor, options) {
 			...options.repo === void 0 ? {} : { repo: options.repo }
 		});
 	} catch (error) {
-		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("bst issue:set-labels 273 agent/plan"));
+		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired("pnpm exec bst issue:set-labels 273 agent/plan"));
 		if (error instanceof NoLabelsGivenError) throw new FatalError(describeNoLabelsGiven(error, "--clear"));
 		throw error;
 	}
@@ -27359,7 +28523,7 @@ async function runIssueState(executor, options) {
 			...options.repo === void 0 ? {} : { repo: options.repo }
 		});
 	} catch (error) {
-		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired(`bst issue:${options.action} 273`));
+		if (error instanceof IssueNumberRequiredError) throw new FatalError(describeIssueNumberRequired(`pnpm exec bst issue:${options.action} 273`));
 		if (error instanceof EmptyCommentError) throw new FatalError(describeEmptyComment({
 			text: "--comment",
 			file: "--comment-file"
@@ -27505,7 +28669,7 @@ function resolveBody(bodyFile) {
 const findingsAddCommand = defineCommand({
 	meta: {
 		name: "findings:add",
-		description: "Author one finding into .agent/findings/, correct-by-construction. Usage: bst findings:add --class <nit|pre-existing> --source <pr|issue>#<n> --title <t>. The first finding creates .agent/findings/, which turns on the agent's backlog run for the repo; set .tooling.json#agent.backlog to false to stop it."
+		description: "Author one finding into .agent/findings/, correct-by-construction. Usage: pnpm exec bst findings:add --class <nit|pre-existing> --source <pr|issue>#<n> --title <t>. The first finding creates .agent/findings/, which turns on the agent's backlog run for the repo; set .tooling.json#agent.backlog to false to stop it."
 	},
 	args: {
 		class: {
@@ -27689,7 +28853,7 @@ function runFindingsResolve(rootDir, names, opts) {
 const findingsResolveCommand = defineCommand({
 	meta: {
 		name: "findings:resolve",
-		description: "Delete finding file(s) from .agent/findings/, or --defer to append a note instead. bst findings:resolve <name>... [--defer <note>]."
+		description: "Delete finding file(s) from .agent/findings/, or --defer to append a note instead. pnpm exec bst findings:resolve <name>... [--defer <note>]."
 	},
 	args: {
 		defer: {
@@ -28035,7 +29199,12 @@ function renderStatus(report) {
 	const next = report.next ?? "(none)";
 	const task = report.nextTask === null || taskLabelId(next) === report.nextTask ? "" : `Task ${report.nextTask} -- `;
 	const lines = [`${report.plan}${report.retired ? " (retired)" : ""}: ${String(report.checked)} done, ${String(report.outstanding)} outstanding, ${String(report.declined)} declined`, `next: ${task}${next}${report.onlyRetireLeft ? " -- only the retire task is left" : ""}`];
+	if (report.deferred > 0) lines.splice(1, 0, `${String(report.deferred)} deferred to a later task`);
 	for (const note of report.notes) lines.push(`  [${note.kind}] ${note.task}: ${note.text}`);
+	for (const deferral of report.deferrals) {
+		if (deferral.failed === null) continue;
+		lines.push(`  [deferred -- not counted] ${deferral.task}: ${describeDeferralCheck(deferral.failed)}.`);
+	}
 	return lines.join("\n");
 }
 const planStatusCommand = defineCommand({
@@ -28047,7 +29216,7 @@ const planStatusCommand = defineCommand({
 		plan: PLAN_ARG,
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: plan, retired, checked, outstanding, declined, next (or null), nextTask (a task label string such as \"3\" or \"18a\", or null), onlyRetireLeft, notes ([{task, kind (progress | blocked | declined), text}]). next is null when there is none; nextTask is null when no task label encloses it."
+			description: "Emit one JSON document: plan, retired, checked, outstanding, declined, deferred, deferrals ([{task, target (a task label string or null), failed (empty-reason | no-target-label | no-own-task | target-not-found | target-not-later | target-is-retire | no-carried-box, or null when valid)}]), next (or null), nextTask (a task label string such as \"3\" or \"18a\", or null), onlyRetireLeft, notes ([{task, kind (progress | blocked | declined | deferred), text}]). next is null when there is none; nextTask is null when no task label encloses it."
 		}
 	},
 	run({ args }) {
@@ -28220,7 +29389,7 @@ async function runCli(config) {
 //#region src/cli-main.ts
 setLogLevel(resolveLogLevel({}));
 setForgejoLogger(log$1);
-const displayVersion = "0.94.0";
+const displayVersion = "0.96.0";
 const bstSubCommands = {
 	"repo:sync": syncCommand,
 	"checks:run": runChecksCommand,
@@ -28250,6 +29419,7 @@ const bstSubCommands = {
 	"coverage:record": coverageRecordCommand,
 	"coverage:status": coverageStatusCommand,
 	"health:check": healthCheckCommand,
+	"health:raise": healthRaiseCommand,
 	"health:summary": healthSummaryCommand,
 	"health:record": healthRecordCommand,
 	"health:status": healthStatusCommand,