@fantastic.dev/repo-gates 0.2.1-bootstrap.0

package/dist/bin/repo-gates.js

@@ -0,0 +1,2318 @@
+#!/usr/bin/env node
+
+// src/bundle-size.ts
+import { spawnSync } from "child_process";
+import {
+  existsSync,
+  lstatSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { basename, dirname, join, posix, resolve, sep } from "path";
+import { gzipSync } from "zlib";
+var HEADROOM = { raw: 2048, gzip: 512 };
+function bucketFor(name, buckets) {
+  for (const [bucket, exts] of Object.entries(buckets)) {
+    if (exts.some((ext) => name.endsWith(ext))) return bucket;
+  }
+  return void 0;
+}
+function measure(distDir, buckets) {
+  const out = { buckets: {}, files: [] };
+  for (const b of Object.keys(buckets)) out.buckets[b] = { raw: 0, gzip: 0, largest: 0 };
+  if (!existsSync(distDir)) return out;
+  const walk2 = (dir, relative7) => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry);
+      const st = lstatSync(full);
+      if (st.isDirectory()) {
+        walk2(full, relative7 ? posix.join(relative7, entry) : entry);
+        continue;
+      }
+      if (!st.isFile()) continue;
+      const bucket = bucketFor(entry, buckets);
+      if (!bucket) continue;
+      const buf = readFileSync(full);
+      const raw = buf.length;
+      const gzip = gzipSync(buf).length;
+      out.files.push({ name: entry, dir: relative7, bucket, raw, gzip });
+      const acc = out.buckets[bucket];
+      if (!acc) continue;
+      acc.raw += raw;
+      acc.gzip += gzip;
+      if (gzip > acc.largest) acc.largest = gzip;
+    }
+  };
+  walk2(distDir, "");
+  return out;
+}
+function resolveParentThroughSymlinks(path) {
+  const trailing = [];
+  let cursor = dirname(path);
+  for (; ; ) {
+    if (existsSync(cursor)) {
+      return join(realpathSync(cursor), ...trailing.reverse(), basename(path));
+    }
+    const parent = dirname(cursor);
+    if (parent === cursor) return path;
+    trailing.push(basename(cursor));
+    cursor = parent;
+  }
+}
+function assertSafeDistDir(distDir, repoRoot) {
+  const rawRoot = resolve(repoRoot);
+  const root = existsSync(rawRoot) ? realpathSync(rawRoot) : rawRoot;
+  const dir = resolveParentThroughSymlinks(resolve(rawRoot, distDir));
+  const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
+  if (dir === root || !dir.startsWith(rootPrefix)) {
+    throw new Error(
+      `check-bundle-size: distDir ${JSON.stringify(distDir)} resolves to ${dir}, which is not inside ${root}. Refusing to remove it.`
+    );
+  }
+  return dir;
+}
+function cleanDist(distDir, repoRoot) {
+  rmSync(assertSafeDistDir(distDir, repoRoot), { recursive: true, force: true });
+}
+var TRAILING_SEGMENT = /-([A-Za-z0-9_-]{8}|[0-9a-f]{16,})(\.[^.]+)$/;
+function looksLikeHash(segment) {
+  if (/^[0-9a-f]{16,}$/.test(segment)) return true;
+  if (/[0-9]/.test(segment)) return true;
+  return (segment.match(/[A-Z]/g) ?? []).length >= 2;
+}
+function logicalChunkName(name) {
+  const match = TRAILING_SEGMENT.exec(name);
+  if (!match?.[1] || !looksLikeHash(match[1])) return name;
+  return name.slice(0, match.index) + match[2];
+}
+var byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function findDuplicateChunks(m) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const f of m.files) {
+    const stripped = logicalChunkName(f.name);
+    if (stripped === f.name) continue;
+    const logical = f.dir ? posix.join(f.dir, stripped) : stripped;
+    const key = `${f.bucket}\0${logical}`;
+    const group = groups.get(key) ?? { bucket: f.bucket, logical, files: [] };
+    group.files.push({ name: f.name, raw: f.raw });
+    groups.set(key, group);
+  }
+  return [...groups.values()].filter((g) => g.files.length > 1).map((g) => ({ ...g, files: g.files.slice().sort((a, b) => byCodeUnit(a.name, b.name)) })).sort((a, b) => byCodeUnit(a.bucket, b.bucket) || byCodeUnit(a.logical, b.logical));
+}
+function loadBudgets(raw, source = "bundle-size-budgets") {
+  const parsed = JSON.parse(raw);
+  const out = {};
+  for (const [target, value] of Object.entries(parsed)) {
+    if (target.startsWith("_") || target.startsWith("$")) continue;
+    const v = value;
+    if (!v?.totals?.raw || !v.totals.gzip || !v.largest?.gzip) {
+      throw new Error(`${source}: ${target} missing totals.raw / totals.gzip / largest.gzip`);
+    }
+    out[target] = v;
+  }
+  return out;
+}
+function diff(target, m, budget) {
+  const failures = [];
+  for (const bucket of Object.keys(m.buckets)) {
+    const size = m.buckets[bucket];
+    if (!size) continue;
+    const checks = [
+      ["totals.raw", size.raw, budget.totals.raw[bucket]],
+      ["totals.gzip", size.gzip, budget.totals.gzip[bucket]],
+      ["largest.gzip", size.largest, budget.largest.gzip[bucket]]
+    ];
+    for (const [metric, actual, cap] of checks) {
+      if (cap !== void 0 && actual > cap) {
+        failures.push({ target, metric, bucket, actual, budget: cap });
+      }
+    }
+  }
+  return failures;
+}
+function seedBudget(m) {
+  const out = { totals: { raw: {}, gzip: {} }, largest: { gzip: {} } };
+  for (const [bucket, size] of Object.entries(m.buckets)) {
+    out.totals.raw[bucket] = size.raw + HEADROOM.raw;
+    out.totals.gzip[bucket] = size.gzip + HEADROOM.gzip;
+    out.largest.gzip[bucket] = size.largest + HEADROOM.gzip;
+  }
+  return out;
+}
+function fmtBytes(n) {
+  return n < 1024 ? `${n} B` : `${(n / 1024).toFixed(1)} KB`;
+}
+function buildTargets(ctx) {
+  const filters = ctx.config.bundleSize.targets.flatMap((t) => ["--filter", t.filter]);
+  if (filters.length === 0) return 0;
+  const proc = spawnSync("pnpm", ["exec", "turbo", "run", "build", ...filters], {
+    cwd: ctx.repoRoot,
+    stdio: "inherit",
+    env: process.env
+  });
+  if (proc.error) {
+    console.error(`check-bundle-size: failed to build targets: ${proc.error.message}`);
+    return 1;
+  }
+  return proc.status ?? 1;
+}
+var DEFAULT_DEPS = { clean: cleanDist, build: buildTargets };
+function runBundleSize(ctx, init = false, deps = DEFAULT_DEPS) {
+  const { budgetsPath, targets } = ctx.config.bundleSize;
+  if (targets.length === 0) {
+    console.log("Bundle-size guard: no targets configured \u2014 skipping.");
+    return 0;
+  }
+  for (const t of targets) deps.clean(t.distDir, ctx.repoRoot);
+  const buildExit = deps.build(ctx);
+  if (buildExit !== 0) return buildExit;
+  const path = resolve(ctx.repoRoot, budgetsPath);
+  const measured = [];
+  for (const t of targets) {
+    const m = measure(resolve(ctx.repoRoot, t.distDir), t.buckets);
+    if (m.files.length === 0) {
+      console.error(
+        `check-bundle-size: ${t.distDir} holds no files matching ${t.name}'s buckets (${Object.keys(t.buckets).join(", ")}) after building. Nothing was measured, so the ratchet would pass regardless of the real size.`
+      );
+      return 1;
+    }
+    measured.push({ target: t, m });
+  }
+  if (init) {
+    const budgets2 = {};
+    for (const { target: t, m } of measured) {
+      const duplicates = findDuplicateChunks(m);
+      if (duplicates.length > 0) {
+        console.error(
+          `check-bundle-size: refusing to seed "${t.name}" \u2014 ${t.distDir} holds ${duplicates.length} chunk(s) emitted more than once:`
+        );
+        for (const d of duplicates.slice(0, 5)) {
+          console.error(`  ${d.logical}: ${d.files.map((f) => `${f.name} (${f.raw} B)`).join(", ")}`);
+        }
+        if (duplicates.length > 5) console.error(`  \u2026 and ${duplicates.length - 5} more`);
+        console.error(
+          `
+One build cannot emit the same chunk twice, so this directory holds output from two. A budget seeded from it would be inflated by the surplus and, because the ratchet only goes DOWN, nothing later would catch it.
+Remove ${t.distDir} and re-run.`
+        );
+        return 1;
+      }
+      budgets2[t.name] = seedBudget(m);
+    }
+    const file = {
+      _comment: "Bundle-size budgets per target (bytes). Ratchet only goes DOWN \u2014 code-split/trim, then lower; never hand-raise. Re-baseline with `check:bundle-size --init`.",
+      ...budgets2
+    };
+    writeFileSync(path, `${JSON.stringify(file, null, 2)}
+`);
+    console.log(`check-bundle-size: seeded budgets for ${targets.length} target(s) \u2192 ${path}`);
+    return 0;
+  }
+  const budgets = loadBudgets(readFileSync(path, "utf8"), budgetsPath);
+  const failures = [];
+  const scoreParts = [];
+  for (const { target: t, m } of measured) {
+    const budget = budgets[t.name];
+    if (!budget) {
+      console.error(`check-bundle-size: no budget for target "${t.name}" \u2014 run --init.`);
+      return 1;
+    }
+    failures.push(...diff(t.name, m, budget));
+    const gzipTotal = Object.values(m.buckets).reduce((s, b) => s + b.gzip, 0);
+    scoreParts.push(`${t.name} ${fmtBytes(gzipTotal)} gz`);
+  }
+  if (failures.length > 0) {
+    console.error("Bundle-size guard failed:");
+    for (const f of failures) {
+      console.error(
+        `  ${f.target} ${f.metric}.${f.bucket}: ${fmtBytes(f.actual)} > budget ${fmtBytes(f.budget)} (+${f.actual - f.budget} B)`
+      );
+    }
+    console.error(
+      "\nCode-split or trim deps to stay under budget.\n\nBefore re-baselining, confirm the growth is real: a budget seeded from a bad measurement raises the ceiling permanently, and the ratchet only goes DOWN, so nothing later will catch it. Check that the reported size matches what the build actually emitted. Only if the growth is intentional, re-baseline with `pnpm run check:bundle-size -- --init` and commit the budget diff."
+    );
+    return 1;
+  }
+  console.log(`SCORE: bundle-size \u2014 ${scoreParts.join(", ")}`);
+  console.log("Bundle-size guard ok.");
+  return 0;
+}
+
+// src/check-all.ts
+import { spawnSync as spawnSync2 } from "child_process";
+
+// src/lib/pkg.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+function loadScripts(repoRoot) {
+  const packageJsonPath = resolve2(repoRoot, "package.json");
+  if (!existsSync2(packageJsonPath)) return {};
+  const pkg = JSON.parse(readFileSync2(packageJsonPath, "utf8"));
+  return pkg.scripts ?? {};
+}
+
+// src/check-all.ts
+function resolveGates(scripts, gates) {
+  return gates.filter((g) => !g.conditional || scripts[g.name] !== void 0).map((g) => g.name);
+}
+function gatesForRepo(ctx) {
+  return resolveGates(loadScripts(ctx.repoRoot), ctx.config.gates);
+}
+function formatGateLine(status, gate, seconds, width) {
+  const mark = status === "ok" ? "\u2713" : "\u2717";
+  return `${mark} ${gate.padEnd(width)} (${seconds.toFixed(1)}s)`;
+}
+var SIGNATURE_RE = /error TS\d+|: error |^error:|^✗ |^✖|^× |^FAIL\b|^Error: |\bAssertionError\b|\bbelow floor\b|\berror\b.*\bbudget\b|exceeds? .*budget|\[error\]|Code style issues/i;
+var MAX_SIGNATURE_LINES = 50;
+var TAIL_FALLBACK_LINES = 25;
+function extractFailureSignatures(output) {
+  const lines = output.split("\n");
+  const matched = lines.filter((l) => SIGNATURE_RE.test(l.trim()));
+  if (matched.length > 0) return matched.slice(0, MAX_SIGNATURE_LINES);
+  return lines.filter((l) => l.trim() !== "").slice(-TAIL_FALLBACK_LINES);
+}
+var SCORE_PREFIX = "SCORE:";
+function extractScores(output) {
+  return output.split("\n").map((l) => l.trim()).filter((l) => l.startsWith(SCORE_PREFIX)).map((l) => l.slice(SCORE_PREFIX.length).trim()).filter((l) => l.length > 0);
+}
+function formatScoresBlock(scores) {
+  if (scores.length === 0) return [];
+  const width = Math.max(...scores.map((s) => s.split("\u2014")[0]?.trim().length ?? 0));
+  const out = ["", "Scores:"];
+  for (const s of scores) {
+    const [label, ...rest] = s.split("\u2014");
+    out.push(
+      rest.length > 0 && label ? `  ${label.trim().padEnd(width)}  ${rest.join("\u2014").trim()}` : `  ${s}`
+    );
+  }
+  return out;
+}
+function runGate(gate, ctx, verbose) {
+  const [cmd2, ...runnerArgs] = ctx.config.runner.split(/\s+/);
+  const start = performance.now();
+  const proc = spawnSync2(cmd2 ?? "pnpm", [...runnerArgs, gate], {
+    cwd: ctx.repoRoot,
+    stdio: verbose ? "inherit" : "pipe",
+    encoding: "utf8",
+    env: process.env
+  });
+  const seconds = (performance.now() - start) / 1e3;
+  const errNote = proc.error ? `
+spawn error: ${proc.error.message}` : "";
+  const output = verbose ? errNote.trim() : `${proc.stdout ?? ""}
+${proc.stderr ?? ""}${errNote}`;
+  return { gate, ok: proc.status === 0 && !proc.error, seconds, output };
+}
+function runCheckAll(ctx, opts = {}) {
+  const verbose = opts.verbose ?? false;
+  const gates = gatesForRepo(ctx);
+  if (gates.length === 0) {
+    console.error("check:all \u2014 no gates resolved; check repo-gates.config.json");
+    return 1;
+  }
+  const width = Math.max(...gates.map((g) => g.length));
+  const results = [];
+  const overallStart = performance.now();
+  for (const gate of gates) {
+    if (verbose) console.log(`
+\u2500\u2500 ${gate} \u2500\u2500`);
+    const result = runGate(gate, ctx, verbose);
+    results.push(result);
+    console.log(formatGateLine(result.ok ? "ok" : "fail", gate, result.seconds, width));
+    if (!result.ok && opts.bail) break;
+  }
+  const failures = results.filter((r) => !r.ok);
+  const totalSeconds = (performance.now() - overallStart) / 1e3;
+  if (failures.length === 0) {
+    console.log(`
+${results.length}/${gates.length} gates passed (${totalSeconds.toFixed(1)}s)`);
+    const scores = results.flatMap((r) => extractScores(r.output));
+    for (const line of formatScoresBlock(scores)) console.log(line);
+    return 0;
+  }
+  const runner = ctx.config.runner;
+  console.error(`
+${failures.length} gate(s) failed: ${failures.map((f) => f.gate).join(", ")}
+`);
+  for (const f of failures) {
+    console.error(`\u2500\u2500 ${f.gate} \u2500\u2500`);
+    for (const line of extractFailureSignatures(f.output)) console.error(`  ${line}`);
+    console.error(`  \u21B3 re-run: ${runner} ${f.gate}  (or CHECK_ALL_VERBOSE=1 ${runner} check:all)`);
+  }
+  return 1;
+}
+
+// src/ci-parity.ts
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join2, relative, resolve as resolve3 } from "path";
+import { parse } from "yaml";
+function loadParityConfig(configPath) {
+  if (!existsSync3(configPath)) return { aliases: {}, ciOnly: /* @__PURE__ */ new Set() };
+  const raw = JSON.parse(readFileSync3(configPath, "utf8"));
+  return { aliases: raw.aliases ?? {}, ciOnly: new Set(raw.ciOnly ?? []) };
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function makeRunTargetRe(runner) {
+  return new RegExp(`${escapeRegExp(runner)}\\s+([A-Za-z][\\w:-]*)(?![\\w./:-])`, "g");
+}
+function extractRunTargets(command, runner) {
+  const out = [];
+  for (const match of command.matchAll(makeRunTargetRe(runner))) {
+    const name = match[1];
+    if (name) out.push(name);
+  }
+  return out;
+}
+function computeReachable(scripts, gates, entryGates, runner) {
+  const reachable = /* @__PURE__ */ new Set();
+  const stack = [...entryGates, ...gates];
+  while (stack.length > 0) {
+    const name = stack.pop();
+    if (!name || reachable.has(name)) continue;
+    reachable.add(name);
+    const body = scripts[name];
+    if (body === void 0) continue;
+    for (const dep of extractRunTargets(body, runner)) {
+      if (!reachable.has(dep)) stack.push(dep);
+    }
+  }
+  return reachable;
+}
+function extractCiInvocations(filePath, repoRoot, runner) {
+  const text = readFileSync3(filePath, "utf8");
+  const doc = parse(text);
+  const workflow = relative(repoRoot, filePath);
+  const out = [];
+  if (!doc || typeof doc !== "object" || !doc.jobs) return out;
+  for (const [jobName, job] of Object.entries(doc.jobs)) {
+    const steps = job?.steps;
+    if (!Array.isArray(steps)) continue;
+    steps.forEach((step, idx) => {
+      const run = step?.run;
+      if (typeof run !== "string") return;
+      for (const script of extractRunTargets(run, runner)) {
+        out.push({ workflow, job: jobName, step: idx, script });
+      }
+    });
+  }
+  return out;
+}
+function listCiWorkflows(dir, prefix) {
+  if (!existsSync3(dir)) return [];
+  return readdirSync2(dir).filter((f) => (f.endsWith(".yml") || f.endsWith(".yaml")) && f.startsWith(prefix)).map((f) => join2(dir, f)).sort();
+}
+function evaluateParity(invocations, reachable, config, rootGate) {
+  const failures = [];
+  for (const inv of invocations) {
+    const canonical = config.aliases[inv.script] ?? inv.script;
+    if (config.ciOnly.has(canonical)) continue;
+    if (reachable.has(canonical)) continue;
+    const reason = canonical === inv.script ? `not reachable from ${rootGate}` : `aliased to "${canonical}", which is not reachable from ${rootGate}`;
+    failures.push({ ...inv, canonical, reason });
+  }
+  return failures;
+}
+function checkParity(ctx) {
+  const { runner, ciParity } = ctx.config;
+  const reachable = computeReachable(
+    loadScripts(ctx.repoRoot),
+    gatesForRepo(ctx),
+    ciParity.entryGates,
+    runner
+  );
+  const workflowsDir = resolve3(ctx.repoRoot, ".github/workflows");
+  const invocations = [];
+  for (const wf of listCiWorkflows(workflowsDir, ciParity.workflowPrefix)) {
+    invocations.push(...extractCiInvocations(wf, ctx.repoRoot, runner));
+  }
+  const config = loadParityConfig(resolve3(ctx.repoRoot, ciParity.configPath));
+  const failures = evaluateParity(invocations, reachable, config, ciParity.rootGate);
+  return { invocations, reachable, failures };
+}
+function formatFailure(f) {
+  return `  ${f.workflow} (job=${f.job}, step=${f.step}): ${f.script} \u2014 ${f.reason}`;
+}
+function runCiParity(ctx) {
+  const { rootGate, configPath } = ctx.config.ciParity;
+  const { invocations, reachable, failures } = checkParity(ctx);
+  if (failures.length === 0) {
+    console.log(
+      `\u2713 CI parity: ${invocations.length} gate invocation(s) across CI workflows, all reachable from "${rootGate}" (${reachable.size} scripts in graph).`
+    );
+    return 0;
+  }
+  console.error(
+    `\u2717 CI parity drift: ${failures.length} CI step(s) invoke a script not reachable from "${rootGate}":
+`
+  );
+  for (const f of failures) console.error(formatFailure(f));
+  console.error(
+    `
+Fix one of:
+  - Wire the script into the gate manifest / a gate's script body.
+  - Change CI to invoke a script that is already reachable.
+  - If the step is intentionally CI-only, add it to "ciOnly" in ${configPath}.
+  - If two scripts run the same gate under different names, map the CI name
+    to its canonical equivalent in "aliases" in ${configPath}.`
+  );
+  return 1;
+}
+
+// src/circular-imports.ts
+import { existsSync as existsSync5, lstatSync as lstatSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, relative as relative2, resolve as resolve4 } from "path";
+
+// src/lib/fs.ts
+import { existsSync as existsSync4, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join3 } from "path";
+function* walk(dir, excludeDirSegments) {
+  if (!existsSync4(dir)) return;
+  for (const entry of readdirSync3(dir)) {
+    if (excludeDirSegments.includes(entry)) continue;
+    const full = join3(dir, entry);
+    const st = lstatSync2(full);
+    if (st.isSymbolicLink()) continue;
+    if (st.isDirectory()) {
+      yield* walk(full, excludeDirSegments);
+    } else if (st.isFile()) {
+      yield full;
+    }
+  }
+}
+function countLines(filePath) {
+  const buf = readFileSync4(filePath);
+  if (buf.length === 0) return 0;
+  let count = 0;
+  for (let i = 0; i < buf.length; i++) {
+    if (buf[i] === 10) count++;
+  }
+  if (buf[buf.length - 1] !== 10) count++;
+  return count;
+}
+function hasExtension(name, extensions) {
+  return extensions.some((ext) => name.endsWith(ext));
+}
+
+// src/circular-imports.ts
+var IMPORT_SPEC_RE = /(?:from|require\()\s*["'](\.[^"'\n]+)["']|import\(\s*["'](\.[^"'\n]+)["']\s*\)|^\s*import\s+["'](\.[^"'\n]+)["']/gm;
+function extractRelativeSpecifiers(source) {
+  const out = [];
+  for (const match of source.matchAll(IMPORT_SPEC_RE)) {
+    const spec = match[1] ?? match[2] ?? match[3];
+    if (spec) out.push(spec);
+  }
+  return out;
+}
+function resolveSpecifier(fromFile, spec, sourceExtensions) {
+  const base = resolve4(dirname2(fromFile), spec);
+  const candidates = [
+    base,
+    ...sourceExtensions.map((ext) => base + ext),
+    ...sourceExtensions.map((ext) => resolve4(base, `index${ext}`))
+  ];
+  return candidates.find(isFile);
+}
+function isFile(path) {
+  return existsSync5(path) && lstatSync3(path).isFile();
+}
+function findCycles(graph) {
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const lowlink = /* @__PURE__ */ new Map();
+  const onStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  const sccs = [];
+  const strongConnect = (v) => {
+    indices.set(v, index);
+    lowlink.set(v, index);
+    index++;
+    stack.push(v);
+    onStack.add(v);
+    const frames = [
+      { node: v, neighbors: [...graph.get(v) ?? []], i: 0 }
+    ];
+    while (frames.length > 0) {
+      const frame = frames.at(-1);
+      if (!frame) break;
+      if (frame.i < frame.neighbors.length) {
+        const w = frame.neighbors[frame.i++];
+        if (w === void 0) continue;
+        if (!indices.has(w)) {
+          indices.set(w, index);
+          lowlink.set(w, index);
+          index++;
+          stack.push(w);
+          onStack.add(w);
+          frames.push({ node: w, neighbors: [...graph.get(w) ?? []], i: 0 });
+        } else if (onStack.has(w)) {
+          lowlink.set(frame.node, Math.min(lowlink.get(frame.node) ?? 0, indices.get(w) ?? 0));
+        }
+      } else {
+        frames.pop();
+        const parent = frames.at(-1);
+        if (parent) {
+          lowlink.set(
+            parent.node,
+            Math.min(lowlink.get(parent.node) ?? 0, lowlink.get(frame.node) ?? 0)
+          );
+        }
+        if (lowlink.get(frame.node) === indices.get(frame.node)) {
+          const scc = [];
+          let w;
+          do {
+            w = stack.pop();
+            if (w === void 0) break;
+            onStack.delete(w);
+            scc.push(w);
+          } while (w !== frame.node);
+          if (scc.length > 1) sccs.push(scc);
+        }
+      }
+    }
+  };
+  for (const node of graph.keys()) {
+    if (!indices.has(node)) strongConnect(node);
+  }
+  return sccs;
+}
+function buildGraph(ctx) {
+  const { scanRoots, excludeDirSegments, excludePathPrefixes, sourceExtensions } = ctx.config;
+  const graph = /* @__PURE__ */ new Map();
+  for (const root of scanRoots) {
+    for (const abs of walk(resolve4(ctx.repoRoot, root), excludeDirSegments)) {
+      if (!hasExtension(abs, sourceExtensions)) continue;
+      const rel = relative2(ctx.repoRoot, abs).replaceAll("\\", "/");
+      if (excludePathPrefixes.some((prefix) => rel.startsWith(prefix))) continue;
+      const source = readFileSync5(abs, "utf8");
+      const edges = graph.get(abs) ?? /* @__PURE__ */ new Set();
+      for (const spec of extractRelativeSpecifiers(source)) {
+        const target = resolveSpecifier(abs, spec, sourceExtensions);
+        if (target && target !== abs) edges.add(target);
+      }
+      graph.set(abs, edges);
+    }
+  }
+  return graph;
+}
+function toSignature(ctx, files) {
+  return files.map((f) => relative2(ctx.repoRoot, f).replaceAll("\\", "/")).sort((a, b) => a.localeCompare(b)).join(", ");
+}
+function parseAllowlist(allowlistPath) {
+  if (!existsSync5(allowlistPath)) return [];
+  const raw = JSON.parse(readFileSync5(allowlistPath, "utf8"));
+  const list = raw.allowlist;
+  if (!Array.isArray(list) || list.some((x) => typeof x !== "string")) {
+    throw new Error(`${allowlistPath}: "allowlist" must be an array of cycle-signature strings`);
+  }
+  return list;
+}
+function scan(ctx) {
+  const graph = buildGraph(ctx);
+  const cycles = findCycles(graph);
+  const signatures = cycles.map((files) => toSignature(ctx, files));
+  const allowlist = parseAllowlist(resolve4(ctx.repoRoot, ctx.config.circular.allowlistPath));
+  const allowSet = new Set(allowlist);
+  const matched = /* @__PURE__ */ new Set();
+  const untracked = [];
+  for (let i = 0; i < cycles.length; i++) {
+    const sig = signatures[i];
+    const files = cycles[i];
+    if (sig === void 0 || files === void 0) continue;
+    if (allowSet.has(sig)) matched.add(sig);
+    else untracked.push({ files: sig.split(", ") });
+  }
+  const staleAllowlistEntries = allowlist.filter((sig) => !matched.has(sig));
+  return { untracked, staleAllowlistEntries };
+}
+function seedAllowlist(ctx) {
+  const emptyCtx = {
+    ...ctx,
+    config: { ...ctx.config, circular: { allowlistPath: "\0missing" } }
+  };
+  return scan(emptyCtx).untracked.map((c) => c.files.join(", ")).sort((a, b) => a.localeCompare(b));
+}
+function writeSeed(ctx) {
+  const path = resolve4(ctx.repoRoot, ctx.config.circular.allowlistPath);
+  const allowlist = seedAllowlist(ctx);
+  const file = {
+    _comment: "Grandfathered circular-import groups (comma-separated, sorted repo-relative paths \u2014 one strongly-connected component per entry). Ratchet only goes down.",
+    allowlist
+  };
+  writeFileSync2(path, `${JSON.stringify(file, null, 2)}
+`);
+  return { path, count: allowlist.length };
+}
+function runCircularImports(ctx, init = false) {
+  if (init) {
+    const { path, count } = writeSeed(ctx);
+    console.log(`circular-import guard: seeded ${count} grandfathered cycle(s) \u2192 ${path}`);
+    return 0;
+  }
+  const { untracked, staleAllowlistEntries } = scan(ctx);
+  if (staleAllowlistEntries.length > 0) {
+    console.error(`${ctx.config.circular.allowlistPath} has entries that no longer cycle:`);
+    for (const sig of staleAllowlistEntries) console.error(`  - ${sig}`);
+    console.error("Remove these entries \u2014 the ratchet only goes down.\n");
+  }
+  if (untracked.length > 0) {
+    console.error("New circular imports found:");
+    for (const c of untracked) console.error(`  ${c.files.join(" -> ")} -> ${c.files[0]}`);
+    console.error(
+      "\nBreak the cycle (extract shared code, invert one of the imports), or \u2014 with justification \u2014 allowlist it via `repo-gates check-circular --init`."
+    );
+    return 1;
+  }
+  if (staleAllowlistEntries.length > 0) return 1;
+  const grandfathered = parseAllowlist(resolve4(ctx.repoRoot, ctx.config.circular.allowlistPath)).length;
+  console.log(`SCORE: circular-imports \u2014 ${grandfathered} grandfathered, 0 new`);
+  console.log("Circular-import guard ok.");
+  return 0;
+}
+
+// src/config.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve5 } from "path";
+var DEFAULT_CONFIG = {
+  runner: "pnpm run",
+  gates: [
+    { name: "lint", conditional: false },
+    { name: "check:design-system", conditional: true },
+    { name: "format:check", conditional: false },
+    { name: "typecheck", conditional: false },
+    { name: "check:scripts", conditional: true },
+    { name: "check:deps", conditional: true },
+    { name: "check:dups", conditional: true },
+    { name: "check:size", conditional: false },
+    { name: "check:debt", conditional: false },
+    { name: "check:circular", conditional: true },
+    { name: "check:secrets", conditional: true },
+    { name: "check:agents", conditional: true },
+    { name: "check:shadscan", conditional: true },
+    { name: "check:docs-coverage", conditional: true },
+    { name: "check:bundle-size", conditional: true },
+    { name: "test", conditional: false },
+    { name: "check:coverage", conditional: true },
+    { name: "check:ci-parity", conditional: false }
+  ],
+  scanRoots: ["apps", "packages", "scripts"],
+  excludeDirSegments: [
+    "node_modules",
+    "dist",
+    "dist-e2e",
+    "out",
+    ".turbo",
+    ".wrangler",
+    "__golden__",
+    "_generated",
+    "coverage"
+  ],
+  excludePathPrefixes: [],
+  sourceExtensions: [".ts", ".tsx"],
+  fileSize: { threshold: 600, budgetsPath: "gates/file-size-budgets.json" },
+  debt: {
+    allowlistPath: "gates/debt-marker-allowlist.json",
+    markerTokens: ["TODO", "FIXME", "HACK", "XXX"],
+    trackerPatterns: ["\\b[A-Z]{2,}-\\d+\\b", "#\\d+\\b", "https?:\\/\\/\\S+"]
+  },
+  circular: { allowlistPath: "gates/circular-imports-allowlist.json" },
+  secrets: {
+    allowlistPath: "gates/secrets-allowlist.json",
+    patterns: [
+      "\\bAKIA[0-9A-Z]{16}\\b",
+      // AWS access key
+      "\\bASIA[0-9A-Z]{16}\\b",
+      // AWS temporary access key
+      "\\bgh[pousr]_[A-Za-z0-9]{36,}\\b",
+      // GitHub personal/OAuth/app/refresh token
+      "\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b",
+      // Slack token
+      "\\bsk_(?:live|test)_[A-Za-z0-9]{16,}\\b",
+      // Stripe secret key
+      "\\bnpm_[A-Za-z0-9]{36}\\b",
+      // npm access token
+      "\\bAIza[0-9A-Za-z_-]{35}\\b",
+      // Google API key
+      "-----BEGIN(?: RSA| EC| OPENSSH| DSA)? PRIVATE KEY-----",
+      // PEM private key
+      "://[^/\\s:@]+:[^/\\s:@]+@"
+      // credentials embedded in a URL
+    ],
+    binaryExtensions: [
+      ".png",
+      ".jpg",
+      ".jpeg",
+      ".gif",
+      ".ico",
+      ".webp",
+      ".pdf",
+      ".zip",
+      ".gz",
+      ".woff",
+      ".woff2",
+      ".ttf",
+      ".eot",
+      ".mp4",
+      ".mp3",
+      ".wasm"
+    ]
+  },
+  coverage: {
+    budgetsPath: "gates/coverage-budgets.json",
+    summaryGlobs: [
+      "apps/*/coverage/coverage-summary.json",
+      "packages/*/coverage/coverage-summary.json"
+    ]
+  },
+  ciParity: {
+    configPath: "gates/ci-parity-config.json",
+    rootGate: "check:all",
+    entryGates: ["check:all", "verify"],
+    workflowPrefix: "ci"
+  },
+  bundleSize: { budgetsPath: "gates/bundle-size-budgets.json", targets: [] },
+  report: { junitGlobs: [], topN: 20 },
+  agents: {
+    targets: [],
+    knownMissingPaths: [],
+    runnerCommand: "pnpm",
+    ignoredSubcommands: [
+      "run",
+      "install",
+      "i",
+      "add",
+      "remove",
+      "rm",
+      "up",
+      "update",
+      "exec",
+      "dlx",
+      "why",
+      "store",
+      "prune",
+      "audit",
+      "outdated",
+      "list",
+      "ls",
+      "link",
+      "unlink",
+      "publish",
+      "pack",
+      "rebuild",
+      "approve-builds",
+      "config",
+      "dedupe",
+      "fetch",
+      "import",
+      "patch",
+      "setup",
+      "create"
+    ]
+  },
+  docsCoverage: { docsGlobs: [], surfaces: [], exclude: [] }
+};
+var CONFIG_FILENAMES = ["repo-gates.config.json"];
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function mergeConfig(base, overlay) {
+  const out = { ...base };
+  for (const [key, value] of Object.entries(overlay)) {
+    if (value === void 0) continue;
+    const baseValue = base[key];
+    out[key] = isPlainObject(baseValue) && isPlainObject(value) ? { ...baseValue, ...value } : value;
+  }
+  return out;
+}
+function findConfigFile(repoRoot) {
+  for (const name of CONFIG_FILENAMES) {
+    const candidate = resolve5(repoRoot, name);
+    if (existsSync6(candidate)) return candidate;
+  }
+  return void 0;
+}
+function loadConfig(repoRoot = process.cwd()) {
+  const file = findConfigFile(repoRoot);
+  if (!file) return DEFAULT_CONFIG;
+  const overlay = JSON.parse(readFileSync6(file, "utf8"));
+  return mergeConfig(DEFAULT_CONFIG, overlay);
+}
+function loadContext(repoRoot = process.cwd()) {
+  return { repoRoot, config: loadConfig(repoRoot) };
+}
+
+// src/coverage.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync7, readdirSync as readdirSync4, readFileSync as readFileSync7, statSync, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4, relative as relative3, resolve as resolve6 } from "path";
+var DEFAULT_MIN = { functions: 80, lines: 80 };
+function validFloor(value, source, where) {
+  const v = value;
+  const out = { functions: 0, lines: 0 };
+  for (const metric of ["functions", "lines"]) {
+    const n = v?.[metric];
+    if (typeof n !== "number" || !Number.isFinite(n) || n < 0 || n > 100) {
+      throw new Error(`${source}: ${where}.${metric} must be a percentage in [0, 100]`);
+    }
+    out[metric] = n;
+  }
+  return out;
+}
+function loadBudgets2(raw, source = "coverage-budgets") {
+  const parsed = JSON.parse(raw);
+  const def = parsed.default === void 0 ? DEFAULT_MIN : validFloor(parsed.default, source, "default");
+  const pkgsRaw = parsed.packages;
+  if (pkgsRaw !== void 0 && (pkgsRaw === null || typeof pkgsRaw !== "object" || Array.isArray(pkgsRaw))) {
+    throw new Error(`${source}: "packages" must be an object`);
+  }
+  const packages = {};
+  for (const [pkg, floor] of Object.entries(pkgsRaw ?? {})) {
+    packages[pkg] = validFloor(floor, source, `packages["${pkg}"]`);
+  }
+  return { default: def, packages };
+}
+function expandGlob(repoRoot, glob) {
+  const segments = glob.split("/");
+  let dirs = [repoRoot];
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i] ?? "";
+    const isLast = i === segments.length - 1;
+    const next = [];
+    for (const dir of dirs) {
+      if (seg === "*") {
+        if (!existsSync7(dir)) continue;
+        for (const entry of readdirSync4(dir)) {
+          const full = join4(dir, entry);
+          if (statSync(full).isDirectory()) next.push(full);
+        }
+      } else {
+        const full = join4(dir, seg);
+        if (isLast ? existsSync7(full) : existsSync7(full) && statSync(full).isDirectory()) {
+          next.push(full);
+        }
+      }
+    }
+    dirs = next;
+  }
+  return dirs;
+}
+function readSummaryCounts(path) {
+  const doc = JSON.parse(readFileSync7(path, "utf8"));
+  const total = doc.total;
+  if (!total) return void 0;
+  const pick = (m) => {
+    const covered = m?.covered;
+    const total_ = m?.total;
+    if (typeof covered !== "number" || typeof total_ !== "number") return void 0;
+    return { covered, total: total_ };
+  };
+  const functions = pick(total.functions);
+  const lines = pick(total.lines);
+  if (!functions || !lines) return void 0;
+  return { functions, lines };
+}
+function pct(counts) {
+  return counts.total === 0 ? 100 : counts.covered / counts.total * 100;
+}
+function pkgKey(repoRoot, summaryPath) {
+  return relative3(repoRoot, summaryPath).replaceAll("\\", "/").replace(/\/coverage\/coverage-summary\.json$/, "");
+}
+function collectPerPackage(ctx) {
+  const out = [];
+  for (const glob of ctx.config.coverage.summaryGlobs) {
+    for (const path of expandGlob(ctx.repoRoot, glob)) {
+      const counts = readSummaryCounts(path);
+      if (!counts) continue;
+      out.push({
+        pkg: pkgKey(ctx.repoRoot, path),
+        totals: { functions: pct(counts.functions), lines: pct(counts.lines) }
+      });
+    }
+  }
+  return out.sort((a, b) => a.pkg.localeCompare(b.pkg));
+}
+function checkPerPackage(perPkg, budgets) {
+  const failures = [];
+  const newPkgs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const { pkg, totals } of perPkg) {
+    seen.add(pkg);
+    const explicit = budgets.packages[pkg];
+    const floor = explicit ?? budgets.default;
+    const isNew = explicit === void 0;
+    if (isNew) newPkgs.push(pkg);
+    for (const metric of ["functions", "lines"]) {
+      if (totals[metric] < floor[metric]) {
+        failures.push({ pkg, metric, actual: totals[metric], floor: floor[metric], isNew });
+      }
+    }
+  }
+  const stale = Object.keys(budgets.packages).filter((p) => !seen.has(p));
+  return { failures, newPkgs, stale };
+}
+function seedFloor(pct_) {
+  return Math.max(0, Math.floor((pct_ - 0.5) * 100) / 100);
+}
+function seedBudgets(perPkg, keepDefault) {
+  const packages = {};
+  for (const { pkg, totals } of perPkg.slice().sort((a, b) => a.pkg.localeCompare(b.pkg))) {
+    packages[pkg] = { functions: seedFloor(totals.functions), lines: seedFloor(totals.lines) };
+  }
+  return { default: keepDefault, packages };
+}
+function runTestCoverage(ctx) {
+  const [cmd2, ...args] = ctx.config.runner.split(/\s+/);
+  const proc = spawnSync3(cmd2 ?? "pnpm", [...args, "test:coverage"], {
+    cwd: ctx.repoRoot,
+    stdio: "inherit",
+    env: process.env
+  });
+  if (proc.error) {
+    console.error(
+      `check-coverage: could not run '${ctx.config.runner} test:coverage': ${proc.error.message}`
+    );
+    return 1;
+  }
+  return proc.status ?? 1;
+}
+function lowest(perPkg) {
+  let min;
+  for (const { pkg, totals } of perPkg) {
+    if (!min || totals.lines < min.lines) min = { pkg, lines: totals.lines };
+  }
+  return min;
+}
+function coverageScore(perPkg) {
+  const min = lowest(perPkg);
+  if (!min) return void 0;
+  return `coverage \u2014 lowest ${min.pkg} ${min.lines.toFixed(1)}% lines (${perPkg.length} pkgs \u2265 floor)`;
+}
+function runCoverage(ctx, opts = {}) {
+  const budgetsPath = resolve6(ctx.repoRoot, ctx.config.coverage.budgetsPath);
+  const testExit = opts.skipRun ? 0 : runTestCoverage(ctx);
+  const perPkg = collectPerPackage(ctx);
+  if (perPkg.length === 0) {
+    console.error(
+      `check-coverage: no coverage-summary.json files matched ${ctx.config.coverage.summaryGlobs.join(", ")} \u2014 did test:coverage run with the json-summary reporter?`
+    );
+    return testExit === 0 ? 1 : testExit;
+  }
+  if (opts.init) {
+    if (!opts.skipRun && testExit !== 0) {
+      console.error(
+        "check-coverage: --init aborted \u2014 test:coverage failed; refusing to seed floors from a failed/partial run. Fix the tests, then re-seed."
+      );
+      return testExit;
+    }
+    const keepDefault = existsSync7(budgetsPath) ? loadBudgets2(readFileSync7(budgetsPath, "utf8"), ctx.config.coverage.budgetsPath).default : DEFAULT_MIN;
+    const budgets2 = seedBudgets(perPkg, keepDefault);
+    const file = {
+      _comment: "Per-package coverage floors. Each package is held to its own floor (packages[dir]) or `default` if unlisted; floors only ratchet UP. Seeded 0.5pt below each baseline.",
+      default: budgets2.default,
+      packages: budgets2.packages
+    };
+    writeFileSync3(budgetsPath, `${JSON.stringify(file, null, 2)}
+`);
+    console.log(
+      `check-coverage: seeded per-package floors for ${perPkg.length} package(s) (default ${budgets2.default.functions}/${budgets2.default.lines}) \u2192 ${budgetsPath}`
+    );
+    return 0;
+  }
+  const budgets = loadBudgets2(readFileSync7(budgetsPath, "utf8"), ctx.config.coverage.budgetsPath);
+  const { failures, newPkgs, stale } = checkPerPackage(perPkg, budgets);
+  if (stale.length > 0) {
+    console.error(`${ctx.config.coverage.budgetsPath} lists packages with no coverage summary:`);
+    for (const p of stale) console.error(`  - ${p}`);
+    console.error("Remove these entries (or restore the package's coverage).\n");
+  }
+  if (failures.length > 0) {
+    console.error("Coverage below floor:");
+    for (const f of failures) {
+      const tag = f.isNew ? " [new package \u2014 no explicit floor, using default]" : "";
+      console.error(
+        `  ${f.pkg}: ${f.metric} ${f.actual.toFixed(2)}% < floor ${f.floor.toFixed(2)}%${tag}`
+      );
+    }
+    console.error(
+      `
+Add tests to lift it, or \u2014 if intentional \u2014 lower that package's floor in ${ctx.config.coverage.budgetsPath}. A new package needs tests to clear the default (${budgets.default.functions}%/${budgets.default.lines}%) or an explicit floor via --init.`
+    );
+    return testExit === 0 ? 1 : testExit;
+  }
+  if (stale.length > 0) return 1;
+  const min = lowest(perPkg);
+  const newNote = newPkgs.length > 0 ? `; ${newPkgs.length} new pkg(s) met default` : "";
+  console.error(
+    `Coverage OK \u2014 ${perPkg.length} package(s) meet their floor` + (min ? `; lowest lines: ${min.pkg} ${min.lines.toFixed(2)}%` : "") + newNote
+  );
+  const score = coverageScore(perPkg);
+  if (score) console.log(`SCORE: ${score}`);
+  return testExit;
+}
+
+// src/debt-markers.ts
+import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { relative as relative4, resolve as resolve7 } from "path";
+function parseAllowlist2(allowlistPath) {
+  if (!existsSync8(allowlistPath)) return { entries: [], raw: [] };
+  const raw = JSON.parse(readFileSync8(allowlistPath, "utf8"));
+  const list = raw.allowlist;
+  if (!Array.isArray(list)) {
+    throw new Error(`${allowlistPath}: "allowlist" must be an array of "path:line" strings`);
+  }
+  const entries = [];
+  const rawStrings = [];
+  for (const item of list) {
+    if (typeof item !== "string") {
+      throw new Error(`${allowlistPath}: allowlist entries must be "path:line" strings`);
+    }
+    const idx = item.lastIndexOf(":");
+    const path = idx < 0 ? "" : item.slice(0, idx);
+    const line = idx < 0 ? Number.NaN : Number.parseInt(item.slice(idx + 1), 10);
+    if (!path || !Number.isInteger(line) || line <= 0) {
+      throw new Error(`${allowlistPath}: "${item}" is not a valid "path:line" entry`);
+    }
+    entries.push({ path, line });
+    rawStrings.push(item);
+  }
+  return { entries, raw: rawStrings };
+}
+function buildMarkerRe(tokens) {
+  return new RegExp(`\\b(${tokens.join("|")})\\b`);
+}
+function buildTrackerRes(patterns) {
+  return patterns.map((p) => new RegExp(p, "i"));
+}
+function shouldExclude(relPath, prefixes, exact) {
+  if (exact.has(relPath)) return true;
+  return prefixes.some((prefix) => relPath.startsWith(prefix));
+}
+function scan2(ctx) {
+  const { scanRoots, excludeDirSegments, excludePathPrefixes, sourceExtensions, debt } = ctx.config;
+  const markerRe = buildMarkerRe(debt.markerTokens);
+  const trackerRes = buildTrackerRes(debt.trackerPatterns);
+  const { entries: allowlist, raw } = parseAllowlist2(resolve7(ctx.repoRoot, debt.allowlistPath));
+  const allowSet = new Set(raw);
+  const matchedAllow = /* @__PURE__ */ new Set();
+  const excludeExact = /* @__PURE__ */ new Set([
+    "packages/repo-gates/src/config.ts",
+    "packages/repo-gates/src/debt-markers.ts",
+    "packages/repo-gates/src/debt-markers.test.ts"
+  ]);
+  const untracked = [];
+  for (const root of scanRoots) {
+    for (const abs of walk(resolve7(ctx.repoRoot, root), excludeDirSegments)) {
+      const rel = relative4(ctx.repoRoot, abs).replaceAll("\\", "/");
+      if (!hasExtension(rel, sourceExtensions)) continue;
+      if (shouldExclude(rel, excludePathPrefixes, excludeExact)) continue;
+      const lines = readFileSync8(abs, "utf8").split("\n");
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] ?? "";
+        const match = line.match(markerRe);
+        if (!match) continue;
+        if (trackerRes.some((re) => re.test(line))) continue;
+        const key = `${rel}:${i + 1}`;
+        const marker = {
+          path: rel,
+          line: i + 1,
+          marker: match[1] ?? match[0],
+          text: line.trim()
+        };
+        if (allowSet.has(key)) matchedAllow.add(key);
+        else untracked.push(marker);
+      }
+    }
+  }
+  const staleAllowlistEntries = allowlist.map((e) => `${e.path}:${e.line}`).filter((key) => !matchedAllow.has(key));
+  return { untracked, staleAllowlistEntries };
+}
+function seedAllowlist2(ctx) {
+  const emptyCtx = {
+    ...ctx,
+    config: { ...ctx.config, debt: { ...ctx.config.debt, allowlistPath: "\0missing" } }
+  };
+  return scan2(emptyCtx).untracked.map((m) => `${m.path}:${m.line}`).sort((a, b) => a.localeCompare(b));
+}
+function writeSeed2(ctx) {
+  const path = resolve7(ctx.repoRoot, ctx.config.debt.allowlistPath);
+  const allowlist = seedAllowlist2(ctx);
+  const file = {
+    _comment: "Grandfathered untracked debt markers (path:line). Each must match an existing TODO/FIXME/HACK/XXX with no tracker ref on the same line. Ratchet only goes down.",
+    allowlist
+  };
+  writeFileSync4(path, `${JSON.stringify(file, null, 2)}
+`);
+  return { path, count: allowlist.length };
+}
+function runDebtMarkers(ctx, init = false) {
+  if (init) {
+    const { path, count } = writeSeed2(ctx);
+    console.log(`debt-marker guard: seeded ${count} grandfathered marker(s) \u2192 ${path}`);
+    return 0;
+  }
+  const { untracked, staleAllowlistEntries } = scan2(ctx);
+  if (staleAllowlistEntries.length > 0) {
+    console.error(`${ctx.config.debt.allowlistPath} has entries that no longer match a marker:`);
+    for (const k of staleAllowlistEntries) console.error(`  - ${k}`);
+    console.error("Remove these entries \u2014 the ratchet only goes down.\n");
+  }
+  if (untracked.length > 0) {
+    console.error("Untracked debt markers found:");
+    for (const m of untracked) console.error(`  ${m.path}:${m.line}  ${m.marker}: ${m.text}`);
+    console.error(
+      `
+Pair each marker with a tracker reference on the same line (ABC-123 / #123 / URL), remove it, or \u2014 with justification \u2014 allowlist it.`
+    );
+    return 1;
+  }
+  if (staleAllowlistEntries.length > 0) return 1;
+  const grandfathered = parseAllowlist2(resolve7(ctx.repoRoot, ctx.config.debt.allowlistPath)).raw.length;
+  console.log(`SCORE: debt-markers \u2014 ${grandfathered} grandfathered, 0 untracked`);
+  console.log("Debt-marker guard ok.");
+  return 0;
+}
+
+// src/docs-coverage.ts
+import { readFileSync as readFileSync9 } from "fs";
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += ".*";
+        i++;
+        if (glob[i + 1] === "/") i++;
+      } else {
+        re += "[^/]*";
+      }
+    } else if (c && "\\^$.|?+()[]{}/".includes(c)) {
+      re += `\\${c}`;
+    } else {
+      re += c;
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function matchesAny(path, globs) {
+  return (globs ?? []).some((g) => globToRegExp(g).test(path));
+}
+var ADDED = /* @__PURE__ */ new Set(["added", "copied"]);
+var PRESENT = /* @__PURE__ */ new Set(["added", "copied", "modified", "renamed", "changed"]);
+function fileTriggersSurface(file, surface) {
+  if (!globToRegExp(surface.glob).test(file.filename)) return false;
+  const set = surface.on === "added" ? ADDED : PRESENT;
+  return set.has(file.status);
+}
+function triggeredSurfaces(files, config) {
+  const out = [];
+  for (const file of files) {
+    if (matchesAny(file.filename, config.exclude)) continue;
+    for (const surface of config.surfaces) {
+      if (fileTriggersSurface(file, surface)) {
+        out.push({ file: file.filename, label: surface.label });
+        break;
+      }
+    }
+  }
+  return out;
+}
+function hasDocsChange(files, config) {
+  return files.some(
+    (f) => PRESENT.has(f.status) && !matchesAny(f.filename, config.exclude) && matchesAny(f.filename, config.docsGlobs)
+  );
+}
+function stripFencedCode(markdown) {
+  return (markdown ?? "").replace(/```[\s\S]*?```/g, "").replace(/~~~[\s\S]*?~~~/g, "");
+}
+function escapeHatch(body) {
+  const line = /^[ \t>*-]*docs:\s*n\/?a\b[ \t]*[-:—]?[ \t]*(.*)$/im;
+  const match = line.exec(stripFencedCode(body));
+  if (!match) return { present: false };
+  return { present: true, reason: (match[1] ?? "").trim() };
+}
+function evaluate(files, body, config) {
+  const triggered = triggeredSurfaces(files, config);
+  if (triggered.length === 0) return { status: "skip" };
+  if (hasDocsChange(files, config)) return { status: "pass", triggered };
+  const hatch = escapeHatch(body);
+  if (hatch.present) return { status: "waived", triggered, reason: hatch.reason };
+  return { status: "fail", triggered };
+}
+function escapeWorkflowCommand(message) {
+  return message.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function notice(message) {
+  console.log(`::notice title=Docs coverage::${escapeWorkflowCommand(message)}`);
+}
+async function fetchChangedFiles(opts) {
+  const files = [];
+  for (let page = 1; page <= 30; page++) {
+    const res = await fetch(
+      `https://api.github.com/repos/${opts.repo}/pulls/${opts.number}/files?per_page=100&page=${page}`,
+      {
+        headers: {
+          Authorization: `Bearer ${opts.token}`,
+          Accept: "application/vnd.github+json",
+          "X-GitHub-Api-Version": "2022-11-28",
+          "User-Agent": "repo-gates-docs-coverage"
+        },
+        signal: AbortSignal.timeout(15e3)
+      }
+    );
+    if (!res.ok) {
+      throw new Error(`GitHub API ${res.status} listing PR files: ${await res.text()}`);
+    }
+    const batch = await res.json();
+    for (const f of batch) files.push({ filename: f.filename, status: f.status });
+    if (batch.length < 100) break;
+  }
+  return files;
+}
+async function runDocsCoverage(ctx) {
+  const config = ctx.config.docsCoverage;
+  if (config.surfaces.length === 0) {
+    console.log("docs-coverage: no surfaces configured \u2014 no-op.");
+    return 0;
+  }
+  const repo = process.env.GITHUB_REPOSITORY;
+  const number = process.env.PR_NUMBER;
+  const token = process.env.GITHUB_TOKEN;
+  const body = process.env.PR_BODY ?? "";
+  if (!repo || !number || !token) {
+    console.log("docs-coverage: not running in a PR context (no GITHUB_REPOSITORY/PR_NUMBER/GITHUB_TOKEN) \u2014 skipping.");
+    return 0;
+  }
+  if (!/^\d+$/.test(number)) {
+    console.error(`docs-coverage: PR_NUMBER is not numeric: ${JSON.stringify(number)}`);
+    return 1;
+  }
+  const files = await fetchChangedFiles({ repo, number, token });
+  const result = evaluate(files, body, config);
+  if (result.status === "skip") {
+    notice("No user-facing surface changed in this PR \u2014 nothing to gate.");
+    return 0;
+  }
+  const list = result.triggered.map((t) => `    - ${t.file}  (${t.label})`).join("\n");
+  if (result.status === "pass") {
+    console.log("SCORE: docs-coverage \u2014 surface changes accompanied by docs");
+    console.log("docs-coverage: surface changes are accompanied by docs.");
+    return 0;
+  }
+  if (result.status === "waived") {
+    notice(
+      `Docs opt-out accepted: "docs: n/a${result.reason ? ` - ${result.reason}` : ""}". Surface(s):
+${list}`
+    );
+    return 0;
+  }
+  console.error("docs-coverage: this PR changes a user-facing surface but adds no docs:");
+  console.error(list);
+  console.error(
+    "\n  Add or update docs for the change, OR \u2014 if it genuinely needs none \u2014 add a line"
+  );
+  console.error("  `docs: n/a - <reason>` to the PR body to opt out on the record.");
+  return 1;
+}
+
+// src/file-sizes.ts
+import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { relative as relative5, resolve as resolve8 } from "path";
+function loadBudgets3(budgetsPath) {
+  if (!existsSync9(budgetsPath)) return {};
+  const raw = JSON.parse(readFileSync10(budgetsPath, "utf8"));
+  const budgets = raw.budgets;
+  if (budgets === null || typeof budgets !== "object" || Array.isArray(budgets)) {
+    throw new Error(`${budgetsPath}: "budgets" must be an object`);
+  }
+  const normalized = {};
+  for (const [path, value] of Object.entries(budgets)) {
+    if (typeof value !== "number" || value <= 0) {
+      throw new Error(`${budgetsPath}: budgets["${path}"] must be a positive number`);
+    }
+    normalized[path] = value;
+  }
+  return normalized;
+}
+function shouldExclude2(relPath, prefixes) {
+  return prefixes.some((prefix) => relPath.startsWith(prefix));
+}
+function collectFiles(ctx) {
+  const { scanRoots, excludeDirSegments, excludePathPrefixes, sourceExtensions } = ctx.config;
+  const out = [];
+  for (const root of scanRoots) {
+    for (const abs of walk(resolve8(ctx.repoRoot, root), excludeDirSegments)) {
+      const rel = relative5(ctx.repoRoot, abs).replaceAll("\\", "/");
+      if (!hasExtension(rel, sourceExtensions)) continue;
+      if (shouldExclude2(rel, excludePathPrefixes)) continue;
+      out.push({ rel, lines: countLines(abs) });
+    }
+  }
+  return out;
+}
+function scan3(ctx) {
+  const threshold = ctx.config.fileSize.threshold;
+  const budgets = loadBudgets3(resolve8(ctx.repoRoot, ctx.config.fileSize.budgetsPath));
+  const failures = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const { rel, lines } of collectFiles(ctx)) {
+    seen.add(rel);
+    const explicit = budgets[rel];
+    if (explicit !== void 0) {
+      if (lines > explicit) {
+        failures.push({
+          path: rel,
+          lines,
+          budget: explicit,
+          reason: `exceeds frozen budget (${lines} > ${explicit}); refactor instead of raising the budget`
+        });
+      }
+    } else if (lines > threshold) {
+      failures.push({
+        path: rel,
+        lines,
+        budget: threshold,
+        reason: `exceeds default threshold (${lines} > ${threshold}); split the file or add a justified budget entry`
+      });
+    }
+  }
+  const staleBudgetEntries = Object.keys(budgets).filter((p) => !seen.has(p));
+  return { failures, staleBudgetEntries };
+}
+function seedBudgets2(ctx) {
+  const threshold = ctx.config.fileSize.threshold;
+  const budgets = {};
+  for (const { rel, lines } of collectFiles(ctx)) {
+    if (lines > threshold) budgets[rel] = lines;
+  }
+  return Object.fromEntries(Object.entries(budgets).sort(([a], [b]) => a.localeCompare(b)));
+}
+function writeSeed3(ctx) {
+  const path = resolve8(ctx.repoRoot, ctx.config.fileSize.budgetsPath);
+  const budgets = seedBudgets2(ctx);
+  const file = {
+    _comment: "Grandfathered per-file line budgets. Files over the threshold are frozen at their current line count; the ratchet only goes down. Refactor and lower these; never raise them.",
+    budgets
+  };
+  writeFileSync5(path, `${JSON.stringify(file, null, 2)}
+`);
+  return { path, count: Object.keys(budgets).length };
+}
+function tightest(ctx) {
+  const threshold = ctx.config.fileSize.threshold;
+  const budgets = loadBudgets3(resolve8(ctx.repoRoot, ctx.config.fileSize.budgetsPath));
+  let best;
+  for (const { rel, lines } of collectFiles(ctx)) {
+    const budget = budgets[rel] ?? threshold;
+    const headroom = budget - lines;
+    if (!best || headroom < best.headroom) best = { path: rel, lines, budget, headroom };
+  }
+  return best;
+}
+function runFileSizes(ctx, init = false) {
+  if (init) {
+    const { path, count } = writeSeed3(ctx);
+    console.log(`file-size guard: seeded ${count} grandfathered budget(s) \u2192 ${path}`);
+    return 0;
+  }
+  const { failures, staleBudgetEntries } = scan3(ctx);
+  if (staleBudgetEntries.length > 0) {
+    console.error(`${ctx.config.fileSize.budgetsPath} has entries for files that no longer exist:`);
+    for (const p of staleBudgetEntries) console.error(`  - ${p}`);
+    console.error("Remove these entries to keep the budget honest.\n");
+  }
+  if (failures.length > 0) {
+    console.error("File-size guard failed:");
+    for (const f of failures) console.error(`  ${f.path}: ${f.reason}`);
+    console.error(
+      `
+The ratchet only goes down \u2014 refactor large files into smaller modules rather than raising their budget.`
+    );
+    return 1;
+  }
+  if (staleBudgetEntries.length > 0) return 1;
+  const t = tightest(ctx);
+  if (t) {
+    console.log(
+      `SCORE: file-size \u2014 tightest ${t.path} ${t.lines}/${t.budget} (${t.headroom} to spare)`
+    );
+  }
+  console.log("File-size guard ok.");
+  return 0;
+}
+
+// src/init.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync11, mkdirSync, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename2, dirname as dirname4, join as join6, resolve as resolve9 } from "path";
+import { satisfies as satisfies2 } from "semver";
+
+// src/init-detect.ts
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname3, join as join5, relative as relative6 } from "path";
+import { createRequire } from "module";
+import { minVersion, satisfies, valid, validRange } from "semver";
+import { parse as parse2 } from "yaml";
+var excluded = [
+  ...DEFAULT_CONFIG.excludeDirSegments,
+  ".git",
+  ".worktrees",
+  ".next",
+  ".yarn",
+  ".cache",
+  "gates"
+];
+function readJson(file) {
+  return JSON.parse(readFileSync11(file, "utf8"));
+}
+function detectManager(cwd, pkg) {
+  const declared = pkg.packageManager?.split("@")[0];
+  if (declared) {
+    if (["pnpm", "npm", "yarn", "bun"].includes(declared)) return declared;
+    throw new Error(`Unsupported package manager: ${declared}`);
+  }
+  const locks = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["pnpm-workspace.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["bun.lock", "bun"],
+    ["bun.lockb", "bun"],
+    ["package-lock.json", "npm"]
+  ];
+  return locks.find(([file]) => existsSync10(join5(cwd, file)))?.[1] ?? "npm";
+}
+function discoverProjects(cwd, pkg) {
+  const workspaceFile = join5(cwd, "pnpm-workspace.yaml");
+  const workspace = existsSync10(workspaceFile) ? parse2(readFileSync11(workspaceFile, "utf8")) : void 0;
+  const patterns = workspace?.packages ?? (Array.isArray(pkg.workspaces) ? pkg.workspaces : pkg.workspaces?.packages) ?? [];
+  if (patterns.some((p) => /[{}[\]?]/.test(p))) {
+    throw new Error(
+      "Workspace discovery supports literal paths, * and ** globs, and ! exclusions. Expand other workspace patterns before running init."
+    );
+  }
+  const included = patterns.filter((p) => !p.startsWith("!")).map((p) => p.replace(/^\.\//, "").replace(/\/$/, ""));
+  const omitted = patterns.filter((p) => p.startsWith("!")).map((p) => p.slice(1).replace(/^\.\//, "").replace(/\/$/, ""));
+  const projects = [{ dir: ".", pkg }];
+  if (included.length) {
+    for (const file of walk(cwd, excluded)) {
+      if (!file.endsWith(`${process.platform === "win32" ? "\\" : "/"}package.json`)) continue;
+      const dir = relative6(cwd, dirname3(file)).replaceAll("\\", "/");
+      if (dir && matchesAny(dir, included) && !matchesAny(dir, omitted))
+        projects.push({ dir, pkg: readJson(file) });
+    }
+  }
+  return {
+    projects: projects.sort((a, b) => a.dir.localeCompare(b.dir)),
+    ignoredPatterns: omitted.map((pattern) => `${pattern}/**`)
+  };
+}
+function dependency(pkg, name) {
+  return pkg.devDependencies?.[name] ?? pkg.dependencies?.[name];
+}
+function dependencyRange(cwd, pkg, name) {
+  const declared = dependency(pkg, name);
+  if (!declared) return void 0;
+  const workspaceFile = join5(cwd, "pnpm-workspace.yaml");
+  if (declared.startsWith("catalog:") && existsSync10(workspaceFile)) {
+    const data = parse2(readFileSync11(workspaceFile, "utf8"));
+    const catalog = declared.slice("catalog:".length);
+    return catalog ? data?.catalogs?.[catalog]?.[name] : data?.catalog?.[name];
+  }
+  return declared;
+}
+function dependencyVersion(cwd, project, name) {
+  const range = dependencyRange(cwd, project.pkg, name);
+  if (!range) return void 0;
+  try {
+    const require2 = createRequire(join5(cwd, project.dir, "package.json"));
+    const version = readJson(require2.resolve(`${name}/package.json`)).version;
+    if (valid(version) && (!validRange(range) || satisfies(version, range))) return version;
+  } catch {
+  }
+  try {
+    return minVersion(range)?.version;
+  } catch {
+    return void 0;
+  }
+}
+function requireCompatible(cwd, pkg, name, range) {
+  if (!dependency(pkg, name)) return;
+  const version = dependencyVersion(cwd, { dir: ".", pkg }, name);
+  if (!version || !satisfies(version, range)) {
+    throw new Error(
+      `${name} must satisfy ${range}. Upgrade or resolve the existing dependency before init, or use --no-design-system.`
+    );
+  }
+}
+
+// src/design-system.ts
+var designSystemRules = {
+  "shadcn/no-restyle": ["error", { allow: ["layout"] }],
+  "shadcn/no-raw-colors": "error",
+  "shadcn/no-arbitrary-values": "error",
+  "shadcn/no-inline-styles": "error",
+  "shadcn/no-unknown-classes": "error",
+  "shadcn/require-static-classes": "error"
+};
+var componentDefinitionRules = { "shadcn/no-restyle": "off" };
+
+// src/init-design-system.ts
+var ESLINT_CONFIG = "eslint.design-system.config.mjs";
+var OXLINT_CONFIG = ".oxlintrc.design-system.json";
+function eslintConfig(files, componentFiles, ignoredProjects = []) {
+  return `// Generated by repo-gates init. Edit these scopes and rule overrides for your project.
+// Rule docs: https://github.com/shadcn-ui/lint
+import { plugin as shadcn } from "@shadcn/lint";
+import tsParser from "@typescript-eslint/parser";
+import { designSystemRules, componentDefinitionRules } from "@fantastic.dev/repo-gates/design-system";
+
+export default [
+  { ignores: ${JSON.stringify(["**/node_modules/**", "**/dist/**", "**/out/**", "**/.next/**", "**/coverage/**", "**/.git/**", "**/.worktrees/**", ...ignoredProjects])} },
+  {
+    files: ${JSON.stringify(files)},
+    languageOptions: { parser: tsParser, parserOptions: { ecmaFeatures: { jsx: true } } },
+    plugins: { shadcn },
+    rules: {
+      ...designSystemRules,
+      // Override individual defaults here, e.g. "shadcn/no-inline-styles": "off".
+    },
+  },
+  {
+    files: ${JSON.stringify(componentFiles)},
+    rules: { ...componentDefinitionRules },
+  },
+];
+`;
+}
+function oxlintConfig(files, componentFiles, ignoredProjects = []) {
+  return JSON.stringify(
+    {
+      $schema: "./node_modules/oxlint/configuration_schema.json",
+      categories: { correctness: "off" },
+      jsPlugins: ["@shadcn/lint"],
+      ignorePatterns: [
+        "**/node_modules/**",
+        "**/dist/**",
+        "**/out/**",
+        "**/.next/**",
+        "**/coverage/**",
+        "**/.git/**",
+        "**/.worktrees/**",
+        ...ignoredProjects
+      ],
+      rules: {},
+      overrides: [
+        { files, rules: designSystemRules },
+        { files: componentFiles, rules: componentDefinitionRules }
+      ]
+    },
+    null,
+    2
+  ) + "\n";
+}
+
+// src/init.ts
+function parseInitOptions(args) {
+  const options = {};
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--skip-install") options.install = false;
+    else if (arg === "--no-design-system") options.designSystem = false;
+    else if (arg === "--no-shadscan") options.shadscan = false;
+    else if (arg === "--shadscan-floor" || arg.startsWith("--shadscan-floor=")) {
+      const raw = arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : args[++i];
+      if (!raw || !/^\d+$/.test(raw) || Number(raw) > 100) {
+        throw new Error("--shadscan-floor must be an integer from 0 to 100.");
+      }
+      options.shadscanFloor = Number(raw);
+    } else throw new Error(`Unknown init option: ${arg}`);
+  }
+  return options;
+}
+function writeJson(file, value) {
+  writeFileSync6(file, `${JSON.stringify(value, null, 2)}
+`);
+}
+function shellQuote(value) {
+  if (!/^[a-zA-Z0-9_./ @+-]+$/.test(value)) {
+    throw new Error(
+      "A Shadscan workspace path contains shell-special characters. Define check:shadscan manually or use --no-shadscan."
+    );
+  }
+  return `"${value === "." ? "." : `./${value}`}"`;
+}
+function runInit(cwd, options = {}) {
+  try {
+    return initialize(cwd, options);
+  } catch (error) {
+    console.error(`repo-gates init: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+function initialize(cwd, options) {
+  const packagePath = join6(cwd, "package.json");
+  if (!existsSync11(packagePath))
+    throw new Error("Run init from a repository root containing package.json.");
+  const floor = options.shadscanFloor ?? 80;
+  if (!Number.isInteger(floor) || floor < 0 || floor > 100)
+    throw new Error("--shadscan-floor must be an integer from 0 to 100.");
+  const pkg = readJson(packagePath);
+  const configPath = join6(cwd, "repo-gates.config.json");
+  const config = existsSync11(configPath) ? readJson(configPath) : {};
+  const manager = detectManager(cwd, pkg);
+  const { projects, ignoredPatterns } = discoverProjects(cwd, pkg);
+  const scripts = { ...pkg.scripts };
+  const added = [];
+  const addScript = (name, command) => {
+    if (scripts[name] !== void 0) return;
+    scripts[name] = command;
+    added.push(name);
+  };
+  const devDependencies = { ...pkg.devDependencies };
+  const addDependency = (name, version) => {
+    if (!dependency(pkg, name)) devDependencies[name] = version;
+  };
+  const filesToWrite = /* @__PURE__ */ new Map();
+  const notices = [];
+  const tailwindProjects = projects.filter((project) => {
+    const own = dependencyVersion(cwd, project, "tailwindcss");
+    const root = dependencyVersion(cwd, { dir: ".", pkg }, "tailwindcss");
+    return (own ?? root)?.startsWith("4.");
+  });
+  const shadcnProjects = projects.filter(
+    (project) => existsSync11(join6(cwd, project.dir, "components.json"))
+  );
+  const useDesign = options.designSystem !== false && tailwindProjects.length > 0;
+  const useShadscan = options.shadscan !== false && shadcnProjects.length > 0;
+  if (useDesign && !scripts["check:design-system"]) {
+    if (!satisfies2(process.versions.node, ">=20.19"))
+      throw new Error(
+        "Design-system setup requires Node >=20.19. Upgrade Node or use --no-design-system."
+      );
+    const useOxlint = Boolean(dependency(pkg, "oxlint") || existsSync11(join6(cwd, ".oxlintrc.json"))) && !dependency(pkg, "eslint");
+    requireCompatible(cwd, pkg, "@shadcn/lint", ">=0.1.5 <0.2.0");
+    if (useOxlint) {
+      if (!satisfies2(process.versions.node, "^20.19.0 || >=22.12.0"))
+        throw new Error("Oxlint requires Node ^20.19.0 or >=22.12.0.");
+      requireCompatible(cwd, pkg, "oxlint", ">=1.80.0");
+      addDependency("oxlint", "1.80.0");
+    } else {
+      requireCompatible(cwd, pkg, "eslint", ">=9.30.0");
+      requireCompatible(cwd, pkg, "@typescript-eslint/parser", ">=8.40.0");
+      addDependency("eslint", "9.39.4");
+      addDependency("@typescript-eslint/parser", "8.40.0");
+    }
+    addDependency("@shadcn/lint", "0.1.5");
+    const scopes = tailwindProjects.map(
+      ({ dir }) => dir === "." ? "**/*.{js,jsx,ts,tsx}" : `${dir}/**/*.{js,jsx,ts,tsx}`
+    );
+    const componentScopes = tailwindProjects.flatMap(({ dir }) => {
+      const prefix = dir === "." ? "" : `${dir}/`;
+      return [
+        `${prefix}src/components/ui/**`,
+        `${prefix}components/ui/**`,
+        ...basename2(dir) === "ui" ? [`${prefix}src/components/**`] : []
+      ];
+    });
+    const ignoredProjects = [
+      ...ignoredPatterns,
+      ...projects.filter((p) => p.dir !== "." && !tailwindProjects.includes(p)).map((p) => `${p.dir}/**`)
+    ];
+    const file = useOxlint ? OXLINT_CONFIG : ESLINT_CONFIG;
+    if (!existsSync11(join6(cwd, file)))
+      filesToWrite.set(
+        file,
+        useOxlint ? oxlintConfig(scopes, componentScopes, ignoredProjects) : eslintConfig(scopes, componentScopes, ignoredProjects)
+      );
+    else
+      notices.push(
+        `Preserved ${file}; verify its rule policy and component scopes. Existing rules were not changed.`
+      );
+    addScript(
+      "check:design-system",
+      `${useOxlint ? "oxlint" : "eslint"} --config ${file} . --max-warnings 0`
+    );
+    if (filesToWrite.has(file))
+      notices.push(
+        `Design-system rules: all six enabled in ${file}. Check component-directory scopes and theme discovery. https://github.com/shadcn-ui/lint`
+      );
+  }
+  if (useShadscan && !scripts["check:shadscan"]) {
+    if (dependency(pkg, "@shadscan/cli") && dependencyRange(cwd, pkg, "@shadscan/cli") !== "0.7.0") {
+      throw new Error(
+        "Existing @shadscan/cli differs from the supported pin 0.7.0. Define your own check:shadscan script or use --no-shadscan."
+      );
+    }
+    addDependency("@shadscan/cli", "0.7.0");
+    addScript(
+      "check:shadscan",
+      shadcnProjects.map(
+        ({ dir }) => `shadscan ${shellQuote(dir)} --json --fail-under ${floor} --no-roast --no-interactive`
+      ).join(" && ")
+    );
+    notices.push(
+      `Shadscan floor: ${floor}/100 for ${shadcnProjects.map((p) => p.dir).join(", ")}. This is a starting policy, not a measured baseline; raise it as findings are fixed.`
+    );
+  }
+  addScript("check:all", "repo-gates check-all");
+  for (const [name, command] of Object.entries({
+    "check:size": "check-size",
+    "check:debt": "check-debt",
+    "check:circular": "check-circular",
+    "check:secrets": "check-secrets",
+    "check:ci-parity": "check-ci-parity"
+  }))
+    addScript(name, `repo-gates ${command}`);
+  const agents = projects.map(({ dir }) => dir === "." ? "AGENTS.md" : `${dir}/AGENTS.md`).filter((path) => existsSync11(join6(cwd, path)));
+  if (agents.length || config.agents?.targets?.length)
+    addScript("check:agents", "repo-gates check-agents");
+  if (scripts["test:coverage"]) addScript("check:coverage", "repo-gates check-coverage");
+  if (config.docsCoverage?.surfaces?.length)
+    addScript("check:docs-coverage", "repo-gates check-docs-coverage");
+  if (config.bundleSize?.targets?.length)
+    addScript("check:bundle-size", "repo-gates check-bundle-size");
+  config.runner ??= `${manager} run`;
+  config.scanRoots ??= ["."];
+  config.sourceExtensions ??= [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", ".mjs", ".cjs"];
+  config.excludeDirSegments ??= excluded;
+  config.coverage = {
+    summaryGlobs: projects.map(
+      ({ dir }) => dir === "." ? "coverage/coverage-summary.json" : `${dir}/coverage/coverage-summary.json`
+    ),
+    ...config.coverage
+  };
+  config.agents = { targets: agents, runnerCommand: manager, ...config.agents };
+  if (config.gates) {
+    const known = new Set(config.gates.map((g) => g.name));
+    const additions = DEFAULT_CONFIG.gates.filter((g) => added.includes(g.name) && !known.has(g.name)).map((g) => ({ ...g, conditional: false }));
+    const parityIndex = config.gates.findIndex((g) => g.name === "check:ci-parity");
+    config.gates.splice(parityIndex < 0 ? config.gates.length : parityIndex, 0, ...additions);
+  } else {
+    config.gates = DEFAULT_CONFIG.gates.filter((g) => scripts[g.name] !== void 0).map((g) => ({ ...g, conditional: false }));
+  }
+  pkg.scripts = scripts;
+  if (Object.keys(devDependencies).length) pkg.devDependencies = devDependencies;
+  for (const [file, content] of filesToWrite) writeFileSync6(join6(cwd, file), content);
+  writeJson(packagePath, pkg);
+  writeJson(configPath, config);
+  mkdirSync(join6(cwd, "gates"), { recursive: true });
+  const ctx = loadContext(cwd);
+  for (const [script, command, path, seed] of [
+    ["check:size", "repo-gates check-size", ctx.config.fileSize.budgetsPath, runFileSizes],
+    ["check:debt", "repo-gates check-debt", ctx.config.debt.allowlistPath, runDebtMarkers],
+    [
+      "check:circular",
+      "repo-gates check-circular",
+      ctx.config.circular.allowlistPath,
+      runCircularImports
+    ]
+  ]) {
+    const absolute = resolve9(cwd, path);
+    if (scripts[script] === command && !existsSync11(absolute)) {
+      mkdirSync(dirname4(absolute), { recursive: true });
+      if (seed(ctx, true) !== 0)
+        throw new Error(`Could not seed ${path}. Fix the error and rerun init.`);
+    }
+  }
+  console.log(
+    `Configured ${added.length} new script(s). Existing scripts, lint configs, and baselines were preserved.`
+  );
+  for (const notice2 of notices) console.log(notice2);
+  const missing = ["lint", "format:check", "typecheck", "test"].filter((name) => !scripts[name]);
+  if (missing.length)
+    console.log(
+      `Not configured: ${missing.join(", ")}. Add real project commands and entries to repo-gates.config.json to enable them.`
+    );
+  if (scripts["check:coverage"])
+    console.log(
+      "Coverage is enabled. Ensure test:coverage writes json-summary reports; run repo-gates check-coverage --init to seed floors."
+    );
+  console.log(
+    "Secret scanning is enabled with no automatic allowlist. Review any findings from check:all."
+  );
+  if (options.install !== false && (useDesign || useShadscan)) {
+    console.log(`Installing dependencies with ${manager} install...`);
+    const result = spawnSync4(manager, ["install"], {
+      cwd,
+      stdio: "inherit",
+      shell: process.platform === "win32"
+    });
+    if (result.error || result.status !== 0) {
+      console.error(
+        `Dependency installation failed. Files were saved; run ${manager} install or rerun init. ${result.error?.message ?? ""}`
+      );
+      return 1;
+    }
+  } else if (options.install === false && (useDesign || useShadscan)) {
+    console.log(
+      `Dependencies were recorded but not installed. Run ${manager} install before checking.`
+    );
+  }
+  if (scripts["check:all"] !== "repo-gates check-all") {
+    console.log(
+      "Existing check:all was preserved. Ensure it invokes repo-gates check-all so the new gates run."
+    );
+  }
+  console.log(
+    `Run ${config.runner} check:all locally and in CI. Commit package.json, the lockfile, generated lint config, repo-gates.config.json, and gates/.`
+  );
+  return 0;
+}
+
+// src/report.ts
+import { appendFileSync, existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { resolve as resolve10 } from "path";
+function attr(tag, name) {
+  return tag.match(new RegExp(`\\b${name}="([^"]*)"`))?.[1];
+}
+function parseJUnit(xml) {
+  const cases = [];
+  for (const match of xml.matchAll(/<testcase\b[^>]*\/?>/g)) {
+    const tag = match[0];
+    const timeSeconds = Number.parseFloat(attr(tag, "time") ?? "0");
+    if (!Number.isFinite(timeSeconds)) continue;
+    cases.push({
+      name: attr(tag, "name") ?? "",
+      classname: attr(tag, "classname") ?? "",
+      file: attr(tag, "file") ?? attr(tag, "classname") ?? "",
+      timeSeconds
+    });
+  }
+  return cases;
+}
+function fmtSeconds(s) {
+  return s >= 1 ? `${s.toFixed(2)}s` : `${(s * 1e3).toFixed(1)}ms`;
+}
+function collectTiming(ctx) {
+  const cases = [];
+  let files = 0;
+  for (const glob of ctx.config.report.junitGlobs) {
+    for (const path of expandGlob(ctx.repoRoot, glob)) {
+      files++;
+      cases.push(...parseJUnit(readFileSync12(path, "utf8")));
+    }
+  }
+  const totalSeconds = cases.reduce((a, c) => a + c.timeSeconds, 0);
+  return { report: { totalSeconds, totalTests: cases.length, cases }, files };
+}
+function formatTiming(report, topN) {
+  const slowest = [...report.cases].sort((a, b) => b.timeSeconds - a.timeSeconds).slice(0, topN);
+  const lines = [
+    "## Test timing",
+    "",
+    `**Total:** ${fmtSeconds(report.totalSeconds)} across ${report.totalTests} tests.`,
+    "",
+    `### Slowest ${slowest.length} tests`,
+    "",
+    "| Time | Test | File |",
+    "| ---: | --- | --- |"
+  ];
+  for (const c of slowest) {
+    const name = `${c.classname} \u203A ${c.name}`.replaceAll("|", "\\|");
+    lines.push(`| ${fmtSeconds(c.timeSeconds)} | ${name} | \`${c.file}\` |`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function pct2(n) {
+  return `${n.toFixed(1)}%`;
+}
+function formatQualityMetrics(ctx) {
+  const rows = [];
+  try {
+    const per = collectPerPackage(ctx);
+    const min = lowest(per);
+    rows.push([
+      "Coverage (lowest pkg)",
+      min ? `${pct2(min.lines)} lines \u2014 \`${min.pkg}\` (${per.length} pkgs)` : "\u2014"
+    ]);
+  } catch {
+    rows.push(["Coverage (lowest pkg)", "\u2014"]);
+  }
+  try {
+    const t = tightest(ctx);
+    rows.push([
+      "File size (tightest)",
+      t ? `\`${t.path}\` ${t.lines}/${t.budget} (${t.headroom} to spare)` : "\u2014"
+    ]);
+  } catch {
+    rows.push(["File size (tightest)", "\u2014"]);
+  }
+  try {
+    const { untracked } = scan2(ctx);
+    rows.push(["Debt markers (untracked)", String(untracked.length)]);
+  } catch {
+    rows.push(["Debt markers (untracked)", "\u2014"]);
+  }
+  try {
+    const path = resolve10(ctx.repoRoot, ctx.config.bundleSize.budgetsPath);
+    if (existsSync12(path)) {
+      const budgets = JSON.parse(readFileSync12(path, "utf8"));
+      for (const t of ctx.config.bundleSize.targets) {
+        const b = budgets[t.name];
+        const gzip = b?.totals?.gzip ?? {};
+        const total = Object.values(gzip).reduce((a, v) => a + v, 0);
+        rows.push([`Bundle budget (${t.name})`, `${(total / 1024).toFixed(1)} KB gz`]);
+      }
+    }
+  } catch {
+    rows.push(["Bundle budget", "\u2014"]);
+  }
+  const lines = ["## Code-quality metrics", "", "| Metric | Current |", "| --- | --- |"];
+  for (const [k, v] of rows) lines.push(`| ${k} | ${v} |`);
+  return `${lines.join("\n")}
+`;
+}
+function emitSummary(markdown) {
+  process.stdout.write(`${markdown}
+`);
+  const summary = process.env.GITHUB_STEP_SUMMARY;
+  if (summary) {
+    try {
+      appendFileSync(summary, `${markdown}
+`);
+    } catch (err) {
+      console.error(`report: could not write GITHUB_STEP_SUMMARY: ${err}`);
+    }
+  }
+}
+function runTestTiming(ctx) {
+  const { report, files } = collectTiming(ctx);
+  if (files === 0) {
+    console.log("report:test-timing \u2014 no junit files found (run test:ci first); skipping.");
+    return 0;
+  }
+  emitSummary(formatTiming(report, ctx.config.report.topN));
+  return 0;
+}
+function runQualityMetrics(ctx) {
+  emitSummary(formatQualityMetrics(ctx));
+  return 0;
+}
+
+// src/secrets.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { resolve as resolve11 } from "path";
+function parseAllowlist3(allowlistPath) {
+  if (!existsSync13(allowlistPath)) return { entries: [], raw: [] };
+  const raw = JSON.parse(readFileSync13(allowlistPath, "utf8"));
+  const list = raw.allowlist;
+  if (!Array.isArray(list)) {
+    throw new Error(`${allowlistPath}: "allowlist" must be an array of "path:line" strings`);
+  }
+  const entries = [];
+  const rawStrings = [];
+  for (const item of list) {
+    if (typeof item !== "string") {
+      throw new Error(`${allowlistPath}: allowlist entries must be "path:line" strings`);
+    }
+    const idx = item.lastIndexOf(":");
+    const path = idx < 0 ? "" : item.slice(0, idx);
+    const line = idx < 0 ? Number.NaN : Number.parseInt(item.slice(idx + 1), 10);
+    if (!path || !Number.isInteger(line) || line <= 0) {
+      throw new Error(`${allowlistPath}: "${item}" is not a valid "path:line" entry`);
+    }
+    entries.push({ path, line });
+    rawStrings.push(item);
+  }
+  return { entries, raw: rawStrings };
+}
+function listTrackedFiles(repoRoot) {
+  const proc = spawnSync5("git", ["ls-files", "-z"], { cwd: repoRoot, encoding: "utf8" });
+  if (proc.status !== 0 || !proc.stdout) return [];
+  return proc.stdout.split("\0").filter((f) => f.length > 0);
+}
+function fingerprint(matched) {
+  return createHash("sha256").update(matched).digest("hex").slice(0, 8);
+}
+function buildPatternRe(patterns) {
+  return new RegExp(`(${patterns.join(")|(")})`);
+}
+function scan4(ctx) {
+  const { excludeDirSegments, excludePathPrefixes, secrets } = ctx.config;
+  const patternRe = buildPatternRe(secrets.patterns);
+  const { entries: allowlist, raw } = parseAllowlist3(resolve11(ctx.repoRoot, secrets.allowlistPath));
+  const allowSet = new Set(raw);
+  const matchedAllow = /* @__PURE__ */ new Set();
+  const untracked = [];
+  for (const rel of listTrackedFiles(ctx.repoRoot)) {
+    if (hasExtension(rel, secrets.binaryExtensions)) continue;
+    if (excludeDirSegments.some((seg) => rel.split("/").includes(seg))) continue;
+    if (excludePathPrefixes.some((prefix) => rel.startsWith(prefix))) continue;
+    const abs = resolve11(ctx.repoRoot, rel);
+    let content;
+    try {
+      content = readFileSync13(abs, "utf8");
+    } catch {
+      continue;
+    }
+    if (content.includes("\0")) continue;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i] ?? "";
+      const match = line.match(patternRe);
+      if (!match) continue;
+      const key = `${rel}:${i + 1}`;
+      const finding = {
+        path: rel,
+        line: i + 1,
+        pattern: match[0].length > 12 ? `${match[0].slice(0, 4)}\u2026` : "match",
+        fingerprint: fingerprint(match[0])
+      };
+      if (allowSet.has(key)) matchedAllow.add(key);
+      else untracked.push(finding);
+    }
+  }
+  const staleAllowlistEntries = allowlist.map((e) => `${e.path}:${e.line}`).filter((key) => !matchedAllow.has(key));
+  return { untracked, staleAllowlistEntries };
+}
+function seedAllowlist3(ctx) {
+  const emptyCtx = {
+    ...ctx,
+    config: { ...ctx.config, secrets: { ...ctx.config.secrets, allowlistPath: "\0missing" } }
+  };
+  return scan4(emptyCtx).untracked.map((f) => `${f.path}:${f.line}`).sort((a, b) => a.localeCompare(b));
+}
+function writeSeed4(ctx) {
+  const path = resolve11(ctx.repoRoot, ctx.config.secrets.allowlistPath);
+  const allowlist = seedAllowlist3(ctx);
+  const file = {
+    _comment: "Grandfathered secret-shaped-string findings (path:line). Review each one BEFORE trusting this seed \u2014 it silences whatever it captures. Ratchet only goes down.",
+    allowlist
+  };
+  writeFileSync7(path, `${JSON.stringify(file, null, 2)}
+`);
+  return { path, count: allowlist.length };
+}
+function runSecrets(ctx, init = false) {
+  if (init) {
+    const { path, count } = writeSeed4(ctx);
+    console.log(`secrets guard: seeded ${count} grandfathered finding(s) \u2192 ${path}`);
+    console.log("Review every entry \u2014 the seed silences whatever it captures.");
+    return 0;
+  }
+  const { untracked, staleAllowlistEntries } = scan4(ctx);
+  if (staleAllowlistEntries.length > 0) {
+    console.error(`${ctx.config.secrets.allowlistPath} has entries that no longer match:`);
+    for (const k of staleAllowlistEntries) console.error(`  - ${k}`);
+    console.error("Remove these entries \u2014 the ratchet only goes down.\n");
+  }
+  if (untracked.length > 0) {
+    console.error("Secret-shaped strings found (fingerprint only \u2014 never the matched text):");
+    for (const f of untracked) {
+      console.error(`  ${f.path}:${f.line}  fingerprint:${f.fingerprint}`);
+    }
+    console.error(
+      "\nRotate and remove the credential, or \u2014 only if this is genuinely a false positive (a test fixture, a placeholder) \u2014 allowlist it via `repo-gates check-secrets --init`."
+    );
+    return 1;
+  }
+  if (staleAllowlistEntries.length > 0) return 1;
+  const grandfathered = parseAllowlist3(resolve11(ctx.repoRoot, ctx.config.secrets.allowlistPath)).raw.length;
+  console.log(`SCORE: secrets \u2014 ${grandfathered} grandfathered, 0 new`);
+  console.log("Secrets guard ok.");
+  return 0;
+}
+
+// src/validate-agents.ts
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
+import { resolve as resolve12 } from "path";
+function extractFencedBashBlocks(markdown) {
+  const blocks = [];
+  const fence = /```(?:bash|sh|shell)\n([\s\S]*?)```/g;
+  for (const m of markdown.matchAll(fence)) {
+    if (m[1] !== void 0) blocks.push(m[1]);
+  }
+  return blocks;
+}
+function stripShellComments(block) {
+  return block.split("\n").map((line) => {
+    const hash = line.indexOf("#");
+    return hash === -1 ? line : line.slice(0, hash);
+  }).join("\n");
+}
+function escapeRegExp2(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractScriptRefs(blocks, runnerCommand, ignoredSubcommands) {
+  const ignored = new Set(ignoredSubcommands);
+  const pm = escapeRegExp2(runnerCommand);
+  const runRe = new RegExp(`\\b${pm}\\s+run\\s+([a-zA-Z0-9:_-]+)`, "g");
+  const bareRe = new RegExp(`\\b${pm}\\s+([a-zA-Z0-9:][a-zA-Z0-9:_-]*)`, "g");
+  const out = /* @__PURE__ */ new Set();
+  for (const raw of blocks) {
+    const block = stripShellComments(raw);
+    for (const m of block.matchAll(runRe)) if (m[1]) out.add(m[1]);
+    for (const m of block.matchAll(bareRe)) {
+      const name = m[1];
+      if (name && name !== "run" && !ignored.has(name)) out.add(name);
+    }
+  }
+  return out;
+}
+function extractBacktickedPaths(markdown) {
+  const paths = [];
+  for (const m of markdown.matchAll(/`([^`\n]+)`/g)) {
+    const token = (m[1] ?? "").trim();
+    if (/^https?:\/\//.test(token)) continue;
+    if (/\s/.test(token)) continue;
+    if (token.startsWith("@")) continue;
+    if (token.endsWith("...")) continue;
+    if (/^\.[A-Za-z0-9]+$/.test(token)) continue;
+    if (!/^[.A-Za-z0-9_][A-Za-z0-9_.\-/]*\/?$/.test(token)) continue;
+    if (!token.includes("/")) continue;
+    const cleaned = token.replace(/\/+$/, "");
+    if (cleaned.includes("<") || cleaned.includes(">") || cleaned.includes("*")) continue;
+    paths.push(cleaned);
+  }
+  return paths;
+}
+function validateAgents(ctx) {
+  const { targets, knownMissingPaths, runnerCommand, ignoredSubcommands } = ctx.config.agents;
+  const scripts = new Set(Object.keys(loadScripts(ctx.repoRoot)));
+  const known = new Set(knownMissingPaths);
+  const failures = [];
+  for (const rel of targets) {
+    const abs = resolve12(ctx.repoRoot, rel);
+    if (!existsSync14(abs)) {
+      failures.push({ file: rel, kind: "missing-doc", detail: `${rel} not found` });
+      continue;
+    }
+    const src = readFileSync14(abs, "utf8");
+    for (const name of extractScriptRefs(
+      extractFencedBashBlocks(src),
+      runnerCommand,
+      ignoredSubcommands
+    )) {
+      if (!scripts.has(name)) {
+        failures.push({
+          file: rel,
+          kind: "missing-script",
+          detail: `\`${runnerCommand} ${name}\` referenced but not a package.json script`
+        });
+      }
+    }
+    for (const p of extractBacktickedPaths(src)) {
+      if (known.has(p)) continue;
+      if (!existsSync14(resolve12(ctx.repoRoot, p))) {
+        failures.push({
+          file: rel,
+          kind: "missing-path",
+          detail: `referenced path \`${p}\` does not exist`
+        });
+      }
+    }
+  }
+  return failures;
+}
+function runValidateAgents(ctx) {
+  const { targets } = ctx.config.agents;
+  if (targets.length === 0) {
+    console.log("check:agents \u2014 no agent docs configured; skipping.");
+    return 0;
+  }
+  const failures = validateAgents(ctx);
+  if (failures.length === 0) {
+    console.log(`\u2713 agent-doc validation passed (${targets.join(", ")})`);
+    return 0;
+  }
+  console.error("\u2717 agent-doc validation failed:");
+  for (const f of failures) console.error(`  [${f.kind}] ${f.file}: ${f.detail}`);
+  return 1;
+}
+
+// src/bin/repo-gates.ts
+var argv = process.argv.slice(2);
+var cmd = argv[0];
+var has = (flag) => argv.includes(flag);
+var USAGE = `repo-gates \u2014 config-driven repo quality gates
+
+Usage: repo-gates <command> [options]
+
+Commands:
+  check-all [--bail]        Run the whole gate manifest (quiet; --bail stops at first fail)
+  check-size [--init]       Per-file line-count ratchet (--init seeds baselines)
+  check-debt [--init]       Debt-marker (TODO/FIXME) ratchet (--init seeds the allowlist)
+  check-circular [--init]   Circular-import ratchet (--init seeds the allowlist)
+  check-secrets [--init]    Secret-shaped-string ratchet (--init seeds the allowlist)
+  check-coverage [--init]   Per-package coverage floors (--init seeds; --skip-run reuses summaries)
+  check-bundle-size [--init] Bundle raw+gzip+chunk ratchet (--init seeds)
+  check-agents              Validate AGENTS.md script/path references resolve
+  check-docs-coverage       PR surface-vs-docs gate (no-op outside a PR context)
+  check-ci-parity           Fail if CI workflows drift from the check:all manifest
+  report-test-timing        Non-gating test-timing dashboard (\u2192 stdout / step summary)
+  report-quality-metrics    Non-gating code-quality dashboard
+  init                      Configure applicable gates, scripts, baselines, and UI tooling
+    --skip-install          Write dependencies/configs without running the package manager
+    --no-design-system      Skip automatic @shadcn/lint setup
+    --no-shadscan            Skip automatic Shadscan setup
+    --shadscan-floor <0-100> Initial score floor (default: 80)
+
+Config: repo-gates.config.json at the repo root (partial overlay on built-in defaults).
+Docs:   https://github.com/FantasticDevHQ/repo-gates`;
+if (!cmd || has("--help") || has("-h")) {
+  console.log(USAGE);
+  process.exit(cmd ? 0 : 1);
+}
+if (cmd === "init") {
+  try {
+    process.exitCode = runInit(process.cwd(), parseInitOptions(argv.slice(1)));
+  } catch (error) {
+    console.error(`repo-gates init: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  }
+} else {
+  const ctx = loadContext();
+  switch (cmd) {
+    case "check-all":
+      process.exitCode = runCheckAll(ctx, {
+        verbose: process.env.CHECK_ALL_VERBOSE === "1",
+        bail: has("--bail")
+      });
+      break;
+    case "check-size":
+      process.exitCode = runFileSizes(ctx, has("--init"));
+      break;
+    case "check-debt":
+      process.exitCode = runDebtMarkers(ctx, has("--init"));
+      break;
+    case "check-circular":
+      process.exitCode = runCircularImports(ctx, has("--init"));
+      break;
+    case "check-secrets":
+      process.exitCode = runSecrets(ctx, has("--init"));
+      break;
+    case "check-coverage":
+      process.exitCode = runCoverage(ctx, { init: has("--init"), skipRun: has("--skip-run") });
+      break;
+    case "check-bundle-size":
+      process.exitCode = runBundleSize(ctx, has("--init"));
+      break;
+    case "check-agents":
+      process.exitCode = runValidateAgents(ctx);
+      break;
+    case "check-docs-coverage":
+      process.exitCode = await runDocsCoverage(ctx);
+      break;
+    case "check-ci-parity":
+      process.exitCode = runCiParity(ctx);
+      break;
+    case "report-test-timing":
+      process.exitCode = runTestTiming(ctx);
+      break;
+    case "report-quality-metrics":
+      process.exitCode = runQualityMetrics(ctx);
+      break;
+    default:
+      console.error(`repo-gates: unknown command '${cmd}'
+`);
+      console.error(USAGE);
+      process.exitCode = 1;
+  }
+}