@fantastic.dev/repo-gates 0.2.1-bootstrap.0

package/dist/index.js

@@ -0,0 +1,1995 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/config.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var DEFAULT_CONFIG = {
+  runner: "pnpm run",
+  gates: [
+    { name: "lint", conditional: false },
+    { name: "check:design-system", conditional: true },
+    { name: "format:check", conditional: false },
+    { name: "typecheck", conditional: false },
+    { name: "check:scripts", conditional: true },
+    { name: "check:deps", conditional: true },
+    { name: "check:dups", conditional: true },
+    { name: "check:size", conditional: false },
+    { name: "check:debt", conditional: false },
+    { name: "check:circular", conditional: true },
+    { name: "check:secrets", conditional: true },
+    { name: "check:agents", conditional: true },
+    { name: "check:shadscan", conditional: true },
+    { name: "check:docs-coverage", conditional: true },
+    { name: "check:bundle-size", conditional: true },
+    { name: "test", conditional: false },
+    { name: "check:coverage", conditional: true },
+    { name: "check:ci-parity", conditional: false }
+  ],
+  scanRoots: ["apps", "packages", "scripts"],
+  excludeDirSegments: [
+    "node_modules",
+    "dist",
+    "dist-e2e",
+    "out",
+    ".turbo",
+    ".wrangler",
+    "__golden__",
+    "_generated",
+    "coverage"
+  ],
+  excludePathPrefixes: [],
+  sourceExtensions: [".ts", ".tsx"],
+  fileSize: { threshold: 600, budgetsPath: "gates/file-size-budgets.json" },
+  debt: {
+    allowlistPath: "gates/debt-marker-allowlist.json",
+    markerTokens: ["TODO", "FIXME", "HACK", "XXX"],
+    trackerPatterns: ["\\b[A-Z]{2,}-\\d+\\b", "#\\d+\\b", "https?:\\/\\/\\S+"]
+  },
+  circular: { allowlistPath: "gates/circular-imports-allowlist.json" },
+  secrets: {
+    allowlistPath: "gates/secrets-allowlist.json",
+    patterns: [
+      "\\bAKIA[0-9A-Z]{16}\\b",
+      // AWS access key
+      "\\bASIA[0-9A-Z]{16}\\b",
+      // AWS temporary access key
+      "\\bgh[pousr]_[A-Za-z0-9]{36,}\\b",
+      // GitHub personal/OAuth/app/refresh token
+      "\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b",
+      // Slack token
+      "\\bsk_(?:live|test)_[A-Za-z0-9]{16,}\\b",
+      // Stripe secret key
+      "\\bnpm_[A-Za-z0-9]{36}\\b",
+      // npm access token
+      "\\bAIza[0-9A-Za-z_-]{35}\\b",
+      // Google API key
+      "-----BEGIN(?: RSA| EC| OPENSSH| DSA)? PRIVATE KEY-----",
+      // PEM private key
+      "://[^/\\s:@]+:[^/\\s:@]+@"
+      // credentials embedded in a URL
+    ],
+    binaryExtensions: [
+      ".png",
+      ".jpg",
+      ".jpeg",
+      ".gif",
+      ".ico",
+      ".webp",
+      ".pdf",
+      ".zip",
+      ".gz",
+      ".woff",
+      ".woff2",
+      ".ttf",
+      ".eot",
+      ".mp4",
+      ".mp3",
+      ".wasm"
+    ]
+  },
+  coverage: {
+    budgetsPath: "gates/coverage-budgets.json",
+    summaryGlobs: [
+      "apps/*/coverage/coverage-summary.json",
+      "packages/*/coverage/coverage-summary.json"
+    ]
+  },
+  ciParity: {
+    configPath: "gates/ci-parity-config.json",
+    rootGate: "check:all",
+    entryGates: ["check:all", "verify"],
+    workflowPrefix: "ci"
+  },
+  bundleSize: { budgetsPath: "gates/bundle-size-budgets.json", targets: [] },
+  report: { junitGlobs: [], topN: 20 },
+  agents: {
+    targets: [],
+    knownMissingPaths: [],
+    runnerCommand: "pnpm",
+    ignoredSubcommands: [
+      "run",
+      "install",
+      "i",
+      "add",
+      "remove",
+      "rm",
+      "up",
+      "update",
+      "exec",
+      "dlx",
+      "why",
+      "store",
+      "prune",
+      "audit",
+      "outdated",
+      "list",
+      "ls",
+      "link",
+      "unlink",
+      "publish",
+      "pack",
+      "rebuild",
+      "approve-builds",
+      "config",
+      "dedupe",
+      "fetch",
+      "import",
+      "patch",
+      "setup",
+      "create"
+    ]
+  },
+  docsCoverage: { docsGlobs: [], surfaces: [], exclude: [] }
+};
+var CONFIG_FILENAMES = ["repo-gates.config.json"];
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function mergeConfig(base, overlay) {
+  const out = { ...base };
+  for (const [key, value] of Object.entries(overlay)) {
+    if (value === void 0) continue;
+    const baseValue = base[key];
+    out[key] = isPlainObject(baseValue) && isPlainObject(value) ? { ...baseValue, ...value } : value;
+  }
+  return out;
+}
+function findConfigFile(repoRoot) {
+  for (const name of CONFIG_FILENAMES) {
+    const candidate = resolve(repoRoot, name);
+    if (existsSync(candidate)) return candidate;
+  }
+  return void 0;
+}
+function loadConfig(repoRoot = process.cwd()) {
+  const file = findConfigFile(repoRoot);
+  if (!file) return DEFAULT_CONFIG;
+  const overlay = JSON.parse(readFileSync(file, "utf8"));
+  return mergeConfig(DEFAULT_CONFIG, overlay);
+}
+function loadContext(repoRoot = process.cwd()) {
+  return { repoRoot, config: loadConfig(repoRoot) };
+}
+
+// src/check-all.ts
+import { spawnSync } from "child_process";
+
+// src/lib/pkg.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+function loadScripts(repoRoot) {
+  const packageJsonPath = resolve2(repoRoot, "package.json");
+  if (!existsSync2(packageJsonPath)) return {};
+  const pkg = JSON.parse(readFileSync2(packageJsonPath, "utf8"));
+  return pkg.scripts ?? {};
+}
+
+// src/check-all.ts
+function resolveGates(scripts, gates) {
+  return gates.filter((g) => !g.conditional || scripts[g.name] !== void 0).map((g) => g.name);
+}
+function gatesForRepo(ctx) {
+  return resolveGates(loadScripts(ctx.repoRoot), ctx.config.gates);
+}
+function formatGateLine(status, gate, seconds, width) {
+  const mark = status === "ok" ? "\u2713" : "\u2717";
+  return `${mark} ${gate.padEnd(width)} (${seconds.toFixed(1)}s)`;
+}
+var SIGNATURE_RE = /error TS\d+|: error |^error:|^✗ |^✖|^× |^FAIL\b|^Error: |\bAssertionError\b|\bbelow floor\b|\berror\b.*\bbudget\b|exceeds? .*budget|\[error\]|Code style issues/i;
+var MAX_SIGNATURE_LINES = 50;
+var TAIL_FALLBACK_LINES = 25;
+function extractFailureSignatures(output) {
+  const lines = output.split("\n");
+  const matched = lines.filter((l) => SIGNATURE_RE.test(l.trim()));
+  if (matched.length > 0) return matched.slice(0, MAX_SIGNATURE_LINES);
+  return lines.filter((l) => l.trim() !== "").slice(-TAIL_FALLBACK_LINES);
+}
+var SCORE_PREFIX = "SCORE:";
+function extractScores(output) {
+  return output.split("\n").map((l) => l.trim()).filter((l) => l.startsWith(SCORE_PREFIX)).map((l) => l.slice(SCORE_PREFIX.length).trim()).filter((l) => l.length > 0);
+}
+function formatScoresBlock(scores) {
+  if (scores.length === 0) return [];
+  const width = Math.max(...scores.map((s) => s.split("\u2014")[0]?.trim().length ?? 0));
+  const out = ["", "Scores:"];
+  for (const s of scores) {
+    const [label, ...rest] = s.split("\u2014");
+    out.push(
+      rest.length > 0 && label ? `  ${label.trim().padEnd(width)}  ${rest.join("\u2014").trim()}` : `  ${s}`
+    );
+  }
+  return out;
+}
+function runGate(gate, ctx, verbose) {
+  const [cmd, ...runnerArgs] = ctx.config.runner.split(/\s+/);
+  const start = performance.now();
+  const proc = spawnSync(cmd ?? "pnpm", [...runnerArgs, gate], {
+    cwd: ctx.repoRoot,
+    stdio: verbose ? "inherit" : "pipe",
+    encoding: "utf8",
+    env: process.env
+  });
+  const seconds = (performance.now() - start) / 1e3;
+  const errNote = proc.error ? `
+spawn error: ${proc.error.message}` : "";
+  const output = verbose ? errNote.trim() : `${proc.stdout ?? ""}
+${proc.stderr ?? ""}${errNote}`;
+  return { gate, ok: proc.status === 0 && !proc.error, seconds, output };
+}
+function runCheckAll(ctx, opts = {}) {
+  const verbose = opts.verbose ?? false;
+  const gates = gatesForRepo(ctx);
+  if (gates.length === 0) {
+    console.error("check:all \u2014 no gates resolved; check repo-gates.config.json");
+    return 1;
+  }
+  const width = Math.max(...gates.map((g) => g.length));
+  const results = [];
+  const overallStart = performance.now();
+  for (const gate of gates) {
+    if (verbose) console.log(`
+\u2500\u2500 ${gate} \u2500\u2500`);
+    const result = runGate(gate, ctx, verbose);
+    results.push(result);
+    console.log(formatGateLine(result.ok ? "ok" : "fail", gate, result.seconds, width));
+    if (!result.ok && opts.bail) break;
+  }
+  const failures = results.filter((r) => !r.ok);
+  const totalSeconds = (performance.now() - overallStart) / 1e3;
+  if (failures.length === 0) {
+    console.log(`
+${results.length}/${gates.length} gates passed (${totalSeconds.toFixed(1)}s)`);
+    const scores = results.flatMap((r) => extractScores(r.output));
+    for (const line of formatScoresBlock(scores)) console.log(line);
+    return 0;
+  }
+  const runner = ctx.config.runner;
+  console.error(`
+${failures.length} gate(s) failed: ${failures.map((f) => f.gate).join(", ")}
+`);
+  for (const f of failures) {
+    console.error(`\u2500\u2500 ${f.gate} \u2500\u2500`);
+    for (const line of extractFailureSignatures(f.output)) console.error(`  ${line}`);
+    console.error(`  \u21B3 re-run: ${runner} ${f.gate}  (or CHECK_ALL_VERBOSE=1 ${runner} check:all)`);
+  }
+  return 1;
+}
+
+// src/ci-parity.ts
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "fs";
+import { join, relative, resolve as resolve3 } from "path";
+import { parse } from "yaml";
+function loadParityConfig(configPath) {
+  if (!existsSync3(configPath)) return { aliases: {}, ciOnly: /* @__PURE__ */ new Set() };
+  const raw = JSON.parse(readFileSync3(configPath, "utf8"));
+  return { aliases: raw.aliases ?? {}, ciOnly: new Set(raw.ciOnly ?? []) };
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function makeRunTargetRe(runner) {
+  return new RegExp(`${escapeRegExp(runner)}\\s+([A-Za-z][\\w:-]*)(?![\\w./:-])`, "g");
+}
+function extractRunTargets(command, runner) {
+  const out = [];
+  for (const match of command.matchAll(makeRunTargetRe(runner))) {
+    const name = match[1];
+    if (name) out.push(name);
+  }
+  return out;
+}
+function computeReachable(scripts, gates, entryGates, runner) {
+  const reachable = /* @__PURE__ */ new Set();
+  const stack = [...entryGates, ...gates];
+  while (stack.length > 0) {
+    const name = stack.pop();
+    if (!name || reachable.has(name)) continue;
+    reachable.add(name);
+    const body = scripts[name];
+    if (body === void 0) continue;
+    for (const dep of extractRunTargets(body, runner)) {
+      if (!reachable.has(dep)) stack.push(dep);
+    }
+  }
+  return reachable;
+}
+function extractCiInvocations(filePath, repoRoot, runner) {
+  const text = readFileSync3(filePath, "utf8");
+  const doc = parse(text);
+  const workflow = relative(repoRoot, filePath);
+  const out = [];
+  if (!doc || typeof doc !== "object" || !doc.jobs) return out;
+  for (const [jobName, job] of Object.entries(doc.jobs)) {
+    const steps = job?.steps;
+    if (!Array.isArray(steps)) continue;
+    steps.forEach((step, idx) => {
+      const run = step?.run;
+      if (typeof run !== "string") return;
+      for (const script of extractRunTargets(run, runner)) {
+        out.push({ workflow, job: jobName, step: idx, script });
+      }
+    });
+  }
+  return out;
+}
+function listCiWorkflows(dir, prefix) {
+  if (!existsSync3(dir)) return [];
+  return readdirSync(dir).filter((f) => (f.endsWith(".yml") || f.endsWith(".yaml")) && f.startsWith(prefix)).map((f) => join(dir, f)).sort();
+}
+function evaluateParity(invocations, reachable, config, rootGate) {
+  const failures = [];
+  for (const inv of invocations) {
+    const canonical = config.aliases[inv.script] ?? inv.script;
+    if (config.ciOnly.has(canonical)) continue;
+    if (reachable.has(canonical)) continue;
+    const reason = canonical === inv.script ? `not reachable from ${rootGate}` : `aliased to "${canonical}", which is not reachable from ${rootGate}`;
+    failures.push({ ...inv, canonical, reason });
+  }
+  return failures;
+}
+function checkParity(ctx) {
+  const { runner, ciParity } = ctx.config;
+  const reachable = computeReachable(
+    loadScripts(ctx.repoRoot),
+    gatesForRepo(ctx),
+    ciParity.entryGates,
+    runner
+  );
+  const workflowsDir = resolve3(ctx.repoRoot, ".github/workflows");
+  const invocations = [];
+  for (const wf of listCiWorkflows(workflowsDir, ciParity.workflowPrefix)) {
+    invocations.push(...extractCiInvocations(wf, ctx.repoRoot, runner));
+  }
+  const config = loadParityConfig(resolve3(ctx.repoRoot, ciParity.configPath));
+  const failures = evaluateParity(invocations, reachable, config, ciParity.rootGate);
+  return { invocations, reachable, failures };
+}
+function formatFailure(f) {
+  return `  ${f.workflow} (job=${f.job}, step=${f.step}): ${f.script} \u2014 ${f.reason}`;
+}
+function runCiParity(ctx) {
+  const { rootGate, configPath } = ctx.config.ciParity;
+  const { invocations, reachable, failures } = checkParity(ctx);
+  if (failures.length === 0) {
+    console.log(
+      `\u2713 CI parity: ${invocations.length} gate invocation(s) across CI workflows, all reachable from "${rootGate}" (${reachable.size} scripts in graph).`
+    );
+    return 0;
+  }
+  console.error(
+    `\u2717 CI parity drift: ${failures.length} CI step(s) invoke a script not reachable from "${rootGate}":
+`
+  );
+  for (const f of failures) console.error(formatFailure(f));
+  console.error(
+    `
+Fix one of:
+  - Wire the script into the gate manifest / a gate's script body.
+  - Change CI to invoke a script that is already reachable.
+  - If the step is intentionally CI-only, add it to "ciOnly" in ${configPath}.
+  - If two scripts run the same gate under different names, map the CI name
+    to its canonical equivalent in "aliases" in ${configPath}.`
+  );
+  return 1;
+}
+
+// src/file-sizes.ts
+var file_sizes_exports = {};
+__export(file_sizes_exports, {
+  collectFiles: () => collectFiles,
+  loadBudgets: () => loadBudgets,
+  runFileSizes: () => runFileSizes,
+  scan: () => scan,
+  seedBudgets: () => seedBudgets,
+  tightest: () => tightest,
+  writeSeed: () => writeSeed
+});
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync } from "fs";
+import { relative as relative2, resolve as resolve4 } from "path";
+
+// src/lib/fs.ts
+import { existsSync as existsSync4, lstatSync, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join2 } from "path";
+function* walk(dir, excludeDirSegments) {
+  if (!existsSync4(dir)) return;
+  for (const entry of readdirSync2(dir)) {
+    if (excludeDirSegments.includes(entry)) continue;
+    const full = join2(dir, entry);
+    const st = lstatSync(full);
+    if (st.isSymbolicLink()) continue;
+    if (st.isDirectory()) {
+      yield* walk(full, excludeDirSegments);
+    } else if (st.isFile()) {
+      yield full;
+    }
+  }
+}
+function countLines(filePath) {
+  const buf = readFileSync4(filePath);
+  if (buf.length === 0) return 0;
+  let count = 0;
+  for (let i = 0; i < buf.length; i++) {
+    if (buf[i] === 10) count++;
+  }
+  if (buf[buf.length - 1] !== 10) count++;
+  return count;
+}
+function hasExtension(name, extensions) {
+  return extensions.some((ext) => name.endsWith(ext));
+}
+
+// src/file-sizes.ts
+function loadBudgets(budgetsPath) {
+  if (!existsSync5(budgetsPath)) return {};
+  const raw = JSON.parse(readFileSync5(budgetsPath, "utf8"));
+  const budgets = raw.budgets;
+  if (budgets === null || typeof budgets !== "object" || Array.isArray(budgets)) {
+    throw new Error(`${budgetsPath}: "budgets" must be an object`);
+  }
+  const normalized = {};
+  for (const [path, value] of Object.entries(budgets)) {
+    if (typeof value !== "number" || value <= 0) {
+      throw new Error(`${budgetsPath}: budgets["${path}"] must be a positive number`);
+    }
+    normalized[path] = value;
+  }
+  return normalized;
+}
+function shouldExclude(relPath, prefixes) {
+  return prefixes.some((prefix) => relPath.startsWith(prefix));
+}
+function collectFiles(ctx) {
+  const { scanRoots, excludeDirSegments, excludePathPrefixes, sourceExtensions } = ctx.config;
+  const out = [];
+  for (const root of scanRoots) {
+    for (const abs of walk(resolve4(ctx.repoRoot, root), excludeDirSegments)) {
+      const rel = relative2(ctx.repoRoot, abs).replaceAll("\\", "/");
+      if (!hasExtension(rel, sourceExtensions)) continue;
+      if (shouldExclude(rel, excludePathPrefixes)) continue;
+      out.push({ rel, lines: countLines(abs) });
+    }
+  }
+  return out;
+}
+function scan(ctx) {
+  const threshold = ctx.config.fileSize.threshold;
+  const budgets = loadBudgets(resolve4(ctx.repoRoot, ctx.config.fileSize.budgetsPath));
+  const failures = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const { rel, lines } of collectFiles(ctx)) {
+    seen.add(rel);
+    const explicit = budgets[rel];
+    if (explicit !== void 0) {
+      if (lines > explicit) {
+        failures.push({
+          path: rel,
+          lines,
+          budget: explicit,
+          reason: `exceeds frozen budget (${lines} > ${explicit}); refactor instead of raising the budget`
+        });
+      }
+    } else if (lines > threshold) {
+      failures.push({
+        path: rel,
+        lines,
+        budget: threshold,
+        reason: `exceeds default threshold (${lines} > ${threshold}); split the file or add a justified budget entry`
+      });
+    }
+  }
+  const staleBudgetEntries = Object.keys(budgets).filter((p) => !seen.has(p));
+  return { failures, staleBudgetEntries };
+}
+function seedBudgets(ctx) {
+  const threshold = ctx.config.fileSize.threshold;
+  const budgets = {};
+  for (const { rel, lines } of collectFiles(ctx)) {
+    if (lines > threshold) budgets[rel] = lines;
+  }
+  return Object.fromEntries(Object.entries(budgets).sort(([a], [b]) => a.localeCompare(b)));
+}
+function writeSeed(ctx) {
+  const path = resolve4(ctx.repoRoot, ctx.config.fileSize.budgetsPath);
+  const budgets = seedBudgets(ctx);
+  const file = {
+    _comment: "Grandfathered per-file line budgets. Files over the threshold are frozen at their current line count; the ratchet only goes down. Refactor and lower these; never raise them.",
+    budgets
+  };
+  writeFileSync(path, `${JSON.stringify(file, null, 2)}
+`);
+  return { path, count: Object.keys(budgets).length };
+}
+function tightest(ctx) {
+  const threshold = ctx.config.fileSize.threshold;
+  const budgets = loadBudgets(resolve4(ctx.repoRoot, ctx.config.fileSize.budgetsPath));
+  let best;
+  for (const { rel, lines } of collectFiles(ctx)) {
+    const budget = budgets[rel] ?? threshold;
+    const headroom = budget - lines;
+    if (!best || headroom < best.headroom) best = { path: rel, lines, budget, headroom };
+  }
+  return best;
+}
+function runFileSizes(ctx, init = false) {
+  if (init) {
+    const { path, count } = writeSeed(ctx);
+    console.log(`file-size guard: seeded ${count} grandfathered budget(s) \u2192 ${path}`);
+    return 0;
+  }
+  const { failures, staleBudgetEntries } = scan(ctx);
+  if (staleBudgetEntries.length > 0) {
+    console.error(`${ctx.config.fileSize.budgetsPath} has entries for files that no longer exist:`);
+    for (const p of staleBudgetEntries) console.error(`  - ${p}`);
+    console.error("Remove these entries to keep the budget honest.\n");
+  }
+  if (failures.length > 0) {
+    console.error("File-size guard failed:");
+    for (const f of failures) console.error(`  ${f.path}: ${f.reason}`);
+    console.error(
+      `
+The ratchet only goes down \u2014 refactor large files into smaller modules rather than raising their budget.`
+    );
+    return 1;
+  }
+  if (staleBudgetEntries.length > 0) return 1;
+  const t = tightest(ctx);
+  if (t) {
+    console.log(
+      `SCORE: file-size \u2014 tightest ${t.path} ${t.lines}/${t.budget} (${t.headroom} to spare)`
+    );
+  }
+  console.log("File-size guard ok.");
+  return 0;
+}
+
+// src/debt-markers.ts
+var debt_markers_exports = {};
+__export(debt_markers_exports, {
+  parseAllowlist: () => parseAllowlist,
+  runDebtMarkers: () => runDebtMarkers,
+  scan: () => scan2,
+  seedAllowlist: () => seedAllowlist,
+  writeSeed: () => writeSeed2
+});
+import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
+import { relative as relative3, resolve as resolve5 } from "path";
+function parseAllowlist(allowlistPath) {
+  if (!existsSync6(allowlistPath)) return { entries: [], raw: [] };
+  const raw = JSON.parse(readFileSync6(allowlistPath, "utf8"));
+  const list = raw.allowlist;
+  if (!Array.isArray(list)) {
+    throw new Error(`${allowlistPath}: "allowlist" must be an array of "path:line" strings`);
+  }
+  const entries = [];
+  const rawStrings = [];
+  for (const item of list) {
+    if (typeof item !== "string") {
+      throw new Error(`${allowlistPath}: allowlist entries must be "path:line" strings`);
+    }
+    const idx = item.lastIndexOf(":");
+    const path = idx < 0 ? "" : item.slice(0, idx);
+    const line = idx < 0 ? Number.NaN : Number.parseInt(item.slice(idx + 1), 10);
+    if (!path || !Number.isInteger(line) || line <= 0) {
+      throw new Error(`${allowlistPath}: "${item}" is not a valid "path:line" entry`);
+    }
+    entries.push({ path, line });
+    rawStrings.push(item);
+  }
+  return { entries, raw: rawStrings };
+}
+function buildMarkerRe(tokens) {
+  return new RegExp(`\\b(${tokens.join("|")})\\b`);
+}
+function buildTrackerRes(patterns) {
+  return patterns.map((p) => new RegExp(p, "i"));
+}
+function shouldExclude2(relPath, prefixes, exact) {
+  if (exact.has(relPath)) return true;
+  return prefixes.some((prefix) => relPath.startsWith(prefix));
+}
+function scan2(ctx) {
+  const { scanRoots, excludeDirSegments, excludePathPrefixes, sourceExtensions, debt } = ctx.config;
+  const markerRe = buildMarkerRe(debt.markerTokens);
+  const trackerRes = buildTrackerRes(debt.trackerPatterns);
+  const { entries: allowlist, raw } = parseAllowlist(resolve5(ctx.repoRoot, debt.allowlistPath));
+  const allowSet = new Set(raw);
+  const matchedAllow = /* @__PURE__ */ new Set();
+  const excludeExact = /* @__PURE__ */ new Set([
+    "packages/repo-gates/src/config.ts",
+    "packages/repo-gates/src/debt-markers.ts",
+    "packages/repo-gates/src/debt-markers.test.ts"
+  ]);
+  const untracked = [];
+  for (const root of scanRoots) {
+    for (const abs of walk(resolve5(ctx.repoRoot, root), excludeDirSegments)) {
+      const rel = relative3(ctx.repoRoot, abs).replaceAll("\\", "/");
+      if (!hasExtension(rel, sourceExtensions)) continue;
+      if (shouldExclude2(rel, excludePathPrefixes, excludeExact)) continue;
+      const lines = readFileSync6(abs, "utf8").split("\n");
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] ?? "";
+        const match = line.match(markerRe);
+        if (!match) continue;
+        if (trackerRes.some((re) => re.test(line))) continue;
+        const key = `${rel}:${i + 1}`;
+        const marker = {
+          path: rel,
+          line: i + 1,
+          marker: match[1] ?? match[0],
+          text: line.trim()
+        };
+        if (allowSet.has(key)) matchedAllow.add(key);
+        else untracked.push(marker);
+      }
+    }
+  }
+  const staleAllowlistEntries = allowlist.map((e) => `${e.path}:${e.line}`).filter((key) => !matchedAllow.has(key));
+  return { untracked, staleAllowlistEntries };
+}
+function seedAllowlist(ctx) {
+  const emptyCtx = {
+    ...ctx,
+    config: { ...ctx.config, debt: { ...ctx.config.debt, allowlistPath: "\0missing" } }
+  };
+  return scan2(emptyCtx).untracked.map((m) => `${m.path}:${m.line}`).sort((a, b) => a.localeCompare(b));
+}
+function writeSeed2(ctx) {
+  const path = resolve5(ctx.repoRoot, ctx.config.debt.allowlistPath);
+  const allowlist = seedAllowlist(ctx);
+  const file = {
+    _comment: "Grandfathered untracked debt markers (path:line). Each must match an existing TODO/FIXME/HACK/XXX with no tracker ref on the same line. Ratchet only goes down.",
+    allowlist
+  };
+  writeFileSync2(path, `${JSON.stringify(file, null, 2)}
+`);
+  return { path, count: allowlist.length };
+}
+function runDebtMarkers(ctx, init = false) {
+  if (init) {
+    const { path, count } = writeSeed2(ctx);
+    console.log(`debt-marker guard: seeded ${count} grandfathered marker(s) \u2192 ${path}`);
+    return 0;
+  }
+  const { untracked, staleAllowlistEntries } = scan2(ctx);
+  if (staleAllowlistEntries.length > 0) {
+    console.error(`${ctx.config.debt.allowlistPath} has entries that no longer match a marker:`);
+    for (const k of staleAllowlistEntries) console.error(`  - ${k}`);
+    console.error("Remove these entries \u2014 the ratchet only goes down.\n");
+  }
+  if (untracked.length > 0) {
+    console.error("Untracked debt markers found:");
+    for (const m of untracked) console.error(`  ${m.path}:${m.line}  ${m.marker}: ${m.text}`);
+    console.error(
+      `
+Pair each marker with a tracker reference on the same line (ABC-123 / #123 / URL), remove it, or \u2014 with justification \u2014 allowlist it.`
+    );
+    return 1;
+  }
+  if (staleAllowlistEntries.length > 0) return 1;
+  const grandfathered = parseAllowlist(resolve5(ctx.repoRoot, ctx.config.debt.allowlistPath)).raw.length;
+  console.log(`SCORE: debt-markers \u2014 ${grandfathered} grandfathered, 0 untracked`);
+  console.log("Debt-marker guard ok.");
+  return 0;
+}
+
+// src/circular-imports.ts
+var circular_imports_exports = {};
+__export(circular_imports_exports, {
+  buildGraph: () => buildGraph,
+  extractRelativeSpecifiers: () => extractRelativeSpecifiers,
+  findCycles: () => findCycles,
+  parseAllowlist: () => parseAllowlist2,
+  resolveSpecifier: () => resolveSpecifier,
+  runCircularImports: () => runCircularImports,
+  scan: () => scan3,
+  seedAllowlist: () => seedAllowlist2,
+  writeSeed: () => writeSeed3
+});
+import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
+import { dirname, relative as relative4, resolve as resolve6 } from "path";
+var IMPORT_SPEC_RE = /(?:from|require\()\s*["'](\.[^"'\n]+)["']|import\(\s*["'](\.[^"'\n]+)["']\s*\)|^\s*import\s+["'](\.[^"'\n]+)["']/gm;
+function extractRelativeSpecifiers(source) {
+  const out = [];
+  for (const match of source.matchAll(IMPORT_SPEC_RE)) {
+    const spec = match[1] ?? match[2] ?? match[3];
+    if (spec) out.push(spec);
+  }
+  return out;
+}
+function resolveSpecifier(fromFile, spec, sourceExtensions) {
+  const base = resolve6(dirname(fromFile), spec);
+  const candidates = [
+    base,
+    ...sourceExtensions.map((ext) => base + ext),
+    ...sourceExtensions.map((ext) => resolve6(base, `index${ext}`))
+  ];
+  return candidates.find(isFile);
+}
+function isFile(path) {
+  return existsSync7(path) && lstatSync2(path).isFile();
+}
+function findCycles(graph) {
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const lowlink = /* @__PURE__ */ new Map();
+  const onStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  const sccs = [];
+  const strongConnect = (v) => {
+    indices.set(v, index);
+    lowlink.set(v, index);
+    index++;
+    stack.push(v);
+    onStack.add(v);
+    const frames = [
+      { node: v, neighbors: [...graph.get(v) ?? []], i: 0 }
+    ];
+    while (frames.length > 0) {
+      const frame = frames.at(-1);
+      if (!frame) break;
+      if (frame.i < frame.neighbors.length) {
+        const w = frame.neighbors[frame.i++];
+        if (w === void 0) continue;
+        if (!indices.has(w)) {
+          indices.set(w, index);
+          lowlink.set(w, index);
+          index++;
+          stack.push(w);
+          onStack.add(w);
+          frames.push({ node: w, neighbors: [...graph.get(w) ?? []], i: 0 });
+        } else if (onStack.has(w)) {
+          lowlink.set(frame.node, Math.min(lowlink.get(frame.node) ?? 0, indices.get(w) ?? 0));
+        }
+      } else {
+        frames.pop();
+        const parent = frames.at(-1);
+        if (parent) {
+          lowlink.set(
+            parent.node,
+            Math.min(lowlink.get(parent.node) ?? 0, lowlink.get(frame.node) ?? 0)
+          );
+        }
+        if (lowlink.get(frame.node) === indices.get(frame.node)) {
+          const scc = [];
+          let w;
+          do {
+            w = stack.pop();
+            if (w === void 0) break;
+            onStack.delete(w);
+            scc.push(w);
+          } while (w !== frame.node);
+          if (scc.length > 1) sccs.push(scc);
+        }
+      }
+    }
+  };
+  for (const node of graph.keys()) {
+    if (!indices.has(node)) strongConnect(node);
+  }
+  return sccs;
+}
+function buildGraph(ctx) {
+  const { scanRoots, excludeDirSegments, excludePathPrefixes, sourceExtensions } = ctx.config;
+  const graph = /* @__PURE__ */ new Map();
+  for (const root of scanRoots) {
+    for (const abs of walk(resolve6(ctx.repoRoot, root), excludeDirSegments)) {
+      if (!hasExtension(abs, sourceExtensions)) continue;
+      const rel = relative4(ctx.repoRoot, abs).replaceAll("\\", "/");
+      if (excludePathPrefixes.some((prefix) => rel.startsWith(prefix))) continue;
+      const source = readFileSync7(abs, "utf8");
+      const edges = graph.get(abs) ?? /* @__PURE__ */ new Set();
+      for (const spec of extractRelativeSpecifiers(source)) {
+        const target = resolveSpecifier(abs, spec, sourceExtensions);
+        if (target && target !== abs) edges.add(target);
+      }
+      graph.set(abs, edges);
+    }
+  }
+  return graph;
+}
+function toSignature(ctx, files) {
+  return files.map((f) => relative4(ctx.repoRoot, f).replaceAll("\\", "/")).sort((a, b) => a.localeCompare(b)).join(", ");
+}
+function parseAllowlist2(allowlistPath) {
+  if (!existsSync7(allowlistPath)) return [];
+  const raw = JSON.parse(readFileSync7(allowlistPath, "utf8"));
+  const list = raw.allowlist;
+  if (!Array.isArray(list) || list.some((x) => typeof x !== "string")) {
+    throw new Error(`${allowlistPath}: "allowlist" must be an array of cycle-signature strings`);
+  }
+  return list;
+}
+function scan3(ctx) {
+  const graph = buildGraph(ctx);
+  const cycles = findCycles(graph);
+  const signatures = cycles.map((files) => toSignature(ctx, files));
+  const allowlist = parseAllowlist2(resolve6(ctx.repoRoot, ctx.config.circular.allowlistPath));
+  const allowSet = new Set(allowlist);
+  const matched = /* @__PURE__ */ new Set();
+  const untracked = [];
+  for (let i = 0; i < cycles.length; i++) {
+    const sig = signatures[i];
+    const files = cycles[i];
+    if (sig === void 0 || files === void 0) continue;
+    if (allowSet.has(sig)) matched.add(sig);
+    else untracked.push({ files: sig.split(", ") });
+  }
+  const staleAllowlistEntries = allowlist.filter((sig) => !matched.has(sig));
+  return { untracked, staleAllowlistEntries };
+}
+function seedAllowlist2(ctx) {
+  const emptyCtx = {
+    ...ctx,
+    config: { ...ctx.config, circular: { allowlistPath: "\0missing" } }
+  };
+  return scan3(emptyCtx).untracked.map((c) => c.files.join(", ")).sort((a, b) => a.localeCompare(b));
+}
+function writeSeed3(ctx) {
+  const path = resolve6(ctx.repoRoot, ctx.config.circular.allowlistPath);
+  const allowlist = seedAllowlist2(ctx);
+  const file = {
+    _comment: "Grandfathered circular-import groups (comma-separated, sorted repo-relative paths \u2014 one strongly-connected component per entry). Ratchet only goes down.",
+    allowlist
+  };
+  writeFileSync3(path, `${JSON.stringify(file, null, 2)}
+`);
+  return { path, count: allowlist.length };
+}
+function runCircularImports(ctx, init = false) {
+  if (init) {
+    const { path, count } = writeSeed3(ctx);
+    console.log(`circular-import guard: seeded ${count} grandfathered cycle(s) \u2192 ${path}`);
+    return 0;
+  }
+  const { untracked, staleAllowlistEntries } = scan3(ctx);
+  if (staleAllowlistEntries.length > 0) {
+    console.error(`${ctx.config.circular.allowlistPath} has entries that no longer cycle:`);
+    for (const sig of staleAllowlistEntries) console.error(`  - ${sig}`);
+    console.error("Remove these entries \u2014 the ratchet only goes down.\n");
+  }
+  if (untracked.length > 0) {
+    console.error("New circular imports found:");
+    for (const c of untracked) console.error(`  ${c.files.join(" -> ")} -> ${c.files[0]}`);
+    console.error(
+      "\nBreak the cycle (extract shared code, invert one of the imports), or \u2014 with justification \u2014 allowlist it via `repo-gates check-circular --init`."
+    );
+    return 1;
+  }
+  if (staleAllowlistEntries.length > 0) return 1;
+  const grandfathered = parseAllowlist2(resolve6(ctx.repoRoot, ctx.config.circular.allowlistPath)).length;
+  console.log(`SCORE: circular-imports \u2014 ${grandfathered} grandfathered, 0 new`);
+  console.log("Circular-import guard ok.");
+  return 0;
+}
+
+// src/secrets.ts
+var secrets_exports = {};
+__export(secrets_exports, {
+  listTrackedFiles: () => listTrackedFiles,
+  parseAllowlist: () => parseAllowlist3,
+  runSecrets: () => runSecrets,
+  scan: () => scan4,
+  seedAllowlist: () => seedAllowlist3,
+  writeSeed: () => writeSeed4
+});
+import { createHash } from "crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { resolve as resolve7 } from "path";
+function parseAllowlist3(allowlistPath) {
+  if (!existsSync8(allowlistPath)) return { entries: [], raw: [] };
+  const raw = JSON.parse(readFileSync8(allowlistPath, "utf8"));
+  const list = raw.allowlist;
+  if (!Array.isArray(list)) {
+    throw new Error(`${allowlistPath}: "allowlist" must be an array of "path:line" strings`);
+  }
+  const entries = [];
+  const rawStrings = [];
+  for (const item of list) {
+    if (typeof item !== "string") {
+      throw new Error(`${allowlistPath}: allowlist entries must be "path:line" strings`);
+    }
+    const idx = item.lastIndexOf(":");
+    const path = idx < 0 ? "" : item.slice(0, idx);
+    const line = idx < 0 ? Number.NaN : Number.parseInt(item.slice(idx + 1), 10);
+    if (!path || !Number.isInteger(line) || line <= 0) {
+      throw new Error(`${allowlistPath}: "${item}" is not a valid "path:line" entry`);
+    }
+    entries.push({ path, line });
+    rawStrings.push(item);
+  }
+  return { entries, raw: rawStrings };
+}
+function listTrackedFiles(repoRoot) {
+  const proc = spawnSync2("git", ["ls-files", "-z"], { cwd: repoRoot, encoding: "utf8" });
+  if (proc.status !== 0 || !proc.stdout) return [];
+  return proc.stdout.split("\0").filter((f) => f.length > 0);
+}
+function fingerprint(matched) {
+  return createHash("sha256").update(matched).digest("hex").slice(0, 8);
+}
+function buildPatternRe(patterns) {
+  return new RegExp(`(${patterns.join(")|(")})`);
+}
+function scan4(ctx) {
+  const { excludeDirSegments, excludePathPrefixes, secrets } = ctx.config;
+  const patternRe = buildPatternRe(secrets.patterns);
+  const { entries: allowlist, raw } = parseAllowlist3(resolve7(ctx.repoRoot, secrets.allowlistPath));
+  const allowSet = new Set(raw);
+  const matchedAllow = /* @__PURE__ */ new Set();
+  const untracked = [];
+  for (const rel of listTrackedFiles(ctx.repoRoot)) {
+    if (hasExtension(rel, secrets.binaryExtensions)) continue;
+    if (excludeDirSegments.some((seg) => rel.split("/").includes(seg))) continue;
+    if (excludePathPrefixes.some((prefix) => rel.startsWith(prefix))) continue;
+    const abs = resolve7(ctx.repoRoot, rel);
+    let content;
+    try {
+      content = readFileSync8(abs, "utf8");
+    } catch {
+      continue;
+    }
+    if (content.includes("\0")) continue;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i] ?? "";
+      const match = line.match(patternRe);
+      if (!match) continue;
+      const key = `${rel}:${i + 1}`;
+      const finding = {
+        path: rel,
+        line: i + 1,
+        pattern: match[0].length > 12 ? `${match[0].slice(0, 4)}\u2026` : "match",
+        fingerprint: fingerprint(match[0])
+      };
+      if (allowSet.has(key)) matchedAllow.add(key);
+      else untracked.push(finding);
+    }
+  }
+  const staleAllowlistEntries = allowlist.map((e) => `${e.path}:${e.line}`).filter((key) => !matchedAllow.has(key));
+  return { untracked, staleAllowlistEntries };
+}
+function seedAllowlist3(ctx) {
+  const emptyCtx = {
+    ...ctx,
+    config: { ...ctx.config, secrets: { ...ctx.config.secrets, allowlistPath: "\0missing" } }
+  };
+  return scan4(emptyCtx).untracked.map((f) => `${f.path}:${f.line}`).sort((a, b) => a.localeCompare(b));
+}
+function writeSeed4(ctx) {
+  const path = resolve7(ctx.repoRoot, ctx.config.secrets.allowlistPath);
+  const allowlist = seedAllowlist3(ctx);
+  const file = {
+    _comment: "Grandfathered secret-shaped-string findings (path:line). Review each one BEFORE trusting this seed \u2014 it silences whatever it captures. Ratchet only goes down.",
+    allowlist
+  };
+  writeFileSync4(path, `${JSON.stringify(file, null, 2)}
+`);
+  return { path, count: allowlist.length };
+}
+function runSecrets(ctx, init = false) {
+  if (init) {
+    const { path, count } = writeSeed4(ctx);
+    console.log(`secrets guard: seeded ${count} grandfathered finding(s) \u2192 ${path}`);
+    console.log("Review every entry \u2014 the seed silences whatever it captures.");
+    return 0;
+  }
+  const { untracked, staleAllowlistEntries } = scan4(ctx);
+  if (staleAllowlistEntries.length > 0) {
+    console.error(`${ctx.config.secrets.allowlistPath} has entries that no longer match:`);
+    for (const k of staleAllowlistEntries) console.error(`  - ${k}`);
+    console.error("Remove these entries \u2014 the ratchet only goes down.\n");
+  }
+  if (untracked.length > 0) {
+    console.error("Secret-shaped strings found (fingerprint only \u2014 never the matched text):");
+    for (const f of untracked) {
+      console.error(`  ${f.path}:${f.line}  fingerprint:${f.fingerprint}`);
+    }
+    console.error(
+      "\nRotate and remove the credential, or \u2014 only if this is genuinely a false positive (a test fixture, a placeholder) \u2014 allowlist it via `repo-gates check-secrets --init`."
+    );
+    return 1;
+  }
+  if (staleAllowlistEntries.length > 0) return 1;
+  const grandfathered = parseAllowlist3(resolve7(ctx.repoRoot, ctx.config.secrets.allowlistPath)).raw.length;
+  console.log(`SCORE: secrets \u2014 ${grandfathered} grandfathered, 0 new`);
+  console.log("Secrets guard ok.");
+  return 0;
+}
+
+// src/coverage.ts
+var coverage_exports = {};
+__export(coverage_exports, {
+  DEFAULT_MIN: () => DEFAULT_MIN,
+  checkPerPackage: () => checkPerPackage,
+  collectPerPackage: () => collectPerPackage,
+  coverageScore: () => coverageScore,
+  expandGlob: () => expandGlob,
+  loadBudgets: () => loadBudgets2,
+  lowest: () => lowest,
+  pct: () => pct,
+  pkgKey: () => pkgKey,
+  readSummaryCounts: () => readSummaryCounts,
+  runCoverage: () => runCoverage,
+  seedBudgets: () => seedBudgets2,
+  seedFloor: () => seedFloor
+});
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync9, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join3, relative as relative5, resolve as resolve8 } from "path";
+var DEFAULT_MIN = { functions: 80, lines: 80 };
+function validFloor(value, source, where) {
+  const v = value;
+  const out = { functions: 0, lines: 0 };
+  for (const metric of ["functions", "lines"]) {
+    const n = v?.[metric];
+    if (typeof n !== "number" || !Number.isFinite(n) || n < 0 || n > 100) {
+      throw new Error(`${source}: ${where}.${metric} must be a percentage in [0, 100]`);
+    }
+    out[metric] = n;
+  }
+  return out;
+}
+function loadBudgets2(raw, source = "coverage-budgets") {
+  const parsed = JSON.parse(raw);
+  const def = parsed.default === void 0 ? DEFAULT_MIN : validFloor(parsed.default, source, "default");
+  const pkgsRaw = parsed.packages;
+  if (pkgsRaw !== void 0 && (pkgsRaw === null || typeof pkgsRaw !== "object" || Array.isArray(pkgsRaw))) {
+    throw new Error(`${source}: "packages" must be an object`);
+  }
+  const packages = {};
+  for (const [pkg, floor] of Object.entries(pkgsRaw ?? {})) {
+    packages[pkg] = validFloor(floor, source, `packages["${pkg}"]`);
+  }
+  return { default: def, packages };
+}
+function expandGlob(repoRoot, glob) {
+  const segments = glob.split("/");
+  let dirs = [repoRoot];
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i] ?? "";
+    const isLast = i === segments.length - 1;
+    const next = [];
+    for (const dir of dirs) {
+      if (seg === "*") {
+        if (!existsSync9(dir)) continue;
+        for (const entry of readdirSync3(dir)) {
+          const full = join3(dir, entry);
+          if (statSync(full).isDirectory()) next.push(full);
+        }
+      } else {
+        const full = join3(dir, seg);
+        if (isLast ? existsSync9(full) : existsSync9(full) && statSync(full).isDirectory()) {
+          next.push(full);
+        }
+      }
+    }
+    dirs = next;
+  }
+  return dirs;
+}
+function readSummaryCounts(path) {
+  const doc = JSON.parse(readFileSync9(path, "utf8"));
+  const total = doc.total;
+  if (!total) return void 0;
+  const pick = (m) => {
+    const covered = m?.covered;
+    const total_ = m?.total;
+    if (typeof covered !== "number" || typeof total_ !== "number") return void 0;
+    return { covered, total: total_ };
+  };
+  const functions = pick(total.functions);
+  const lines = pick(total.lines);
+  if (!functions || !lines) return void 0;
+  return { functions, lines };
+}
+function pct(counts) {
+  return counts.total === 0 ? 100 : counts.covered / counts.total * 100;
+}
+function pkgKey(repoRoot, summaryPath) {
+  return relative5(repoRoot, summaryPath).replaceAll("\\", "/").replace(/\/coverage\/coverage-summary\.json$/, "");
+}
+function collectPerPackage(ctx) {
+  const out = [];
+  for (const glob of ctx.config.coverage.summaryGlobs) {
+    for (const path of expandGlob(ctx.repoRoot, glob)) {
+      const counts = readSummaryCounts(path);
+      if (!counts) continue;
+      out.push({
+        pkg: pkgKey(ctx.repoRoot, path),
+        totals: { functions: pct(counts.functions), lines: pct(counts.lines) }
+      });
+    }
+  }
+  return out.sort((a, b) => a.pkg.localeCompare(b.pkg));
+}
+function checkPerPackage(perPkg, budgets) {
+  const failures = [];
+  const newPkgs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const { pkg, totals } of perPkg) {
+    seen.add(pkg);
+    const explicit = budgets.packages[pkg];
+    const floor = explicit ?? budgets.default;
+    const isNew = explicit === void 0;
+    if (isNew) newPkgs.push(pkg);
+    for (const metric of ["functions", "lines"]) {
+      if (totals[metric] < floor[metric]) {
+        failures.push({ pkg, metric, actual: totals[metric], floor: floor[metric], isNew });
+      }
+    }
+  }
+  const stale = Object.keys(budgets.packages).filter((p) => !seen.has(p));
+  return { failures, newPkgs, stale };
+}
+function seedFloor(pct_) {
+  return Math.max(0, Math.floor((pct_ - 0.5) * 100) / 100);
+}
+function seedBudgets2(perPkg, keepDefault) {
+  const packages = {};
+  for (const { pkg, totals } of perPkg.slice().sort((a, b) => a.pkg.localeCompare(b.pkg))) {
+    packages[pkg] = { functions: seedFloor(totals.functions), lines: seedFloor(totals.lines) };
+  }
+  return { default: keepDefault, packages };
+}
+function runTestCoverage(ctx) {
+  const [cmd, ...args] = ctx.config.runner.split(/\s+/);
+  const proc = spawnSync3(cmd ?? "pnpm", [...args, "test:coverage"], {
+    cwd: ctx.repoRoot,
+    stdio: "inherit",
+    env: process.env
+  });
+  if (proc.error) {
+    console.error(
+      `check-coverage: could not run '${ctx.config.runner} test:coverage': ${proc.error.message}`
+    );
+    return 1;
+  }
+  return proc.status ?? 1;
+}
+function lowest(perPkg) {
+  let min;
+  for (const { pkg, totals } of perPkg) {
+    if (!min || totals.lines < min.lines) min = { pkg, lines: totals.lines };
+  }
+  return min;
+}
+function coverageScore(perPkg) {
+  const min = lowest(perPkg);
+  if (!min) return void 0;
+  return `coverage \u2014 lowest ${min.pkg} ${min.lines.toFixed(1)}% lines (${perPkg.length} pkgs \u2265 floor)`;
+}
+function runCoverage(ctx, opts = {}) {
+  const budgetsPath = resolve8(ctx.repoRoot, ctx.config.coverage.budgetsPath);
+  const testExit = opts.skipRun ? 0 : runTestCoverage(ctx);
+  const perPkg = collectPerPackage(ctx);
+  if (perPkg.length === 0) {
+    console.error(
+      `check-coverage: no coverage-summary.json files matched ${ctx.config.coverage.summaryGlobs.join(", ")} \u2014 did test:coverage run with the json-summary reporter?`
+    );
+    return testExit === 0 ? 1 : testExit;
+  }
+  if (opts.init) {
+    if (!opts.skipRun && testExit !== 0) {
+      console.error(
+        "check-coverage: --init aborted \u2014 test:coverage failed; refusing to seed floors from a failed/partial run. Fix the tests, then re-seed."
+      );
+      return testExit;
+    }
+    const keepDefault = existsSync9(budgetsPath) ? loadBudgets2(readFileSync9(budgetsPath, "utf8"), ctx.config.coverage.budgetsPath).default : DEFAULT_MIN;
+    const budgets2 = seedBudgets2(perPkg, keepDefault);
+    const file = {
+      _comment: "Per-package coverage floors. Each package is held to its own floor (packages[dir]) or `default` if unlisted; floors only ratchet UP. Seeded 0.5pt below each baseline.",
+      default: budgets2.default,
+      packages: budgets2.packages
+    };
+    writeFileSync5(budgetsPath, `${JSON.stringify(file, null, 2)}
+`);
+    console.log(
+      `check-coverage: seeded per-package floors for ${perPkg.length} package(s) (default ${budgets2.default.functions}/${budgets2.default.lines}) \u2192 ${budgetsPath}`
+    );
+    return 0;
+  }
+  const budgets = loadBudgets2(readFileSync9(budgetsPath, "utf8"), ctx.config.coverage.budgetsPath);
+  const { failures, newPkgs, stale } = checkPerPackage(perPkg, budgets);
+  if (stale.length > 0) {
+    console.error(`${ctx.config.coverage.budgetsPath} lists packages with no coverage summary:`);
+    for (const p of stale) console.error(`  - ${p}`);
+    console.error("Remove these entries (or restore the package's coverage).\n");
+  }
+  if (failures.length > 0) {
+    console.error("Coverage below floor:");
+    for (const f of failures) {
+      const tag = f.isNew ? " [new package \u2014 no explicit floor, using default]" : "";
+      console.error(
+        `  ${f.pkg}: ${f.metric} ${f.actual.toFixed(2)}% < floor ${f.floor.toFixed(2)}%${tag}`
+      );
+    }
+    console.error(
+      `
+Add tests to lift it, or \u2014 if intentional \u2014 lower that package's floor in ${ctx.config.coverage.budgetsPath}. A new package needs tests to clear the default (${budgets.default.functions}%/${budgets.default.lines}%) or an explicit floor via --init.`
+    );
+    return testExit === 0 ? 1 : testExit;
+  }
+  if (stale.length > 0) return 1;
+  const min = lowest(perPkg);
+  const newNote = newPkgs.length > 0 ? `; ${newPkgs.length} new pkg(s) met default` : "";
+  console.error(
+    `Coverage OK \u2014 ${perPkg.length} package(s) meet their floor` + (min ? `; lowest lines: ${min.pkg} ${min.lines.toFixed(2)}%` : "") + newNote
+  );
+  const score = coverageScore(perPkg);
+  if (score) console.log(`SCORE: ${score}`);
+  return testExit;
+}
+
+// src/bundle-size.ts
+var bundle_size_exports = {};
+__export(bundle_size_exports, {
+  assertSafeDistDir: () => assertSafeDistDir,
+  cleanDist: () => cleanDist,
+  diff: () => diff,
+  findDuplicateChunks: () => findDuplicateChunks,
+  fmtBytes: () => fmtBytes,
+  loadBudgets: () => loadBudgets3,
+  logicalChunkName: () => logicalChunkName,
+  measure: () => measure,
+  runBundleSize: () => runBundleSize,
+  seedBudget: () => seedBudget
+});
+import { spawnSync as spawnSync4 } from "child_process";
+import {
+  existsSync as existsSync10,
+  lstatSync as lstatSync3,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync10,
+  realpathSync,
+  rmSync,
+  writeFileSync as writeFileSync6
+} from "fs";
+import { basename, dirname as dirname2, join as join4, posix, resolve as resolve9, sep } from "path";
+import { gzipSync } from "zlib";
+var HEADROOM = { raw: 2048, gzip: 512 };
+function bucketFor(name, buckets) {
+  for (const [bucket, exts] of Object.entries(buckets)) {
+    if (exts.some((ext) => name.endsWith(ext))) return bucket;
+  }
+  return void 0;
+}
+function measure(distDir, buckets) {
+  const out = { buckets: {}, files: [] };
+  for (const b of Object.keys(buckets)) out.buckets[b] = { raw: 0, gzip: 0, largest: 0 };
+  if (!existsSync10(distDir)) return out;
+  const walk2 = (dir, relative6) => {
+    for (const entry of readdirSync4(dir)) {
+      const full = join4(dir, entry);
+      const st = lstatSync3(full);
+      if (st.isDirectory()) {
+        walk2(full, relative6 ? posix.join(relative6, entry) : entry);
+        continue;
+      }
+      if (!st.isFile()) continue;
+      const bucket = bucketFor(entry, buckets);
+      if (!bucket) continue;
+      const buf = readFileSync10(full);
+      const raw = buf.length;
+      const gzip = gzipSync(buf).length;
+      out.files.push({ name: entry, dir: relative6, bucket, raw, gzip });
+      const acc = out.buckets[bucket];
+      if (!acc) continue;
+      acc.raw += raw;
+      acc.gzip += gzip;
+      if (gzip > acc.largest) acc.largest = gzip;
+    }
+  };
+  walk2(distDir, "");
+  return out;
+}
+function resolveParentThroughSymlinks(path) {
+  const trailing = [];
+  let cursor = dirname2(path);
+  for (; ; ) {
+    if (existsSync10(cursor)) {
+      return join4(realpathSync(cursor), ...trailing.reverse(), basename(path));
+    }
+    const parent = dirname2(cursor);
+    if (parent === cursor) return path;
+    trailing.push(basename(cursor));
+    cursor = parent;
+  }
+}
+function assertSafeDistDir(distDir, repoRoot) {
+  const rawRoot = resolve9(repoRoot);
+  const root = existsSync10(rawRoot) ? realpathSync(rawRoot) : rawRoot;
+  const dir = resolveParentThroughSymlinks(resolve9(rawRoot, distDir));
+  const rootPrefix = root.endsWith(sep) ? root : `${root}${sep}`;
+  if (dir === root || !dir.startsWith(rootPrefix)) {
+    throw new Error(
+      `check-bundle-size: distDir ${JSON.stringify(distDir)} resolves to ${dir}, which is not inside ${root}. Refusing to remove it.`
+    );
+  }
+  return dir;
+}
+function cleanDist(distDir, repoRoot) {
+  rmSync(assertSafeDistDir(distDir, repoRoot), { recursive: true, force: true });
+}
+var TRAILING_SEGMENT = /-([A-Za-z0-9_-]{8}|[0-9a-f]{16,})(\.[^.]+)$/;
+function looksLikeHash(segment) {
+  if (/^[0-9a-f]{16,}$/.test(segment)) return true;
+  if (/[0-9]/.test(segment)) return true;
+  return (segment.match(/[A-Z]/g) ?? []).length >= 2;
+}
+function logicalChunkName(name) {
+  const match = TRAILING_SEGMENT.exec(name);
+  if (!match?.[1] || !looksLikeHash(match[1])) return name;
+  return name.slice(0, match.index) + match[2];
+}
+var byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function findDuplicateChunks(m) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const f of m.files) {
+    const stripped = logicalChunkName(f.name);
+    if (stripped === f.name) continue;
+    const logical = f.dir ? posix.join(f.dir, stripped) : stripped;
+    const key = `${f.bucket}\0${logical}`;
+    const group = groups.get(key) ?? { bucket: f.bucket, logical, files: [] };
+    group.files.push({ name: f.name, raw: f.raw });
+    groups.set(key, group);
+  }
+  return [...groups.values()].filter((g) => g.files.length > 1).map((g) => ({ ...g, files: g.files.slice().sort((a, b) => byCodeUnit(a.name, b.name)) })).sort((a, b) => byCodeUnit(a.bucket, b.bucket) || byCodeUnit(a.logical, b.logical));
+}
+function loadBudgets3(raw, source = "bundle-size-budgets") {
+  const parsed = JSON.parse(raw);
+  const out = {};
+  for (const [target, value] of Object.entries(parsed)) {
+    if (target.startsWith("_") || target.startsWith("$")) continue;
+    const v = value;
+    if (!v?.totals?.raw || !v.totals.gzip || !v.largest?.gzip) {
+      throw new Error(`${source}: ${target} missing totals.raw / totals.gzip / largest.gzip`);
+    }
+    out[target] = v;
+  }
+  return out;
+}
+function diff(target, m, budget) {
+  const failures = [];
+  for (const bucket of Object.keys(m.buckets)) {
+    const size = m.buckets[bucket];
+    if (!size) continue;
+    const checks = [
+      ["totals.raw", size.raw, budget.totals.raw[bucket]],
+      ["totals.gzip", size.gzip, budget.totals.gzip[bucket]],
+      ["largest.gzip", size.largest, budget.largest.gzip[bucket]]
+    ];
+    for (const [metric, actual, cap] of checks) {
+      if (cap !== void 0 && actual > cap) {
+        failures.push({ target, metric, bucket, actual, budget: cap });
+      }
+    }
+  }
+  return failures;
+}
+function seedBudget(m) {
+  const out = { totals: { raw: {}, gzip: {} }, largest: { gzip: {} } };
+  for (const [bucket, size] of Object.entries(m.buckets)) {
+    out.totals.raw[bucket] = size.raw + HEADROOM.raw;
+    out.totals.gzip[bucket] = size.gzip + HEADROOM.gzip;
+    out.largest.gzip[bucket] = size.largest + HEADROOM.gzip;
+  }
+  return out;
+}
+function fmtBytes(n) {
+  return n < 1024 ? `${n} B` : `${(n / 1024).toFixed(1)} KB`;
+}
+function buildTargets(ctx) {
+  const filters = ctx.config.bundleSize.targets.flatMap((t) => ["--filter", t.filter]);
+  if (filters.length === 0) return 0;
+  const proc = spawnSync4("pnpm", ["exec", "turbo", "run", "build", ...filters], {
+    cwd: ctx.repoRoot,
+    stdio: "inherit",
+    env: process.env
+  });
+  if (proc.error) {
+    console.error(`check-bundle-size: failed to build targets: ${proc.error.message}`);
+    return 1;
+  }
+  return proc.status ?? 1;
+}
+var DEFAULT_DEPS = { clean: cleanDist, build: buildTargets };
+function runBundleSize(ctx, init = false, deps = DEFAULT_DEPS) {
+  const { budgetsPath, targets } = ctx.config.bundleSize;
+  if (targets.length === 0) {
+    console.log("Bundle-size guard: no targets configured \u2014 skipping.");
+    return 0;
+  }
+  for (const t of targets) deps.clean(t.distDir, ctx.repoRoot);
+  const buildExit = deps.build(ctx);
+  if (buildExit !== 0) return buildExit;
+  const path = resolve9(ctx.repoRoot, budgetsPath);
+  const measured = [];
+  for (const t of targets) {
+    const m = measure(resolve9(ctx.repoRoot, t.distDir), t.buckets);
+    if (m.files.length === 0) {
+      console.error(
+        `check-bundle-size: ${t.distDir} holds no files matching ${t.name}'s buckets (${Object.keys(t.buckets).join(", ")}) after building. Nothing was measured, so the ratchet would pass regardless of the real size.`
+      );
+      return 1;
+    }
+    measured.push({ target: t, m });
+  }
+  if (init) {
+    const budgets2 = {};
+    for (const { target: t, m } of measured) {
+      const duplicates = findDuplicateChunks(m);
+      if (duplicates.length > 0) {
+        console.error(
+          `check-bundle-size: refusing to seed "${t.name}" \u2014 ${t.distDir} holds ${duplicates.length} chunk(s) emitted more than once:`
+        );
+        for (const d of duplicates.slice(0, 5)) {
+          console.error(`  ${d.logical}: ${d.files.map((f) => `${f.name} (${f.raw} B)`).join(", ")}`);
+        }
+        if (duplicates.length > 5) console.error(`  \u2026 and ${duplicates.length - 5} more`);
+        console.error(
+          `
+One build cannot emit the same chunk twice, so this directory holds output from two. A budget seeded from it would be inflated by the surplus and, because the ratchet only goes DOWN, nothing later would catch it.
+Remove ${t.distDir} and re-run.`
+        );
+        return 1;
+      }
+      budgets2[t.name] = seedBudget(m);
+    }
+    const file = {
+      _comment: "Bundle-size budgets per target (bytes). Ratchet only goes DOWN \u2014 code-split/trim, then lower; never hand-raise. Re-baseline with `check:bundle-size --init`.",
+      ...budgets2
+    };
+    writeFileSync6(path, `${JSON.stringify(file, null, 2)}
+`);
+    console.log(`check-bundle-size: seeded budgets for ${targets.length} target(s) \u2192 ${path}`);
+    return 0;
+  }
+  const budgets = loadBudgets3(readFileSync10(path, "utf8"), budgetsPath);
+  const failures = [];
+  const scoreParts = [];
+  for (const { target: t, m } of measured) {
+    const budget = budgets[t.name];
+    if (!budget) {
+      console.error(`check-bundle-size: no budget for target "${t.name}" \u2014 run --init.`);
+      return 1;
+    }
+    failures.push(...diff(t.name, m, budget));
+    const gzipTotal = Object.values(m.buckets).reduce((s, b) => s + b.gzip, 0);
+    scoreParts.push(`${t.name} ${fmtBytes(gzipTotal)} gz`);
+  }
+  if (failures.length > 0) {
+    console.error("Bundle-size guard failed:");
+    for (const f of failures) {
+      console.error(
+        `  ${f.target} ${f.metric}.${f.bucket}: ${fmtBytes(f.actual)} > budget ${fmtBytes(f.budget)} (+${f.actual - f.budget} B)`
+      );
+    }
+    console.error(
+      "\nCode-split or trim deps to stay under budget.\n\nBefore re-baselining, confirm the growth is real: a budget seeded from a bad measurement raises the ceiling permanently, and the ratchet only goes DOWN, so nothing later will catch it. Check that the reported size matches what the build actually emitted. Only if the growth is intentional, re-baseline with `pnpm run check:bundle-size -- --init` and commit the budget diff."
+    );
+    return 1;
+  }
+  console.log(`SCORE: bundle-size \u2014 ${scoreParts.join(", ")}`);
+  console.log("Bundle-size guard ok.");
+  return 0;
+}
+
+// src/eslint-boundaries.ts
+function resolvePatterns(b, byName, seen) {
+  if (seen.has(b.name)) {
+    throw new Error(
+      `repo-gates boundaries: circular \`extends\` involving "${b.name}" (${[...seen, b.name].join(" \u2192 ")}).`
+    );
+  }
+  const inherited = [];
+  for (const parentName of b.extends ?? []) {
+    const parent = byName.get(parentName);
+    if (!parent) {
+      throw new Error(`repo-gates boundary "${b.name}" extends unknown boundary "${parentName}".`);
+    }
+    inherited.push(...resolvePatterns(parent, byName, /* @__PURE__ */ new Set([...seen, b.name])));
+  }
+  return [...inherited, ...b.patterns];
+}
+function boundariesToEslintConfigs(boundaries) {
+  const byName = new Map(boundaries.map((b) => [b.name, b]));
+  return boundaries.map((b) => ({
+    name: `repo-gates/boundary/${b.name}`,
+    files: b.files,
+    ...b.ignores ? { ignores: b.ignores } : {},
+    rules: {
+      "@typescript-eslint/no-restricted-imports": [
+        "error",
+        {
+          patterns: resolvePatterns(b, byName, /* @__PURE__ */ new Set()).map((p) => ({
+            group: p.forbid,
+            allowTypeImports: p.allowTypeImports ?? false,
+            message: p.message ?? `Import boundary "${b.name}" violated.`
+          }))
+        }
+      ]
+    }
+  }));
+}
+
+// src/validate-agents.ts
+var validate_agents_exports = {};
+__export(validate_agents_exports, {
+  extractBacktickedPaths: () => extractBacktickedPaths,
+  extractFencedBashBlocks: () => extractFencedBashBlocks,
+  extractScriptRefs: () => extractScriptRefs,
+  runValidateAgents: () => runValidateAgents,
+  validateAgents: () => validateAgents
+});
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+import { resolve as resolve10 } from "path";
+function extractFencedBashBlocks(markdown) {
+  const blocks = [];
+  const fence = /```(?:bash|sh|shell)\n([\s\S]*?)```/g;
+  for (const m of markdown.matchAll(fence)) {
+    if (m[1] !== void 0) blocks.push(m[1]);
+  }
+  return blocks;
+}
+function stripShellComments(block) {
+  return block.split("\n").map((line) => {
+    const hash = line.indexOf("#");
+    return hash === -1 ? line : line.slice(0, hash);
+  }).join("\n");
+}
+function escapeRegExp2(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractScriptRefs(blocks, runnerCommand, ignoredSubcommands) {
+  const ignored = new Set(ignoredSubcommands);
+  const pm = escapeRegExp2(runnerCommand);
+  const runRe = new RegExp(`\\b${pm}\\s+run\\s+([a-zA-Z0-9:_-]+)`, "g");
+  const bareRe = new RegExp(`\\b${pm}\\s+([a-zA-Z0-9:][a-zA-Z0-9:_-]*)`, "g");
+  const out = /* @__PURE__ */ new Set();
+  for (const raw of blocks) {
+    const block = stripShellComments(raw);
+    for (const m of block.matchAll(runRe)) if (m[1]) out.add(m[1]);
+    for (const m of block.matchAll(bareRe)) {
+      const name = m[1];
+      if (name && name !== "run" && !ignored.has(name)) out.add(name);
+    }
+  }
+  return out;
+}
+function extractBacktickedPaths(markdown) {
+  const paths = [];
+  for (const m of markdown.matchAll(/`([^`\n]+)`/g)) {
+    const token = (m[1] ?? "").trim();
+    if (/^https?:\/\//.test(token)) continue;
+    if (/\s/.test(token)) continue;
+    if (token.startsWith("@")) continue;
+    if (token.endsWith("...")) continue;
+    if (/^\.[A-Za-z0-9]+$/.test(token)) continue;
+    if (!/^[.A-Za-z0-9_][A-Za-z0-9_.\-/]*\/?$/.test(token)) continue;
+    if (!token.includes("/")) continue;
+    const cleaned = token.replace(/\/+$/, "");
+    if (cleaned.includes("<") || cleaned.includes(">") || cleaned.includes("*")) continue;
+    paths.push(cleaned);
+  }
+  return paths;
+}
+function validateAgents(ctx) {
+  const { targets, knownMissingPaths, runnerCommand, ignoredSubcommands } = ctx.config.agents;
+  const scripts = new Set(Object.keys(loadScripts(ctx.repoRoot)));
+  const known = new Set(knownMissingPaths);
+  const failures = [];
+  for (const rel of targets) {
+    const abs = resolve10(ctx.repoRoot, rel);
+    if (!existsSync11(abs)) {
+      failures.push({ file: rel, kind: "missing-doc", detail: `${rel} not found` });
+      continue;
+    }
+    const src = readFileSync11(abs, "utf8");
+    for (const name of extractScriptRefs(
+      extractFencedBashBlocks(src),
+      runnerCommand,
+      ignoredSubcommands
+    )) {
+      if (!scripts.has(name)) {
+        failures.push({
+          file: rel,
+          kind: "missing-script",
+          detail: `\`${runnerCommand} ${name}\` referenced but not a package.json script`
+        });
+      }
+    }
+    for (const p of extractBacktickedPaths(src)) {
+      if (known.has(p)) continue;
+      if (!existsSync11(resolve10(ctx.repoRoot, p))) {
+        failures.push({
+          file: rel,
+          kind: "missing-path",
+          detail: `referenced path \`${p}\` does not exist`
+        });
+      }
+    }
+  }
+  return failures;
+}
+function runValidateAgents(ctx) {
+  const { targets } = ctx.config.agents;
+  if (targets.length === 0) {
+    console.log("check:agents \u2014 no agent docs configured; skipping.");
+    return 0;
+  }
+  const failures = validateAgents(ctx);
+  if (failures.length === 0) {
+    console.log(`\u2713 agent-doc validation passed (${targets.join(", ")})`);
+    return 0;
+  }
+  console.error("\u2717 agent-doc validation failed:");
+  for (const f of failures) console.error(`  [${f.kind}] ${f.file}: ${f.detail}`);
+  return 1;
+}
+
+// src/docs-coverage.ts
+var docs_coverage_exports = {};
+__export(docs_coverage_exports, {
+  escapeHatch: () => escapeHatch,
+  escapeWorkflowCommand: () => escapeWorkflowCommand,
+  evaluate: () => evaluate,
+  fetchChangedFiles: () => fetchChangedFiles,
+  fileTriggersSurface: () => fileTriggersSurface,
+  globToRegExp: () => globToRegExp,
+  hasDocsChange: () => hasDocsChange,
+  matchesAny: () => matchesAny,
+  readDocsCoverageConfig: () => readDocsCoverageConfig,
+  runDocsCoverage: () => runDocsCoverage,
+  stripFencedCode: () => stripFencedCode,
+  triggeredSurfaces: () => triggeredSurfaces
+});
+import { readFileSync as readFileSync12 } from "fs";
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += ".*";
+        i++;
+        if (glob[i + 1] === "/") i++;
+      } else {
+        re += "[^/]*";
+      }
+    } else if (c && "\\^$.|?+()[]{}/".includes(c)) {
+      re += `\\${c}`;
+    } else {
+      re += c;
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function matchesAny(path, globs) {
+  return (globs ?? []).some((g) => globToRegExp(g).test(path));
+}
+var ADDED = /* @__PURE__ */ new Set(["added", "copied"]);
+var PRESENT = /* @__PURE__ */ new Set(["added", "copied", "modified", "renamed", "changed"]);
+function fileTriggersSurface(file, surface) {
+  if (!globToRegExp(surface.glob).test(file.filename)) return false;
+  const set = surface.on === "added" ? ADDED : PRESENT;
+  return set.has(file.status);
+}
+function triggeredSurfaces(files, config) {
+  const out = [];
+  for (const file of files) {
+    if (matchesAny(file.filename, config.exclude)) continue;
+    for (const surface of config.surfaces) {
+      if (fileTriggersSurface(file, surface)) {
+        out.push({ file: file.filename, label: surface.label });
+        break;
+      }
+    }
+  }
+  return out;
+}
+function hasDocsChange(files, config) {
+  return files.some(
+    (f) => PRESENT.has(f.status) && !matchesAny(f.filename, config.exclude) && matchesAny(f.filename, config.docsGlobs)
+  );
+}
+function stripFencedCode(markdown) {
+  return (markdown ?? "").replace(/```[\s\S]*?```/g, "").replace(/~~~[\s\S]*?~~~/g, "");
+}
+function escapeHatch(body) {
+  const line = /^[ \t>*-]*docs:\s*n\/?a\b[ \t]*[-:—]?[ \t]*(.*)$/im;
+  const match = line.exec(stripFencedCode(body));
+  if (!match) return { present: false };
+  return { present: true, reason: (match[1] ?? "").trim() };
+}
+function evaluate(files, body, config) {
+  const triggered = triggeredSurfaces(files, config);
+  if (triggered.length === 0) return { status: "skip" };
+  if (hasDocsChange(files, config)) return { status: "pass", triggered };
+  const hatch = escapeHatch(body);
+  if (hatch.present) return { status: "waived", triggered, reason: hatch.reason };
+  return { status: "fail", triggered };
+}
+function escapeWorkflowCommand(message) {
+  return message.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function notice(message) {
+  console.log(`::notice title=Docs coverage::${escapeWorkflowCommand(message)}`);
+}
+async function fetchChangedFiles(opts) {
+  const files = [];
+  for (let page = 1; page <= 30; page++) {
+    const res = await fetch(
+      `https://api.github.com/repos/${opts.repo}/pulls/${opts.number}/files?per_page=100&page=${page}`,
+      {
+        headers: {
+          Authorization: `Bearer ${opts.token}`,
+          Accept: "application/vnd.github+json",
+          "X-GitHub-Api-Version": "2022-11-28",
+          "User-Agent": "repo-gates-docs-coverage"
+        },
+        signal: AbortSignal.timeout(15e3)
+      }
+    );
+    if (!res.ok) {
+      throw new Error(`GitHub API ${res.status} listing PR files: ${await res.text()}`);
+    }
+    const batch = await res.json();
+    for (const f of batch) files.push({ filename: f.filename, status: f.status });
+    if (batch.length < 100) break;
+  }
+  return files;
+}
+async function runDocsCoverage(ctx) {
+  const config = ctx.config.docsCoverage;
+  if (config.surfaces.length === 0) {
+    console.log("docs-coverage: no surfaces configured \u2014 no-op.");
+    return 0;
+  }
+  const repo = process.env.GITHUB_REPOSITORY;
+  const number = process.env.PR_NUMBER;
+  const token = process.env.GITHUB_TOKEN;
+  const body = process.env.PR_BODY ?? "";
+  if (!repo || !number || !token) {
+    console.log("docs-coverage: not running in a PR context (no GITHUB_REPOSITORY/PR_NUMBER/GITHUB_TOKEN) \u2014 skipping.");
+    return 0;
+  }
+  if (!/^\d+$/.test(number)) {
+    console.error(`docs-coverage: PR_NUMBER is not numeric: ${JSON.stringify(number)}`);
+    return 1;
+  }
+  const files = await fetchChangedFiles({ repo, number, token });
+  const result = evaluate(files, body, config);
+  if (result.status === "skip") {
+    notice("No user-facing surface changed in this PR \u2014 nothing to gate.");
+    return 0;
+  }
+  const list = result.triggered.map((t) => `    - ${t.file}  (${t.label})`).join("\n");
+  if (result.status === "pass") {
+    console.log("SCORE: docs-coverage \u2014 surface changes accompanied by docs");
+    console.log("docs-coverage: surface changes are accompanied by docs.");
+    return 0;
+  }
+  if (result.status === "waived") {
+    notice(
+      `Docs opt-out accepted: "docs: n/a${result.reason ? ` - ${result.reason}` : ""}". Surface(s):
+${list}`
+    );
+    return 0;
+  }
+  console.error("docs-coverage: this PR changes a user-facing surface but adds no docs:");
+  console.error(list);
+  console.error(
+    "\n  Add or update docs for the change, OR \u2014 if it genuinely needs none \u2014 add a line"
+  );
+  console.error("  `docs: n/a - <reason>` to the PR body to opt out on the record.");
+  return 1;
+}
+function readDocsCoverageConfig(path) {
+  const parsed = JSON.parse(readFileSync12(path, "utf8")).docsCoverage;
+  return {
+    docsGlobs: parsed?.docsGlobs ?? [],
+    surfaces: parsed?.surfaces ?? [],
+    exclude: parsed?.exclude ?? []
+  };
+}
+
+// src/report.ts
+var report_exports = {};
+__export(report_exports, {
+  collectTiming: () => collectTiming,
+  emitSummary: () => emitSummary,
+  formatQualityMetrics: () => formatQualityMetrics,
+  formatTiming: () => formatTiming,
+  parseJUnit: () => parseJUnit,
+  runQualityMetrics: () => runQualityMetrics,
+  runTestTiming: () => runTestTiming
+});
+import { appendFileSync, existsSync as existsSync12, readFileSync as readFileSync13 } from "fs";
+import { resolve as resolve11 } from "path";
+function attr(tag, name) {
+  return tag.match(new RegExp(`\\b${name}="([^"]*)"`))?.[1];
+}
+function parseJUnit(xml) {
+  const cases = [];
+  for (const match of xml.matchAll(/<testcase\b[^>]*\/?>/g)) {
+    const tag = match[0];
+    const timeSeconds = Number.parseFloat(attr(tag, "time") ?? "0");
+    if (!Number.isFinite(timeSeconds)) continue;
+    cases.push({
+      name: attr(tag, "name") ?? "",
+      classname: attr(tag, "classname") ?? "",
+      file: attr(tag, "file") ?? attr(tag, "classname") ?? "",
+      timeSeconds
+    });
+  }
+  return cases;
+}
+function fmtSeconds(s) {
+  return s >= 1 ? `${s.toFixed(2)}s` : `${(s * 1e3).toFixed(1)}ms`;
+}
+function collectTiming(ctx) {
+  const cases = [];
+  let files = 0;
+  for (const glob of ctx.config.report.junitGlobs) {
+    for (const path of expandGlob(ctx.repoRoot, glob)) {
+      files++;
+      cases.push(...parseJUnit(readFileSync13(path, "utf8")));
+    }
+  }
+  const totalSeconds = cases.reduce((a, c) => a + c.timeSeconds, 0);
+  return { report: { totalSeconds, totalTests: cases.length, cases }, files };
+}
+function formatTiming(report, topN) {
+  const slowest = [...report.cases].sort((a, b) => b.timeSeconds - a.timeSeconds).slice(0, topN);
+  const lines = [
+    "## Test timing",
+    "",
+    `**Total:** ${fmtSeconds(report.totalSeconds)} across ${report.totalTests} tests.`,
+    "",
+    `### Slowest ${slowest.length} tests`,
+    "",
+    "| Time | Test | File |",
+    "| ---: | --- | --- |"
+  ];
+  for (const c of slowest) {
+    const name = `${c.classname} \u203A ${c.name}`.replaceAll("|", "\\|");
+    lines.push(`| ${fmtSeconds(c.timeSeconds)} | ${name} | \`${c.file}\` |`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function pct2(n) {
+  return `${n.toFixed(1)}%`;
+}
+function formatQualityMetrics(ctx) {
+  const rows = [];
+  try {
+    const per = collectPerPackage(ctx);
+    const min = lowest(per);
+    rows.push([
+      "Coverage (lowest pkg)",
+      min ? `${pct2(min.lines)} lines \u2014 \`${min.pkg}\` (${per.length} pkgs)` : "\u2014"
+    ]);
+  } catch {
+    rows.push(["Coverage (lowest pkg)", "\u2014"]);
+  }
+  try {
+    const t = tightest(ctx);
+    rows.push([
+      "File size (tightest)",
+      t ? `\`${t.path}\` ${t.lines}/${t.budget} (${t.headroom} to spare)` : "\u2014"
+    ]);
+  } catch {
+    rows.push(["File size (tightest)", "\u2014"]);
+  }
+  try {
+    const { untracked } = scan2(ctx);
+    rows.push(["Debt markers (untracked)", String(untracked.length)]);
+  } catch {
+    rows.push(["Debt markers (untracked)", "\u2014"]);
+  }
+  try {
+    const path = resolve11(ctx.repoRoot, ctx.config.bundleSize.budgetsPath);
+    if (existsSync12(path)) {
+      const budgets = JSON.parse(readFileSync13(path, "utf8"));
+      for (const t of ctx.config.bundleSize.targets) {
+        const b = budgets[t.name];
+        const gzip = b?.totals?.gzip ?? {};
+        const total = Object.values(gzip).reduce((a, v) => a + v, 0);
+        rows.push([`Bundle budget (${t.name})`, `${(total / 1024).toFixed(1)} KB gz`]);
+      }
+    }
+  } catch {
+    rows.push(["Bundle budget", "\u2014"]);
+  }
+  const lines = ["## Code-quality metrics", "", "| Metric | Current |", "| --- | --- |"];
+  for (const [k, v] of rows) lines.push(`| ${k} | ${v} |`);
+  return `${lines.join("\n")}
+`;
+}
+function emitSummary(markdown) {
+  process.stdout.write(`${markdown}
+`);
+  const summary = process.env.GITHUB_STEP_SUMMARY;
+  if (summary) {
+    try {
+      appendFileSync(summary, `${markdown}
+`);
+    } catch (err) {
+      console.error(`report: could not write GITHUB_STEP_SUMMARY: ${err}`);
+    }
+  }
+}
+function runTestTiming(ctx) {
+  const { report, files } = collectTiming(ctx);
+  if (files === 0) {
+    console.log("report:test-timing \u2014 no junit files found (run test:ci first); skipping.");
+    return 0;
+  }
+  emitSummary(formatTiming(report, ctx.config.report.topN));
+  return 0;
+}
+function runQualityMetrics(ctx) {
+  emitSummary(formatQualityMetrics(ctx));
+  return 0;
+}
+export {
+  CONFIG_FILENAMES,
+  DEFAULT_CONFIG,
+  boundariesToEslintConfigs,
+  bundle_size_exports as bundleSize,
+  checkParity,
+  circular_imports_exports as circularImports,
+  computeReachable,
+  coverage_exports as coverage,
+  debt_markers_exports as debtMarkers,
+  docs_coverage_exports as docsCoverage,
+  evaluateParity,
+  extractCiInvocations,
+  extractFailureSignatures,
+  extractRunTargets,
+  extractScores,
+  file_sizes_exports as fileSizes,
+  findConfigFile,
+  formatGateLine,
+  formatScoresBlock,
+  gatesForRepo,
+  listCiWorkflows,
+  loadConfig,
+  loadContext,
+  loadParityConfig,
+  makeRunTargetRe,
+  mergeConfig,
+  report_exports as report,
+  resolveGates,
+  runCheckAll,
+  runCiParity,
+  secrets_exports as secrets,
+  validate_agents_exports as validateAgents
+};