@floh-solutions/pharos-cli 0.24.0 → 0.26.0

package/dist/commands/comment.js.map

@@ -1 +1 @@
-{"version":3,"file":"comment.js","sourceRoot":"","sources":["../../src/commands/comment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,UAAU,EAA0B,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,OAAO,EAAgB,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,SAAS,GAA+B;IAC5C,MAAM;IACN,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAM,EACN,OAAgB,EAChB,WAA8B,EAC9B,KAAoC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,mEAAmE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,iCAAiC,IAAI,oDAAoD;cACrF,oBAAoB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,KAAK;YACR,OAAO,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrF,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtF,KAAK,UAAU;YACb,OAAO,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF;YACE,MAAM,UAAU,CACd,yBAAyB,IAAI,6DAA6D,CAC3F,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,EAAM,EAAE,OAAgB,EAAE,MAAc;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CACT,EAAE,EACF,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW;YACzC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,IAAI,CACT,EAAE,EACF,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW;QACzC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;KACJ,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,EAAM,EACN,OAAgB,EAChB,MAAc,EACd,IAAY;IAEZ,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,EAAE,EAAE;QACd,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,OAAO,CAAC,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,EAAM,EACN,OAAgB,EAChB,MAAc,EACd,EAAU,EACV,IAAY;IAEZ,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,EAAE,EAAE;QACd,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAM,EAAE,OAAgB,EAAE,MAAc,EAAE,EAAU;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE;QAChC,IAAI,EAAE,kBAAkB,EAAE,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE;QACzD,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;KAClF,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,EAAM,EACN,OAAgB,EAChB,MAAc,EACd,EAAU,EACV,IAAqB,EACrB,EAAW;IAEX,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,EAAE;YACjB,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC;YAC1D,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,EAAE;YACb,IAAI;YACJ,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,EAAE,EAAE;QACd,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,EAAE;QACb,IAAI;QACJ,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;KACpD,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,QAAQ,CACrB,EAAM,EACN,OAAgB,EAChB,MAAc,EACd,EAAU,EACV,IAAqB;IAErB,MAAM,UAAU,GACd,MAAM,CAAC,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAClD,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC,CAAC,EAAE,CAAC;IAEX,OAAO,IAAI,CACT,EAAE,EACF,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,QAAQ,CACrB,OAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,UAAU,CAAC,iBAAiB,IAAI,kDAAkD,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,UAAU,CAAC,6CAA6C,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,UAAU,CAAC,2BAA2B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,UAAU,CAAC,IAAI,GAAG,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/E,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,UAA8B,EAAE,QAA4B;IAC5E,MAAM,IAAI,GAAG,UAAU,IAAI,QAAQ,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,UAAU,CACd,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"comment.js","sourceRoot":"","sources":["../../src/commands/comment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,UAAU,EAA0B,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,OAAO,EAAgB,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAkB,MAAM,cAAc,CAAC;AAC3E,OAAO,EACL,UAAU,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,wBAAwB,GAEzB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,MAAM,SAAS,GAA+B;IAC5C,MAAM;IACN,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;CACX,CAAC;AAEF,MAAM,KAAK,GAAG;IACZ,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;CACC,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAM,EACN,OAAgB,EAChB,WAA8B,EAC9B,KAAoC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,iCAAiC,IAAI,kDAAkD;cACnF,4DAA4D,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,KAAK;YACR,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxE,OAAO,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM;YACT,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,KAAK,QAAQ;YACX,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,OAAO,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,OAAO,CAAC;QACb,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,GAAG,IAAI,KAAK,OAAO,CAAC;YAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,UAAU;YACb,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,2EAA2E;QAC3E,2EAA2E;QAC3E,mDAAmD;QACnD,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;gBAAE,MAAM,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChF,OAAO,UAAU,CACf,EAAE,EACF,OAAO,EACP,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACf,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAC;QACJ,CAAC;QACD,KAAK,KAAK,CAAC;QACX,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;gBAAE,MAAM,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD;YACE,MAAM,UAAU,CAAC,yBAAyB,IAAI,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3E,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,EAAM,EAAE,OAAgB,EAAE,MAAiB;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CACT,EAAE,EACF,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW;YACzC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,IAAI,CACT,EAAE,EACF,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW;QACzC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;KACJ,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,EAAM,EACN,OAAgB,EAChB,MAAiB,EACjB,IAAY;IAEZ,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,EAAE,EAAE;QACd,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,OAAO,CAAC,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,EAAM,EACN,OAAgB,EAChB,MAAiB,EACjB,EAAU,EACV,IAAY;IAEZ,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,EAAE,EAAE;QACd,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAM,EAAE,OAAgB,EAAE,MAAiB,EAAE,EAAU;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE;QAChC,IAAI,EAAE,kBAAkB,EAAE,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE;QACzD,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;KAClF,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,EAAM,EACN,OAAgB,EAChB,MAAiB,EACjB,EAAU,EACV,IAAqB,EACrB,EAAW;IAEX,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,EAAE;YACjB,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC;YAC1D,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,EAAE;YACb,IAAI;YACJ,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;SACpD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,EAAE,EAAE;QACd,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,EAAE;QACb,IAAI;QACJ,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;KACpD,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,QAAQ,CACrB,EAAM,EACN,OAAgB,EAChB,MAAiB,EACjB,EAAU,EACV,IAAqB;IAErB,MAAM,UAAU,GACd,MAAM,CAAC,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAClD,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC,CAAC,EAAE,CAAC;IAEX,OAAO,IAAI,CACT,EAAE,EACF,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,QAAQ,CACrB,OAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,UAAU,CAAC,iBAAiB,IAAI,kDAAkD,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,UAAU,CAAC,6CAA6C,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,MAAM,CAAC,GAAuB;IACrC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,UAAU,CACd,kFAAkF;cAC9E,8CAA8C,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACxB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,UAAU,CAAC,2BAA2B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,UAAU,CAAC,IAAI,GAAG,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/E,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,UAA8B,EAAE,QAA4B;IAC5E,MAAM,IAAI,GAAG,UAAU,IAAI,QAAQ,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,UAAU,CACd,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/doctor.d.ts

@@ -1,3 +1,4 @@
+import type { GhAccount, GitHubClient, RepoBinding } from "@floh-solutions/gh-core";
 import { type ExitCode, type Io } from "../output.js";
 /**
  * `pharos doctor` — what is installed, what is missing, and what each missing
@@ -50,5 +51,173 @@ export interface DoctorCommandOptions {
     /** Also prove the token against Azure DevOps. Costs two requests. */
     verify: boolean;
 }
+export interface Check {
+    id: string;
+    name: string;
+    tier: 0 | 1 | 2;
+    /** Plain-language: what having this gets you. Rendered as-is by a GUI. */
+    unlocks: string;
+    /** What is lost without it — never "it is broken" when it is not. */
+    without: string;
+    ok: boolean;
+    version: string | null;
+    path: string | null;
+    /** The command that would install it here, or null when we cannot say. */
+    install: string | null;
+    /** Set when something needs saying beyond present/absent. */
+    note?: string;
+    /**
+     * **`gh-auth` only: does `repos.json` list at least one binding?** (#892)
+     *
+     * `true` when it lists one or more, `false` when it lists none or does not
+     * exist. **Absent** on every other check, on an older CLI, and — deliberately
+     * — in the two states where the answer was never established: `gh` missing
+     * (the config is not read at all) and a `repos.json` that could not be
+     * parsed, where "lists none" and "lists plenty" are indistinguishable.
+     * Absent means *not known*, never `false`; that is the same trap `gh` sets
+     * with an empty `scopes` on a non-`valid` account.
+     *
+     * It exists because the app cannot get this fact any other way without
+     * breaking a rule. `gh-auth` is `ok: true` whenever gh holds healthy
+     * credentials, so on the wizard's success path the row is green and its note
+     * is suppressed — and the "No repository is bound yet" sentence goes with it.
+     * The obvious fix, rendering the note when it *contains* that sentence, is
+     * prose sniffing: `CommandLineTools.swift` renders a row per id and never
+     * reads English, precisely so that rewording a note cannot silently break a
+     * GUI. So the fact travels as a field.
+     *
+     * Not a check of its own, either: `gh-repo-bound` would be permanently red on
+     * every machine that has `gh` for ordinary git work and does not want the
+     * bridge, which is the red-row-nobody-reads this whole section avoids.
+     */
+    bound?: boolean;
+    /** Per-account detail for `gh-account`. See {@link AccountReport}. */
+    accounts?: AccountReport[];
+    /** Per-repository detail for `gh-repo-access`. See {@link RepoReport}. */
+    repos?: RepoReport[];
+}
+/**
+ * One configured GitHub account, and whether `gh` still holds a token for it.
+ *
+ * **`active` is reported and never acted on.** On the machine plan §2 was
+ * measured on, the account a project is bound to is *not* the active one, so a
+ * report that omitted this would be unreadable the first time it disagreed with
+ * what `gh auth status` prints by hand.
+ */
+export interface AccountReport {
+    account: string;
+    ok: boolean;
+    /** What `gh` calls active, or null when `gh auth status` could not say. */
+    active: boolean | null;
+    detail: string;
+}
+/**
+ * One configured repository, reached **as its configured account**.
+ *
+ * `resolved` and `nodeId` are the point: a 200 proves nothing on a machine with
+ * two accounts, because `owner/widgets` can exist under both. What GitHub
+ * answered with is recorded so the mismatch is a fact rather than an inference.
+ */
+export interface RepoReport {
+    repo: string;
+    account: string;
+    /**
+     * Access was **proven**. `false` is therefore "not proven", which is wider
+     * than "broken": `problem: "unreachable"` lands here having judged nothing.
+     * Anything rendering this must read `problem` before drawing a failure.
+     */
+    ok: boolean;
+    /** Who the token turned out to belong to — `gh api user`'s login. */
+    viewer: string | null;
+    /** The `full_name` GitHub actually returned. */
+    resolved: string | null;
+    /** GitHub's node id for it: the identity that survives a rename. */
+    nodeId: string | null;
+    /**
+     * `gh-core`'s closed set: no-token | unauthorized | not-visible |
+     * wrong-repository | issues-disabled | archived | **unreachable** | unknown.
+     *
+     * `unreachable` is the one that is not a fault — no answer was obtained, so
+     * neither the binding nor the credential was judged. It is the `gh-auth`
+     * row's `unverified` in a different vocabulary, and the check stays green on
+     * it.
+     */
+    problem: string | null;
+    detail: string | null;
+}
 export declare function runDoctor(io: Io, env: NodeJS.ProcessEnv, options: DoctorCommandOptions, pretty: boolean, version: string): Promise<ExitCode>;
+/**
+ * `gh` is fine and nothing is bound — say so **as data** on the `gh-auth` row
+ * (#892), and name the command that fixes it **as data** too (#890).
+ *
+ * Its own function because of the one rule inside it that a test cannot reach
+ * through `pharos doctor`: **an existing `install` is never overwritten.** The
+ * state that matters is a credential GitHub has actively REFUSED — `authCheck`
+ * puts `gh auth login --user <login>` on the row for it — and binding a
+ * repository to a dead token achieves nothing, so that command outranks this
+ * one. Replacing it would be #886's mistake (naming the wrong command with
+ * confidence) committed in the row directly above #886's.
+ *
+ * Arranging a refused credential on a real machine is not something a test may
+ * do, so the precedence is asserted here instead, against a synthesised row.
+ */
+export declare function markUnbound(auth: Check, configPath: string, configExists: boolean, held?: readonly GhAccount[]): void;
+/** The `gh-auth` row, worded by which of the three states we are actually in. */
+export declare function authCheck(base: Omit<Check, "ok" | "install">, accounts: readonly GhAccount[], accountReports: readonly AccountReport[], authFailure: string | undefined): Check;
+/**
+ * `gh-repo-access` — **the one that a status code cannot answer.**
+ *
+ * Plan §2: with two `gh` accounts in play, `owner/widgets` can exist under both,
+ * so the wrong identity returns a perfectly good 200 for a different
+ * repository. `verifyAccess` compares the `full_name` GitHub answered with
+ * against what was configured; this records the account it asked as, the viewer
+ * that token turned out to be, and the node id — the identity that survives a
+ * rename — so a disagreement is a fact on the page rather than an inference.
+ *
+ * ## It is also the one row that makes real calls, so it can fail to ask (#886)
+ *
+ * This is the only GitHub row that needs the network — which means it is the
+ * only one that can be offline, and the first draft reported that as a fault.
+ * `gh-core` returned `unknown` for a dead socket, and `unknown` landed in the
+ * `else` below as {@link BIND_COMMAND}: **run the wizard on a plane and it told
+ * you to re-record a binding that was perfectly correct.**
+ *
+ * {@link authCheck} had already met this exactly one layer up and answered it —
+ * an `unverified` account is reported as not-a-fault and is deliberately NOT
+ * offered `gh auth login`, because sending somebody to re-authenticate over the
+ * network that is itself the problem is the original bug wearing a new hat.
+ * That reasoning is not about credentials specifically; it is about the
+ * difference between "we asked and the answer was no" and "we could not ask".
+ * `gh-core` now spells the second one `unreachable`, and this row treats it the
+ * same way `gh-auth` treats `unverified`:
+ *
+ * - the check is **green**, because nothing here is broken;
+ * - `install` is **null**, because no command would help — offering the wrong
+ *   one is worse than offering none;
+ * - the note says *could not ask*, never *failed*.
+ *
+ * The per-repository row keeps `ok: false` with `problem: "unreachable"`, which
+ * is the honest pair: access was not proven, and it was not disproven either.
+ * A consumer rendering `repos` must branch on `problem` rather than paint every
+ * `ok: false` red — {@link render} below does, and the app's wizard step
+ * (`CommandLineStep.swift`, todo #888) has to as well.
+ *
+ * A **mixed** run still fails, and that is the point of separating them rather
+ * than counting: one repository unreachable and another genuinely unauthorized
+ * is a real fault with a real fix, and the fix is named for the fault.
+ */
+export declare function repoAccessCheck(client: GitHubClient, bindings: readonly RepoBinding[], configPath: string): Promise<Check>;
+/**
+ * The mark beside one repository — and there are **three** of them, not two.
+ *
+ * `ok: false` covers two different states (#886): GitHub gave a verdict and it
+ * was no, and nobody could be asked at all. Printing `✗` against an unreachable
+ * host is the same overclaim in ink that `install: BIND_COMMAND` was in JSON —
+ * a broken-looking line underneath a check that has just said it is fine. `?`
+ * is the state `gh` itself calls `unverified`.
+ *
+ * Its own function because it is the assertable half of that decision, and
+ * `render` is not reachable from a test without a machine in a known state.
+ */
+export declare function repoMark(repo: Pick<RepoReport, "ok" | "problem">): "✓" | "?" | "✗";
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkB,KAAK,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,cAAc,CAAC;AAItE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;CACjB;AAwOD,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CA8DnB"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EAEZ,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAkB,KAAK,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,cAAc,CAAC;AAItE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,EAAE,EAAE,OAAO,CAAC;IACZ,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oEAAoE;IACpE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA6KD,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CA8DnB;AAodD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,KAAK,EACX,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,OAAO,EACrB,IAAI,GAAE,SAAS,SAAS,EAAO,GAC9B,IAAI,CAqCN;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CACvB,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,SAAS,CAAC,EACnC,QAAQ,EAAE,SAAS,SAAS,EAAE,EAC9B,cAAc,EAAE,SAAS,aAAa,EAAE,EACxC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,KAAK,CAuHP;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC,CA6FhB;AAwDD;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAGlF"}

package/dist/commands/doctor.js

@@ -454,21 +454,39 @@ async function verifyScopes(env, configured) {
  * ## Why `gh-auth` never says "you are signed out"
  *
  * **Measured on gh 2.87.3.** `gh auth status` validates every token against
- * github.com. With the host unreachable it prints `X Failed to log in to
- * github.com account ASNNetworks` / `The token in keyring is invalid` — a
- * connectivity fault worded as a credential fault. `gh-core`'s parser matches
- * `Logged in to … account …`, so {@link GhTokenSource.accounts} comes back
- * **empty on a machine holding two accounts** whenever the network is down.
- *
- * A check that reported that as "no accounts" would tell somebody on a plane to
- * run `gh auth login`, which is the one thing that cannot work there. So an
- * empty result is reported as the disjunction it actually is — and where a repo
- * is bound it is settled for free, because `gh auth token --user` reads the
- * keyring and is fully offline (0.043s, measured both ways). A keyring hit while
- * `auth status` came back empty is proof the network is the problem.
- *
- * The source fix is #793: `gh auth status --json hosts` exists in 2.87.3, always
- * exits zero, and carries a per-account `state`. It is not this track's file.
+ * github.com, and with the host unreachable it words a connectivity fault as a
+ * credential fault: `X Failed to log in to github.com account ASNNetworks` /
+ * `The token in keyring is invalid`. A check that repeated that would tell
+ * somebody on a plane to run `gh auth login`, which is the one thing that cannot
+ * work there.
+ *
+ * **#793 has since landed in `gh-core`**, and it changed the shape of the
+ * problem rather than removing it. `gh auth status --json hosts` lists every
+ * account whatever happens, each carrying a `state`:
+ *
+ * | `state` | what it means | what to tell somebody |
+ * |---|---|---|
+ * | `valid` | GitHub answered for this token | nothing |
+ * | `rejected` | GitHub answered **401/403** — the credential really is bad | `gh auth login --user <login>` |
+ * | `unverified` | nobody judged it: host unreachable, GitHub erred, or `gh` too old | check the network, **not** the credential |
+ *
+ * So the failure this section was written about — an empty list on a machine
+ * holding two accounts — no longer happens for an unreachable host. **The
+ * hazard moved**: a listed account is no longer the same thing as a working
+ * one, and reading `accounts.length > 0` as "signed in" now reports a token
+ * GitHub has actively refused as healthy. {@link authCheck} branches on `state`
+ * for that reason.
+ *
+ * An empty list is still possible and still a disjunction, because `gh auth
+ * status` reads `$XDG_CONFIG_HOME/gh/hosts.yml` while `gh auth token --user`
+ * reads the keyring — a moved or overridden `GH_CONFIG_DIR` empties the first
+ * and not the second. The keyring cross-check below stays for that case, which
+ * is the only one it was ever able to settle.
+ *
+ * **One trap when reading an account:** `scopes` is empty whenever `state` is
+ * not `valid`, because `gh` takes them off the `X-OAuth-Scopes` *response*
+ * header. Empty means *not known*, never "no scopes" — the same overclaim as
+ * the original bug, one field along. Check `state` first.
  *
  * ## What is emitted, and what is deliberately not
  *
@@ -563,14 +581,10 @@ async function githubChecks(env, gh, verify) {
         return checks;
     }
     if (bindings.length === 0) {
-        const auth = checks[0];
-        auth.note =
-            `${auth.note ?? ""} No repository is bound yet — `
-                + `${configExists ? `${configPath} lists none` : `${configPath} does not exist`}. `
-                + `\`${BIND_COMMAND}\` binds one, and \`gh-account\` and \`gh-repo-access\` appear `
-                + "once it does.";
+        markUnbound(checks[0], configPath, configExists, accounts);
         return checks;
     }
+    checks[0].bound = true;
     const accountsOk = accountReports.every((report) => report.ok);
     checks.push({
         id: "gh-account",
@@ -598,8 +612,60 @@ const ACCOUNT_UNLOCKS = "Every bound repository is reached as the account bound
     + "happens to have active.";
 const ACCOUNT_WITHOUT = "`pharos issue` fails on that repository with an account error rather than a GitHub outage.";
 const BIND_COMMAND = "pharos setup --repo owner/name --gh-account <login>";
+/**
+ * `gh` is fine and nothing is bound — say so **as data** on the `gh-auth` row
+ * (#892), and name the command that fixes it **as data** too (#890).
+ *
+ * Its own function because of the one rule inside it that a test cannot reach
+ * through `pharos doctor`: **an existing `install` is never overwritten.** The
+ * state that matters is a credential GitHub has actively REFUSED — `authCheck`
+ * puts `gh auth login --user <login>` on the row for it — and binding a
+ * repository to a dead token achieves nothing, so that command outranks this
+ * one. Replacing it would be #886's mistake (naming the wrong command with
+ * confidence) committed in the row directly above #886's.
+ *
+ * Arranging a refused credential on a real machine is not something a test may
+ * do, so the precedence is asserted here instead, against a synthesised row.
+ */
+export function markUnbound(auth, configPath, configExists, held = []) {
+    // **The accounts `gh` holds, as data, in the one state where nothing else
+    // reports them** (#889). `gh-account` carries the per-binding list, but it is
+    // emitted only once a repository is bound — so on an unbound machine, which is
+    // exactly when somebody needs to choose an account to bind AS, the app had no
+    // decoded list of accounts at all and could only have scraped this note.
+    //
+    // Attached here rather than on every `gh-auth` row so the wizard never draws
+    // the same accounts twice: once bound, `gh-account` owns that display.
+    if (held.length > 0) {
+        auth.accounts = held.map((account) => ({
+            account: account.login,
+            // Listed is not the same as working (#793): a REJECTED credential is one
+            // GitHub has actively refused, and binding a repository to it achieves
+            // nothing. The picker uses this to refuse the account rather than to hide
+            // it — a missing account is a question, a refused one is an answer.
+            ok: account.state !== "rejected",
+            active: account.active,
+            detail: account.state === "rejected"
+                ? `GitHub refused this credential${account.stateDetail === undefined ? "" : ` — ${account.stateDetail}`}.`
+                : `gh holds a token for "${account.login}".`,
+        }));
+    }
+    auth.note =
+        `${auth.note ?? ""} No repository is bound yet — `
+            + `${configExists ? `${configPath} lists none` : `${configPath} does not exist`}. `
+            + `\`${BIND_COMMAND}\` binds one, and \`gh-account\` and \`gh-repo-access\` appear `
+            + "once it does.";
+    auth.bound = false;
+    // The app renders `install` as a COPYABLE command wherever it shows a note,
+    // and it must not have to dig this out of the sentence above — that is the
+    // prose sniffing `bound` exists to end. No install BUTTON appears: that is
+    // driven by `CommandLineStep.isOffered`, which lists skill, pharos-convert,
+    // gh, libreoffice and pdftotext, and `gh-auth` is not among them. Signing in
+    // stays the user's own job (#890).
+    auth.install ??= BIND_COMMAND;
+}
 /** The `gh-auth` row, worded by which of the three states we are actually in. */
-function authCheck(base, accounts, accountReports, authFailure) {
+export function authCheck(base, accounts, accountReports, authFailure) {
     if (authFailure !== undefined) {
         return {
             ...base,
@@ -608,17 +674,61 @@ function authCheck(base, accounts, accountReports, authFailure) {
             note: `\`gh auth status\` could not be run: ${authFailure}`,
         };
     }
+    // **LISTED IS NOT THE SAME AS WORKING, since #793.** `gh auth status --json
+    // hosts` lists an account whatever GitHub said about it, so reading
+    // `accounts.length > 0` as "signed in" reports a token GitHub has actively
+    // refused as healthy — and offers no way to fix it. Branch on `state`.
     if (accounts.length > 0) {
-        const listed = accounts
-            .map((account) => `${account.login}${account.active ? " (active)" : ""}`)
-            .join(", ");
+        const describe = (account) => `${account.login}${account.active ? " (active)" : ""}`;
+        const rejected = accounts.filter((account) => account.state === "rejected");
+        const unverified = accounts.filter((account) => account.state === "unverified");
+        // REJECTED IS THE ONE STATE THAT EARNS `gh auth login`, because it is the
+        // only one where GitHub itself has judged the credential. Named per account:
+        // re-authenticating the wrong login leaves the broken one broken.
+        if (rejected.length > 0) {
+            const reasons = rejected
+                .map((account) => account.stateDetail === undefined
+                ? describe(account)
+                : `${describe(account)} — ${account.stateDetail}`)
+                .join("; ");
+            return {
+                ...base,
+                ok: false,
+                install: `gh auth login --user ${rejected[0].login}`,
+                note: `GitHub REFUSED the credential for ${reasons}. This is the one case that is genuinely `
+                    + "a credential fault — gh asked and got a 401 or 403 back, rather than failing to ask. "
+                    + (accounts.length > rejected.length
+                        ? `Also held: ${accounts.filter((a) => a.state !== "rejected").map(describe).join(", ")}.`
+                        : ""),
+            };
+        }
+        // UNVERIFIED IS NOT A FAULT AND MUST NOT OFFER `gh auth login`. gh holds the
+        // token and could not get an answer about it — an unreachable host, a 5xx, a
+        // gh too old to say. Sending somebody to re-authenticate over the network
+        // that is itself the problem is the original bug wearing a new hat.
+        if (unverified.length > 0) {
+            const reasons = unverified
+                .map((account) => account.stateDetail === undefined
+                ? describe(account)
+                : `${describe(account)} — ${account.stateDetail}`)
+                .join("; ");
+            return {
+                ...base,
+                ok: true,
+                install: null,
+                note: `gh holds ${reasons}, but could not check it with GitHub — unreachable, erroring, or a `
+                    + "gh too old to say which. That is NOT a credential fault and `gh auth login` is the "
+                    + "wrong answer to it; check the connection. The token still works for anything that "
+                    + "does not call out, because `gh auth token --user` reads the keyring offline.",
+            };
+        }
         return {
             ...base,
             ok: true,
             install: null,
-            note: `Signed in: ${listed}. The active account is reported and never acted on — a repository `
-                + "is reached as the account bound to it in repos.json, because on this machine's own "
-                + "measurement the active one was the wrong one (plan §2).",
+            note: `Signed in: ${accounts.map(describe).join(", ")}. The active account is reported and `
+                + "never acted on — a repository is reached as the account bound to it in repos.json, "
+                + "because on this machine's own measurement the active one was the wrong one (plan §2).",
         };
     }
     // Empty. Which cause it is, we may or may not be able to say — and saying the
@@ -654,10 +764,11 @@ function authCheck(base, accounts, accountReports, authFailure) {
         ...base,
         ok: false,
         install: "gh auth login",
-        note: "`gh auth status` listed no accounts. That is either nothing signed in OR github.com "
-            + "unreachable, and from here the two are identical: `auth status` validates every token "
-            + "over the network and reports an unreachable host as an invalid credential (measured, "
-            + "gh 2.87.3). Check the connection before re-authenticating.",
+        note: "`gh auth status` listed no accounts at all. Since #793 an unreachable github.com no "
+            + "longer produces this — an account gh holds is listed whatever GitHub said, as "
+            + "`unverified` — so the remaining causes are that nothing is signed in, or that gh is "
+            + "reading a different config directory than the one holding your hosts.yml (a moved or "
+            + "overridden GH_CONFIG_DIR / XDG_CONFIG_HOME).",
     };
 }
 /**
@@ -669,8 +780,40 @@ function authCheck(base, accounts, accountReports, authFailure) {
  * against what was configured; this records the account it asked as, the viewer
  * that token turned out to be, and the node id — the identity that survives a
  * rename — so a disagreement is a fact on the page rather than an inference.
+ *
+ * ## It is also the one row that makes real calls, so it can fail to ask (#886)
+ *
+ * This is the only GitHub row that needs the network — which means it is the
+ * only one that can be offline, and the first draft reported that as a fault.
+ * `gh-core` returned `unknown` for a dead socket, and `unknown` landed in the
+ * `else` below as {@link BIND_COMMAND}: **run the wizard on a plane and it told
+ * you to re-record a binding that was perfectly correct.**
+ *
+ * {@link authCheck} had already met this exactly one layer up and answered it —
+ * an `unverified` account is reported as not-a-fault and is deliberately NOT
+ * offered `gh auth login`, because sending somebody to re-authenticate over the
+ * network that is itself the problem is the original bug wearing a new hat.
+ * That reasoning is not about credentials specifically; it is about the
+ * difference between "we asked and the answer was no" and "we could not ask".
+ * `gh-core` now spells the second one `unreachable`, and this row treats it the
+ * same way `gh-auth` treats `unverified`:
+ *
+ * - the check is **green**, because nothing here is broken;
+ * - `install` is **null**, because no command would help — offering the wrong
+ *   one is worse than offering none;
+ * - the note says *could not ask*, never *failed*.
+ *
+ * The per-repository row keeps `ok: false` with `problem: "unreachable"`, which
+ * is the honest pair: access was not proven, and it was not disproven either.
+ * A consumer rendering `repos` must branch on `problem` rather than paint every
+ * `ok: false` red — {@link render} below does, and the app's wizard step
+ * (`CommandLineStep.swift`, todo #888) has to as well.
+ *
+ * A **mixed** run still fails, and that is the point of separating them rather
+ * than counting: one repository unreachable and another genuinely unauthorized
+ * is a real fault with a real fix, and the fix is named for the fault.
  */
-async function repoAccessCheck(client, bindings, configPath) {
+export async function repoAccessCheck(client, bindings, configPath) {
     const repos = await Promise.all(bindings.map(async (binding) => {
         const report = await client.repos.verifyAccess(binding);
         return {
@@ -685,6 +828,34 @@ async function repoAccessCheck(client, bindings, configPath) {
         };
     }));
     const failed = repos.filter((report) => !report.ok);
+    // **Split before counting.** `failed` mixes two different things: repositories
+    // GitHub gave a verdict on, and repositories nobody could reach. Only the
+    // first kind is a fault, only the first kind earns an `install`, and the
+    // second kind is the whole of #886.
+    //
+    // A RATE LIMIT joins that second kind (#894). It arrives as a 403 carrying
+    // rate-limit headers, so before it was classified it read as a refused
+    // credential and earned the bind command — #886's mistake with the budget
+    // instead of the network. It is worded separately because the remedy is
+    // different: you wait, and telling somebody to check their connection because
+    // GitHub is rationing them would be wrong in a new way.
+    const unreachable = failed.filter((report) => report.problem === "unreachable");
+    const limited = failed.filter((report) => report.problem === "rate-limited");
+    const faults = failed.filter((report) => report.problem !== "unreachable" && report.problem !== "rate-limited");
+    /** Everything that was not judged, for the counts the note reports. */
+    const unasked = unreachable.length + limited.length;
+    const couldNotAsk = (unreachable.length === 0
+        ? ""
+        : ` ${unreachable.length} of ${repos.length} could not be asked at all `
+            + `(${unreachable.map((report) => report.repo).join(", ")}) — unreachable host or `
+            + "GitHub erroring, which judges neither the binding nor the credential. Nothing to fix "
+            + "here; check the connection and run this again.")
+        + (limited.length === 0
+            ? ""
+            : ` ${limited.length} of ${repos.length} hit the rate limit `
+                + `(${limited.map((report) => report.repo).join(", ")}) — GitHub is rationing this `
+                + "account, which judges neither the binding nor the credential. Nothing to fix here; "
+                + "wait for the budget to reset and run this again.");
     return {
         id: "gh-repo-access",
         name: "Bound repositories, read as their own account",
@@ -693,25 +864,35 @@ async function repoAccessCheck(client, bindings, configPath) {
             + "returned is the owner asked for.",
         without: "A repository can 200 from the WRONG account and look fine, because two accounts can "
             + "each see one of that name. Silent, and wrong.",
-        ok: failed.length === 0,
+        // An unreachable host is not a failing check. See this function's note.
+        ok: faults.length === 0,
         version: null,
         path: configPath,
         // The generic fix is the binding, EXCEPT where gh simply has no credential
         // for the account — pointing that at `pharos setup` would send somebody to
-        // re-record a pair that is already right.
-        install: failed.length === 0
+        // re-record a pair that is already right. Same for a repository nobody
+        // could reach, which is why `faults` is what is asked here and not `failed`:
+        // there is no command for "the network is down", and BIND_COMMAND was being
+        // offered as one.
+        install: faults.length === 0
             ? null
-            : failed.some((report) => report.problem === "no-token")
+            : faults.some((report) => report.problem === "no-token")
                 ? "gh auth login"
                 : BIND_COMMAND,
         repos,
         // Deliberately NOT a re-listing of `repos` — that array is the detail, and
         // a note that restates it is two places to read and one place to disagree.
-        note: (failed.length === 0
-            ? "Every bound repository answered as the account it is bound to, and the owner "
-                + `returned matched the owner configured (${repos.length} checked).`
-            : `${failed.length} of ${repos.length} failed: `
-                + `${failed.map((report) => `${report.repo} (${report.problem ?? "unknown"})`).join(", ")}.`)
+        note: (faults.length > 0
+            ? `${faults.length} of ${repos.length} failed: `
+                + `${faults.map((report) => `${report.repo} (${report.problem ?? "unknown"})`).join(", ")}.`
+            : unasked === 0
+                ? "Every bound repository answered as the account it is bound to, and the owner "
+                    + `returned matched the owner configured (${repos.length} checked).`
+                : unasked === repos.length
+                    ? "Nothing was proven either way — no repository could be asked."
+                    : `${repos.length - unasked} of ${repos.length} answered as the account `
+                        + "they are bound to, and the owner returned matched the owner configured.")
+            + couldNotAsk
             + " Each was reached as its configured account rather than whichever one `gh` has active;"
             + " per-repository detail, including the node id, is in `repos`.",
     };
@@ -765,6 +946,23 @@ async function exists(path) {
         return false;
     }
 }
+/**
+ * The mark beside one repository — and there are **three** of them, not two.
+ *
+ * `ok: false` covers two different states (#886): GitHub gave a verdict and it
+ * was no, and nobody could be asked at all. Printing `✗` against an unreachable
+ * host is the same overclaim in ink that `install: BIND_COMMAND` was in JSON —
+ * a broken-looking line underneath a check that has just said it is fine. `?`
+ * is the state `gh` itself calls `unverified`.
+ *
+ * Its own function because it is the assertable half of that decision, and
+ * `render` is not reachable from a test without a machine in a known state.
+ */
+export function repoMark(repo) {
+    if (repo.ok)
+        return "✓";
+    return repo.problem === "unreachable" ? "?" : "✗";
+}
 /** The human rendering. Grouped by tier, because that is what "missing" means. */
 function render(result) {
     const lines = [];
@@ -793,8 +991,7 @@ function render(result) {
                 lines.push(`      ${mark} ${account.account}${active} — ${account.detail}`);
             }
             for (const repo of check.repos ?? []) {
-                const mark = repo.ok ? "✓" : "✗";
-                lines.push(`      ${mark} ${repo.repo} as ${repo.account}`);
+                lines.push(`      ${repoMark(repo)} ${repo.repo} as ${repo.account}`);
                 if (repo.viewer !== null)
                     lines.push(`          token belongs to: ${repo.viewer}`);
                 if (repo.resolved !== null)