@burdenoff/toolchain 0.0.0-stage → 2026.1107.1

package/dist/cli.js

@@ -0,0 +1,3014 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/coverage-gate.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { isAbsolute, join as join2, relative } from "path";
+
+// src/lib/args.ts
+function parseArgs(argv, valueFlags = []) {
+  const flags = new Map;
+  const positionals = [];
+  let rest = [];
+  for (let i = 0;i < argv.length; i++) {
+    const a = argv[i] ?? "";
+    if (a === "--") {
+      rest = argv.slice(i + 1);
+      break;
+    }
+    if (a.startsWith("--")) {
+      const eq = a.indexOf("=");
+      if (eq > 0) {
+        flags.set(a.slice(2, eq), a.slice(eq + 1));
+        continue;
+      }
+      const name = a.slice(2);
+      const next = argv[i + 1];
+      if (valueFlags.includes(name) && next !== undefined && !next.startsWith("--")) {
+        flags.set(name, next);
+        i++;
+        continue;
+      }
+      flags.set(name, true);
+      continue;
+    }
+    positionals.push(a);
+  }
+  return { flags, positionals, rest };
+}
+function flagString(args, name) {
+  const v = args.flags.get(name);
+  return typeof v === "string" ? v : undefined;
+}
+function flagBool(args, name) {
+  return args.flags.has(name);
+}
+
+// src/lib/proc.ts
+function capture(cmd, opts = {}) {
+  try {
+    const res = Bun.spawnSync([...cmd], {
+      cwd: opts.cwd,
+      env: opts.env,
+      stdin: opts.stdin === undefined ? "ignore" : new TextEncoder().encode(opts.stdin),
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    return {
+      code: res.exitCode ?? 1,
+      stdout: res.stdout.toString(),
+      stderr: res.stderr.toString()
+    };
+  } catch (error) {
+    return { code: 127, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+// src/lib/git.ts
+function isGitRepo(cwd) {
+  return capture(["git", "rev-parse", "--is-inside-work-tree"], { cwd }).stdout.trim() === "true";
+}
+function listRepoFiles(cwd) {
+  const res = capture(["git", "ls-files", "-z", "-c", "-o", "--exclude-standard"], { cwd });
+  if (res.code !== 0)
+    return null;
+  const seen = new Set;
+  for (const f of res.stdout.split("\x00")) {
+    if (f !== "")
+      seen.add(f);
+  }
+  return [...seen].sort();
+}
+function showHead(cwd, path) {
+  const res = capture(["git", "show", `HEAD:${path}`], { cwd });
+  return res.code === 0 ? res.stdout : null;
+}
+function refExists(cwd, ref) {
+  return capture(["git", "rev-parse", "--verify", "--quiet", `${ref}^{commit}`], { cwd }).code === 0;
+}
+function differsFromHead(cwd, path) {
+  const tracked = capture(["git", "ls-files", "--error-unmatch", "--", path], { cwd }).code === 0;
+  if (!tracked)
+    return true;
+  return capture(["git", "diff", "--quiet", "HEAD", "--", path], { cwd }).code !== 0;
+}
+function diffAgainst(cwd, base) {
+  const mergeBase = capture(["git", "merge-base", base, "HEAD"], { cwd });
+  const from = mergeBase.code === 0 ? mergeBase.stdout.trim() : base;
+  const res = capture(["git", "diff", "-U0", "--no-color", "--no-ext-diff", from, "--"], { cwd });
+  return res.code === 0 ? res.stdout : null;
+}
+
+// src/lib/log.ts
+var consoleWriter = {
+  out: (line) => {
+    process.stdout.write(`${line}
+`);
+  },
+  err: (line) => {
+    process.stderr.write(`${line}
+`);
+  }
+};
+function isGithubActions(env = process.env) {
+  return env.GITHUB_ACTIONS === "true";
+}
+function isCi(env = process.env) {
+  const v = env.CI;
+  return v !== undefined && v !== "" && v !== "0" && v.toLowerCase() !== "false";
+}
+function renderTable(header, rows) {
+  const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
+  const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ").trimEnd();
+  return [fmt(header), widths.map((w) => "-".repeat(w)).join("  "), ...rows.map(fmt)];
+}
+
+// src/lib/repo.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var REPO_TYPES = [
+  "svc",
+  "gateway",
+  "be-sdk",
+  "mfe",
+  "fe-libs",
+  "app",
+  "website",
+  "docs",
+  "cli",
+  "mcp",
+  "sdk-node",
+  "browser-ext",
+  "vscode-ext",
+  "plugin",
+  "doctor",
+  "lib"
+];
+function isRepoType(value) {
+  return typeof value === "string" && REPO_TYPES.includes(value);
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function stringArray(v, where) {
+  if (v === undefined)
+    return;
+  if (Array.isArray(v) && v.every((x) => typeof x === "string"))
+    return v;
+  throw new Error(`package.json ${where} must be an array of strings`);
+}
+function optionalNumber(v, where) {
+  if (v === undefined)
+    return;
+  if (typeof v === "number" && Number.isFinite(v) && v >= 0 && v <= 100)
+    return v;
+  throw new Error(`package.json ${where} must be a number between 0 and 100`);
+}
+function parseBoffConfig(raw) {
+  if (raw === undefined)
+    return {};
+  if (!isRecord(raw))
+    throw new Error('package.json "boff" must be an object');
+  const allowed = new Set(["type", "sanity", "coverage", "scripts", "depsMode"]);
+  for (const key of Object.keys(raw)) {
+    if (!allowed.has(key))
+      throw new Error(`package.json "boff.${key}" is not a known key`);
+  }
+  const cfg = {};
+  if (raw.type !== undefined) {
+    if (!isRepoType(raw.type)) {
+      throw new Error(`package.json "boff.type" must be one of: ${REPO_TYPES.join(", ")}`);
+    }
+    cfg.type = raw.type;
+  }
+  if (raw.sanity !== undefined) {
+    if (!isRecord(raw.sanity))
+      throw new Error('package.json "boff.sanity" must be an object');
+    const s = raw.sanity;
+    for (const key of Object.keys(s)) {
+      if (!["steps", "extra", "formatPaths", "codegenCommitted"].includes(key)) {
+        throw new Error(`package.json "boff.sanity.${key}" is not a known key`);
+      }
+    }
+    cfg.sanity = {
+      steps: stringArray(s.steps, '"boff.sanity.steps"'),
+      extra: stringArray(s.extra, '"boff.sanity.extra"'),
+      formatPaths: stringArray(s.formatPaths, '"boff.sanity.formatPaths"'),
+      codegenCommitted: stringArray(s.codegenCommitted, '"boff.sanity.codegenCommitted"')
+    };
+  }
+  if (raw.coverage !== undefined) {
+    if (!isRecord(raw.coverage))
+      throw new Error('package.json "boff.coverage" must be an object');
+    const c = raw.coverage;
+    cfg.coverage = {
+      global: optionalNumber(c.global, '"boff.coverage.global"'),
+      diff: optionalNumber(c.diff, '"boff.coverage.diff"'),
+      exclude: stringArray(c.exclude, '"boff.coverage.exclude"')
+    };
+  }
+  if (raw.scripts !== undefined) {
+    if (!isRecord(raw.scripts))
+      throw new Error('package.json "boff.scripts" must be an object');
+    cfg.scripts = { unmanaged: stringArray(raw.scripts.unmanaged, '"boff.scripts.unmanaged"') };
+  }
+  if (raw.depsMode !== undefined) {
+    if (!isRecord(raw.depsMode))
+      throw new Error('package.json "boff.depsMode" must be an object');
+    const d = raw.depsMode;
+    const paths = {};
+    if (d.paths !== undefined) {
+      if (!isRecord(d.paths))
+        throw new Error('package.json "boff.depsMode.paths" must be an object');
+      for (const [k, v] of Object.entries(d.paths)) {
+        if (typeof v !== "string")
+          throw new Error(`package.json "boff.depsMode.paths.${k}" must be a string`);
+        paths[k] = v;
+      }
+    }
+    if (d.stateFile !== undefined && typeof d.stateFile !== "string") {
+      throw new Error('package.json "boff.depsMode.stateFile" must be a string');
+    }
+    cfg.depsMode = {
+      paths: d.paths === undefined ? undefined : paths,
+      stateFile: typeof d.stateFile === "string" ? d.stateFile : undefined
+    };
+  }
+  return cfg;
+}
+function readPackageJson(root) {
+  const path = join(root, "package.json");
+  if (!existsSync(path))
+    return null;
+  const raw = JSON.parse(readFileSync(path, "utf8"));
+  if (!isRecord(raw))
+    throw new Error(`${path} is not a JSON object`);
+  return raw;
+}
+function inferRepoType(root, pkg) {
+  const name = (pkg?.name ?? "").replace(/^@[^/]+\//, "");
+  const has = (p) => existsSync(join(root, p));
+  if (/^(wspace|global)-.+-svc$/.test(name) || has("prisma") && has("src/modules"))
+    return "svc";
+  if (/-gateway$/.test(name))
+    return "gateway";
+  if (name === "be-sdk")
+    return "be-sdk";
+  if (name === "fe-libs")
+    return "fe-libs";
+  if (/^microfe-/.test(name))
+    return "mfe";
+  if (/-browser-extension$/.test(name) || has("manifest.json"))
+    return "browser-ext";
+  if (/-code-extension$/.test(name) || pkg?.engines?.vscode !== undefined)
+    return "vscode-ext";
+  if (/^vibe-plugin-/.test(name))
+    return "plugin";
+  if (/-sdk-node$|-sdk$/.test(name))
+    return "sdk-node";
+  if (/-mcp$|-mcp-server$/.test(name))
+    return "mcp";
+  if (/-cli$/.test(name))
+    return "cli";
+  if (/-docs$/.test(name) || has("docusaurus.config.ts") || has("docusaurus.config.js"))
+    return "docs";
+  if (/-website$/.test(name))
+    return "website";
+  if (/-app$/.test(name))
+    return "app";
+  if (/-doctor$/.test(name))
+    return "doctor";
+  return "lib";
+}
+function loadRepo(root, typeOverride) {
+  const pkg = readPackageJson(root);
+  const config = parseBoffConfig(pkg?.boff);
+  let type;
+  if (typeOverride !== undefined) {
+    if (!isRepoType(typeOverride)) {
+      throw new Error(`unknown repo type "${typeOverride}" (expected one of: ${REPO_TYPES.join(", ")})`);
+    }
+    type = typeOverride;
+  } else {
+    type = config.type ?? inferRepoType(root, pkg);
+  }
+  return { root, pkg, config, type };
+}
+function hasScript(ctx, name) {
+  return typeof ctx.pkg?.scripts?.[name] === "string";
+}
+
+// src/coverage-gate.ts
+var DEFAULT_GLOBAL_THRESHOLD = 80;
+var DEFAULT_DIFF_THRESHOLD = 80;
+var DEFAULT_COMPARE_BRANCH = "origin/main";
+var DEFAULT_EXCLUDES = [
+  "**/generated/**",
+  "**/*.generated.ts",
+  "**/__tests__/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "src/test/**",
+  "test/**",
+  "tests/**",
+  "**/node_modules/**"
+];
+function counter(value, line) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 0)
+    throw new Error(`malformed lcov line: "${line}"`);
+  return n;
+}
+function parseLcov(text) {
+  const files = [];
+  let cur = null;
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "")
+      continue;
+    if (line.startsWith("SF:")) {
+      cur = { path: line.slice(3), linesFound: 0, linesHit: 0, functionsFound: 0, functionsHit: 0, lines: new Map };
+      continue;
+    }
+    if (line === "end_of_record") {
+      if (cur !== null)
+        files.push(cur);
+      cur = null;
+      continue;
+    }
+    if (cur === null)
+      continue;
+    const sep = line.indexOf(":");
+    if (sep <= 0)
+      continue;
+    const tag = line.slice(0, sep);
+    const value = line.slice(sep + 1);
+    switch (tag) {
+      case "LF":
+        cur.linesFound = counter(value, line);
+        break;
+      case "LH":
+        cur.linesHit = counter(value, line);
+        break;
+      case "FNF":
+        cur.functionsFound = counter(value, line);
+        break;
+      case "FNH":
+        cur.functionsHit = counter(value, line);
+        break;
+      case "DA": {
+        const [ln, hits] = value.split(",");
+        const lineNo = counter(ln ?? "", line);
+        const count = counter(hits ?? "", line);
+        cur.lines.set(lineNo, (cur.lines.get(lineNo) ?? 0) + count);
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  if (cur !== null)
+    files.push(cur);
+  return files;
+}
+function normalisePath(root, sf) {
+  const rel = isAbsolute(sf) ? relative(root, sf) : sf;
+  return rel.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function filterFiles(files, root, excludes) {
+  const globs = excludes.map((p) => new Bun.Glob(p));
+  return files.map((f) => ({ ...f, path: normalisePath(root, f.path) })).filter((f) => !globs.some((g) => g.match(f.path)));
+}
+function totals(files) {
+  const t = { files: files.length, linesFound: 0, linesHit: 0, functionsFound: 0, functionsHit: 0 };
+  for (const f of files) {
+    t.linesFound += f.linesFound;
+    t.linesHit += f.linesHit;
+    t.functionsFound += f.functionsFound;
+    t.functionsHit += f.functionsHit;
+  }
+  return t;
+}
+function pct(hit, found) {
+  return found === 0 ? 100 : hit / found * 100;
+}
+function parseDiff(diff) {
+  const out = new Map;
+  let current = null;
+  for (const line of diff.split(`
+`)) {
+    if (line.startsWith("+++ ")) {
+      const target = line.slice(4).trim();
+      if (target === "/dev/null") {
+        current = null;
+        continue;
+      }
+      const path = target.replace(/^b\//, "");
+      current = out.get(path) ?? new Set;
+      out.set(path, current);
+      continue;
+    }
+    const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+    if (m !== null && current !== null) {
+      const start = Number(m[1]);
+      const count = m[2] === undefined ? 1 : Number(m[2]);
+      for (let i = 0;i < count; i++)
+        current.add(start + i);
+    }
+  }
+  return out;
+}
+function diffCoverage(files, changed) {
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  let instrumented = 0;
+  let covered = 0;
+  const uncovered = new Map;
+  for (const [path, lines] of changed) {
+    const cov = byPath.get(path);
+    if (cov === undefined)
+      continue;
+    for (const ln of [...lines].sort((a, b) => a - b)) {
+      const hits = cov.lines.get(ln);
+      if (hits === undefined)
+        continue;
+      instrumented++;
+      if (hits > 0)
+        covered++;
+      else
+        uncovered.set(path, [...uncovered.get(path) ?? [], ln]);
+    }
+  }
+  return { instrumented, covered, uncovered };
+}
+function formatRanges(lines) {
+  const parts = [];
+  let start = lines[0];
+  let prev = lines[0];
+  for (const n of lines.slice(1)) {
+    if (prev !== undefined && n === prev + 1) {
+      prev = n;
+      continue;
+    }
+    if (start !== undefined && prev !== undefined)
+      parts.push(start === prev ? `${start}` : `${start}-${prev}`);
+    start = n;
+    prev = n;
+  }
+  if (start !== undefined && prev !== undefined)
+    parts.push(start === prev ? `${start}` : `${start}-${prev}`);
+  return parts.join(", ");
+}
+function envNumber(env, name) {
+  const v = env[name];
+  if (v === undefined || v.trim() === "")
+    return;
+  const n = Number(v);
+  if (!Number.isFinite(n) || n < 0 || n > 100)
+    throw new Error(`${name} must be a number between 0 and 100`);
+  return n;
+}
+var HELP = `usage: boff coverage-gate [options]
+
+Reads coverage/lcov.info and enforces:
+  aggregate lines and functions >= global threshold
+  coverage of changed lines vs the compare branch >= diff threshold
+
+Options:
+  --lcov <path>            lcov file (default coverage/lcov.info)
+  --global <pct>           global threshold (env GLOBAL_THRESHOLD, package.json boff.coverage.global, default 80)
+  --diff <pct>             diff threshold (env DIFF_THRESHOLD, package.json boff.coverage.diff, default 80)
+  --compare-branch <ref>   base ref (env COMPARE_BRANCH, default origin/main)
+  --no-diff                skip the diff check
+  --run-tests              run bun test --coverage first (drop-in for scripts/check-coverage.sh)`;
+async function coverageGate(opts) {
+  const env = opts.env ?? process.env;
+  const w = opts.writer ?? consoleWriter;
+  const args = parseArgs(opts.argv ?? [], ["lcov", "global", "diff", "compare-branch"]);
+  if (flagBool(args, "help")) {
+    w.out(HELP);
+    return 0;
+  }
+  const repo = loadRepo(opts.root);
+  const cfg = repo.config.coverage ?? {};
+  const cliNumber = (name) => {
+    const v = flagString(args, name);
+    if (v === undefined)
+      return;
+    const n = Number(v);
+    if (!Number.isFinite(n) || n < 0 || n > 100)
+      throw new Error(`--${name} must be a number between 0 and 100`);
+    return n;
+  };
+  const globalThreshold = cliNumber("global") ?? envNumber(env, "GLOBAL_THRESHOLD") ?? cfg.global ?? DEFAULT_GLOBAL_THRESHOLD;
+  const diffThreshold = cliNumber("diff") ?? envNumber(env, "DIFF_THRESHOLD") ?? cfg.diff ?? DEFAULT_DIFF_THRESHOLD;
+  const compareBranch = flagString(args, "compare-branch") ?? env.COMPARE_BRANCH ?? DEFAULT_COMPARE_BRANCH;
+  const lcovPath = join2(opts.root, flagString(args, "lcov") ?? "coverage/lcov.info");
+  const annotate = isGithubActions(env);
+  const fail = (msg) => {
+    w.err(annotate ? `::error title=coverage gate::${msg}` : `coverage gate: ${msg}`);
+  };
+  if (flagBool(args, "run-tests")) {
+    rmSync(join2(opts.root, "coverage"), { recursive: true, force: true });
+    const envFile = existsSync2(join2(opts.root, ".env.local")) ? ["--env-file=.env.local"] : [];
+    const proc = Bun.spawn(["bun", ...envFile, "test", "--coverage", "--coverage-reporter=text", "--coverage-reporter=lcov"], { cwd: opts.root, env, stdin: "ignore", stdout: "inherit", stderr: "inherit" });
+    const rc = await proc.exited;
+    if (rc !== 0) {
+      fail(`bun test exited with ${rc}`);
+      return rc;
+    }
+  }
+  if (!existsSync2(lcovPath)) {
+    fail(`no coverage report at ${relative(opts.root, lcovPath)} (run bun test --coverage --coverage-reporter=lcov)`);
+    return 1;
+  }
+  const excludes = [...DEFAULT_EXCLUDES, ...cfg.exclude ?? []];
+  const files = filterFiles(parseLcov(readFileSync2(lcovPath, "utf8")), opts.root, excludes);
+  const t = totals(files);
+  const failures = [];
+  const rows = [];
+  const linePct = pct(t.linesHit, t.linesFound);
+  const fnPct = pct(t.functionsHit, t.functionsFound);
+  const verdict = (ok) => ok ? "pass" : "FAIL";
+  if (t.files === 0 || t.linesFound === 0)
+    failures.push("coverage report contains no source files after excludes");
+  rows.push([
+    "lines",
+    `${t.linesHit}/${t.linesFound}`,
+    `${linePct.toFixed(2)}%`,
+    `${globalThreshold}%`,
+    verdict(linePct >= globalThreshold)
+  ]);
+  rows.push([
+    "functions",
+    `${t.functionsHit}/${t.functionsFound}`,
+    `${fnPct.toFixed(2)}%`,
+    `${globalThreshold}%`,
+    verdict(fnPct >= globalThreshold)
+  ]);
+  if (linePct < globalThreshold) {
+    failures.push(`line coverage ${linePct.toFixed(2)}% is below the ${globalThreshold}% threshold`);
+  }
+  if (fnPct < globalThreshold) {
+    failures.push(`function coverage ${fnPct.toFixed(2)}% is below the ${globalThreshold}% threshold`);
+  }
+  let uncoveredReport = [];
+  if (flagBool(args, "no-diff")) {
+    rows.push(["diff", "-", "-", `${diffThreshold}%`, "skipped (--no-diff)"]);
+  } else if (!isGitRepo(opts.root) || !refExists(opts.root, compareBranch)) {
+    if (isCi(env)) {
+      failures.push(`compare branch ${compareBranch} is not available; fetch it (actions/checkout fetch-depth: 0) or set COMPARE_BRANCH`);
+      rows.push(["diff", "-", "-", `${diffThreshold}%`, "FAIL (no base ref)"]);
+    } else {
+      rows.push(["diff", "-", "-", `${diffThreshold}%`, `skipped (${compareBranch} not found locally)`]);
+    }
+  } else {
+    const diff = diffAgainst(opts.root, compareBranch);
+    if (diff === null) {
+      failures.push(`git diff against ${compareBranch} failed`);
+    } else {
+      const d = diffCoverage(files, parseDiff(diff));
+      const dPct = pct(d.covered, d.instrumented);
+      const ok = dPct >= diffThreshold;
+      rows.push([
+        `diff vs ${compareBranch}`,
+        `${d.covered}/${d.instrumented}`,
+        d.instrumented === 0 ? "n/a" : `${dPct.toFixed(2)}%`,
+        `${diffThreshold}%`,
+        d.instrumented === 0 ? "pass (no coverable changed lines)" : verdict(ok)
+      ]);
+      if (!ok)
+        failures.push(`diff coverage ${dPct.toFixed(2)}% is below the ${diffThreshold}% threshold`);
+      uncoveredReport = [...d.uncovered].map(([p, lns]) => `  ${p}: ${formatRanges(lns)}`);
+    }
+  }
+  w.out(`Coverage (${t.files} files, excludes: ${excludes.length} globs)`);
+  for (const line of renderTable(["metric", "covered", "percent", "threshold", "result"], rows))
+    w.out(line);
+  if (uncoveredReport.length > 0) {
+    w.out("Changed lines without coverage:");
+    for (const line of uncoveredReport)
+      w.out(line);
+  }
+  if (failures.length > 0) {
+    for (const f of failures)
+      fail(f);
+    return 1;
+  }
+  w.out("coverage gate: passed");
+  return 0;
+}
+
+// src/deps-mode.ts
+import { copyFileSync, existsSync as existsSync4, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync } from "fs";
+import { dirname as dirname2, join as join4, relative as relative2, resolve } from "path";
+
+// src/lib/meta.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { dirname, join as join3 } from "path";
+var SUPPORTED_BUN = "1.4.4";
+var MANAGED_START = "# >>> boff managed (do not edit)";
+var MANAGED_END = "# <<< boff managed";
+function findPackageRoot(start) {
+  let dir = start;
+  for (;; ) {
+    const candidate = join3(dir, "package.json");
+    if (existsSync3(candidate) && readFileSync3(candidate, "utf8").includes('"@burdenoff/toolchain"'))
+      return dir;
+    const parent = dirname(dir);
+    if (parent === dir)
+      throw new Error(`cannot locate the @burdenoff/toolchain package root above ${start}`);
+    dir = parent;
+  }
+}
+var PACKAGE_ROOT = findPackageRoot(import.meta.dir);
+function readOwnPackage() {
+  const raw = JSON.parse(readFileSync3(join3(PACKAGE_ROOT, "package.json"), "utf8"));
+  if (typeof raw === "object" && raw !== null && "name" in raw && "version" in raw && typeof raw.name === "string" && typeof raw.version === "string") {
+    return { name: raw.name, version: raw.version };
+  }
+  throw new Error(`toolchain package.json at ${PACKAGE_ROOT} is missing name or version`);
+}
+var own = readOwnPackage();
+var TOOLCHAIN_NAME = own.name;
+var TOOLCHAIN_VERSION = own.version;
+
+// src/deps-mode.ts
+var INTERNAL_PREFIX = "@burdenoff/";
+var DEP_SECTIONS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+var REWRITE_SECTIONS = ["dependencies", "devDependencies"];
+var LOCAL_REF = /^(workspace:|file:|link:|\.\.\/|\.\/|\/home\/|\/Users\/|\/root\/)/;
+function conventionalDirs(pkgName) {
+  const short = pkgName.replace(INTERNAL_PREFIX, "");
+  const known = {
+    "be-sdk": ["burdenoff-be-sdk-node"],
+    "fe-libs": ["fe-libs"],
+    "fluidgrids-fe-sdk": ["fluidgrids/fluidgrids-fe-sdk"]
+  };
+  if (known[short] !== undefined)
+    return known[short];
+  if (short.startsWith("microfe-"))
+    return [`microfe/${short}`];
+  return [short, `burdenoff-${short}`];
+}
+
+class DepsMode {
+  root;
+  ctx;
+  w;
+  silent;
+  fetchImpl;
+  constructor(root, opts = {}) {
+    this.root = root;
+    this.ctx = loadRepo(root);
+    this.w = opts.writer ?? consoleWriter;
+    this.silent = opts.silent === true;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+  }
+  log(msg) {
+    if (!this.silent)
+      this.w.out(msg);
+  }
+  error(msg) {
+    this.w.err(msg);
+  }
+  get pkgPath() {
+    return join4(this.root, "package.json");
+  }
+  get lockPath() {
+    return join4(this.root, "bun.lock");
+  }
+  get lockWorkspacePath() {
+    return join4(this.root, "bun.lock.workspace");
+  }
+  get statePath() {
+    const configured = this.ctx.config.depsMode?.stateFile;
+    if (configured !== undefined)
+      return join4(this.root, configured);
+    if (existsSync4(join4(this.root, ".boiler-env.json")))
+      return join4(this.root, ".boiler-env.json");
+    return join4(this.root, ".vibe-env.json");
+  }
+  readPkg() {
+    return JSON.parse(readFileSync4(this.pkgPath, "utf8"));
+  }
+  writePkg(pkg) {
+    writeFileSync(this.pkgPath, `${JSON.stringify(pkg, null, 2)}
+`);
+  }
+  readState() {
+    if (!existsSync4(this.statePath))
+      return {};
+    try {
+      const raw = JSON.parse(readFileSync4(this.statePath, "utf8"));
+      if (typeof raw !== "object" || raw === null)
+        return {};
+      return Object.fromEntries(Object.entries(raw).filter((e) => typeof e[1] === "string"));
+    } catch {
+      return {};
+    }
+  }
+  writeState(state) {
+    writeFileSync(this.statePath, `${JSON.stringify(state, null, 2)}
+`);
+  }
+  mode() {
+    return this.readState().depsMode === "workspace" ? "workspace" : "npm";
+  }
+  setMode(mode) {
+    const { _restore_workspace: restore } = this.readState();
+    this.writeState(restore === undefined ? { depsMode: mode } : { depsMode: mode, _restore_workspace: restore });
+  }
+  internalPackages() {
+    const pkg = this.readPkg();
+    const found = new Set;
+    for (const section of REWRITE_SECTIONS) {
+      for (const name of Object.keys(pkg[section] ?? {}))
+        if (name.startsWith(INTERNAL_PREFIX))
+          found.add(name);
+    }
+    return [...found];
+  }
+  hasLocalRefs() {
+    const pkg = this.readPkg();
+    return DEP_SECTIONS.some((s) => Object.values(pkg[s] ?? {}).some((v) => LOCAL_REF.test(v)));
+  }
+  inAncestorWorkspace() {
+    let dir = dirname2(this.root);
+    for (let i = 0;i < 5; i++) {
+      const pj = join4(dir, "package.json");
+      if (existsSync4(pj)) {
+        try {
+          const parent = JSON.parse(readFileSync4(pj, "utf8"));
+          const ws = Array.isArray(parent.workspaces) ? parent.workspaces : parent.workspaces?.packages ?? [];
+          if (ws.length > 0) {
+            const rel = relative2(dir, this.root).replace(/\\/g, "/");
+            return ws.some((g) => matchSimpleGlob(g, rel));
+          }
+        } catch {}
+      }
+      const parent = dirname2(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+    return false;
+  }
+  kind() {
+    const t = this.ctx.config.type;
+    const vite = existsSync4(join4(this.root, "vite.config.ts")) || existsSync4(join4(this.root, "vite.config.js"));
+    if (t === "app" || t === "website")
+      return "app-shell";
+    if (t === "mfe" || t === "fe-libs")
+      return this.inAncestorWorkspace() ? "mfe" : "app-shell";
+    if (t !== undefined)
+      return "backend";
+    if (vite)
+      return "app-shell";
+    return this.inAncestorWorkspace() ? "mfe" : "backend";
+  }
+  resolveLocalPath(name) {
+    const configured = this.ctx.config.depsMode?.paths?.[name] ?? this.legacyPathMap()[name];
+    if (configured !== undefined)
+      return configured;
+    let dir = dirname2(this.root);
+    for (let i = 0;i < 5; i++) {
+      for (const rel of conventionalDirs(name)) {
+        const candidate = join4(dir, rel);
+        const pj = join4(candidate, "package.json");
+        if (!existsSync4(pj))
+          continue;
+        try {
+          if (JSON.parse(readFileSync4(pj, "utf8")).name === name)
+            return relative2(this.root, candidate);
+        } catch {}
+      }
+      const parent = dirname2(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+    return null;
+  }
+  legacyPathMap() {
+    const p = join4(this.root, "deps-local-paths.json");
+    if (!existsSync4(p))
+      return {};
+    try {
+      const raw = JSON.parse(readFileSync4(p, "utf8"));
+      if (typeof raw !== "object" || raw === null)
+        return {};
+      return Object.fromEntries(Object.entries(raw).filter((e) => typeof e[1] === "string"));
+    } catch {
+      this.log("  Warning: Could not read deps-local-paths.json");
+      return {};
+    }
+  }
+  restoreDepsFromGit() {
+    const committedText = showHead(this.root, "package.json");
+    if (committedText === null)
+      return -1;
+    const committed = JSON.parse(committedText);
+    const pkg = this.readPkg();
+    let count = 0;
+    for (const section of DEP_SECTIONS) {
+      const deps = pkg[section];
+      if (deps === undefined)
+        continue;
+      for (const name of Object.keys(deps)) {
+        if (!name.startsWith(INTERNAL_PREFIX))
+          continue;
+        const value = committed[section]?.[name];
+        if (value !== undefined && deps[name] !== value) {
+          deps[name] = value;
+          this.log(`  ${section}.${name} \u2192 ${value}`);
+          count++;
+        }
+      }
+    }
+    if (count > 0)
+      this.writePkg(pkg);
+    return count;
+  }
+  async restoreDepsFromPublished(fetchImpl = this.fetchImpl) {
+    const pkg = this.readPkg();
+    let count = 0;
+    for (const section of DEP_SECTIONS) {
+      const deps = pkg[section];
+      if (deps === undefined)
+        continue;
+      for (const name of Object.keys(deps)) {
+        if (!name.startsWith(INTERNAL_PREFIX) || !LOCAL_REF.test(deps[name] ?? ""))
+          continue;
+        let version;
+        const installed = join4(this.root, "node_modules", ...name.split("/"), "package.json");
+        if (existsSync4(installed)) {
+          try {
+            const v = JSON.parse(readFileSync4(installed, "utf8")).version;
+            if (v !== undefined && v !== "0.0.0-dev")
+              version = v;
+          } catch {}
+        }
+        if (version === undefined) {
+          try {
+            const token = process.env.NPM_TOKEN;
+            const res = await fetchImpl(`https://registry.npmjs.org/${name.replace("/", "%2f")}/latest`, {
+              headers: token === undefined || token === "" ? {} : { authorization: `Bearer ${token}` }
+            });
+            if (res.ok) {
+              const body = await res.json();
+              const v = typeof body === "object" && body !== null ? Reflect.get(body, "version") : undefined;
+              if (typeof v === "string")
+                version = v;
+            }
+          } catch {}
+        }
+        if (version === undefined)
+          continue;
+        deps[name] = `^${version}`;
+        this.log(`  ${section}.${name} \u2192 ^${version}`);
+        count++;
+      }
+    }
+    if (count > 0)
+      this.writePkg(pkg);
+    return count;
+  }
+  restoreLockFromGit() {
+    return capture(["git", "checkout", "--", "bun.lock"], { cwd: this.root }).code === 0;
+  }
+  cleanViteCache() {
+    const p = join4(this.root, "node_modules", ".vite");
+    if (existsSync4(p)) {
+      rmSync2(p, { recursive: true, force: true });
+      this.log("  Cleaned Vite cache (node_modules/.vite).");
+    }
+  }
+  status() {
+    const mode = this.mode();
+    const refs = this.hasLocalRefs();
+    this.log("");
+    this.log(`  Dependency mode: ${mode === "workspace" ? "local (workspace/file refs)" : "remote (registry packages)"}`);
+    this.log(`  Repo type:       ${this.kind()}`);
+    this.log(`  Internal deps:   ${this.internalPackages().join(", ") || "none"}`);
+    this.log(`  package.json:    ${refs ? "has local refs" : "registry-only"}`);
+    if (mode === "workspace" && !refs)
+      this.log(`
+  Mode is 'local' but package.json has registry versions.`);
+    if (mode === "npm" && refs)
+      this.log(`
+  Mode is 'remote' but package.json has local references! Run 'boff deps-mode remote'.`);
+    this.log("");
+    return 0;
+  }
+  async remote() {
+    this.log(`
+  Switching to remote mode...
+`);
+    const restored = this.restoreDepsFromGit();
+    if (restored < 0 || this.hasLocalRefs()) {
+      const published = await this.restoreDepsFromPublished();
+      if (this.hasLocalRefs()) {
+        this.error("  Error: could not restore registry versions from git or the registry. Fix package.json manually.");
+        return 1;
+      }
+      if (published > 0)
+        this.log(`  Restored ${published} @burdenoff/* dep(s) to published versions.`);
+    } else if (restored > 0) {
+      this.log(`  Restored ${restored} @burdenoff/* dep(s) to registry versions.`);
+    } else {
+      this.log("  package.json already has registry-only deps.");
+    }
+    if (existsSync4(this.lockPath) && this.restoreLockFromGit())
+      this.log("  Restored committed bun.lock.");
+    if (this.kind() === "app-shell")
+      this.cleanViteCache();
+    this.setMode("npm");
+    this.log(`  Mode set to: remote
+`);
+    return 0;
+  }
+  async local(skipInstall) {
+    this.log(`
+  Switching to local mode...
+`);
+    const kind = this.kind();
+    const internal = this.internalPackages();
+    if (internal.length === 0) {
+      this.error("  Error: No @burdenoff/* packages found in dependencies.");
+      return 1;
+    }
+    if (this.hasLocalRefs() && this.restoreDepsFromGit() > 0)
+      this.log("  Restored canonical dep values from git first.");
+    const pkg = this.readPkg();
+    let count = 0;
+    for (const section of REWRITE_SECTIONS) {
+      const deps = pkg[section];
+      if (deps === undefined)
+        continue;
+      for (const name of Object.keys(deps)) {
+        if (!name.startsWith(INTERNAL_PREFIX))
+          continue;
+        let next;
+        if (kind === "mfe") {
+          next = "workspace:*";
+        } else {
+          const path = this.resolveLocalPath(name);
+          if (path === null || !existsSync4(join4(resolve(this.root, path), "package.json"))) {
+            this.log(`  Warning: Could not find local path for ${name}. Skipping.`);
+            continue;
+          }
+          next = kind === "app-shell" ? `file:${path}` : path;
+        }
+        if (deps[name] !== next) {
+          this.log(`  ${section}.${name}: ${deps[name] ?? ""} \u2192 ${next}`);
+          deps[name] = next;
+          count++;
+        }
+      }
+    }
+    if (count === 0) {
+      this.log("  No packages to rewrite. Nothing changed.");
+      return 0;
+    }
+    this.writePkg(pkg);
+    if (existsSync4(this.lockWorkspacePath)) {
+      copyFileSync(this.lockWorkspacePath, this.lockPath);
+      this.log("  Restored cached workspace lockfile.");
+    }
+    if (kind === "app-shell")
+      this.cleanViteCache();
+    this.setMode("workspace");
+    if (skipInstall) {
+      this.log("  Skipped bun install (--skip-install flag).");
+      return 0;
+    }
+    this.log(`
+  Running bun install...
+`);
+    const res = Bun.spawnSync(["bun", "install"], {
+      cwd: this.root,
+      stdout: this.silent ? "ignore" : "inherit",
+      stderr: "inherit"
+    });
+    if (res.exitCode !== 0) {
+      this.error(`
+  bun install failed. Restoring remote mode...`);
+      await this.remote();
+      return 1;
+    }
+    if (existsSync4(this.lockPath))
+      copyFileSync(this.lockPath, this.lockWorkspacePath);
+    if (kind !== "app-shell" && this.restoreLockFromGit())
+      this.log("  Restored committed bun.lock (git stays clean).");
+    this.log(`
+  Mode set to: local
+`);
+    return 0;
+  }
+  check() {
+    let errors = 0;
+    const pkg = this.readPkg();
+    for (const section of DEP_SECTIONS) {
+      for (const [name, value] of Object.entries(pkg[section] ?? {})) {
+        if (LOCAL_REF.test(value)) {
+          this.error(`  \u2717 ${section}.${name} = "${value}" (local ref)`);
+          errors++;
+        }
+      }
+    }
+    if (existsSync4(this.lockPath)) {
+      const lock = readFileSync4(this.lockPath, "utf8");
+      if (/"workspace:/.test(lock)) {
+        this.error("  \u2717 bun.lock contains workspace: references");
+        errors++;
+      }
+      if (/"file:/.test(lock)) {
+        this.error("  \u2717 bun.lock contains file: references");
+        errors++;
+      }
+    }
+    if (errors > 0) {
+      this.error(`
+  \u2717 Found ${errors} dependency validation error(s). Run 'boff deps-mode remote'.
+`);
+      return 1;
+    }
+    this.log(`  \u2713 All dependency references are registry-only.
+`);
+    return 0;
+  }
+  async guardPreCommit() {
+    if (!this.hasLocalRefs())
+      return 0;
+    this.w.out("deps-guard: package.json has local refs \u2014 restoring registry deps for this commit");
+    this.writeState({ ...this.readState(), _restore_workspace: "true" });
+    const quiet = new DepsMode(this.root, { writer: this.w, silent: true, fetchImpl: this.fetchImpl });
+    const rc = await quiet.remote();
+    if (rc !== 0)
+      return rc;
+    return capture(["git", "add", "package.json"], { cwd: this.root }).code === 0 ? 0 : 1;
+  }
+  guardPostCommit(cliPath, extraArgs = []) {
+    const state = this.readState();
+    if (state._restore_workspace !== "true")
+      return 0;
+    const rest = { ...state };
+    delete rest._restore_workspace;
+    this.writeState(rest);
+    this.w.out("deps-guard: restoring local mode in the background");
+    const child = Bun.spawn([
+      "sh",
+      "-c",
+      'nohup "$@" >/dev/null 2>&1 &',
+      "sh",
+      process.execPath,
+      cliPath,
+      "deps-mode",
+      "local",
+      "--silent",
+      ...extraArgs
+    ], {
+      cwd: this.root,
+      stdin: "ignore",
+      stdout: "ignore",
+      stderr: "ignore"
+    });
+    child.unref();
+    return 0;
+  }
+}
+function matchSimpleGlob(glob, path) {
+  const g = glob.replace(/\\/g, "/");
+  const p = path.replace(/\\/g, "/");
+  if (g === p)
+    return true;
+  if (g.endsWith("/*")) {
+    const prefix = g.slice(0, -2);
+    return p.startsWith(`${prefix}/`) && !p.slice(prefix.length + 1).includes("/");
+  }
+  if (g.endsWith("/**"))
+    return p.startsWith(`${g.slice(0, -3)}/`);
+  return false;
+}
+function cliPath() {
+  const src = join4(PACKAGE_ROOT, "src", "cli.ts");
+  return existsSync4(src) ? src : join4(PACKAGE_ROOT, "dist", "cli.js");
+}
+var HELP2 = `usage: boff deps-mode <status|remote|local|check|guard pre-commit|guard post-commit> [--silent] [--skip-install]`;
+async function depsModeCommand(root, argv, w = consoleWriter) {
+  const args = parseArgs(argv);
+  const [command, sub] = args.positionals;
+  if (!existsSync4(join4(root, "package.json"))) {
+    w.err("boff deps-mode: no package.json in this directory");
+    return 2;
+  }
+  const dm = new DepsMode(root, { writer: w, silent: flagBool(args, "silent") });
+  switch (command) {
+    case "status":
+      return dm.status();
+    case "remote":
+    case "npm":
+      return dm.remote();
+    case "local":
+    case "workspace":
+      return dm.local(flagBool(args, "skip-install"));
+    case "check":
+      return dm.check();
+    case "guard":
+      if (sub === "pre-commit")
+        return dm.guardPreCommit();
+      if (sub === "post-commit")
+        return dm.guardPostCommit(cliPath(), flagBool(args, "skip-install") ? ["--skip-install"] : []);
+      w.err(HELP2);
+      return 2;
+    case "help":
+      w.out(HELP2);
+      return 0;
+    default:
+      w.err(HELP2);
+      return 2;
+  }
+}
+
+// src/doctor.ts
+import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
+import { join as join11 } from "path";
+
+// src/lib/files.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+function scan(root, pattern) {
+  if (!existsSync5(root))
+    return [];
+  return [...new Bun.Glob(pattern).scanSync({ cwd: root, dot: true, onlyFiles: true })].filter((p) => !p.split("/").includes("node_modules")).sort();
+}
+function read(root, rel) {
+  return { path: rel, text: readFileSync5(join5(root, rel), "utf8") };
+}
+function workflowFiles(root) {
+  return scan(root, ".github/workflows/*.{yml,yaml}").map((p) => read(root, p));
+}
+function actionFiles(root) {
+  return scan(root, ".github/actions/**/action.{yml,yaml}").map((p) => read(root, p));
+}
+function dockerFiles(root) {
+  const found = new Set([
+    ...scan(root, "**/Dockerfile"),
+    ...scan(root, "**/Dockerfile.*"),
+    ...scan(root, "**/*.Dockerfile")
+  ]);
+  return [...found].filter((p) => !p.endsWith(".dockerignore")).sort().map((p) => read(root, p));
+}
+
+// src/lib/hash.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join6 } from "path";
+var HASH_EXCLUDES = [
+  "node_modules/**",
+  "**/node_modules/**",
+  ".git/**",
+  "coverage/**",
+  "dist/**",
+  "sanity.log",
+  "junit.xml",
+  ".eslintcache"
+];
+function sha256(...parts) {
+  const h = new Bun.CryptoHasher("sha256");
+  for (const p of parts) {
+    h.update(p);
+    h.update("\x00");
+  }
+  return h.digest("hex");
+}
+function repoFiles(root) {
+  const fromGit = listRepoFiles(root);
+  const files = fromGit ?? [...new Bun.Glob("**/*").scanSync({ cwd: root, dot: true, onlyFiles: true })].map((f) => f.replace(/\\/g, "/"));
+  const excluded = HASH_EXCLUDES.map((g) => new Bun.Glob(g));
+  return files.filter((f) => !excluded.some((g) => g.match(f))).sort();
+}
+
+class FileHasher {
+  root;
+  cache = new Map;
+  constructor(root) {
+    this.root = root;
+  }
+  fileHash(rel) {
+    const hit = this.cache.get(rel);
+    if (hit !== undefined)
+      return hit;
+    let digest;
+    try {
+      const h = new Bun.CryptoHasher("sha256");
+      h.update(readFileSync6(join6(this.root, rel)));
+      digest = h.digest("hex");
+    } catch {
+      digest = "missing";
+    }
+    this.cache.set(rel, digest);
+    return digest;
+  }
+  combined(files) {
+    const h = new Bun.CryptoHasher("sha256");
+    for (const f of files) {
+      h.update(f);
+      h.update("\x00");
+      h.update(this.fileHash(f));
+      h.update(`
+`);
+    }
+    return h.digest("hex");
+  }
+}
+function matchGlobs(files, globs) {
+  const compiled = globs.map((g) => new Bun.Glob(g));
+  return files.filter((f) => compiled.some((g) => g.match(f)));
+}
+
+// src/lib/jsonc.ts
+function stripJsonComments(text) {
+  let out = "";
+  let inString = false;
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i] ?? "";
+    const next = text[i + 1] ?? "";
+    if (inString) {
+      out += ch;
+      if (ch === "\\") {
+        out += next;
+        i++;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      continue;
+    }
+    if (ch === "/" && next === "/") {
+      while (i < text.length && text[i] !== `
+`)
+        i++;
+      out += `
+`;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
+        i++;
+      i++;
+      continue;
+    }
+    if (ch === ",") {
+      let j = i + 1;
+      while (j < text.length && /\s/.test(text[j] ?? ""))
+        j++;
+      if (text[j] === "}" || text[j] === "]")
+        continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+function parseJsonc(text) {
+  return JSON.parse(stripJsonComments(text));
+}
+
+// src/sync.ts
+import { existsSync as existsSync7 } from "fs";
+import { join as join10 } from "path";
+
+// src/lib/bunfig.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join8 } from "path";
+
+// src/lib/managed.ts
+function findRegions(lines) {
+  const regions = [];
+  let open = -1;
+  lines.forEach((line, i) => {
+    const t = line.trim();
+    if (t === MANAGED_START) {
+      if (open >= 0)
+        throw new Error(`nested "${MANAGED_START}" at line ${i + 1}`);
+      open = i;
+    } else if (t === MANAGED_END) {
+      if (open < 0)
+        throw new Error(`"${MANAGED_END}" without a start marker at line ${i + 1}`);
+      regions.push({ start: open, end: i });
+      open = -1;
+    }
+  });
+  if (open >= 0)
+    throw new Error(`"${MANAGED_START}" at line ${open + 1} has no "${MANAGED_END}"`);
+  return regions;
+}
+var TABLE_HEADER = /^\s*\[\s*([^[\]]+?)\s*\]\s*(?:#.*)?$/;
+function tableHeader(line) {
+  if (/^\s*\[\[/.test(line))
+    return null;
+  const m = TABLE_HEADER.exec(line);
+  if (m === null)
+    return null;
+  return (m[1] ?? "").split(".").map((part) => part.trim().replace(/^"(.*)"$/, "$1").replace(/^'(.*)'$/, "$1")).join(".");
+}
+function stripRegions(lines) {
+  const regions = findRegions(lines);
+  if (regions.length === 0)
+    return [...lines];
+  const drop = new Set;
+  for (const r of regions) {
+    let hasHeader = false;
+    for (let i = r.start;i <= r.end; i++) {
+      drop.add(i);
+      if (tableHeader(lines[i] ?? "") !== null || /^[A-Za-z0-9_-]+:\s*(#.*)?$/.test(lines[i] ?? ""))
+        hasHeader = true;
+    }
+    if (hasHeader && r.end + 1 < lines.length && (lines[r.end + 1] ?? "").trim() === "")
+      drop.add(r.end + 1);
+  }
+  return lines.filter((_, i) => !drop.has(i));
+}
+function trimEnd(lines) {
+  const out = [...lines];
+  while (out.length > 0 && (out[out.length - 1] ?? "").trim() === "")
+    out.pop();
+  return out;
+}
+function splitLines(text) {
+  const lines = text.replace(/\r\n/g, `
+`).split(`
+`);
+  if (lines.length > 0 && lines[lines.length - 1] === "")
+    lines.pop();
+  return lines;
+}
+function joinLines(lines) {
+  return lines.length === 0 ? "" : `${lines.join(`
+`)}
+`;
+}
+function wrapRegion(body) {
+  return [MANAGED_START, ...body, MANAGED_END];
+}
+
+// src/lib/excludes.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join7 } from "path";
+var FLEET_SCOPES = ["@burdenoff", "@fluidgrids", "@vibecontrols"];
+var REGISTRY = "https://registry.npmjs.org";
+var NAME_RE = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+function isPackageName(v) {
+  return typeof v === "string" && NAME_RE.test(v);
+}
+function sortedUnique(names) {
+  return [...new Set(names)].sort();
+}
+function shippedExcludesPath() {
+  return join7(PACKAGE_ROOT, "bunfig", "release-age-excludes.json");
+}
+function readExcludesFile(path = shippedExcludesPath()) {
+  const raw = JSON.parse(readFileSync7(path, "utf8"));
+  if (typeof raw !== "object" || raw === null || !("packages" in raw) || !Array.isArray(raw.packages)) {
+    throw new Error(`${path}: expected an object with a "packages" array`);
+  }
+  const packages = raw.packages.filter(isPackageName);
+  if (packages.length !== raw.packages.length)
+    throw new Error(`${path}: "packages" holds an invalid package name`);
+  const generatedAt = "generatedAt" in raw && typeof raw.generatedAt === "string" ? raw.generatedAt : "";
+  const scopes = "scopes" in raw && Array.isArray(raw.scopes) ? raw.scopes.filter((s) => typeof s === "string") : [];
+  return { generatedAt, scopes, packages: sortedUnique(packages) };
+}
+function shippedExcludes() {
+  return sortedUnique([...readExcludesFile().packages, TOOLCHAIN_NAME]);
+}
+async function fetchScopePackages(scope, token, fetchImpl = fetch) {
+  const org = scope.replace(/^@/, "");
+  const headers = { accept: "application/json" };
+  if (token !== undefined && token !== "")
+    headers.authorization = `Bearer ${token}`;
+  const res = await fetchImpl(`${REGISTRY}/-/org/${encodeURIComponent(org)}/package`, { headers });
+  if (!res.ok)
+    throw new Error(`registry returned ${res.status} for ${scope} packages`);
+  const body = await res.json();
+  if (typeof body !== "object" || body === null)
+    throw new Error(`unexpected registry response for ${scope}`);
+  return Object.keys(body).filter((name) => isPackageName(name) && name.startsWith(`${scope}/`));
+}
+async function fetchFleetExcludes(token, fetchImpl = fetch, base = shippedExcludes()) {
+  const all = new Set(base);
+  for (const scope of FLEET_SCOPES) {
+    for (const name of await fetchScopePackages(scope, token, fetchImpl))
+      all.add(name);
+  }
+  all.add(TOOLCHAIN_NAME);
+  return sortedUnique(all);
+}
+
+// src/lib/bunfig.ts
+var EXCLUDES_PLACEHOLDER = "{{RELEASE_AGE_EXCLUDES}}";
+function parseTemplate(text) {
+  const tables = [];
+  let current = null;
+  for (const raw of splitLines(text)) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#"))
+      continue;
+    const header = tableHeader(line);
+    if (header !== null) {
+      current = { table: header, keys: [] };
+      tables.push(current);
+      continue;
+    }
+    const m = /^([A-Za-z0-9_-]+)\s*=\s*(.+)$/.exec(line);
+    if (m === null || current === null)
+      throw new Error(`fragment template: cannot parse line "${raw}"`);
+    current.keys.push({ name: m[1] ?? "", value: m[2] ?? "" });
+  }
+  return tables;
+}
+function readTemplate() {
+  return parseTemplate(readFileSync8(join8(PACKAGE_ROOT, "bunfig", "fragment.toml.tmpl"), "utf8"));
+}
+function renderExcludes(names) {
+  if (names.length === 0)
+    return ["[]"];
+  return ["[", ...names.map((n) => `  ${JSON.stringify(n)},`), "]"];
+}
+function bracketDelta(text) {
+  let depth = 0;
+  let quote = null;
+  for (let i = 0;i < text.length; i++) {
+    const ch = text[i];
+    if (quote !== null) {
+      if (ch === "\\" && quote === '"')
+        i++;
+      else if (ch === quote)
+        quote = null;
+      continue;
+    }
+    if (ch === "#")
+      break;
+    if (ch === '"' || ch === "'")
+      quote = ch;
+    else if (ch === "[" || ch === "{")
+      depth++;
+    else if (ch === "]" || ch === "}")
+      depth--;
+  }
+  return depth;
+}
+function headerIndex(lines, table) {
+  return lines.findIndex((l) => tableHeader(l) === table);
+}
+function removeKey(lines, table, name) {
+  const h = headerIndex(lines, table);
+  if (h < 0)
+    return false;
+  const keyRe = new RegExp(`^\\s*(?:${name}|"${name}"|'${name}')\\s*=(.*)$`);
+  for (let i = h + 1;i < lines.length && tableHeader(lines[i] ?? "") === null; i++) {
+    const m = keyRe.exec(lines[i] ?? "");
+    if (m === null)
+      continue;
+    let depth = bracketDelta(m[1] ?? "");
+    let end = i;
+    while (depth > 0 && end + 1 < lines.length) {
+      end++;
+      depth += bracketDelta(lines[end] ?? "");
+    }
+    lines.splice(i, end - i + 1);
+    return true;
+  }
+  return false;
+}
+function asTable(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
+}
+function existingExcludes(parsed) {
+  const install = asTable(asTable(parsed)?.install);
+  const list = install?.minimumReleaseAgeExcludes;
+  return Array.isArray(list) ? list.filter(isPackageName) : [];
+}
+function renderBunfig(original, template, excludes) {
+  const parsedOriginal = original.trim() === "" ? {} : Bun.TOML.parse(original);
+  const allExcludes = sortedUnique([...excludes, ...existingExcludes(parsedOriginal)]);
+  let lines = stripRegions(splitLines(original));
+  const replacedKeys = [];
+  for (const t of template) {
+    for (const k of t.keys) {
+      while (removeKey(lines, t.table, k.name))
+        replacedKeys.push(`[${t.table}] ${k.name}`);
+    }
+  }
+  for (const t of template) {
+    const body = [];
+    for (const k of t.keys) {
+      if (k.value === EXCLUDES_PLACEHOLDER) {
+        const rendered = renderExcludes(allExcludes);
+        body.push(`${k.name} = ${rendered[0] ?? "[]"}`, ...rendered.slice(1));
+      } else {
+        body.push(`${k.name} = ${k.value}`);
+      }
+    }
+    const h = headerIndex(lines, t.table);
+    if (h >= 0) {
+      lines.splice(h + 1, 0, ...wrapRegion(body));
+      continue;
+    }
+    const sub = lines.findIndex((l) => (tableHeader(l) ?? "").startsWith(`${t.table}.`));
+    const region = wrapRegion([`[${t.table}]`, ...body]);
+    if (sub >= 0) {
+      lines.splice(sub, 0, ...region, "");
+    } else {
+      lines = trimEnd(lines);
+      if (lines.length > 0)
+        lines.push("");
+      lines.push(...region);
+    }
+  }
+  const text = joinLines(lines);
+  validateBunfig(text, template, allExcludes);
+  return { text, replacedKeys };
+}
+function validateBunfig(text, template, excludes) {
+  const parsed = asTable(Bun.TOML.parse(text));
+  for (const t of template) {
+    let node = parsed;
+    for (const part of t.table.split("."))
+      node = asTable(node?.[part]);
+    if (node === undefined)
+      throw new Error(`rendered bunfig.toml has no [${t.table}] table`);
+    for (const k of t.keys) {
+      const actual = node[k.name];
+      const expected = k.value === EXCLUDES_PLACEHOLDER ? [...excludes] : asTable(Bun.TOML.parse(`v = ${k.value}`))?.v;
+      if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+        throw new Error(`rendered bunfig.toml: [${t.table}] ${k.name} does not read back as written`);
+      }
+    }
+  }
+}
+
+// src/lib/lefthook.ts
+var PRE_PUSH_COMMAND = "./node_modules/.bin/boff sanity --pre-push";
+var PRE_PUSH_BODY = ["pre-push:", "  commands:", "    sanity:", `      run: ${PRE_PUSH_COMMAND}`];
+function removeTopLevelKey(lines, key) {
+  const start = lines.findIndex((l) => new RegExp(`^${key}:\\s*(#.*)?$`).test(l));
+  if (start < 0)
+    return [];
+  let end = start + 1;
+  while (end < lines.length && !/^[^\s#]/.test(lines[end] ?? ""))
+    end++;
+  while (end - 1 > start && /^(#.*)?\s*$/.test(lines[end - 1] ?? ""))
+    end--;
+  return lines.splice(start, end - start);
+}
+function renderLefthook(original) {
+  let lines = stripRegions(splitLines(original));
+  const replaced = removeTopLevelKey(lines, "pre-push");
+  lines = trimEnd(lines);
+  if (lines.length === 0) {
+    lines.push("# Git hooks (https://lefthook.dev). The pre-push block is managed by `boff sync`.");
+  }
+  lines.push("", ...wrapRegion(PRE_PUSH_BODY));
+  const text = joinLines(lines);
+  validateLefthook(text);
+  return { text, replaced };
+}
+function yamlApi() {
+  const candidate = Reflect.get(Bun, "YAML");
+  if (typeof candidate === "object" && candidate !== null && typeof Reflect.get(candidate, "parse") === "function") {
+    return { parse: (text) => Reflect.apply(Reflect.get(candidate, "parse"), candidate, [text]) };
+  }
+  return;
+}
+function validateLefthook(text) {
+  const yaml = yamlApi();
+  if (yaml === undefined)
+    return;
+  const doc = yaml.parse(text);
+  const run = Reflect.get(Reflect.get(Reflect.get(Reflect.get(Object(doc), "pre-push") ?? {}, "commands") ?? {}, "sanity") ?? {}, "run");
+  if (run !== PRE_PUSH_COMMAND)
+    throw new Error("rendered lefthook.yml does not run boff sanity on pre-push");
+}
+
+// src/lib/scripts.ts
+import { existsSync as existsSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "fs";
+import { join as join9 } from "path";
+var BUILD_REFERENCES = ["mfe", "fe-libs", "website"];
+var FOREIGN_TEST_RUNNER = ["vscode-ext", "docs"];
+function shellQuote(arg) {
+  return /^[A-Za-z0-9_./*@:=-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+function typeCheckCommand(ctx) {
+  const parts = ["boff gate -- bun check --no-pretty"];
+  if (BUILD_REFERENCES.includes(ctx.type))
+    parts.push("-b");
+  if (ctx.type === "app" && existsSync6(join9(ctx.root, "tsconfig.typecheck.json"))) {
+    parts.push("-p tsconfig.typecheck.json");
+  }
+  return parts.join(" ");
+}
+function managedScripts(ctx) {
+  const formatPaths = (ctx.config.sanity?.formatPaths ?? []).map(shellQuote).join(" ");
+  const fmt = (check) => ["bun fmt", check ? "--check" : "", formatPaths].filter((p) => p !== "").join(" ");
+  const scripts = {};
+  if (ctx.type !== "docs") {
+    scripts["type:check"] = typeCheckCommand(ctx);
+    scripts.format = fmt(false);
+    scripts["format:check"] = fmt(true);
+    scripts.lint = "eslint .";
+  }
+  if (!FOREIGN_TEST_RUNNER.includes(ctx.type))
+    scripts.test = "bun test";
+  scripts.sanity = "boff sanity";
+  scripts["sanity:force"] = "boff sanity --force";
+  scripts.audit = "bun audit --audit-level=high";
+  for (const key of ctx.config.scripts?.unmanaged ?? [])
+    delete scripts[key];
+  return scripts;
+}
+function detectIndent(text) {
+  const m = /\n([ \t]+)"/.exec(text);
+  if (m?.[1] === undefined)
+    return 2;
+  return m[1].startsWith("\t") ? "\t" : m[1].length;
+}
+function renderPackageJson(original, scripts, type) {
+  const parsed = JSON.parse(original);
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("package.json is not a JSON object");
+  }
+  const pkg = parsed;
+  const current = typeof pkg.scripts === "object" && pkg.scripts !== null && !Array.isArray(pkg.scripts) ? pkg.scripts : {};
+  const changed = [];
+  const next = { ...current };
+  for (const [key, value] of Object.entries(scripts)) {
+    if (current[key] !== value)
+      changed.push({ key, from: current[key], to: value });
+    next[key] = value;
+  }
+  pkg.scripts = next;
+  if (type !== undefined) {
+    const boff = typeof pkg.boff === "object" && pkg.boff !== null && !Array.isArray(pkg.boff) ? pkg.boff : {};
+    if (boff.type !== type) {
+      changed.push({ key: "boff.type", from: typeof boff.type === "string" ? boff.type : undefined, to: type });
+      pkg.boff = { ...boff, type };
+    }
+  }
+  const trailing = original.endsWith(`
+`) ? `
+` : "";
+  return { text: `${JSON.stringify(pkg, null, detectIndent(original))}${trailing}`, changed };
+}
+function readText(path) {
+  return existsSync6(path) ? readFileSync9(path, "utf8") : null;
+}
+function writeText(path, text) {
+  writeFileSync2(path, text);
+}
+
+// src/sync.ts
+function usesLefthook(ctx) {
+  if (existsSync7(join10(ctx.root, "lefthook.yml")))
+    return true;
+  const deps = { ...ctx.pkg?.dependencies, ...ctx.pkg?.devDependencies };
+  return deps.lefthook !== undefined;
+}
+function apply(root, file, original, rendered, check, notes) {
+  if (original === rendered)
+    return { file, status: "unchanged", notes };
+  if (check)
+    return { file, status: original === null ? "missing" : "drift", notes };
+  writeText(join10(root, file), rendered);
+  return { file, status: original === null ? "created" : "updated", notes };
+}
+function bunTooOldForBlock(root) {
+  const pin = readText(join10(root, ".bun-version"))?.trim();
+  if (pin === undefined || pin === "")
+    return true;
+  const [major = 0, minor = 0] = pin.split(".").map((n) => Number.parseInt(n, 10));
+  return major < 1 || major === 1 && minor < 4;
+}
+function syncBunfig(ctx, check, excludes) {
+  const original = readText(join10(ctx.root, "bunfig.toml"));
+  const r = renderBunfig(original ?? "", readTemplate(), excludes);
+  const notes = r.replacedKeys.map((k) => `replaced an unmanaged ${k}`);
+  if (bunTooOldForBlock(ctx.root)) {
+    notes.push(`.bun-version is not ${SUPPORTED_BUN}: Bun 1.3.x rejects minimumReleaseAge = "3d", so pin Bun ${SUPPORTED_BUN} in the same commit`);
+  }
+  return apply(ctx.root, "bunfig.toml", original, r.text, check, notes);
+}
+function syncLefthook(ctx, check) {
+  if (!usesLefthook(ctx))
+    return { file: "lefthook.yml", status: "skipped", notes: ["repo does not use lefthook"] };
+  const original = readText(join10(ctx.root, "lefthook.yml"));
+  const r = renderLefthook(original ?? "");
+  const notes = r.replaced.some((l) => l.includes("run:") && !l.includes("sanity")) ? [`replaced an unmanaged pre-push block: ${r.replaced.map((l) => l.trim()).join(" | ")}`] : [];
+  return apply(ctx.root, "lefthook.yml", original, r.text, check, notes);
+}
+function syncScripts(ctx, check, writeType) {
+  const original = readText(join10(ctx.root, "package.json"));
+  if (original === null)
+    return { file: "package.json", status: "skipped", notes: ["no package.json"] };
+  const r = renderPackageJson(original, managedScripts(ctx), writeType ? ctx.type : undefined);
+  const notes = r.changed.map((c) => `${c.key}: ${c.from ?? "(absent)"} -> ${c.to}`);
+  return apply(ctx.root, "package.json", original, r.text, check, notes);
+}
+function runSync(root, opts) {
+  const ctx = loadRepo(root, opts.type);
+  const excludes = opts.excludes ?? shippedExcludes();
+  const items = [syncBunfig(ctx, opts.check, excludes), syncLefthook(ctx, opts.check)];
+  if (opts.scripts || opts.type !== undefined) {
+    if (opts.scripts)
+      items.push(syncScripts(ctx, opts.check, opts.type !== undefined));
+    else
+      items.push(syncTypeOnly(ctx, opts.check));
+  }
+  return items;
+}
+function syncTypeOnly(ctx, check) {
+  const original = readText(join10(ctx.root, "package.json"));
+  if (original === null)
+    return { file: "package.json", status: "skipped", notes: ["no package.json"] };
+  const r = renderPackageJson(original, {}, ctx.type);
+  return apply(ctx.root, "package.json", original, r.text, check, r.changed.map((c) => `${c.key} -> ${c.to}`));
+}
+var HELP3 = `usage: boff sync [--check] [--type <type>] [--scripts] [--refresh-excludes]
+
+  --check             verify only; exit 1 when any managed block is missing or differs
+  --type <type>       repo type (also recorded as package.json boff.type)
+  --scripts           also manage the package.json scripts for the repo type
+  --refresh-excludes  merge the live @burdenoff/@fluidgrids/@vibecontrols package list
+                      from the npm registry (NPM_TOKEN adds private packages)`;
+async function syncCommand(root, argv, w = consoleWriter) {
+  const args = parseArgs(argv, ["type"]);
+  if (flagBool(args, "help")) {
+    w.out(HELP3);
+    return 0;
+  }
+  const check = flagBool(args, "check");
+  let excludes;
+  if (flagBool(args, "refresh-excludes")) {
+    excludes = await fetchFleetExcludes(process.env.NPM_TOKEN);
+    w.out(`boff sync: ${excludes.length} fleet packages from the registry`);
+  }
+  const items = runSync(root, { check, scripts: flagBool(args, "scripts"), type: flagString(args, "type"), excludes });
+  let drift = false;
+  for (const item of items) {
+    w.out(`${item.status.padEnd(9)} ${item.file}`);
+    for (const note of item.notes)
+      w.out(`          ${note}`);
+    if (item.status === "drift" || item.status === "missing")
+      drift = true;
+  }
+  if (drift) {
+    w.err("boff sync --check: managed blocks are missing or modified; run `boff sync` and commit the result");
+    return 1;
+  }
+  return 0;
+}
+
+// src/doctor.ts
+var ok = (id, detail = "") => ({ id, status: "ok", detail });
+var fail = (id, detail) => ({ id, status: "fail", detail });
+var skip = (id, detail) => ({ id, status: "skip", detail });
+function linesMatching(files, re) {
+  const hits = [];
+  for (const f of files) {
+    f.text.split(`
+`).forEach((line, i) => {
+      if (/^\s*#/.test(line))
+        return;
+      if (re.test(line))
+        hits.push(`${f.path}:${i + 1}`);
+    });
+  }
+  return hits;
+}
+function checkBunVersion(root) {
+  const path = join11(root, ".bun-version");
+  if (!existsSync8(path))
+    return fail("bun-version", `.bun-version is missing (expected ${SUPPORTED_BUN})`);
+  const v = readFileSync10(path, "utf8").trim();
+  return v === SUPPORTED_BUN ? ok("bun-version", v) : fail("bun-version", `.bun-version is ${v}, expected ${SUPPORTED_BUN}`);
+}
+function checkPackageManager(root) {
+  const { pkg } = loadRepo(root);
+  if (pkg === null)
+    return skip("package-manager", "no package.json");
+  const problems = [];
+  if (pkg.packageManager !== `bun@${SUPPORTED_BUN}`) {
+    problems.push(`packageManager is ${pkg.packageManager ?? "(absent)"}, expected bun@${SUPPORTED_BUN}`);
+  }
+  if (pkg.engines?.bun !== `>=${SUPPORTED_BUN}`) {
+    problems.push(`engines.bun is ${pkg.engines?.bun ?? "(absent)"}, expected >=${SUPPORTED_BUN}`);
+  }
+  return problems.length === 0 ? ok("package-manager", `bun@${SUPPORTED_BUN}`) : fail("package-manager", problems.join("; "));
+}
+function checkNoBaseUrl(root) {
+  const configs = repoFiles(root).filter((f) => /(^|\/)[tj]sconfig[^/]*\.json$/.test(f));
+  const offenders = [];
+  for (const f of configs) {
+    try {
+      const parsed = parseJsonc(readFileSync10(join11(root, f), "utf8"));
+      const co = typeof parsed === "object" && parsed !== null ? Reflect.get(parsed, "compilerOptions") : undefined;
+      if (typeof co === "object" && co !== null && Reflect.has(co, "baseUrl"))
+        offenders.push(f);
+    } catch {
+      if (/"baseUrl"\s*:/.test(readFileSync10(join11(root, f), "utf8")))
+        offenders.push(f);
+    }
+  }
+  if (configs.length === 0)
+    return skip("no-baseurl", "no tsconfig files");
+  return offenders.length === 0 ? ok("no-baseurl", `${configs.length} tsconfig file(s)`) : fail("no-baseurl", `baseUrl is removed in TypeScript 7 (bun check fails on it): ${offenders.join(", ")}`);
+}
+function checkManagedBlocks(root) {
+  const ctx = loadRepo(root);
+  let items;
+  try {
+    items = runSync(root, { check: true, scripts: ctx.config.type !== undefined });
+  } catch (error) {
+    return fail("managed-blocks", error instanceof Error ? error.message : String(error));
+  }
+  const bad = items.filter((i) => i.status === "drift" || i.status === "missing");
+  return bad.length === 0 ? ok("managed-blocks", items.filter((i) => i.status === "unchanged").map((i) => i.file).join(", ")) : fail("managed-blocks", `${bad.map((i) => `${i.file} (${i.status})`).join(", ")}; run \`boff sync\``);
+}
+function checkNoBunfigOverwrite(root) {
+  const ci = [...workflowFiles(root), ...actionFiles(root)];
+  const heredoc = linesMatching(ci, /(?:cat|tee|printf|echo)\b[^#\n]*>\s*["']?(?:\.\/|\$\{?\w+\}?\/)?bunfig\.toml\b|\btee\s+(?:-a\s+)?["']?(?:\.\/)?bunfig\.toml\b/);
+  const mounts = linesMatching(dockerFiles(root), /--mount=type=secret[^\n]*(?:id=bunfig\b|target=[^\s,]*bunfig\.toml)/);
+  const hits = [...heredoc, ...mounts];
+  if (ci.length === 0 && mounts.length === 0 && dockerFiles(root).length === 0)
+    return skip("bunfig-overwrite", "no workflows or Dockerfiles");
+  return hits.length === 0 ? ok("bunfig-overwrite", "no CI or Docker step rewrites bunfig.toml") : fail("bunfig-overwrite", `bunfig.toml is overwritten or secret-mounted (its settings are lost): ${hits.join(", ")}`);
+}
+function checkBunPins(root) {
+  const ci = [...workflowFiles(root), ...actionFiles(root)];
+  const literal = linesMatching(ci, /^\s*bun-version:\s*\S/);
+  const docker = [];
+  for (const f of dockerFiles(root)) {
+    f.text.split(`
+`).forEach((line, i) => {
+      const m = /oven\/bun:([0-9][^\s@-]*)/.exec(line);
+      if (m !== null && !/^\s*#/.test(line) && m[1] !== SUPPORTED_BUN)
+        docker.push(`${f.path}:${i + 1} (${m[1] ?? ""})`);
+    });
+  }
+  if (ci.length === 0 && dockerFiles(root).length === 0)
+    return skip("bun-pins", "no workflows or Dockerfiles");
+  const problems = [];
+  if (literal.length > 0)
+    problems.push(`literal bun-version (use bun-version-file: .bun-version): ${literal.join(", ")}`);
+  if (docker.length > 0)
+    problems.push(`Docker base is not oven/bun:${SUPPORTED_BUN}: ${docker.join(", ")}`);
+  return problems.length === 0 ? ok("bun-pins", "Bun version comes from .bun-version") : fail("bun-pins", problems.join("; "));
+}
+function checkSetupBunSha(root) {
+  const ci = [...workflowFiles(root), ...actionFiles(root)];
+  const uses = linesMatching(ci, /uses:\s*["']?oven-sh\/setup-bun@/);
+  if (uses.length === 0)
+    return skip("setup-bun-sha", "setup-bun is not used");
+  const unpinned = linesMatching(ci, /uses:\s*["']?oven-sh\/setup-bun@(?![0-9a-f]{40}\b)/);
+  return unpinned.length === 0 ? ok("setup-bun-sha", `${uses.length} pinned use(s)`) : fail("setup-bun-sha", `oven-sh/setup-bun must be pinned to a full commit SHA: ${unpinned.join(", ")}`);
+}
+function checkPrGate(root) {
+  const wfs = workflowFiles(root);
+  if (wfs.length === 0)
+    return skip("pr-gate", "no workflows");
+  const gate = wfs.find((f) => /^\s*pull_request(?:_target)?\s*:?/m.test(f.text) && /^\s+name:\s*["']?PR Gate["']?\s*$/m.test(f.text));
+  return gate === undefined ? fail("pr-gate", 'no pull_request workflow has a job named exactly "PR Gate" (the required check)') : ok("pr-gate", gate.path);
+}
+function checkBunfigUnchanged(root) {
+  if (!existsSync8(join11(root, "bunfig.toml")))
+    return skip("bunfig-unchanged", "no bunfig.toml");
+  if (!isGitRepo(root))
+    return skip("bunfig-unchanged", "not a git work tree");
+  return differsFromHead(root, "bunfig.toml") ? fail("bunfig-unchanged", "bunfig.toml differs from HEAD (or is uncommitted); CI must use the committed file") : ok("bunfig-unchanged", "matches HEAD");
+}
+function runDoctorChecks(root) {
+  return [
+    checkBunVersion(root),
+    checkPackageManager(root),
+    checkNoBaseUrl(root),
+    checkManagedBlocks(root),
+    checkNoBunfigOverwrite(root),
+    checkBunPins(root),
+    checkSetupBunSha(root),
+    checkPrGate(root),
+    checkBunfigUnchanged(root)
+  ];
+}
+function doctorCommand(root, argv, w = consoleWriter) {
+  const args = parseArgs(argv);
+  if (flagBool(args, "help")) {
+    w.out(`usage: boff doctor [--ci]
+
+  --ci  exit 1 when any check fails (otherwise failures are warnings)`);
+    return 0;
+  }
+  const ci = flagBool(args, "ci");
+  const results = runDoctorChecks(root);
+  const label = (s) => s === "fail" ? ci ? "FAIL" : "warn" : s;
+  for (const line of renderTable(["check", "status", "detail"], results.map((r) => [r.id, label(r.status), r.detail]))) {
+    w.out(line);
+  }
+  const failed = results.filter((r) => r.status === "fail");
+  if (isGithubActions() && ci) {
+    for (const r of failed)
+      w.err(`::error title=boff doctor (${r.id})::${r.detail}`);
+  }
+  if (failed.length > 0) {
+    w.err(`boff doctor: ${failed.length} check(s) ${ci ? "failed" : "need attention"}`);
+    return ci ? 1 : 0;
+  }
+  return 0;
+}
+
+// src/gate.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync2, accessSync, constants as fsConstants } from "fs";
+import { availableParallelism, homedir } from "os";
+import { join as join12 } from "path";
+
+// src/lib/lock.ts
+import { closeSync, existsSync as existsSync9, mkdirSync, openSync, readFileSync as readFileSync11, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+var LOCK_EX = 2;
+var LOCK_NB = 4;
+var LOCK_UN = 8;
+var cachedFlock;
+function libcCandidates() {
+  if (process.platform === "darwin")
+    return ["libc.dylib", "/usr/lib/libSystem.B.dylib"];
+  return ["libc.so.6", `libc.musl-${process.arch === "arm64" ? "aarch64" : "x86_64"}.so.1`, "libc.so"];
+}
+async function loadFlock() {
+  if (cachedFlock !== undefined)
+    return cachedFlock;
+  if (process.env.BOFF_LOCK_IMPL === "mkdir") {
+    cachedFlock = null;
+    return null;
+  }
+  try {
+    const ffi = await import("bun:ffi");
+    for (const name of libcCandidates()) {
+      try {
+        const lib = ffi.dlopen(name, { flock: { args: [ffi.FFIType.i32, ffi.FFIType.i32], returns: ffi.FFIType.i32 } });
+        const fn = lib.symbols.flock;
+        cachedFlock = (fd, op) => fn(fd, op);
+        return cachedFlock;
+      } catch {}
+    }
+  } catch {}
+  cachedFlock = null;
+  return null;
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error instanceof Error && "code" in error && error.code === "EPERM";
+  }
+}
+function tryMkdirLock(path) {
+  const dir = `${path}.d`;
+  const owner = `${dir}/pid`;
+  for (let attempt = 0;attempt < 2; attempt++) {
+    try {
+      mkdirSync(dir);
+      writeFileSync3(owner, String(process.pid));
+      return {
+        path,
+        release: () => {
+          rmSync3(dir, { recursive: true, force: true });
+        }
+      };
+    } catch {
+      let pid = Number.NaN;
+      try {
+        pid = Number(readFileSync11(owner, "utf8").trim());
+      } catch {
+        return null;
+      }
+      if (Number.isInteger(pid) && pid > 0 && pidAlive(pid))
+        return null;
+      rmSync3(dir, { recursive: true, force: true });
+    }
+  }
+  return null;
+}
+async function tryLock(path) {
+  const flock = await loadFlock();
+  if (flock === null)
+    return tryMkdirLock(path);
+  let fd;
+  try {
+    fd = existsSync9(path) ? openSync(path, "r") : openSync(path, "a");
+  } catch {
+    return null;
+  }
+  if (flock(fd, LOCK_EX | LOCK_NB) !== 0) {
+    closeSync(fd);
+    return null;
+  }
+  let released = false;
+  return {
+    path,
+    release: () => {
+      if (released)
+        return;
+      released = true;
+      flock(fd, LOCK_UN);
+      closeSync(fd);
+    }
+  };
+}
+
+// src/gate.ts
+var GATE_TIMEOUT_EXIT = 75;
+var DEFAULT_WAIT_SECONDS = 900;
+function clamp(n, lo, hi) {
+  return Math.min(hi, Math.max(lo, n));
+}
+function positiveInt(value) {
+  if (value === undefined || value.trim() === "")
+    return;
+  const n = Number(value);
+  return Number.isInteger(n) && n > 0 ? n : undefined;
+}
+function cpuCount() {
+  return availableParallelism();
+}
+function slotCount(env, cores) {
+  return positiveInt(env.BOFF_BUILD_SLOTS) ?? clamp(Math.floor(cores / 8), 1, 4);
+}
+function threadCount(env, cores) {
+  return positiveInt(env.BOFF_BUILD_THREADS) ?? clamp(Math.floor(cores / 4), 2, 8);
+}
+function waitSeconds(env) {
+  const raw = env.BOFF_BUILD_WAIT;
+  if (raw === undefined || raw.trim() === "")
+    return DEFAULT_WAIT_SECONDS;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_WAIT_SECONDS;
+}
+function isSlotHeld(env) {
+  return env.BOFF_BUILD_SLOT_HELD === "1" || env.BUILDSLOT_HELD === "1";
+}
+function writableDir(path) {
+  try {
+    accessSync(path, fsConstants.W_OK | fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function lockRoot(env, uid = process.getuid?.() ?? 0, runUserBase = "/run/user") {
+  const override = env.BOFF_BUILD_SLOT_DIR;
+  if (override !== undefined && override !== "")
+    return override;
+  const runDir = join12(runUserBase, String(uid));
+  if (existsSync10(runDir) && writableDir(runDir))
+    return join12(runDir, "boff-build-slots");
+  const home = env.HOME !== undefined && env.HOME !== "" ? env.HOME : homedir();
+  return join12(home, ".cache", "boff", "build-slots");
+}
+function gateEnv(env, threads, held) {
+  const out = {
+    BOFF_BUILD_THREADS: String(threads),
+    RAYON_NUM_THREADS: env.RAYON_NUM_THREADS ?? String(threads),
+    ROLLDOWN_WORKER_THREADS: env.ROLLDOWN_WORKER_THREADS ?? String(threads),
+    ROLLDOWN_MAX_BLOCKING_THREADS: env.ROLLDOWN_MAX_BLOCKING_THREADS ?? String(threads)
+  };
+  if (held) {
+    out.BOFF_BUILD_SLOT_HELD = "1";
+    out.BUILDSLOT_HELD = "1";
+  }
+  return out;
+}
+function hasFlag(argv, flag) {
+  return argv.some((a) => a === flag || a.startsWith(`${flag}=`));
+}
+function isVitest(argv) {
+  const bin = (a) => a !== undefined && /(^|\/)vitest$/.test(a);
+  if (bin(argv[0]))
+    return true;
+  if ((argv[0] === "bunx" || argv[0] === "npx") && bin(argv[1]))
+    return true;
+  return argv[0] === "bun" && argv[1] === "x" && bin(argv[2]);
+}
+function injectThreadFlags(argv, threads) {
+  const out = [...argv];
+  const isBun = out[0] === "bun" || /(^|\/)bun$/.test(out[0] ?? "");
+  if (isBun && (out[1] === "check" || out[1] === "fmt") && !hasFlag(out, "--threads")) {
+    out.splice(2, 0, `--threads=${threads}`);
+    return out;
+  }
+  if (isBun && out[1] === "test") {
+    const i = out.indexOf("--parallel");
+    if (i >= 0)
+      out[i] = `--parallel=${threads}`;
+    return out;
+  }
+  if (isVitest(out) && !hasFlag(out, "--maxWorkers")) {
+    out.push(`--maxWorkers=${threads}`);
+  }
+  return out;
+}
+var cachedPrefix;
+function throttlePrefix() {
+  if (cachedPrefix !== undefined)
+    return cachedPrefix;
+  const prefix = [];
+  if (capture(["nice", "-n", "10", "true"]).code === 0)
+    prefix.push("nice", "-n", "10");
+  if (capture(["ionice", "-c3", "-t", "true"]).code === 0)
+    prefix.push("ionice", "-c3", "-t");
+  else if (capture(["ionice", "-c3", "true"]).code === 0)
+    prefix.push("ionice", "-c3");
+  cachedPrefix = prefix;
+  return prefix;
+}
+async function acquireSlot(opts = {}) {
+  const env = opts.env ?? process.env;
+  const writer = opts.writer ?? consoleWriter;
+  if (isSlotHeld(env))
+    return { kind: "reentrant" };
+  if (isCi(env) && env.BOFF_GATE_IN_CI !== "1")
+    return { kind: "ci" };
+  const cores = opts.cores ?? cpuCount();
+  const slots = slotCount(env, cores);
+  const root = lockRoot(env);
+  try {
+    mkdirSync2(root, { recursive: true });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    writer.err(`boff gate: cannot create the lock root ${root} (${reason}); running ungated`);
+    return { kind: "ungated", waitedMs: 0 };
+  }
+  const strict = opts.strict === true || env.BOFF_GATE_STRICT === "1";
+  const deadline = Date.now() + waitSeconds(env) * 1000;
+  const started = Date.now();
+  const pollMs = opts.pollMs ?? 500;
+  let announced = false;
+  for (;; ) {
+    for (let i = 1;i <= slots; i++) {
+      const lock = await tryLock(join12(root, `slot.${i}`));
+      if (lock !== null)
+        return { kind: "held", lock, waitedMs: Date.now() - started, slot: i };
+    }
+    if (Date.now() >= deadline) {
+      const waitedMs = Date.now() - started;
+      if (strict) {
+        writer.err(`boff gate: no build slot freed within ${waitSeconds(env)}s (${slots} slots in ${root}); failing (strict mode)`);
+        return { kind: "timeout", waitedMs };
+      }
+      writer.err(`boff gate: waited ${waitSeconds(env)}s for one of ${slots} build slots; running ungated`);
+      return { kind: "ungated", waitedMs };
+    }
+    if (!announced) {
+      writer.err(`boff gate: all ${slots} build slots busy (${root}); waiting...`);
+      announced = true;
+    }
+    await Bun.sleep(pollMs + Math.floor(Math.random() * pollMs));
+  }
+}
+async function runGated(argv, opts = {}) {
+  if (argv.length === 0) {
+    (opts.writer ?? consoleWriter).err("usage: boff gate [--pre-push] -- <command> [args...]");
+    return 2;
+  }
+  const env = opts.env ?? process.env;
+  const cores = opts.cores ?? cpuCount();
+  const threads = threadCount(env, cores);
+  const slot = await acquireSlot({ ...opts, env, cores });
+  if (slot.kind === "timeout")
+    return GATE_TIMEOUT_EXIT;
+  const holds = slot.kind === "held" || slot.kind === "reentrant";
+  const cmd = injectThreadFlags(argv, threads);
+  const full = slot.kind === "held" || slot.kind === "ungated" ? [...throttlePrefix(), ...cmd] : cmd;
+  const childEnv = { ...env, ...gateEnv(env, threads, holds) };
+  try {
+    const proc = Bun.spawn(full, {
+      cwd: opts.cwd,
+      env: childEnv,
+      stdin: "inherit",
+      stdout: "inherit",
+      stderr: "inherit"
+    });
+    const forward = (sig) => {
+      proc.kill(sig);
+    };
+    process.on("SIGINT", forward);
+    process.on("SIGTERM", forward);
+    try {
+      return await proc.exited;
+    } finally {
+      process.off("SIGINT", forward);
+      process.off("SIGTERM", forward);
+    }
+  } catch (error) {
+    (opts.writer ?? consoleWriter).err(`boff gate: cannot run ${cmd[0] ?? ""}: ${error instanceof Error ? error.message : String(error)}`);
+    return 127;
+  } finally {
+    if (slot.kind === "held")
+      slot.lock.release();
+  }
+}
+
+// src/sanity.ts
+import {
+  closeSync as closeSync2,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync3,
+  openSync as openSync2,
+  readFileSync as readFileSync12,
+  readdirSync,
+  renameSync,
+  rmSync as rmSync4,
+  statSync,
+  writeFileSync as writeFileSync4,
+  writeSync
+} from "fs";
+import { join as join13 } from "path";
+var STEP_NAMES = [
+  "format",
+  "codegen",
+  "gendb",
+  "migrate",
+  "lint",
+  "typecheck",
+  "build",
+  "test",
+  "knip",
+  "audit"
+];
+function isStepName(v) {
+  return STEP_NAMES.includes(v);
+}
+var FRONTEND = ["mfe", "fe-libs", "app", "website"];
+var BUILD_REFERENCES2 = ["mfe", "fe-libs", "website"];
+var COVERAGE_GATED = ["svc", "gateway", "be-sdk"];
+var DEFAULT_STEPS = {
+  svc: ["format", "codegen", "gendb", "migrate", "lint", "typecheck", "build", "test", "knip"],
+  gateway: ["format", "lint", "typecheck", "build", "test"],
+  "be-sdk": ["format", "lint", "typecheck", "build", "test"],
+  mfe: ["format", "codegen", "lint", "typecheck", "build", "test"],
+  "fe-libs": ["format", "lint", "typecheck", "build", "test"],
+  app: ["format", "codegen", "lint", "typecheck", "build", "test"],
+  website: ["format", "lint", "typecheck", "build", "test"],
+  docs: ["build"],
+  cli: ["format", "lint", "typecheck", "build", "test"],
+  mcp: ["format", "lint", "typecheck", "build", "test"],
+  "sdk-node": ["format", "lint", "typecheck", "build", "test"],
+  "browser-ext": ["format", "lint", "typecheck", "build", "test"],
+  "vscode-ext": ["format", "lint", "typecheck", "build", "test"],
+  plugin: ["format", "lint", "typecheck", "build", "test"],
+  doctor: ["format", "lint", "typecheck", "test"],
+  lib: ["format", "lint", "typecheck", "build", "test"]
+};
+var CODE = ["**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}"];
+var FORMATTABLE = "**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc,json5,md,mdx,yml,yaml,css,scss,less,html,vue,svelte,graphql,gql,toml}";
+var FORMAT_CONFIG = [".prettierrc*", "prettier.config.*", ".prettierignore", ".editorconfig", ".gitignore"];
+var TYPECHECK_INPUTS = [...CODE, "src/**", "**/tsconfig*.json", "scripts/typecheck.sh"];
+var STEP_DEPS = {
+  format: [],
+  codegen: [],
+  gendb: [],
+  migrate: [],
+  lint: ["codegen", "gendb"],
+  typecheck: ["codegen", "gendb"],
+  build: ["typecheck"],
+  test: ["codegen", "gendb"],
+  knip: [],
+  audit: []
+};
+var GENERATORS = ["codegen", "gendb"];
+var MIGRATE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+var STAMPS_KEPT_PER_STEP = 10;
+function cliEntry() {
+  const src = join13(PACKAGE_ROOT, "src", "cli.ts");
+  return existsSync11(src) ? src : join13(PACKAGE_ROOT, "dist", "cli.js");
+}
+function binPath(root, name) {
+  const p = join13(root, "node_modules", ".bin", name);
+  return existsSync11(p) ? p : null;
+}
+function anyFile(root, names) {
+  return names.some((n) => existsSync11(join13(root, n)));
+}
+function readEnvValue(root, env, key) {
+  const direct = env[key];
+  if (direct !== undefined && direct !== "")
+    return direct;
+  for (const file of [".env.local", ".env"]) {
+    const path = join13(root, file);
+    if (!existsSync11(path))
+      continue;
+    for (const line of readFileSync12(path, "utf8").split(`
+`)) {
+      const m = new RegExp(`^\\s*(?:export\\s+)?${key}\\s*=\\s*(.*)$`).exec(line);
+      if (m?.[1] !== undefined)
+        return m[1].trim().replace(/^(['"])(.*)\1$/, "$2");
+    }
+  }
+  return;
+}
+function databaseIdentity(root, env) {
+  const url = readEnvValue(root, env, "DATABASE_URL");
+  if (url === undefined)
+    return;
+  try {
+    const u = new URL(url);
+    return sha256(`${u.hostname}:${u.port}${u.pathname}`);
+  } catch {
+    return sha256("unparsable-database-url", url);
+  }
+}
+function formatGlobs(paths) {
+  return paths.flatMap((p) => /[*?[{]/.test(p) ? [p] : [p, `${p}/**`]);
+}
+function bunTestArgs(script) {
+  if (script === undefined)
+    return [];
+  const m = /^bun test(?:\s+(.*))?$/.exec(script.trim());
+  if (m === null)
+    return null;
+  const rest = m[1] ?? "";
+  if (/[|&;<>$`()]/.test(rest))
+    return null;
+  return rest === "" ? [] : rest.split(/\s+/);
+}
+function specFor(step, ctx, files, env) {
+  const { root, type } = ctx;
+  const override = `sanity:${step}`;
+  const scriptCmd = (name) => [["bun", "run", name]];
+  const withOverride = (spec) => hasScript(ctx, override) ? { ...spec, commands: scriptCmd(override) } : spec;
+  switch (step) {
+    case "format": {
+      const paths = ctx.config.sanity?.formatPaths;
+      const inputs = paths === undefined ? [FORMATTABLE, ...FORMAT_CONFIG] : [...formatGlobs(paths), ...FORMAT_CONFIG];
+      if (matchGlobs(files, inputs.slice(0, paths === undefined ? 1 : formatGlobs(paths).length)).length === 0) {
+        return "no files to format";
+      }
+      const cmd = ["bun", "fmt", "--check", "--no-script"];
+      if (paths !== undefined)
+        cmd.push("--no-error-on-unmatched-pattern", ...paths);
+      return withOverride({ inputs, commands: [cmd], keyParts: [] });
+    }
+    case "codegen": {
+      if (!hasScript(ctx, "codegen"))
+        return "no codegen script";
+      const inputs = ["**/*.{gql,graphql}", "codegen.*", ".graphqlrc*", "scripts/*codegen*", "graphql/**"];
+      if (FRONTEND.includes(type))
+        inputs.push("src/**/*.{ts,tsx}");
+      const committed = ctx.config.sanity?.codegenCommitted ?? (type === "svc" ? [".hive-schema.graphql"] : []);
+      const drift = committed.filter((f) => files.includes(f)).map((f) => ["git", "diff", "--exit-code", "--", f]);
+      return withOverride({ inputs, commands: [...scriptCmd("codegen"), ...drift], keyParts: committed });
+    }
+    case "gendb":
+      if (!hasScript(ctx, "gendb"))
+        return "no gendb script";
+      return withOverride({
+        inputs: ["prisma/**/*.prisma", "prisma.config.*", "prisma/schema/**"],
+        commands: scriptCmd("gendb"),
+        keyParts: []
+      });
+    case "migrate": {
+      if (!hasScript(ctx, "migrate:deploy"))
+        return "no migrate:deploy script";
+      const db = databaseIdentity(root, env);
+      if (db === undefined)
+        return "no DATABASE_URL (environment, .env.local or .env)";
+      return withOverride({
+        inputs: ["prisma/migrations/**", "prisma/schema/migrations/**"],
+        commands: scriptCmd("migrate:deploy"),
+        keyParts: [db],
+        maxAgeMs: MIGRATE_MAX_AGE_MS
+      });
+    }
+    case "lint": {
+      const inputs = [...CODE, "eslint.config.*", ".eslintignore", "**/tsconfig*.json"];
+      const cache = ["--cache", "--cache-location", "node_modules/.cache/eslint/"];
+      if (hasScript(ctx, override))
+        return withOverride({ inputs, commands: [], keyParts: [] });
+      if (hasScript(ctx, "lint"))
+        return { inputs, commands: [["bun", "run", "lint", ...cache]], keyParts: [] };
+      if (!anyFile(root, ["eslint.config.js", "eslint.config.mjs", "eslint.config.cjs", "eslint.config.ts"])) {
+        return "no eslint config";
+      }
+      const eslint = binPath(root, "eslint");
+      if (eslint === null)
+        return "eslint is not installed";
+      return { inputs, commands: [[eslint, ".", ...cache]], keyParts: [] };
+    }
+    case "typecheck": {
+      if (hasScript(ctx, override))
+        return withOverride({ inputs: TYPECHECK_INPUTS, commands: [], keyParts: [] });
+      if (hasScript(ctx, "type:check")) {
+        return { inputs: TYPECHECK_INPUTS, commands: scriptCmd("type:check"), keyParts: [] };
+      }
+      if (!existsSync11(join13(root, "tsconfig.json")))
+        return "no tsconfig.json";
+      const cmd = ["bun", "check", "--no-pretty", "--no-script"];
+      if (BUILD_REFERENCES2.includes(type))
+        cmd.push("-b");
+      return { inputs: TYPECHECK_INPUTS, commands: [cmd], keyParts: [] };
+    }
+    case "build": {
+      const script = type === "svc" && hasScript(ctx, "build:bundle") ? "build:bundle" : "build";
+      if (!hasScript(ctx, override) && !hasScript(ctx, script))
+        return "no build script";
+      return withOverride({
+        inputs: [
+          ...TYPECHECK_INPUTS,
+          "*.config.*",
+          "vite.config.*",
+          "index.html",
+          "public/**",
+          "scripts/**",
+          "build.ts",
+          "prisma/**",
+          "manifest.json"
+        ],
+        commands: scriptCmd(script),
+        keyParts: []
+      });
+    }
+    case "test": {
+      const inputs = [
+        ...CODE,
+        "src/**",
+        "tests/**",
+        "test/**",
+        "**/__tests__/**",
+        "**/__snapshots__/**",
+        "bunfig*.toml",
+        "vitest.config.*",
+        "fixtures/**"
+      ];
+      const envFile = existsSync11(join13(root, ".env.local")) ? join13(root, ".env.local") : null;
+      const keyParts = envFile === null ? [] : [sha256(readFileSync12(envFile, "utf8"))];
+      if (hasScript(ctx, override))
+        return withOverride({ inputs, commands: [], keyParts });
+      const script = ctx.pkg?.scripts?.test;
+      const args = bunTestArgs(script);
+      if (args === null)
+        return { inputs, commands: scriptCmd("test"), keyParts };
+      const hasTests = matchGlobs(files, ["**/*.{test,spec}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}"]).length > 0;
+      if (!hasTests)
+        return "no test files";
+      const cmd = [
+        "bun",
+        ...envFile === null ? [] : ["--env-file=.env.local"],
+        "test",
+        "--coverage",
+        "--coverage-reporter=text",
+        "--coverage-reporter=lcov",
+        "--reporter=junit",
+        "--reporter-outfile=junit.xml",
+        ...args
+      ];
+      const commands = [cmd];
+      if (ctx.config.coverage?.global !== undefined || COVERAGE_GATED.includes(type)) {
+        commands.push([process.execPath, cliEntry(), "coverage-gate"]);
+      }
+      return { inputs, commands, keyParts };
+    }
+    case "knip": {
+      const inputs = [...CODE, "knip.*", ".knip.*", "**/tsconfig*.json"];
+      if (hasScript(ctx, override))
+        return withOverride({ inputs, commands: [], keyParts: [] });
+      if (hasScript(ctx, "knip"))
+        return { inputs, commands: scriptCmd("knip"), keyParts: [] };
+      if (!anyFile(root, ["knip.json", "knip.jsonc", ".knip.json", "knip.config.ts", "knip.config.js", "knip.ts"])) {
+        return "no knip config";
+      }
+      const knip = binPath(root, "knip");
+      if (knip === null)
+        return "knip is not installed";
+      return { inputs, commands: [[knip, "--cache"]], keyParts: [] };
+    }
+    case "audit":
+      if (!existsSync11(join13(root, "bun.lock")))
+        return "no bun.lock";
+      return withOverride({
+        inputs: [],
+        commands: [["bun", "audit", "--audit-level=high"]],
+        keyParts: [new Date().toISOString().slice(0, 10)]
+      });
+  }
+}
+function planSanity(root, opts = {}) {
+  const env = opts.env ?? process.env;
+  const ctx = loadRepo(root);
+  const files = repoFiles(root);
+  const hasher = new FileHasher(root);
+  const explicit = ctx.config.sanity?.steps;
+  if (explicit !== undefined) {
+    for (const s of explicit) {
+      if (!isStepName(s))
+        throw new Error(`package.json boff.sanity.steps: unknown step "${s}" (known: ${STEP_NAMES.join(", ")})`);
+    }
+  }
+  const wanted = (explicit ?? DEFAULT_STEPS[ctx.type]).filter(isStepName);
+  const base = sha256("boff-sanity/1", TOOLCHAIN_VERSION, Bun.version, isCi(env) ? "ci" : "local", ctx.type, hasher.combined(["package.json", "bun.lock", "bunfig.toml", ".bun-version"]));
+  const steps = [];
+  const skipped = [];
+  const keys = new Map;
+  for (const name of STEP_NAMES) {
+    if (!wanted.includes(name))
+      continue;
+    const spec = specFor(name, ctx, files, env);
+    if (typeof spec === "string") {
+      if (explicit !== undefined && name !== "migrate") {
+        throw new Error(`package.json boff.sanity.steps lists "${name}" but it cannot run here: ${spec}`);
+      }
+      skipped.push({ name, reason: spec });
+      continue;
+    }
+    const deps = STEP_DEPS[name].filter((d) => keys.has(d));
+    const key = sha256(base, name, JSON.stringify(spec.commands), hasher.combined(matchGlobs(files, spec.inputs)), ...deps.map((d) => keys.get(d) ?? ""), ...spec.keyParts).slice(0, 32);
+    keys.set(name, key);
+    steps.push({
+      name,
+      outputKey: name,
+      inputs: spec.inputs,
+      deps,
+      generator: GENERATORS.includes(name),
+      commands: spec.commands,
+      keyParts: spec.keyParts,
+      maxAgeMs: spec.maxAgeMs,
+      key
+    });
+  }
+  const allBuiltinKeys = [...keys.values()];
+  for (const script of ctx.config.sanity?.extra ?? []) {
+    if (!hasScript(ctx, script))
+      throw new Error(`package.json boff.sanity.extra lists "${script}" but there is no such script`);
+    const name = `extra:${script}`;
+    const commands = [["bun", "run", script]];
+    const key = sha256(base, name, JSON.stringify(commands), hasher.combined(files), ...allBuiltinKeys).slice(0, 32);
+    steps.push({
+      name,
+      outputKey: `extra_${script.replace(/[^A-Za-z0-9_]/g, "_")}`,
+      inputs: ["**"],
+      deps: [],
+      generator: false,
+      commands,
+      keyParts: [],
+      key
+    });
+  }
+  return { ctx, steps, skipped, stampDir: join13(root, "node_modules", ".cache", "sanity") };
+}
+function stampFile(plan, step) {
+  return join13(plan.stampDir, `${step.name.replace(/[^A-Za-z0-9_.-]/g, "_")}.${step.key}`);
+}
+function isStampFresh(plan, step, now = Date.now()) {
+  const path = stampFile(plan, step);
+  if (!existsSync11(path))
+    return false;
+  if (step.maxAgeMs === undefined)
+    return true;
+  return now - statSync(path).mtimeMs <= step.maxAgeMs;
+}
+function writeStamp(plan, step) {
+  mkdirSync3(plan.stampDir, { recursive: true });
+  const final = stampFile(plan, step);
+  const tmp = `${final}.tmp-${process.pid}`;
+  writeFileSync4(tmp, "");
+  renameSync(tmp, final);
+  const prefix = `${step.name.replace(/[^A-Za-z0-9_.-]/g, "_")}.`;
+  const mine = readdirSync(plan.stampDir).filter((f) => f.startsWith(prefix) && !f.includes(".tmp-")).map((f) => ({ f, t: statSync(join13(plan.stampDir, f)).mtimeMs })).sort((a, b) => b.t - a.t);
+  for (const old of mine.slice(STAMPS_KEPT_PER_STEP))
+    rmSync4(join13(plan.stampDir, old.f), { force: true });
+}
+function removePartialState(plan) {
+  if (!existsSync11(plan.stampDir))
+    return;
+  for (const f of readdirSync(plan.stampDir)) {
+    if (f.includes(".tmp-"))
+      rmSync4(join13(plan.stampDir, f), { force: true });
+  }
+}
+function appendTiming(plan, entry) {
+  mkdirSync3(plan.stampDir, { recursive: true });
+  writeFileSync4(join13(plan.stampDir, "timings.jsonl"), `${JSON.stringify({ ...entry, ts: new Date().toISOString() })}
+`, {
+    flag: "a"
+  });
+}
+function printKeys(plan) {
+  const lines = plan.steps.map((s) => `${s.outputKey}=${s.key}`);
+  lines.push(`all=${sha256(...plan.steps.map((s) => `${s.name}:${s.key}`)).slice(0, 32)}`);
+  return lines;
+}
+async function pump(stream, sink, logFd) {
+  for await (const chunk of stream) {
+    sink.write(chunk);
+    writeSync(logFd, chunk);
+  }
+}
+async function runCommand(prefix, cmd, cwd, env, logFd, state) {
+  writeSync(logFd, `$ ${cmd.join(" ")}
+`);
+  let child;
+  try {
+    child = Bun.spawn([...prefix, ...cmd], { cwd, env, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  } catch (error) {
+    const msg = `boff sanity: cannot run ${cmd[0] ?? ""}: ${error instanceof Error ? error.message : String(error)}
+`;
+    process.stderr.write(msg);
+    writeSync(logFd, msg);
+    return 127;
+  }
+  state.child = child;
+  await Promise.all([pump(child.stdout, process.stdout, logFd), pump(child.stderr, process.stderr, logFd)]);
+  const rc = await child.exited;
+  state.child = null;
+  return rc;
+}
+var HELP4 = `usage: boff sanity [--force] [--only step,...] [--print-keys] [--pre-push]
+
+  --force        ignore stamps and run every step (also SANITY_FORCE=1)
+  --only a,b     run only these steps (generators they need still run)
+  --print-keys   print step=key lines and all=<key> for $GITHUB_OUTPUT, run nothing
+  --pre-push     fail instead of running ungated when no build slot frees in time
+  --print-keys / print-keys are identical
+
+Steps: ${STEP_NAMES.join(", ")} (+ boff.sanity.extra scripts)`;
+async function runSanity(opts) {
+  const env = opts.env ?? process.env;
+  const w = opts.writer ?? consoleWriter;
+  const args = parseArgs(opts.argv ?? [], ["only"]);
+  if (flagBool(args, "help")) {
+    w.out(HELP4);
+    return 0;
+  }
+  let plan;
+  try {
+    plan = planSanity(opts.root, { env });
+  } catch (error) {
+    w.err(`boff sanity: ${error instanceof Error ? error.message : String(error)}`);
+    return 2;
+  }
+  if (flagBool(args, "print-keys")) {
+    for (const line of printKeys(plan))
+      w.out(line);
+    return 0;
+  }
+  const only = flagString(args, "only")?.split(",").map((s) => s.trim()).filter((s) => s !== "");
+  if (only !== undefined) {
+    const unknown = only.filter((s) => !plan.steps.some((p) => p.name === s));
+    if (unknown.length > 0) {
+      w.err(`boff sanity: --only names steps that are not planned here: ${unknown.join(", ")}`);
+      return 2;
+    }
+  }
+  const selected = plan.steps.filter((s) => only === undefined || only.includes(s.name));
+  const force = flagBool(args, "force") || env.SANITY_FORCE === "1";
+  const missed = new Set(selected.filter((s) => force || !isStampFresh(plan, s)).map((s) => s.name));
+  for (const s of plan.skipped)
+    w.out(`sanity: ${s.name} skipped (${s.reason})`);
+  if (missed.size === 0) {
+    w.out(`sanity: all ${selected.length} steps cached (${selected.map((s) => s.name).join(", ")})`);
+    return 0;
+  }
+  const toRun = new Set(missed);
+  for (const s of plan.steps) {
+    if (!missed.has(s.name))
+      continue;
+    for (const d of s.deps) {
+      const dep = plan.steps.find((p) => p.name === d);
+      if (dep?.generator === true)
+        toRun.add(d);
+    }
+  }
+  const strict = flagBool(args, "pre-push") || env.BOFF_GATE_STRICT === "1";
+  const slot = await acquireSlot({ env, strict, writer: w });
+  if (slot.kind === "timeout")
+    return GATE_TIMEOUT_EXIT;
+  const cores = cpuCount();
+  const threads = threadCount(env, cores);
+  const prefix = slot.kind === "held" || slot.kind === "ungated" ? throttlePrefix() : [];
+  const childEnv = { ...env, ...gateEnv(env, threads, true) };
+  const logPath = join13(opts.root, "sanity.log");
+  const logFd = openSync2(logPath, "w");
+  const state = { child: null, aborted: null };
+  const onSignal = (sig) => {
+    state.aborted = sig;
+    state.child?.kill(sig);
+  };
+  if (opts.handleSignals === true) {
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+  }
+  const rows = [];
+  let exitCode = 0;
+  try {
+    for (const step of plan.steps) {
+      if (!toRun.has(step.name)) {
+        if (selected.includes(step))
+          rows.push([step.name, "cached", "-"]);
+        continue;
+      }
+      w.out(`sanity: ${step.name} (${step.key.slice(0, 12)})`);
+      const started = performance.now();
+      let rc = 0;
+      for (const cmd of step.commands) {
+        rc = await runCommand(prefix, injectThreadFlags(cmd, threads), opts.root, childEnv, logFd, state);
+        if (rc !== 0 || state.aborted !== null)
+          break;
+      }
+      const ms = Math.round(performance.now() - started);
+      appendTiming(plan, { step: step.name, key: step.key, ms, rc });
+      if (state.aborted !== null) {
+        exitCode = state.aborted === "SIGINT" ? 130 : 143;
+        rows.push([step.name, `interrupted (${state.aborted})`, `${ms}ms`]);
+        break;
+      }
+      if (rc !== 0) {
+        exitCode = rc;
+        rows.push([step.name, `FAILED (exit ${rc})`, `${ms}ms`]);
+        break;
+      }
+      writeStamp(plan, step);
+      rows.push([step.name, "passed", `${ms}ms`]);
+    }
+  } finally {
+    closeSync2(logFd);
+    removePartialState(plan);
+    if (slot.kind === "held")
+      slot.lock.release();
+    if (opts.handleSignals === true) {
+      process.off("SIGINT", onSignal);
+      process.off("SIGTERM", onSignal);
+    }
+  }
+  for (const line of renderTable(["step", "result", "time"], rows))
+    w.out(line);
+  if (exitCode !== 0)
+    w.err(`boff sanity: failed; full output in sanity.log`);
+  return exitCode;
+}
+
+// src/workflow-policy.ts
+import { existsSync as existsSync12, statSync as statSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+function logicalLines(text) {
+  const out = [];
+  let buf = "";
+  let start = 0;
+  text.split(`
+`).forEach((raw, i) => {
+    if (/^[ \t]*#/.test(raw) && buf === "")
+      return;
+    let line = raw;
+    if (buf === "")
+      start = i + 1;
+    if (/\\[ \t\r]*$/.test(line)) {
+      line = line.replace(/\\[ \t\r]*$/, " ");
+      buf += line;
+      return;
+    }
+    out.push({ line: start, text: buf + line });
+    buf = "";
+  });
+  if (buf !== "")
+    out.push({ line: start, text: buf });
+  return out;
+}
+var CMD_START = "(^|[^A-Za-z0-9_.-])";
+var USES_RE = /^\s*(-\s+)?uses:\s*(.*)$/;
+var SHA_REF_RE = /^[^@\s]+@[0-9a-f]{40}$/;
+var DOCKER_DIGEST_RE = /^docker:\/\/[^@\s]+@sha256:[0-9a-f]{64}$/;
+var LATEST_RE = /@latest([^A-Za-z0-9_.-]|$)/;
+var REMOTE_PIPE_RE = /(curl|wget)[^|]*\|\s*(sudo\s+(-\S+\s+)*)?(env\s+)?([A-Za-z0-9_./-]*\/)?((ba|z|da|k)?sh|python[0-9.]*|node|perl|ruby|bun|deno)(\s|$|;|\))/;
+var REMOTE_SUBST_RE = new RegExp(`${CMD_START}(source|\\.|eval|(ba|z|da|k)?sh(\\s+-[A-Za-z]+)*)\\s+["']?(<\\(|\\$\\()\\s*(curl|wget)`);
+var EXEC_RE = new RegExp(`${CMD_START}(npx|bunx|npm\\s+exec|pnpm\\s+dlx|yarn\\s+dlx)\\s+`);
+var BUN_INSTALL_RE = new RegExp(`${CMD_START}bun\\s+(install|i)(\\s|$|;|&|\\|)`);
+var NPM_INSTALL_RE = new RegExp(`${CMD_START}npm\\s+(install|i|add)(\\s|$|;|&|\\|)`);
+var PIP_INSTALL_RE = new RegExp(`${CMD_START}pip[0-9.]*\\s+install(\\s|$|;|&|\\|)`);
+var EXACT_VERSION_RE = /^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.+-]+)?$/;
+var UNTRUSTED_RE = /\$\{\{\s*(inputs\.|github\.(event|ref|head_ref))/;
+function commandArgs(re, text) {
+  const out = [];
+  let rest = text;
+  for (;; ) {
+    const m = re.exec(rest);
+    if (m === null)
+      break;
+    const match = m[0];
+    rest = rest.slice(m.index + match.length);
+    if (/[;&|]$/.test(match))
+      out.push("");
+    else
+      out.push(rest.split(/[;&|]/)[0] ?? "");
+  }
+  return out;
+}
+function execSpecs(text) {
+  const specs = [];
+  for (const args of commandArgs(EXEC_RE, text)) {
+    let spec = "";
+    for (const token of args.trim().split(/\s+/).filter((t) => t !== "")) {
+      if (token.startsWith("--package=")) {
+        spec = token.slice("--package=".length);
+        break;
+      }
+      if (token.startsWith("-"))
+        continue;
+      spec = token;
+      break;
+    }
+    spec = spec.replace(/^["']/, "").replace(/["']$/, "");
+    if (spec !== "")
+      specs.push(spec);
+  }
+  return specs;
+}
+function checkRunInterpolation(file, add) {
+  const msg = "pass dispatch and GitHub context values through env, not directly into run";
+  let keyIndent = -1;
+  file.text.split(`
+`).forEach((line, i) => {
+    const text = line.replace(/^\s+/, "");
+    const indent = line.length - text.length;
+    const m = /^(-\s+)?run:\s*(.*)$/.exec(text);
+    if (m !== null) {
+      const value = m[2] ?? "";
+      const block = /^[|>][-+0-9]*\s*(#.*)?$/.test(value);
+      keyIndent = block ? indent + (m[1]?.length ?? 0) : -1;
+      if (!block && UNTRUSTED_RE.test(value))
+        add(i + 1, "unsafe-interpolation", msg);
+      return;
+    }
+    if (keyIndent >= 0 && text !== "" && indent <= keyIndent)
+      keyIndent = -1;
+    if (keyIndent >= 0 && UNTRUSTED_RE.test(line))
+      add(i + 1, "unsafe-interpolation", msg);
+  });
+}
+function checkFile(file) {
+  const violations = [];
+  const add = (line, rule, message) => {
+    violations.push({ file: file.path, line, rule, message });
+  };
+  for (const { line, text } of logicalLines(file.text)) {
+    const uses = USES_RE.exec(text);
+    if (uses !== null) {
+      const ref = (uses[2] ?? "").replace(/\s+#.*$/, "").trim().replace(/^["']/, "").replace(/["']$/, "");
+      if (ref.startsWith("./")) {} else if (ref.startsWith("docker://")) {
+        if (!DOCKER_DIGEST_RE.test(ref))
+          add(line, "pinned-uses", `'${ref}' must be pinned to an image digest (@sha256:...)`);
+      } else if (!SHA_REF_RE.test(ref)) {
+        add(line, "pinned-uses", `'${ref}' must be pinned to a full 40-character commit SHA`);
+      }
+    }
+    if (LATEST_RE.test(text)) {
+      add(line, "floating-latest", "'@latest' resolves to whatever is published at run time; pin an exact version");
+    }
+    if (REMOTE_PIPE_RE.test(text) || REMOTE_SUBST_RE.test(text)) {
+      add(line, "remote-script", "a downloaded script is executed directly; download a pinned release and verify its checksum first");
+    }
+    if (EXEC_RE.test(text)) {
+      for (const spec of execSpecs(text)) {
+        if (!spec.slice(1).includes("@"))
+          continue;
+        const version = spec.slice(spec.lastIndexOf("@") + 1);
+        if (!EXACT_VERSION_RE.test(version)) {
+          add(line, "exact-exec", `'${spec}' does not name an exact version; pin x.y.z or use the lockfile-installed package`);
+        }
+      }
+    }
+    if (BUN_INSTALL_RE.test(text) && !text.includes("--lockfile-only")) {
+      for (const args of commandArgs(BUN_INSTALL_RE, text)) {
+        if (!` ${args} `.includes(" --frozen-lockfile "))
+          add(line, "frozen-install", "'bun install' must run with --frozen-lockfile");
+      }
+    }
+    if (NPM_INSTALL_RE.test(text)) {
+      add(line, "frozen-install", "use 'npm ci' against the committed lockfile instead of 'npm install'");
+    }
+    if (text.includes("--no-package-lock")) {
+      add(line, "frozen-install", "'--no-package-lock' installs unlocked transitive dependencies");
+    }
+    if (PIP_INSTALL_RE.test(text)) {
+      for (const args of commandArgs(PIP_INSTALL_RE, text)) {
+        if (` ${args} `.includes(" --lockfile-only "))
+          continue;
+        if (!` ${args} `.includes(" --require-hashes ")) {
+          add(line, "hashed-pip", "'pip install' must use --require-hashes with a hash-locked requirements file");
+        }
+      }
+    }
+  }
+  checkRunInterpolation(file, add);
+  return violations;
+}
+function checkRepo(root) {
+  const files = [...workflowFiles(root), ...actionFiles(root)];
+  return { files: files.length, violations: files.flatMap(checkFile) };
+}
+function workflowPolicyCommand(cwd, argv, w = consoleWriter) {
+  if (argv.includes("--help")) {
+    w.out("usage: boff workflow-policy [repo-root]   (default: current directory)");
+    return 0;
+  }
+  const root = resolve2(cwd, argv.find((a) => !a.startsWith("--")) ?? ".");
+  if (!existsSync12(root) || !statSync2(root).isDirectory()) {
+    w.err(`boff workflow-policy: '${root}' is not a directory`);
+    return 2;
+  }
+  const { files, violations } = checkRepo(root);
+  if (files === 0) {
+    w.out(`boff workflow-policy: no workflows or composite actions under ${root}/.github`);
+    return 0;
+  }
+  for (const v of violations) {
+    w.out(`::error file=${v.file},line=${v.line},title=workflow policy (${v.rule})::${v.message}`);
+  }
+  if (violations.length > 0) {
+    w.err(`boff workflow-policy: ${violations.length} violation(s) in ${files} file(s)`);
+    return 1;
+  }
+  w.out(`boff workflow-policy: ${files} file(s) clean`);
+  return 0;
+}
+
+// src/cli.ts
+var USAGE = `boff ${TOOLCHAIN_VERSION} \u2014 Burdenoff toolchain (${TOOLCHAIN_NAME}, Bun ${SUPPORTED_BUN})
+
+usage: boff <command> [options]
+
+commands:
+  sanity          hash-stamped sanity runner (--force, --only, --print-keys, --pre-push)
+  print-keys      same as sanity --print-keys (k=v lines for $GITHUB_OUTPUT)
+  gate -- <cmd>   run a heavy command under the machine-wide build semaphore
+  coverage-gate   lcov aggregate + diff coverage gate
+  doctor          check the repo against the toolchain contract (--ci to fail)
+  sync            write or --check the managed blocks (bunfig, lefthook, scripts)
+  deps-mode       switch @burdenoff/* deps between registry and local sources
+  workflow-policy check GitHub workflows for supply-chain policy violations
+  version         print the toolchain version
+
+Run boff <command> --help for the options of a command.`;
+async function main(argv, cwd = process.cwd(), w = consoleWriter) {
+  const [command, ...rest] = argv;
+  switch (command) {
+    case undefined:
+    case "help":
+    case "--help":
+    case "-h":
+      w.out(USAGE);
+      return command === undefined ? 2 : 0;
+    case "version":
+    case "--version":
+    case "-v":
+      w.out(TOOLCHAIN_VERSION);
+      return 0;
+    case "sanity":
+      return runSanity({ root: cwd, argv: rest, writer: w, handleSignals: true });
+    case "print-keys":
+      return runSanity({ root: cwd, argv: ["--print-keys", ...rest], writer: w });
+    case "gate": {
+      const dash = rest.indexOf("--");
+      const opts = dash < 0 ? [] : rest.slice(0, dash);
+      const cmd = dash < 0 ? rest : rest.slice(dash + 1);
+      return runGated(cmd, { cwd, writer: w, strict: opts.includes("--pre-push") });
+    }
+    case "coverage-gate":
+      return coverageGate({ root: cwd, argv: rest, writer: w });
+    case "doctor":
+      return doctorCommand(cwd, rest, w);
+    case "sync":
+      return syncCommand(cwd, rest, w);
+    case "deps-mode":
+      return depsModeCommand(cwd, rest, w);
+    case "workflow-policy":
+      return workflowPolicyCommand(cwd, rest, w);
+    default:
+      w.err(`boff: unknown command "${command}"
+
+${USAGE}`);
+      return 2;
+  }
+}
+if (import.meta.main) {
+  try {
+    process.exitCode = await main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(`boff: ${error instanceof Error ? error.message : String(error)}
+`);
+    process.exitCode = 1;
+  }
+}
+export {
+  USAGE,
+  main
+};